Bump the github-dependencies group with 3 updates

Bumps the github-dependencies group with 3 updates: [actions/upload-artifact](https://github.com/actions/upload-artifact), [actions/download-artifact](https://github.com/actions/download-artifact) and [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance).


Updates `actions/upload-artifact` from 6 to 7
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@v6...v7)

Updates `actions/download-artifact` from 7 to 8
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@v7...v8)

Updates `actions/attest-build-provenance` from 3 to 4
- [Release notes](https://github.com/actions/attest-build-provenance/releases)
- [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md)
- [Commits](actions/attest-build-provenance@v3...v4)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-dependencies
- dependency-name: actions/download-artifact
  dependency-version: '8'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-dependencies
- dependency-name: actions/attest-build-provenance
  dependency-version: '4'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

Author: dependabot[bot]

.github/workflows/benchmark.yml

@@ -261,7 +261,7 @@ jobs:
 
       - name: Upload results
         if: always() && hashFiles(format('duckdb_{0}_results.json', matrix.query)) != ''
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: duckdb-${{ matrix.query }}-results-sf${{ matrix.scale_factor }}
           path: duckdb_${{ matrix.query }}_results.json
@@ -317,7 +317,7 @@ jobs:
 
       - name: Upload results
         if: always() && hashFiles(format('geopandas_{0}_results.json', matrix.query)) != ''
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: geopandas-${{ matrix.query }}-results-sf${{ matrix.scale_factor }}
           path: geopandas_${{ matrix.query }}_results.json
@@ -378,7 +378,7 @@ jobs:
 
       - name: Upload results
         if: always() && hashFiles(format('sedonadb_{0}_results.json', matrix.query)) != ''
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: sedonadb-${{ matrix.query }}-results-sf${{ matrix.scale_factor }}
           path: sedonadb_${{ matrix.query }}_results.json
@@ -434,7 +434,7 @@ jobs:
 
       - name: Upload results
         if: always() && hashFiles(format('spatial_polars_{0}_results.json', matrix.query)) != ''
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: spatial_polars-${{ matrix.query }}-results-sf${{ matrix.scale_factor }}
           path: spatial_polars_${{ matrix.query }}_results.json
@@ -452,7 +452,7 @@ jobs:
       - uses: actions/checkout@v6
 
       - name: Download all results for this scale factor
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           pattern: '*-results-sf${{ matrix.scale_factor }}'
           path: results
@@ -480,7 +480,7 @@ jobs:
         run: cat benchmark_summary.md >> $GITHUB_STEP_SUMMARY
 
       - name: Upload combined results
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: benchmark-summary-sf${{ matrix.scale_factor }}
           path: |

.github/workflows/build-py-packages.yml

@@ -112,7 +112,7 @@ jobs:
           manylinux: ${{ matrix.manylinux || '' }}
       - name: Upload wheels
         if: ${{ inputs.upload-artifacts || github.event_name == 'push' || github.event_name == 'pull_request' || github.event_name == 'workflow_dispatch' }}
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: wheels-${{ matrix.os }}-${{ matrix.target }}
           path: spatialbench-cli/dist
@@ -129,7 +129,7 @@ jobs:
           working-directory: spatialbench-cli
       - name: Upload sdist
         if: ${{ inputs.upload-artifacts || github.event_name == 'push' || github.event_name == 'pull_request' || github.event_name == 'workflow_dispatch' }}
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: wheels-sdist
           path: spatialbench-cli/dist

.github/workflows/packaging.yml

@@ -57,7 +57,7 @@ jobs:
           tar -czf docs.tgz documentation-site
 
       - name: Upload docs artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: docs
           retention-days: 2
@@ -72,7 +72,7 @@ jobs:
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
 
     steps:
-      - uses: actions/download-artifact@v7
+      - uses: actions/download-artifact@v8
         with:
           name: docs
 

.github/workflows/spatialbench-cli-publish-pypi.yml

@@ -24,7 +24,7 @@ jobs:
       attestations: write # Used to generate artifact attestation
     steps:
       - name: Download all build artifacts
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           pattern: '*'
           merge-multiple: true
@@ -37,7 +37,7 @@ jobs:
         run: python -m twine check --strict dist/*
 
       - name: Generate artifact attestation
-        uses: actions/attest-build-provenance@v3
+        uses: actions/attest-build-provenance@v4
         with:
           subject-path: 'dist/*'