chore(deps): bump the github-actions group across 1 directory with 8 updates

.github/workflows/iac-scan.yml

@@ -48,7 +48,7 @@ jobs:
           persist-credentials: false
 
       - name: Checkov
-        uses: bridgecrewio/checkov-action@1246d92f57abae29d5db5f9aeeed2a9813e52d7d  # v12.3117.0
+        uses: bridgecrewio/checkov-action@59b9d7edfcad5b87fbe3f473a9a134a721ad03f8  # v12.3119.0
         with:
           directory: ${{ inputs.directory }}
           framework: ${{ inputs.framework }}

.github/workflows/java-ci.yml

@@ -64,7 +64,7 @@ jobs:
 
       - name: Set up Java
         if: ${{ !inputs.use_preinstalled_toolchain }}
-        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961  # v5.7.0
+        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c  # v6.0.0
         with:
           java-version: ${{ inputs.java_version }}
           distribution: ${{ inputs.distribution }}

.github/workflows/kotlin-android-ci.yml

@@ -74,7 +74,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up JDK
-        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961  # v5.7.0
+        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c  # v6.0.0
         with:
           java-version: ${{ inputs.java_version }}
           distribution: ${{ inputs.java_distribution }}

.github/workflows/nddev-security-bundle.yml

@@ -170,7 +170,7 @@ jobs:
 
       - name: Upload zizmor SARIF
         if: ${{ !cancelled() && steps.scan.conclusion != 'skipped' }}
-        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd  # v4.37.7
+        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28  # v4.37.8
         with:
           sarif_file: ${{ runner.temp }}/private-security-zizmor.sarif
           category: zizmor

.github/workflows/private-security-bundle-free.yml

@@ -137,7 +137,7 @@ jobs:
       - name: Restore pinned uv archive
         if: ${{ steps.baked-uv.outputs.available != 'true' }}
         id: uv-archive
-        uses: NDDev-OpenNetwork/github-actions/actions/tool-cache@470c95c3e7cd1f9a0d763f3f6d7f43024f8451ad  # v1.0.1
+        uses: NDDev-OpenNetwork/github-actions/actions/tool-cache@468af475a08210020502f74588b2c98ba4c01696  # v1.2.0
         with:
           url: https://github.com/astral-sh/uv/releases/download/0.11.30/uv-x86_64-unknown-linux-gnu.tar.gz
           sha256: 04bc7d180d6138bf6dc08387acf507a823f397a98fea55da36b0ccc7fbce3b68
@@ -160,23 +160,23 @@ jobs:
           printf '%s\n' "$RUNNER_TEMP/private-security-tools/bin" >> "$GITHUB_PATH"
 
       - name: Restore actionlint archive
-        uses: NDDev-OpenNetwork/github-actions/actions/tool-cache@470c95c3e7cd1f9a0d763f3f6d7f43024f8451ad  # v1.0.1
+        uses: NDDev-OpenNetwork/github-actions/actions/tool-cache@468af475a08210020502f74588b2c98ba4c01696  # v1.2.0
         with:
           url: https://github.com/rhysd/actionlint/releases/download/v1.7.12/actionlint_1.7.12_linux_amd64.tar.gz
           sha256: 8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8
           output: ${{ runner.temp }}/private-security-tools/actionlint.tar.gz
           max-bytes: '16777216'
 
       - name: Restore OSV-Scanner binary
-        uses: NDDev-OpenNetwork/github-actions/actions/tool-cache@470c95c3e7cd1f9a0d763f3f6d7f43024f8451ad  # v1.0.1
+        uses: NDDev-OpenNetwork/github-actions/actions/tool-cache@468af475a08210020502f74588b2c98ba4c01696  # v1.2.0
         with:
           url: https://github.com/google/osv-scanner/releases/download/v2.5.0/osv-scanner_linux_amd64
           sha256: edcfc41d257db36148f065055655fe3fcfc434b0b423ea67468a84c207524e0c
           output: ${{ runner.temp }}/private-security-tools/osv-scanner
           max-bytes: '268435456'
 
