Bump third-party workflows

.github/actions/helpers/has-application-changed/action.yml

@@ -11,7 +11,7 @@ runs:
   steps:
     - name: Get all changed application files
       id: changed-application-files
-      uses: tj-actions/changed-files@ed68ef82c095e0d48ec87eccea555d944a631a4c # v46.0.5
+      uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
       with:
         since_last_remote_commit: true
         files: |

.github/actions/tools/gradle/action.yml

@@ -53,7 +53,7 @@ runs:
         echo "Java version: ${{ inputs.java-version }}"
 
     - name: Set Up Java
-      uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5.1.0
+      uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
       with:
         java-version: ${{ inputs.java-version }}
         distribution: ${{ inputs.java-distribution }}

.github/actions/tools/pnpm/action.yml

@@ -31,7 +31,7 @@ runs:
   using: composite
   steps:
     - name: Install pnpm
-      uses: pnpm/action-setup@8b2eead6074fefa43a68bf4c9e0f03ea4126b5ba # v6.0.3
+      uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
       with:
         version: ${{ inputs.pnpm-version }}
         run_install: false

.github/actions/tools/terraform/action.yml

@@ -93,7 +93,7 @@ runs:
         exit 1
 
     - name: Setup Terraform
-      uses: hashicorp/setup-terraform@5e8dbf3c6d9deaf4193ca7a8fb23f2ac83bb6c85 # v4
+      uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
       with:
         terraform_version: ${{ env.TERRAFORM_VERSION }}
 

.github/workflows/build.gradle.yml

@@ -76,7 +76,7 @@ jobs:
           GRADLE_CACHE_ENCRYPTION_KEY: ${{ secrets.GRADLE_CACHE_ENCRYPTION_KEY }}
 
       - name: Store built JAR as Artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: ${{ inputs.artifact-name }}
           path: ${{inputs.working-directory}}/${{ inputs.artifact-path }}

.github/workflows/build.node.yml

@@ -98,7 +98,7 @@ jobs:
           pnpm-version: ${{ inputs.pnpm-version }}
 
       - name: Store build as Artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: ${{ inputs.artifact-name }}
           path: ${{inputs.working-directory}}/${{ inputs.artifact-path }}

.github/workflows/build.python.yml

@@ -44,12 +44,12 @@ jobs:
           ref: ${{ inputs.git-sha }}
 
       - name: Install uv
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           enable-cache: true
           cache-dependency-glob: "${{ inputs.working-directory }}/uv.lock"
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: ${{ inputs.python_version }}
 
@@ -79,7 +79,7 @@ jobs:
           INPUT_NAME: ${{ inputs.artifact-name }}
 
       - name: Store build as Artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: ${{ steps.artifact-name.outputs.artifact-name }}
           path: ${{ inputs.working-directory }}/out

.github/workflows/deployment.preview-cleanup-schedule.yml

@@ -375,7 +375,7 @@ jobs:
     environment: Test
     steps:
       - name: Authenticate with AWS
-        uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
+        uses: aws-actions/configure-aws-credentials@v6
         with:
           aws-region: ${{ vars.AWS_REGION }}
           role-to-assume: "arn:aws:iam::${{ vars.AWS_ACCOUNT_ID }}:role/${{ vars.AWS_DEPLOYMENT_ROLE_NAME }}"

.github/workflows/helpers.build-railyard-docs.yml

@@ -56,7 +56,7 @@ jobs:
       contents: read
     steps:
       - name: Set up Python 3.12
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: '3.12'
       - name: Install mkdocs and plugins
@@ -106,7 +106,7 @@ jobs:
       contents: read
     steps:
       - name: Download build artifact
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           name: ${{ inputs.artifact-name }}
           path: artifact-download

.github/workflows/helpers.find-changes.terraform.yml

@@ -127,7 +127,7 @@ jobs:
           echo "working-directory=$NAME_WITHOUT_SLASHES" >> $GITHUB_OUTPUT
 
       - name: Upload matrix outputs
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: ${{ steps.without-slashes.outputs.working-directory }}-matrix-outputs-${{ matrix.environment }}
           path: ./matrix-outputs
@@ -151,7 +151,7 @@ jobs:
           echo "working-directory=$NAME_WITHOUT_SLASHES" >> $GITHUB_OUTPUT
 
       - name: Download matrix outputs
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           pattern: ${{ steps.without-slashes.outputs.working-directory }}-matrix-outputs-*
           merge-multiple: true

