build(deps): bump the actions group across 1 directory with 12 updates

.github/workflows/ci.yml

@@ -15,8 +15,8 @@ jobs:
   python-api:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
       - name: Contract tests
@@ -25,8 +25,8 @@ jobs:
   frontend:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: 20
           cache: npm
@@ -43,7 +43,7 @@ jobs:
         os: [ubuntu-24.04, windows-latest, macos-14]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       # The full workspace (engine + duckle-runner + duckle-mcp + apps/desktop
       # with two embedded binaries) plus test artifacts can exceed the ~14 GB
       # free on a GitHub Linux runner ("No space left on device"). Drop large
@@ -147,7 +147,7 @@ jobs:
   desktop-release-build:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Free disk space
         shell: bash
         run: |
@@ -156,7 +156,7 @@ jobs:
             /usr/local/share/powershell /usr/share/swift || true
           sudo docker image prune --all --force || true
           df -h /
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: 20
           cache: npm
@@ -220,7 +220,7 @@ jobs:
           --health-timeout 5s
           --health-retries 20
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
       - name: Install DuckDB CLI
@@ -258,7 +258,7 @@ jobs:
           --health-timeout 5s
           --health-retries 30
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
       - name: Install DuckDB CLI
@@ -286,7 +286,7 @@ jobs:
   minio-integration:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
       - name: Start MinIO + create bucket
@@ -370,7 +370,7 @@ jobs:
     if: vars.SF_LIVE_TESTS == 'true'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
       - name: Install DuckDB CLI

.github/workflows/docker-web.yml

@@ -24,20 +24,20 @@ jobs:
   build-push:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: docker/setup-buildx-action@v3
+      - uses: docker/setup-buildx-action@v4
 
       - name: Log in to GHCR
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Image tags
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: ghcr.io/${{ github.repository_owner }}/duckle-web
           tags: |
@@ -46,7 +46,7 @@ jobs:
             type=semver,pattern={{version}}
 
       - name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: Dockerfile.web

.github/workflows/pages.yml

@@ -28,16 +28,16 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Configure Pages
-        uses: actions/configure-pages@v5
+        uses: actions/configure-pages@v6
 
       - name: Upload site artifact
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@v5
         with:
           path: website
 
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5

.github/workflows/pypi.yml

@@ -39,7 +39,7 @@ jobs:
     outputs:
       version: ${{ steps.v.outputs.version }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           ref: ${{ inputs.ref || github.ref }}
       - id: v
@@ -103,11 +103,11 @@ jobs:
             triple: aarch64-pc-windows-msvc
             plat: win_arm64
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           ref: ${{ inputs.ref || github.ref }}
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
 
@@ -174,7 +174,7 @@ jobs:
           python -m pip install --quiet twine
           python -m twine check dist/*.whl
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: wheel-${{ matrix.name }}
           path: dist/*.whl
@@ -191,7 +191,7 @@ jobs:
     permissions:
       id-token: write   # mint the OIDC token; this is the whole auth story
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           pattern: wheel-*
           path: dist

.github/workflows/release.yml

@@ -55,11 +55,11 @@ jobs:
     needs: prepare-release
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Build the static Linux duckle-runner (musl, in Docker)
         run: bash scripts/build-runner-linux.sh
       - name: Upload as a workflow artifact (not a release asset)
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: duckle-runner-linux-x64
           path: apps/desktop/bin/duckle-runner-linux-x64
@@ -97,7 +97,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       # Reclaim ~20 GB on Linux runners so the full workspace + embedded
       # binaries build does not hit "No space left on device".
       - name: Free disk space (Linux)
@@ -109,7 +109,7 @@ jobs:
             /usr/local/share/powershell /usr/share/swift || true
           sudo docker image prune --all --force || true
           df -h /
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: 20
           cache: npm
@@ -164,7 +164,7 @@ jobs:
       # desktop binary, enabling Build Pipeline -> Linux from any OS. This is a
       # workflow artifact from the build-linux-runner job, never a release asset.
       - name: Stage the embedded Linux runner
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: duckle-runner-linux-x64
           path: apps/desktop/bin