       - name: Restore gitleaks archive
-        uses: NDDev-OpenNetwork/github-actions/actions/tool-cache@470c95c3e7cd1f9a0d763f3f6d7f43024f8451ad  # v1.0.1
+        uses: NDDev-OpenNetwork/github-actions/actions/tool-cache@468af475a08210020502f74588b2c98ba4c01696  # v1.2.0
         with:
           url: https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz
           sha256: 551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb

.github/workflows/public-codeql.yml

@@ -115,21 +115,21 @@ jobs:
 
       - name: Initialize CodeQL
         if: ${{ inputs.config_file == '' }}
-        uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd  # v4.37.7
+        uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28  # v4.37.8
         with:
           languages: ${{ matrix.language }}
           queries: ${{ inputs.queries }}
 
       - name: Initialize CodeQL with config
         if: ${{ inputs.config_file != '' }}
-        uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd  # v4.37.7
+        uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28  # v4.37.8
         with:
           languages: ${{ matrix.language }}
           config-file: ${{ inputs.config_file }}
 
       - name: Autobuild
         if: ${{ inputs.autobuild && inputs.build_command == '' }}
-        uses: github/codeql-action/autobuild@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd  # v4.37.7
+        uses: github/codeql-action/autobuild@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28  # v4.37.8
 
       - name: Custom build
         if: ${{ inputs.build_command != '' }}
@@ -139,13 +139,13 @@ jobs:
 
       - name: Analyze
         if: ${{ inputs.output_directory == '' }}
-        uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd  # v4.37.7
+        uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28  # v4.37.8
         with:
           category: "/language:${{ matrix.language }}"
 
       - name: Analyze with output directory
         if: ${{ inputs.output_directory != '' }}
-        uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd  # v4.37.7
+        uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28  # v4.37.8
         with:
           category: "/language:${{ matrix.language }}"
           output: ${{ inputs.output_directory }}

.github/workflows/public-scorecard.yml

@@ -165,7 +165,7 @@ jobs:
       - name: Upload SARIF to code scanning
         id: upload-sarif
         if: ${{ github.event_name != 'pull_request' || inputs.upload_sarif_on_forks || github.event.pull_request.head.repo.full_name == github.repository }}
-        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd  # v4.37.7
+        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28  # v4.37.8
         with:
           sarif_file: results.sarif
           category: ${{ inputs.sarif_category }}

.github/workflows/runtime-fixtures-languages.yml

@@ -586,7 +586,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Set up JDK
-        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961  # v5.7.0
+        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c  # v6.0.0
         with:
           java-version: '21'
           distribution: temurin

.github/workflows/rust-supply-chain.yml

@@ -97,7 +97,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Install cargo-audit
-        uses: taiki-e/install-action@b6b84cf49ebfe0176417bdce007c624f0db37f20  # v2.86.2
+        uses: taiki-e/install-action@b6ff580856c41316412a0b9b60540fbc6f8c82cc  # v2.86.7
         with:
           tool: cargo-audit@${{ inputs.cargo_audit_version }}
       - name: Run cargo-audit
@@ -116,7 +116,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Install cargo-machete
-        uses: taiki-e/install-action@b6b84cf49ebfe0176417bdce007c624f0db37f20  # v2.86.2
+        uses: taiki-e/install-action@b6ff580856c41316412a0b9b60540fbc6f8c82cc  # v2.86.7
         with:
           tool: cargo-machete@${{ inputs.cargo_machete_version }}
       - name: Run cargo-machete

