docs: Package Update Policy - GitHub Actions

[marcossevilla]

Overview

This issue tracks the Package Update Policy for GitHub Actions across VeryGoodOpenSource repositories.

GitHub Actions update policy belongs with the workflows repo, where it has proper ownership and community visibility.

Scope

Define and document the policy for:

• How and when to update GitHub Actions versions (e.g. actions/checkout, actions/setup-java, etc.)
• Who is responsible for initiating updates
• Cadence for reviewing and bumping action versions
• How to handle breaking changes in upstream actions