.github/workflows/helpers.terraform-plan.yml

@@ -142,7 +142,7 @@ jobs:
 
       - name: Upload plan artifact
         if: steps.changed-files.outcome == 'success'
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: terraform-plan-${{ matrix.environment }}
           path: temp-plans/${{ matrix.environment }}.md
@@ -160,7 +160,7 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Download all plan artifacts
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@v8
         continue-on-error: true
         with:
           pattern: terraform-plan-*

.github/workflows/helpers.upload-open-api-spec.yml

@@ -38,12 +38,12 @@ jobs:
       - uses: actions/checkout@v6
 
       - name: Convert from YAML to JSON
-        uses: mikefarah/yq@v4.40.5
+        uses: mikefarah/yq@1b9b4ac5187171d2e5e3129be0cfa827c7f9d53d # v4.53.3
         with:
           cmd: yq -o=json '.' '${{ inputs.open-api-spec-path }}' > 'converted.json'
 
       - name: Persist file between jobs
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: 'open-api-spec'
           path: 'converted.json'
@@ -62,7 +62,7 @@ jobs:
           role-to-assume: "arn:aws:iam::${{ vars.AWS_ACCOUNT_ID }}:role/${{ vars.AWS_DEPLOYMENT_ROLE_NAME }}"
 
       - name: Download API Spec
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           name: "open-api-spec"
 

.github/workflows/lint.terraform.yml

@@ -39,7 +39,7 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
-      - uses: hashicorp/setup-terraform@5e8dbf3c6d9deaf4193ca7a8fb23f2ac83bb6c85 # v4.0
+      - uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
         with:
           terraform_version: ${{ inputs.terraform-version }}
 
@@ -57,7 +57,7 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
-      - uses: hashicorp/setup-terraform@5e8dbf3c6d9deaf4193ca7a8fb23f2ac83bb6c85 # v4.0
+      - uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
         with:
           terraform_version: ${{ inputs.terraform-version }}
 

.github/workflows/package.docker.yml

@@ -62,7 +62,7 @@ jobs:
 
       - name: Download Artifact
         if: inputs.artifact-name != ''
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           name: ${{ inputs.artifact-name }}
           path: ${{inputs.working-directory}}/${{ inputs.artifact-path }}

.github/workflows/package.s3.jar.yml

@@ -55,13 +55,13 @@ jobs:
 
       - name: Download artifacts
         id: download-artifacts
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           name: ${{ inputs.artifact-name }}
           path: "./temp-artifact"
 
       - name: Authenticate with AWS
-        uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0
+        uses: aws-actions/configure-aws-credentials@v6
         with:
           aws-region: ${{ inputs.aws-region }}
           role-to-assume: "arn:aws:iam::${{ vars.AWS_ACCOUNT_ID }}:role/${{ vars.AWS_DEPLOYMENT_ROLE_NAME }}"

.github/workflows/package.s3.yml

@@ -51,7 +51,7 @@ jobs:
 
       - name: Download artifacts if specified
         if: inputs.artifact-name != ''
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           name: ${{ inputs.artifact-name }}
           path: "./temp-artifact"

.github/workflows/test.node.yml

@@ -54,7 +54,7 @@ jobs:
 
       - name: Download Artifact
         if: inputs.artifact-name != ''
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           name: ${{ inputs.artifact-name }}
           path: ${{ inputs.artifact-path }}

.github/workflows/test.python.yml

@@ -30,12 +30,12 @@ jobs:
       - uses: actions/checkout@v6
 
       - name: Install uv
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           enable-cache: true
           cache-dependency-glob: "${{ inputs.working-directory }}/uv.lock"
 
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: ${{ inputs.python-version }}
 

.opencode/skills/update-github-actions/SKILL.md

@@ -0,0 +1,10 @@
+---
+name: update-github-actions
+description: Update external GitHub Actions to their latest versions. Use when someone asks to "update github actions", "bump action versions", "update action dependencies", "upgrade workflow dependencies", or similar. Fetches the latest releases from GitHub, checks for known vulnerabilities, reviews breaking changes, and updates workflow files with correct version pins.
+---
+
+# Update GitHub Actions
+
+Updates external GitHub Actions dependencies across all workflow files in `.github/workflows/` (and any `action.yml` files under `.github/actions/` that call external actions).
+
+Read [references/workflow.md](references/workflow.md) **fully before proceeding** — it contains the complete step-by-step process: pinning rules, how to discover actions, how to fetch the latest release and commit SHA, vulnerability checks, breaking change analysis, and how to apply updates.