chore(deps): Bump the actions group across 1 directory with 7 updates

.github/workflows/ci.yml

@@ -49,7 +49,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event_name == 'pull_request'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
       - name: Fail if PR branch is behind its base branch
@@ -100,10 +100,10 @@ jobs:
       # exactly as deploy.yml's proven-green gate does.
       TEST_POSTGRES_CUSTOMERS_URL: postgres://postgres:postgres@localhost:5432/instant_customers?sslmode=disable
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Checkout proto sibling (for go.mod replace ../proto)
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: ${{ vars.PROTO_REPO || format('{0}/proto', github.repository_owner) }}
           token: ${{ secrets.REPO_ACCESS_TOKEN }}
@@ -113,7 +113,7 @@ jobs:
         run: mv _proto_ci ../proto
 
       - name: Checkout common sibling (for go.mod replace ../common)
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: ${{ vars.COMMON_REPO || format('{0}/common', github.repository_owner) }}
           token: ${{ secrets.REPO_ACCESS_TOKEN }}
@@ -122,7 +122,7 @@ jobs:
       - name: Place ../common for Go replace directive
         run: mv _common_ci ../common
 
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v6
         with:
           go-version: '1.25'
 
@@ -168,10 +168,10 @@ jobs:
     if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Checkout proto sibling
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: ${{ vars.PROTO_REPO || format('{0}/proto', github.repository_owner) }}
           token: ${{ secrets.REPO_ACCESS_TOKEN }}
@@ -180,14 +180,14 @@ jobs:
       - run: mv _proto_ci ../proto
 
       - name: Checkout common sibling
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: ${{ vars.COMMON_REPO || format('{0}/common', github.repository_owner) }}
           token: ${{ secrets.REPO_ACCESS_TOKEN }}
           path: _common_ci
       - run: mv _common_ci ../common
 
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v6
         with:
           go-version: '1.25'
 

.github/workflows/codeql.yml

@@ -20,29 +20,29 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout this repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           path: api
       - name: Checkout sibling InstaNode-dev/common
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: InstaNode-dev/common
           path: common
       - name: Checkout sibling InstaNode-dev/proto
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: InstaNode-dev/proto
           path: proto
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v6
         with:
           go-version-file: api/go.mod
-      - uses: github/codeql-action/init@v3
+      - uses: github/codeql-action/init@v4
         with:
           languages: go
           queries: security-extended
       - name: Build
         working-directory: api
         run: go build ./...
-      - uses: github/codeql-action/analyze@v3
+      - uses: github/codeql-action/analyze@v4
         with:
           category: "/language:go"

.github/workflows/deploy.yml

@@ -97,12 +97,12 @@ jobs:
           --health-retries 12
     steps:
       - name: Checkout api (this repo) into ./api
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           path: api
 
       - name: Checkout common sibling into ./common
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: ${{ vars.COMMON_REPO || format('{0}/common', github.repository_owner) }}
           # 2026-05-15: GITHUB_TOKEN is scoped to THIS repo only and 404s
@@ -114,7 +114,7 @@ jobs:
           path: common
 
       - name: Checkout proto sibling into ./proto
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: ${{ vars.PROTO_REPO || format('{0}/proto', github.repository_owner) }}
           token: ${{ secrets.REPO_ACCESS_TOKEN }}
@@ -132,7 +132,7 @@ jobs:
           echo "Built ${VERSION} (${BUILD_TIME})"
 
       - name: Set up Go (for unit tests + go.mod replace directives)
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version: '1.25'
 
@@ -205,15 +205,15 @@ jobs:
           go test ./... -short -count=1 -p 1
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Log in to GHCR
         # 2026-05-17: the per-job GITHUB_TOKEN (even with packages: write)
         # is scoped to THIS repo and is not authorised to push the
         # org-owned package ghcr.io/instanode-dev/instant-api — every push
         # 403'd. GHCR_PUSH_TOKEN is a classic PAT with write:packages owned
         # by a user who has write access to that package. See task #121.
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -235,7 +235,7 @@ jobs:
             .
 
       - name: Set up kubectl
-        uses: azure/setup-kubectl@v3
+        uses: azure/setup-kubectl@v5
         with:
           version: 'latest'
 

.github/workflows/govulncheck.yml

@@ -17,20 +17,20 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout this repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           path: api
       - name: Checkout sibling InstaNode-dev/common
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: InstaNode-dev/common
           path: common
       - name: Checkout sibling InstaNode-dev/proto
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: InstaNode-dev/proto
           path: proto
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v6
         with:
           go-version-file: api/go.mod
           check-latest: true

.github/workflows/integration-backup.yml

@@ -50,19 +50,19 @@ jobs:
     if: ${{ vars.INTEGRATION_BACKUP_ENABLED == 'true' }}
     steps:
       - name: Check out api
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           path: api
       - name: Check out infra (sibling repo with restore-drill.sh)
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: ${{ github.repository_owner }}/infra
           path: infra
           token: ${{ secrets.REPO_ACCESS_TOKEN }}
       - name: Install kubectl
-        uses: azure/setup-kubectl@v4
+        uses: azure/setup-kubectl@v5
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version-file: api/go.mod
       - name: Materialise drill kubeconfig

.github/workflows/osv-scanner.yml

@@ -15,7 +15,7 @@ permissions:
 
 jobs:
   scan:
-    uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.0.1
+    uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.3.8
     permissions:
       actions: read
       contents: read