Build(deps): bump the github-actions group across 1 directory with 16 updates

.github/workflows/build-and-package.yml

@@ -73,8 +73,8 @@ jobs:
 
       - name: Install uv
         if: inputs.platform != 'linux'
-        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990
-        # v8.3.2
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d
+        # v10.0.1
         with:
           python-version: ${{ inputs['python-version'] }}
 
@@ -88,7 +88,7 @@ jobs:
           cargo-orthohelp --version | grep -Eq '(^|[[:space:]])0\.9\.0([[:space:]]|$)'
 
       - name: Build release binary
-        uses: leynos/shared-actions/.github/actions/rust-build-release@8add2d99854a5b77548eae98cca59202e68fefc8
+        uses: leynos/shared-actions/.github/actions/rust-build-release@f4764bea8d813b1a8f7ebc37a44907d3c3b1e0e4
         with:
           target: ${{ inputs.target }}
           bin-name: ${{ env.BIN_NAME }}
@@ -111,7 +111,7 @@ jobs:
 
       - name: Stage artefacts
         id: stage
-        uses: leynos/shared-actions/.github/actions/stage-release-artefacts@8add2d99854a5b77548eae98cca59202e68fefc8
+        uses: leynos/shared-actions/.github/actions/stage-release-artefacts@f4764bea8d813b1a8f7ebc37a44907d3c3b1e0e4
         with:
           config-file: .github/release-staging.toml
           target: ${{ inputs['stage-target'] }}
@@ -133,7 +133,7 @@ jobs:
 
       - name: Package Linux artefacts with dependencies
         if: inputs.platform == 'linux'
-        uses: leynos/shared-actions/.github/actions/linux-packages@8add2d99854a5b77548eae98cca59202e68fefc8
+        uses: leynos/shared-actions/.github/actions/linux-packages@f4764bea8d813b1a8f7ebc37a44907d3c3b1e0e4
         with:
           project-dir: .
           package-name: ${{ inputs['bin-name'] }}
@@ -154,7 +154,7 @@ jobs:
       - name: Build Windows installer package
         if: inputs.platform == 'windows'
         id: package_windows
-        uses: leynos/shared-actions/.github/actions/windows-package@8add2d99854a5b77548eae98cca59202e68fefc8
+        uses: leynos/shared-actions/.github/actions/windows-package@f4764bea8d813b1a8f7ebc37a44907d3c3b1e0e4
         with:
           product-name: ${{ inputs['bin-name'] }}
           manufacturer: Leynos
@@ -172,7 +172,7 @@ jobs:
       - name: Build macOS installer package
         if: inputs.platform == 'macos'
         id: package_macos
-        uses: leynos/shared-actions/.github/actions/macos-package@8add2d99854a5b77548eae98cca59202e68fefc8
+        uses: leynos/shared-actions/.github/actions/macos-package@f4764bea8d813b1a8f7ebc37a44907d3c3b1e0e4
         with:
           name: ${{ inputs['bin-name'] }}
           identifier: com.leynos.${{ inputs['bin-name'] }}

