Merge pull request #168 from Annotation-Garden/chore/dependency-bumps

Bump CI actions to current majors, point dependabot at develop

Author: neuromechanist

.github/dependabot.yml

@@ -6,6 +6,8 @@ updates:
   # Python dependencies
   - package-ecosystem: "pip"
     directory: "/"
+    # PRs go to develop, per the branching strategy in CLAUDE.md
+    target-branch: "develop"
     schedule:
       interval: "weekly"
       day: "monday"
@@ -36,6 +38,8 @@ updates:
   # GitHub Actions
   - package-ecosystem: "github-actions"
     directory: "/"
+    # PRs go to develop, per the branching strategy in CLAUDE.md
+    target-branch: "develop"
     schedule:
       interval: "weekly"
       day: "monday"
@@ -53,6 +57,8 @@ updates:
   # Docker
   - package-ecosystem: "docker"
     directory: "/deploy"
+    # PRs go to develop, per the branching strategy in CLAUDE.md
+    target-branch: "develop"
     schedule:
       interval: "weekly"
       day: "monday"
@@ -70,6 +76,8 @@ updates:
   # Cloudflare Workers (npm)
   - package-ecosystem: "npm"
     directory: "/workers"
+    # PRs go to develop, per the branching strategy in CLAUDE.md
+    target-branch: "develop"
     schedule:
       interval: "weekly"
       day: "monday"

.github/workflows/auto-dev-bump.yml

@@ -25,7 +25,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
           token: ${{ secrets.RELEASE_PAT }}

.github/workflows/auto-release.yml

@@ -28,7 +28,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
           # Use PAT to bypass branch protection rules

.github/workflows/claude-code-review.yml

@@ -24,6 +24,12 @@ jobs:
       actions: read
 
     steps:
+      # Pinned to v6 deliberately: this job runs on pull_request_target for
+      # fork PRs and checks out the PR head, which checkout v7 blocks outright
+      # (actions/checkout#2454). Bumping this step disables fork-PR review.
+      # The block exists because checking out fork code in a
+      # pull_request_target job that holds secrets and contents: write is a
+      # privilege-escalation shape; revisit the fork lane rather than the pin.
       - name: Checkout repository
         uses: actions/checkout@v6
         with:

.github/workflows/claude.yml

@@ -26,7 +26,7 @@ jobs:
       actions: read
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 1
 
@@ -50,7 +50,7 @@ jobs:
       id-token: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 1
 
@@ -92,7 +92,7 @@ jobs:
       id-token: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 1
 

.github/workflows/codeql-analysis.yml

@@ -34,7 +34,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
 
     - name: Initialize CodeQL
       uses: github/codeql-action/init@v4

.github/workflows/codeql.yml

@@ -20,7 +20,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v4

.github/workflows/codespell.yml

@@ -18,7 +18,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Annotate locations with typos
         uses: codespell-project/codespell-problem-matcher@v1
       - name: Codespell

.github/workflows/docker-build.yml

@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Build Docker image for testing
         run: |
@@ -81,22 +81,22 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
 
       - name: Log in to GitHub Container Registry
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Extract metadata (tags, labels)
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |

.github/workflows/process-feedback.yml

@@ -24,7 +24,7 @@ jobs:
       contents: read
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 2  # Get previous commit to detect new files