updated deprecated action versions

.github/workflows/lint-actions.yml

@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Run actionlint
         uses: raven-actions/actionlint@e01d1ea33dd6a5ed517d95b4c0c357560ac6f518 # v2.1.1

.github/workflows/manual-test-pirate-agent.yml

@@ -13,7 +13,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout code
-        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Ask pirate agent about shipments
         uses: ./

.github/workflows/pr-describe.yml

@@ -21,12 +21,12 @@ jobs:
       checks: write
     steps:
       - name: Check out Git repository
-        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Create check run
         id: create-check
         continue-on-error: true # Don't fail if checks: write permission is missing
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const prNumber = context.issue.number;
@@ -57,7 +57,7 @@ jobs:
 
       - name: Validate PR and add reaction
         id: validate_pr
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           github-token: ${{ steps.app-token.outputs.token || github.token }}
           script: |
@@ -88,7 +88,7 @@ jobs:
 
       - name: Get PR details
         id: pr_details
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           github-token: ${{ steps.app-token.outputs.token || github.token }}
           script: |
@@ -186,7 +186,7 @@ jobs:
 
       - name: Update PR description
         if: ${{ steps.generate.conclusion == 'success' }}
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           github-token: ${{ steps.app-token.outputs.token || github.token }}
           script: |
@@ -244,7 +244,7 @@ jobs:
 
       - name: Post success comment
         if: ${{ steps.generate.conclusion == 'success' }}
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           github-token: ${{ steps.app-token.outputs.token || github.token }}
           script: |
@@ -259,7 +259,7 @@ jobs:
 
       - name: Post failure comment
         if: ${{ failure() && steps.generate.conclusion != 'success' }}
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           github-token: ${{ steps.app-token.outputs.token || github.token }}
           script: |
@@ -274,7 +274,7 @@ jobs:
 
       - name: Post summary
         if: always()
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           PR_TITLE: ${{ steps.pr_details.outputs.title }}
           PR_BRANCH: ${{ steps.pr_details.outputs.branch }}
@@ -314,7 +314,7 @@ jobs:
 
       - name: Update check run
         if: always() && steps.create-check.outputs.check-id != ''
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           CHECK_ID: ${{ steps.create-check.outputs.check-id }}
           JOB_STATUS: ${{ job.status }}

.github/workflows/pr-review-trigger.yml

@@ -27,7 +27,7 @@ jobs:
           echo "$PR_NUMBER" > pr-metadata/pr-number
 
       - name: Upload PR metadata
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: pr-review-trigger-metadata-${{ github.run_id }}
           path: pr-metadata/

.github/workflows/release.yml

@@ -42,7 +42,7 @@ jobs:
           private-key: ${{ secrets.CAGENT_REVIEWER_APP_PRIVATE_KEY }}
 
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
           token: ${{ steps.app-token.outputs.token }}
@@ -349,7 +349,7 @@ jobs:
           private-key: ${{ secrets.CAGENT_REVIEWER_APP_PRIVATE_KEY }}
 
       - name: Checkout cagent-action
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           repository: docker/cagent-action
           token: ${{ steps.app-token.outputs.token }}
@@ -445,7 +445,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ needs.release.outputs.version }}
 

.github/workflows/reply-to-feedback.yml

@@ -34,7 +34,7 @@ jobs:
       # ----------------------------------------------------------------
       - name: Download feedback artifact
         id: download
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const runId = context.payload.workflow_run.id;
@@ -129,7 +129,7 @@ jobs:
       - name: Add eyes reaction
         if: steps.meta.outputs.proceed == 'true'
         continue-on-error: true
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           COMMENT_ID: ${{ steps.meta.outputs.comment_id }}
           REPO: ${{ steps.meta.outputs.repo }}
@@ -153,7 +153,7 @@ jobs:
       - name: Check authorization
         if: steps.meta.outputs.proceed == 'true'
         id: auth
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           USERNAME: ${{ steps.meta.outputs.author }}
         with:
@@ -182,7 +182,7 @@ jobs:
       - name: Notify unauthorized user
         if: steps.meta.outputs.proceed == 'true' && steps.auth.outputs.authorized == 'false'
         continue-on-error: true
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           PR_NUMBER: ${{ steps.meta.outputs.pr_number }}
           REPO: ${{ steps.meta.outputs.repo }}
@@ -295,7 +295,7 @@ jobs:
         if: steps.meta.outputs.proceed == 'true' && steps.auth.outputs.authorized == 'true'
         id: checkout
         continue-on-error: true
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
           ref: refs/pull/${{ steps.meta.outputs.pr_number }}/head

.github/workflows/review-pr.yml

@@ -145,7 +145,7 @@ jobs:
       - name: Fetch PR info
         id: pr-info
         if: github.event_name == 'workflow_run'
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           PR_NUMBER: ${{ steps.get-pr.outputs.pr-number }}
         with:
@@ -161,7 +161,7 @@ jobs:
 