.github/workflows/ci.yml

@@ -49,13 +49,13 @@ jobs:
           command -v awk
           awk --version
       - name: Setup Rust
-        uses: leynos/shared-actions/.github/actions/setup-rust@8add2d99854a5b77548eae98cca59202e68fefc8
+        uses: leynos/shared-actions/.github/actions/setup-rust@f4764bea8d813b1a8f7ebc37a44907d3c3b1e0e4
         with:
           toolchain: ${{ env.NETSUKE_RUST_TOOLCHAIN }}
           # Preserve warnings-as-errors and Polonius through toolchain setup.
           rustflags: -D warnings -Zpolonius=next
       - name: Install cargo-nextest
-        uses: taiki-e/install-action@18b1216eba7f8039b0f8d131d5473787f0edce68  # v2.85.3
+        uses: taiki-e/install-action@288e746965032cfcc232e09af2daf5f23c14d780  # v2.86.1
         with:
           tool: nextest@${{ env.NEXTEST_VERSION }}
       - name: Show rustc version
@@ -88,7 +88,7 @@ jobs:
       - name: Lint
         run: make lint
       - name: Setup uv
-        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d
         with:
           python-version: '3.13'
           # This Rust workspace has no Python dependency manifest. Cache the
@@ -111,7 +111,7 @@ jobs:
       - name: Test
         run: make test
       - name: Test and Measure Coverage
-        uses: leynos/shared-actions/.github/actions/generate-coverage@8add2d99854a5b77548eae98cca59202e68fefc8
+        uses: leynos/shared-actions/.github/actions/generate-coverage@f4764bea8d813b1a8f7ebc37a44907d3c3b1e0e4
         with:
           output-path: lcov.info
           format: lcov
@@ -122,7 +122,7 @@ jobs:
         if: env.CS_ACCESS_TOKEN != '' && github.event_name == 'pull_request'
         env:
           CS_ACCESS_TOKEN: ${{ secrets.CS_ACCESS_TOKEN }}
-        uses: leynos/shared-actions/.github/actions/upload-codescene-coverage@8add2d99854a5b77548eae98cca59202e68fefc8
+        uses: leynos/shared-actions/.github/actions/upload-codescene-coverage@f4764bea8d813b1a8f7ebc37a44907d3c3b1e0e4
         with:
           path: lcov.info
           format: lcov
@@ -158,15 +158,15 @@ jobs:
       - name: Install GNU Make
         run: choco install make --yes --no-progress
       - name: Setup Rust
-        uses: leynos/shared-actions/.github/actions/setup-rust@8add2d99854a5b77548eae98cca59202e68fefc8
+        uses: leynos/shared-actions/.github/actions/setup-rust@f4764bea8d813b1a8f7ebc37a44907d3c3b1e0e4
         with:
           toolchain: ${{ env.NETSUKE_RUST_TOOLCHAIN }}
           # Preserve warnings-as-errors and Polonius through toolchain setup.
           rustflags: -D warnings -Zpolonius=next
       - name: Install Ninja
         uses: seanmiddleditch/gha-setup-ninja@3b1f8f94a2f8254bd26914c4ab9474d4f0015f67  # v6
       - name: Install cargo-nextest
-        uses: taiki-e/install-action@18b1216eba7f8039b0f8d131d5473787f0edce68  # v2.85.3
+        uses: taiki-e/install-action@288e746965032cfcc232e09af2daf5f23c14d780  # v2.86.1
         with:
           tool: nextest@${{ env.NEXTEST_VERSION }}
       - name: Show rustc version
@@ -239,11 +239,11 @@ jobs:
         with:
           persist-credentials: false
       - name: Setup Rust
-        uses: leynos/shared-actions/.github/actions/setup-rust@8add2d99854a5b77548eae98cca59202e68fefc8
+        uses: leynos/shared-actions/.github/actions/setup-rust@f4764bea8d813b1a8f7ebc37a44907d3c3b1e0e4
         with:
           toolchain: stable
       - name: Install uv
-        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990  # v8.3.2
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
         with:
           # The Kani job has no Python dependency manifest; its explicit cache
           # below owns the Rust toolchain artefacts.

.github/workflows/coverage-main.yml

@@ -24,7 +24,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Setup Rust
-        uses: leynos/shared-actions/.github/actions/setup-rust@8add2d99854a5b77548eae98cca59202e68fefc8
+        uses: leynos/shared-actions/.github/actions/setup-rust@f4764bea8d813b1a8f7ebc37a44907d3c3b1e0e4
         with:
           # Match rust-toolchain.toml: the tree needs -Zpolonius=next (see
           # docs/adr-006-adopt-polonius-nightly-toolchain.md).
@@ -33,7 +33,7 @@ jobs:
           # cargo-llvm-cov appends its instrumentation flags to this value.
           rustflags: -D warnings -Zpolonius=next
       - name: Test and Measure Coverage
-        uses: leynos/shared-actions/.github/actions/generate-coverage@8add2d99854a5b77548eae98cca59202e68fefc8
+        uses: leynos/shared-actions/.github/actions/generate-coverage@f4764bea8d813b1a8f7ebc37a44907d3c3b1e0e4
         with:
           output-path: lcov.info
           format: lcov
@@ -42,7 +42,7 @@ jobs:
         env:
           CS_ACCESS_TOKEN: ${{ secrets.CS_ACCESS_TOKEN }}
         if: env.CS_ACCESS_TOKEN != ''
-        uses: leynos/shared-actions/.github/actions/upload-codescene-coverage@8add2d99854a5b77548eae98cca59202e68fefc8
+        uses: leynos/shared-actions/.github/actions/upload-codescene-coverage@f4764bea8d813b1a8f7ebc37a44907d3c3b1e0e4
         with:
           path: lcov.info
           format: lcov

