build(deps): Bump the actions group with 7 updates

dependabot[bot] · web-flow · commit b5f362efe5fd · 2026-05-21T17:27:05.000Z
Bumps the actions group with 7 updates: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `4` | `6` | | [actions/setup-go](https://github.com/actions/setup-go) | `5` | `6` | | [github/codeql-action](https://github.com/github/codeql-action) | `3` | `4` | | [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `3` | `4` | | [docker/login-action](https://github.com/docker/login-action) | `3` | `4` | | [azure/setup-kubectl](https://github.com/azure/setup-kubectl) | `3` | `5` | | [google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml](https://github.com/google/osv-scanner-action) | `2.0.1` | `2.3.8` | Updates `actions/checkout` from 4 to 6 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4...v6) Updates `actions/setup-go` from 5 to 6 - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](actions/setup-go@v5...v6) Updates `github/codeql-action` from 3 to 4 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@v3...v4) Updates `docker/setup-buildx-action` from 3 to 4 - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](docker/setup-buildx-action@v3...v4) Updates `docker/login-action` from 3 to 4 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@v3...v4) Updates `azure/setup-kubectl` from 3 to 5 - [Release notes](https://github.com/azure/setup-kubectl/releases) - [Changelog](https://github.com/Azure/setup-kubectl/blob/main/CHANGELOG.md) - [Commits](Azure/setup-kubectl@v3...v5) Updates `google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml` from 2.0.1 to 2.3.8 - [Release notes](https://github.com/google/osv-scanner-action/releases) - [Commits](google/osv-scanner-action@v2.0.1...v2.3.8) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/setup-go dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: github/codeql-action dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: docker/setup-buildx-action dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: docker/login-action dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: azure/setup-kubectl dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml dependency-version: 2.3.8 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -36,7 +36,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event_name == 'pull_request'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
       - name: Fail if PR branch is behind its base branch
@@ -53,10 +53,10 @@ jobs:
   build-and-test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Checkout proto sibling (replace ../proto)
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: ${{ vars.PROTO_REPO || format('{0}/proto', github.repository_owner) }}
           # REPO_ACCESS_TOKEN is a fine-grained PAT with read on the private
@@ -66,7 +66,7 @@ jobs:
       - run: mv _proto_ci ../proto
 
       - name: Checkout common sibling (replace ../common)
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: ${{ vars.COMMON_REPO || format('{0}/common', github.repository_owner) }}
           token: ${{ secrets.REPO_ACCESS_TOKEN }}
@@ -80,15 +80,15 @@ jobs:
       # to developer machines only. INSTANT_API_REPO is set on the test step
       # below so findApiRepoRoot() locates the sibling deterministically.
       - name: Checkout api sibling (for cross-repo registry-iterating tests)
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: ${{ vars.API_REPO || format('{0}/api', github.repository_owner) }}
           token: ${{ secrets.REPO_ACCESS_TOKEN }}
           path: _api_ci
           fetch-depth: 1
       - run: mv _api_ci ../api
 
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v6
         with:
           go-version: '1.24'
 
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
@@ -20,29 +20,29 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout this repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           path: worker
       - name: Checkout sibling InstaNode-dev/common
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: InstaNode-dev/common
           path: common
       - name: Checkout sibling InstaNode-dev/proto
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: InstaNode-dev/proto
           path: proto
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v6
         with:
           go-version-file: worker/go.mod
-      - uses: github/codeql-action/init@v3
+      - uses: github/codeql-action/init@v4
         with:
           languages: go
           queries: security-extended
       - name: Build
         working-directory: worker
         run: go build ./...
-      - uses: github/codeql-action/analyze@v3
+      - uses: github/codeql-action/analyze@v4
         with:
           category: "/language:go"
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
@@ -58,12 +58,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout worker (this repo) into ./worker
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           path: worker
 
       - name: Checkout common sibling into ./common
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: ${{ vars.COMMON_REPO || format('{0}/common', github.repository_owner) }}
           # 2026-05-15: GITHUB_TOKEN is scoped to THIS repo only and 404s
@@ -74,7 +74,7 @@ jobs:
           path: common
 
       - name: Checkout proto sibling into ./proto
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: ${{ vars.PROTO_REPO || format('{0}/proto', github.repository_owner) }}
           token: ${{ secrets.REPO_ACCESS_TOKEN }}
@@ -87,7 +87,7 @@ jobs:
       # detection to developer machines only. INSTANT_API_REPO is set on the
       # test step below so findApiRepoRoot() locates the sibling deterministically.
       - name: Checkout api sibling into ./api (for cross-repo registry-iterating tests)
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: ${{ vars.API_REPO || format('{0}/api', github.repository_owner) }}
           token: ${{ secrets.REPO_ACCESS_TOKEN }}
@@ -106,7 +106,7 @@ jobs:
           echo "Built ${VERSION} (${BUILD_TIME})"
 
       - name: Set up Go (for unit tests + go.mod replace directives)
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version: '1.25'
 
@@ -126,10 +126,10 @@ jobs:
         run: go test ./... -short -count=1
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Log in to GHCR
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -151,7 +151,7 @@ jobs:
             .
 
       - name: Set up kubectl
-        uses: azure/setup-kubectl@v3
+        uses: azure/setup-kubectl@v5
         with:
           version: 'latest'
 
diff --git a/.github/workflows/govulncheck.yml b/.github/workflows/govulncheck.yml
@@ -17,20 +17,20 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout this repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           path: worker
       - name: Checkout sibling InstaNode-dev/common
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: InstaNode-dev/common
           path: common
       - name: Checkout sibling InstaNode-dev/proto
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: InstaNode-dev/proto
           path: proto
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v6
         with:
           go-version-file: worker/go.mod
           check-latest: true
diff --git a/.github/workflows/osv-scanner.yml b/.github/workflows/osv-scanner.yml
@@ -15,7 +15,7 @@ permissions:
 
 jobs:
   scan:
-    uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.0.1
+    uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.3.8
     permissions:
       actions: read
       contents: read
