chore(deps): bump the github-actions group with 10 updates

.github/workflows/ci-feedback.yml

@@ -37,7 +37,7 @@ jobs:
       # tree. Either way `./actions/ci-feedback` cannot resolve, which is how
       # 0.1.21 shipped this path broken for every reusable caller. Name the
       # repository explicitly and pin it.
-      - uses: NDDev-OpenNetwork/ci-workflows/actions/ci-feedback@a7b90bdf1ac12465cbd07072e3360442cfc8eec6  # 0.1.26
+      - uses: NDDev-OpenNetwork/ci-workflows/actions/ci-feedback@d92026cf31a10a0eeaa532e1f323c7cfdfbfac5b  # 0.1.29
         with:
           run-id: ${{ inputs.run-id }}
           run-attempt: ${{ inputs.run-attempt }}

.github/workflows/docs-quality.yml

@@ -75,7 +75,7 @@ jobs:
 
       - name: Spell check (typos)
         if: ${{ inputs.typos }}
-        uses: crate-ci/typos@512fc24f32f44ab01972217aaaf3dc86ec234d53  # v1.50.2
+        uses: crate-ci/typos@00f422f3b19c57bc6338715ebfe3316d38768461  # v1.50.3
         with:
           files: ${{ inputs.typos_files }}
 

.github/workflows/iac-scan.yml

@@ -48,7 +48,7 @@ jobs:
           persist-credentials: false
 
       - name: Checkov
-        uses: bridgecrewio/checkov-action@444c9db6fa75e2d9c19ebf1fde7322089be9009e  # v12.3125.0
+        uses: bridgecrewio/checkov-action@5798bad4f6dd9c1fb67ae3ec10d42d8fb67037c4  # v12.3126.0
         with:
           directory: ${{ inputs.directory }}
           framework: ${{ inputs.framework }}

.github/workflows/kotlin-android-ci.yml

@@ -81,7 +81,7 @@ jobs:
 
       - name: Set up Gradle
         id: gradle
-        uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb  # v6.3.0
+        uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6  # v6.4.0
         with:
           cache-provider: basic
 

.github/workflows/nddev-security-bundle.yml

@@ -169,7 +169,7 @@ jobs:
 
       - name: Upload zizmor SARIF
         if: ${{ !cancelled() && steps.scan.conclusion != 'skipped' }}
-        uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd  # v4.38.1
+        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2  # v4.38.2
         with:
           sarif_file: ${{ runner.temp }}/private-security-zizmor.sarif
           category: zizmor

.github/workflows/private-security-bundle-free.yml

@@ -150,7 +150,7 @@ jobs:
       - name: Restore pinned uv archive
         if: ${{ steps.baked-uv.outputs.available != 'true' }}
         id: uv-archive
-        uses: NDDev-OpenNetwork/ci-workflows/actions/tool-cache@a7b90bdf1ac12465cbd07072e3360442cfc8eec6  # 0.1.26
+        uses: NDDev-OpenNetwork/ci-workflows/actions/tool-cache@d92026cf31a10a0eeaa532e1f323c7cfdfbfac5b  # 0.1.29
         with:
           url: https://github.com/astral-sh/uv/releases/download/0.11.30/uv-x86_64-unknown-linux-gnu.tar.gz
           sha256: 04bc7d180d6138bf6dc08387acf507a823f397a98fea55da36b0ccc7fbce3b68
@@ -173,23 +173,23 @@ jobs:
           printf '%s\n' "$RUNNER_TEMP/private-security-tools/bin" >> "$GITHUB_PATH"
 
       - name: Restore actionlint archive
-        uses: NDDev-OpenNetwork/ci-workflows/actions/tool-cache@a7b90bdf1ac12465cbd07072e3360442cfc8eec6  # 0.1.26
+        uses: NDDev-OpenNetwork/ci-workflows/actions/tool-cache@d92026cf31a10a0eeaa532e1f323c7cfdfbfac5b  # 0.1.29
         with:
           url: https://github.com/rhysd/actionlint/releases/download/v1.7.12/actionlint_1.7.12_linux_amd64.tar.gz
           sha256: 8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8
           output: ${{ runner.temp }}/private-security-tools/actionlint.tar.gz
           max-bytes: '16777216'
 