.github/workflows/zizmor-sarif.yml

@@ -82,7 +82,7 @@ jobs:
             "${ZIZMOR_TARGET}" > zizmor.sarif
 
       - name: Upload SARIF to code scanning
-        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd  # v4.37.7
+        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28  # v4.37.8
         with:
           sarif_file: zizmor.sarif
           category: zizmor

catalog/scorecard-evidence.yml

@@ -66,7 +66,7 @@ category_contract:
     guid: null
   source_urls:
     - https://github.com/ossf/scorecard/blob/v5.5.0/pkg/scorecard/sarif.go
-    - https://github.com/github/codeql-action/blob/ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd/src/upload-lib.ts
+    - https://github.com/github/codeql-action/blob/db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28/src/upload-lib.ts
     - https://docs.github.com/en/code-security/reference/code-scanning/sarif-files/sarif-support-for-code-scanning
 attempts:
   - attempt: 1

catalog/tools.yml

@@ -114,14 +114,14 @@ tools:
     name: github/codeql-action
     homepage: "https://github.com/github/codeql-action"
     kind: action
-    current_version: "v4.37.7"
-    pin: "github/codeql-action@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd"
+    current_version: "v4.37.8"
+    pin: "github/codeql-action@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28"
     used_by:
       - .github/workflows/nddev-security-bundle.yml
       - .github/workflows/public-codeql.yml
       - .github/workflows/public-scorecard.yml
       - .github/workflows/zizmor-sarif.yml
-    last_verified: "2026-07-12"
+    last_verified: "2026-09-01"
 
   - id: dependency-review-action
     name: actions/dependency-review-action
@@ -458,11 +458,11 @@ tools:
     name: bridgecrewio/checkov-action
     homepage: "https://github.com/bridgecrewio/checkov-action"
     kind: action
-    current_version: "v12.3117.0"
-    pin: "bridgecrewio/checkov-action@1246d92f57abae29d5db5f9aeeed2a9813e52d7d"
+    current_version: "v12.3119.0"
+    pin: "bridgecrewio/checkov-action@59b9d7edfcad5b87fbe3f473a9a134a721ad03f8"
     used_by:
       - .github/workflows/iac-scan.yml
-    last_verified: "2026-07-25"
+    last_verified: "2026-09-01"
 
   - id: github-action-benchmark
     name: benchmark-action/github-action-benchmark
@@ -524,11 +524,11 @@ tools:
     name: NDDev-OpenNetwork/github-actions/actions/tool-cache
     homepage: "https://github.com/NDDev-OpenNetwork/github-actions/tree/main/actions/tool-cache"
     kind: action
-    current_version: "v1.0.1"
-    pin: "NDDev-OpenNetwork/github-actions@470c95c3e7cd1f9a0d763f3f6d7f43024f8451ad"
+    current_version: "v1.2.0"
+    pin: "NDDev-OpenNetwork/github-actions@468af475a08210020502f74588b2c98ba4c01696"
     used_by:
       - .github/workflows/private-security-bundle-free.yml
-    last_verified: "2026-08-23"
+    last_verified: "2026-09-01"
     notes: >-
       Signed tag v1.0.1 resolves to the exact pinned repository commit and
       mirrors structured fetch evidence into the runner diagnostic bundle.
@@ -589,13 +589,13 @@ tools:
     name: actions/setup-java
     homepage: "https://github.com/actions/setup-java"
     kind: action
-    current_version: "v5.7.0"
-    pin: "actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961"
+    current_version: "v6.0.0"
+    pin: "actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c"
     used_by:
       - .github/workflows/java-ci.yml
       - .github/workflows/kotlin-android-ci.yml
       - .github/workflows/runtime-fixtures-languages.yml
-    last_verified: "2026-07-25"
+    last_verified: "2026-09-01"
 
   - id: setup-terraform
     name: hashicorp/setup-terraform
@@ -636,11 +636,11 @@ tools:
     name: taiki-e/install-action
     homepage: "https://github.com/taiki-e/install-action"
     kind: action
-    current_version: "v2.86.2"
-    pin: "taiki-e/install-action@b6b84cf49ebfe0176417bdce007c624f0db37f20"
+    current_version: "v2.86.7"
+    pin: "taiki-e/install-action@b6ff580856c41316412a0b9b60540fbc6f8c82cc"
     used_by:
       - .github/workflows/rust-supply-chain.yml
-    last_verified: "2026-08-12"
+    last_verified: "2026-09-01"
 
   # Upstream tags no release, so the pin comment carries the commit date rather
   # than a version. Bump it by picking a newer commit deliberately, not by