chore(deps): bump the actions-minor-and-patch group with 4 updates

.github/workflows/candidate.yml

@@ -219,7 +219,7 @@ jobs:
             --evidence build/browser-evidence/qualification.json
 
       - name: Retain browser qualification evidence
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: rootform-browser-${{ inputs.version }}-${{ github.sha }}
           path: build/browser-evidence/qualification.json
@@ -270,7 +270,7 @@ jobs:
             --evidence build/image-evidence/qualification.json
 
       - name: Preserve OCI image qualification evidence
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: rootform-image-qualification-${{ inputs.version }}-${{ github.sha }}
           path: |
@@ -321,7 +321,7 @@ jobs:
           printf 'release_id=%s\n' "$release_id" >> "$GITHUB_OUTPUT"
 
       - name: Upload exact draft candidate for native jobs
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: rootform-candidate-${{ inputs.version }}-${{ github.sha }}
           path: build/release
@@ -330,7 +330,7 @@ jobs:
           retention-days: 90
 
       - name: Upload generated installation metadata for review
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: rootform-installation-metadata-${{ inputs.version }}-${{ github.sha }}
           path: build/installers
@@ -385,7 +385,7 @@ jobs:
           bun-version: 1.4.0
 
       - name: Download exact draft candidate
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: rootform-candidate-${{ inputs.version }}-${{ github.sha }}
           path: build/release
@@ -408,7 +408,7 @@ jobs:
 
       - name: Upload native runtime evidence
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: rootform-runtime-${{ inputs.version }}-${{ matrix.target }}
           path: build/platform-evidence/${{ matrix.target }}.json
@@ -440,7 +440,7 @@ jobs:
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
           bun-version: 1.4.0
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: rootform-candidate-${{ inputs.version }}-${{ github.sha }}
           path: build/release
@@ -472,7 +472,7 @@ jobs:
           bun scripts/registry-qualification.ts --proof build/registry-proof.json --version "$VERSION" \
             --rootform-commit "$GITHUB_SHA" --binary build/bin/rootform --candidate-release-id "$RELEASE_ID" \
             --engine-commit "$(jq -r .source_commit public-export.json)" --evidence build/registry-evidence/qualification.json
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: rootform-registry-${{ inputs.version }}-${{ github.sha }}
           path: build/registry-evidence/qualification.json
@@ -517,7 +517,7 @@ jobs:
           echo "Qualified draft $RELEASE_ID of v$ROOTFORM_VERSION at \`$GITHUB_SHA\` is ready for publish." >> "$GITHUB_STEP_SUMMARY"
 
       - name: Upload qualification record
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: rootform-qualification-${{ inputs.version }}-${{ github.sha }}
           path: build/qualification/qualification.json

.github/workflows/ci.yml

@@ -75,7 +75,7 @@ jobs:
           fi
 
       - name: Retain public impact report
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: contribution-impact-${{ github.event.pull_request.head.sha || github.sha }}
           path: artifacts/impact.json
@@ -235,7 +235,7 @@ jobs:
         run: bun install --frozen-lockfile --ignore-scripts
 
       - name: Initialize source security analysis
-        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4
+        uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
         with:
           languages: go
           build-mode: manual
@@ -245,7 +245,7 @@ jobs:
         run: bun scripts/ci/run.ts cli
 
       - name: Analyze source security
-        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4
+        uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
         with:
           category: /language:go
 
@@ -327,7 +327,7 @@ jobs:
 
       - name: Return expected generated output to the contributor
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: expected-generated-references-${{ github.event.pull_request.head.sha || github.sha }}
           path: artifacts/generated-references/*
@@ -445,7 +445,7 @@ jobs:
           printf '%s\n' "$RUNNER_TEMP" >> "$GITHUB_PATH"
 
       - name: Initialize source security analysis
-        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4
+        uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
         with:
           languages: actions,javascript-typescript
           build-mode: none
@@ -455,7 +455,7 @@ jobs:
         run: bun scripts/ci/run.ts tooling
 
       - name: Analyze source security
-        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4
+        uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
         with:
           category: /language:tooling
 

.github/workflows/installation-qualification.yml

@@ -89,7 +89,7 @@ jobs:
 
       - name: Upload installation evidence
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: rootform-installation-${{ inputs.version }}-${{ matrix.target }}
           path: |

.github/workflows/publish-image.yml

@@ -266,7 +266,7 @@ jobs:
 
       - name: Upload publication evidence
         if: steps.qualified.outputs.present != 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: rootform-official-image-${{ inputs.version }}-${{ steps.release.outputs.commit }}
           path: |

.github/workflows/publish-policy-packs.yml

@@ -257,7 +257,7 @@ jobs:
 
       - name: Record publication evidence
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: example-policy-pack-${{ inputs.rootform_version }}-${{ github.sha }}
           path: |

scripts/validate-repository.ts

@@ -411,7 +411,7 @@ export function validateRepository(): void {
     !candidateWorkflow.includes("needs.registry.result == 'success'") ||
     !candidateWorkflow.includes("registry-qualification-v$VERSION-$RELEASE_ID") ||
     !candidateWorkflow.includes(
-      "actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c",
+      "actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333",
     ) ||
     candidateWorkflow.split(candidateArtifactName).length !== 4 ||
     !candidateWorkflow.includes("bun scripts/prepare-release.ts --check") ||