.github/workflows/dependabot-automerge.yml

@@ -28,6 +28,6 @@ jobs:
       # The token is not used for any external cloud auth.
       id-token: write
     if: ${{ github.event_name == 'workflow_dispatch' || github.actor == 'dependabot[bot]' }}
-    uses: leynos/shared-actions/.github/workflows/dependabot-automerge.yml@8add2d99854a5b77548eae98cca59202e68fefc8
+    uses: leynos/shared-actions/.github/workflows/dependabot-automerge.yml@f4764bea8d813b1a8f7ebc37a44907d3c3b1e0e4
     with:
       pull-request-number: ${{ inputs.pull-request-number || github.event.pull_request.number }}

.github/workflows/mutation-testing.yml

@@ -26,7 +26,7 @@ jobs:
     permissions:
       contents: read
       id-token: write # OIDC workflow-source resolution
-    uses: leynos/shared-actions/.github/workflows/mutation-cargo.yml@8add2d99854a5b77548eae98cca59202e68fefc8
+    uses: leynos/shared-actions/.github/workflows/mutation-cargo.yml@f4764bea8d813b1a8f7ebc37a44907d3c3b1e0e4
     with:
       # test_support is deliberately omitted from extra crates: it is a
       # test-fixture crate whose survivors are noise.

.github/workflows/netsukefile-test.yml

@@ -21,7 +21,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Setup Rust
-        uses: leynos/shared-actions/.github/actions/setup-rust@8add2d99854a5b77548eae98cca59202e68fefc8
+        uses: leynos/shared-actions/.github/actions/setup-rust@f4764bea8d813b1a8f7ebc37a44907d3c3b1e0e4
         with:
           toolchain: ${{ env.NETSUKE_RUST_TOOLCHAIN }}
           # Preserve the Polonius requirement through toolchain setup.

.github/workflows/release.yml

@@ -76,11 +76,11 @@ jobs:
       - id: release_modes
         name: Determine release modes
         uses: >-
-          leynos/shared-actions/.github/actions/determine-release-modes@8add2d99854a5b77548eae98cca59202e68fefc8
+          leynos/shared-actions/.github/actions/determine-release-modes@f4764bea8d813b1a8f7ebc37a44907d3c3b1e0e4
       - id: ensure_version
         name: Read package version from Cargo.toml
         uses: >-
-          leynos/shared-actions/.github/actions/ensure-cargo-version@8add2d99854a5b77548eae98cca59202e68fefc8
+          leynos/shared-actions/.github/actions/ensure-cargo-version@f4764bea8d813b1a8f7ebc37a44907d3c3b1e0e4
         with:
           check-tag: ${{ fromJSON(steps.release_modes.outputs['should-publish']) }}
       - id: wix_extension_version
@@ -107,7 +107,7 @@ jobs:
       - id: bin_name
         name: Extract binary name from Cargo.toml
         uses: >-
-          leynos/shared-actions/.github/actions/export-cargo-metadata@8add2d99854a5b77548eae98cca59202e68fefc8
+          leynos/shared-actions/.github/actions/export-cargo-metadata@f4764bea8d813b1a8f7ebc37a44907d3c3b1e0e4
         with:
           manifest-path: ${{ steps.manifest_path.outputs.value }}
           fields: bin-name
@@ -241,8 +241,8 @@ jobs:
         # repository's Python tooling targets, rather than whichever `python3`
         # the runner image happens to ship. The script relies on
         # `BaseExceptionGroup`, which needs Python 3.11 or later.
-        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990
-        # v8.3.2
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d
+        # v10.0.1
         with:
           python-version: '3.13'
           # The hoist script is stdlib-only and runs with --no-project, so a
@@ -263,7 +263,7 @@ jobs:
       - id: upload_assets
         name: Upload artefacts to release
         uses: >-
-          leynos/shared-actions/.github/actions/upload-release-assets@8add2d99854a5b77548eae98cca59202e68fefc8
+          leynos/shared-actions/.github/actions/upload-release-assets@f4764bea8d813b1a8f7ebc37a44907d3c3b1e0e4
         with:
           release-tag: ${{ github.ref_name }}
           bin-name: ${{ needs.metadata.outputs.bin_name }}