       - name: Check if PR author is org member
         id: membership
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           PR_NUMBER: ${{ steps.get-pr.outputs.pr-number }}
           PR_DRAFT: ${{ steps.pr-info.outputs.draft }}
@@ -209,7 +209,7 @@ jobs:
 
       - name: Checkout PR head
         if: steps.membership.outputs.is_member == 'true'
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
           ref: refs/pull/${{ steps.get-pr.outputs.pr-number }}/head
@@ -262,7 +262,7 @@ jobs:
     steps:
       - name: Check if commenter is org member
         id: membership
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           github-token: ${{ secrets.CAGENT_ORG_MEMBERSHIP_TOKEN }}
           script: |
@@ -315,7 +315,7 @@ jobs:
         if: steps.membership.outputs.is_member == 'true'
         id: create-check
         continue-on-error: true # Don't fail if caller didn't grant checks: write
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           PR_NUMBER: ${{ inputs.pr-number || github.event.issue.number }}
         with:
@@ -341,7 +341,7 @@ jobs:
 
       - name: Checkout PR head
         if: steps.membership.outputs.is_member == 'true'
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
           ref: refs/pull/${{ github.event.issue.number }}/head
@@ -370,7 +370,7 @@ jobs:
 
       - name: Update check run
         if: always() && steps.create-check.outputs.check-id != ''
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           CHECK_ID: ${{ steps.create-check.outputs.check-id }}
           JOB_STATUS: ${{ job.status }}
@@ -436,7 +436,7 @@ jobs:
 
       - name: Upload feedback artifact
         if: steps.check.outputs.is_agent == 'true'
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: pr-review-feedback
           path: feedback/
@@ -675,7 +675,7 @@ jobs:
       # Safe to checkout PR head because the reply agent only READS files (no code execution)
       - name: Checkout PR head
         if: steps.check.outputs.is_agent == 'true' && steps.auth.outputs.authorized == 'true'
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
           ref: refs/pull/${{ github.event.pull_request.number }}/head

.github/workflows/security-scan.yml

@@ -26,7 +26,7 @@ jobs:
       issues: write
     steps:
       - name: Check out Git repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0 # Need full history to get commits from past week
 

.github/workflows/self-review-pr.yml

@@ -89,7 +89,7 @@ jobs:
 
       - name: Check if PR author is org member
         id: membership
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           github-token: ${{ secrets.CAGENT_ORG_MEMBERSHIP_TOKEN }}
           script: |
@@ -146,7 +146,7 @@ jobs:
 
       - name: Checkout PR head
         if: steps.membership.outputs.is_member == 'true'
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
           ref: refs/pull/${{ steps.get-pr.outputs.pr-number }}/head
@@ -194,7 +194,7 @@ jobs:
     steps:
       - name: Check if commenter is org member
         id: membership
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           github-token: ${{ secrets.CAGENT_ORG_MEMBERSHIP_TOKEN }}
           script: |
@@ -247,7 +247,7 @@ jobs:
         if: steps.membership.outputs.is_member == 'true'
         id: create-check
         continue-on-error: true # Don't fail if checks: write permission is missing
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           APP_TOKEN: ${{ steps.app-token.outputs.token }}
         with:
@@ -273,7 +273,7 @@ jobs:
 
       - name: Checkout PR head
         if: steps.membership.outputs.is_member == 'true'
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
           ref: refs/pull/${{ github.event.issue.number }}/head
@@ -299,7 +299,7 @@ jobs:
 
       - name: Update check run
         if: always() && steps.create-check.outputs.check-id != ''
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           CHECK_ID: ${{ steps.create-check.outputs.check-id }}
           JOB_STATUS: ${{ job.status }}
@@ -415,7 +415,7 @@ jobs:
 
       - name: Upload feedback artifact
         if: steps.check.outputs.is_agent == 'true'
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: pr-review-feedback
           path: feedback/

.github/workflows/test.yml

@@ -18,7 +18,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout code
-        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Run prompt sanitization tests
         run: |
@@ -33,7 +33,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout code
-        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Run output extraction tests
         run: |
@@ -48,7 +48,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout code
-        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Run job summary tests
         run: |
@@ -63,7 +63,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout code
-        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Run security tests
         run: |
@@ -78,7 +78,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout code
-        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Run exploit tests
         run: |
@@ -106,7 +106,7 @@ jobs:
 
       - name: Checkout code
         if: steps.fork-check.outputs.is_fork != 'true'
-        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Run test
         if: steps.fork-check.outputs.is_fork != 'true'
@@ -171,7 +171,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout code
-        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Test should fail on invalid agent
         id: invalid-agent