       - name: Restore OSV-Scanner binary
-        uses: NDDev-OpenNetwork/ci-workflows/actions/tool-cache@a7b90bdf1ac12465cbd07072e3360442cfc8eec6  # 0.1.26
+        uses: NDDev-OpenNetwork/ci-workflows/actions/tool-cache@d92026cf31a10a0eeaa532e1f323c7cfdfbfac5b  # 0.1.29
         with:
           url: https://github.com/google/osv-scanner/releases/download/v2.6.0/osv-scanner_linux_amd64
           sha256: ca69b3d3cd08f889a49dc0a383122f71cc528b83803671df5fd874d97485b108
           output: ${{ runner.temp }}/private-security-tools/osv-scanner
           max-bytes: '268435456'
 
       - name: Restore gitleaks archive
-        uses: NDDev-OpenNetwork/ci-workflows/actions/tool-cache@a7b90bdf1ac12465cbd07072e3360442cfc8eec6  # 0.1.26
+        uses: NDDev-OpenNetwork/ci-workflows/actions/tool-cache@d92026cf31a10a0eeaa532e1f323c7cfdfbfac5b  # 0.1.29
         with:
           url: https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz
           sha256: 551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb

.github/workflows/public-codeql.yml

@@ -115,21 +115,21 @@ jobs:
 
       - name: Initialize CodeQL
         if: ${{ inputs.config_file == '' }}
-        uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd  # v4.38.1
+        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2  # v4.38.2
         with:
           languages: ${{ matrix.language }}
           queries: ${{ inputs.queries }}
 
       - name: Initialize CodeQL with config
         if: ${{ inputs.config_file != '' }}
-        uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd  # v4.38.1
+        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2  # v4.38.2
         with:
           languages: ${{ matrix.language }}
           config-file: ${{ inputs.config_file }}
 
       - name: Autobuild
         if: ${{ inputs.autobuild && inputs.build_command == '' }}
-        uses: github/codeql-action/autobuild@1c5b675653bb5c22dbe9b12b556ec555138e09fd  # v4.38.1
+        uses: github/codeql-action/autobuild@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2  # v4.38.2
 
       - name: Custom build
         if: ${{ inputs.build_command != '' }}
@@ -139,13 +139,13 @@ jobs:
 
       - name: Analyze
         if: ${{ inputs.output_directory == '' }}
-        uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd  # v4.38.1
+        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2  # v4.38.2
         with:
           category: "/language:${{ matrix.language }}"
 
       - name: Analyze with output directory
         if: ${{ inputs.output_directory != '' }}
-        uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd  # v4.38.1
+        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2  # v4.38.2
         with:
           category: "/language:${{ matrix.language }}"
           output: ${{ inputs.output_directory }}

.github/workflows/public-scorecard.yml

@@ -165,7 +165,7 @@ jobs:
       - name: Upload SARIF to code scanning
         id: upload-sarif
         if: ${{ github.event_name != 'pull_request' || inputs.upload_sarif_on_forks || github.event.pull_request.head.repo.full_name == github.repository }}
-        uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd  # v4.38.1
+        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2  # v4.38.2
         with:
           sarif_file: results.sarif
           category: ${{ inputs.sarif_category }}

.github/workflows/rust-supply-chain.yml

@@ -101,7 +101,7 @@ jobs:
         with:
           toolchain: ${{ inputs.toolchain }}
       - name: Install cargo-audit
-        uses: taiki-e/install-action@94c31af3204a9f15ab40b35ad084410b905bbc73  # v2.87.17
+        uses: taiki-e/install-action@4cef1412cce204788f482e778a0b9187f9626a29  # v2.87.21
         with:
           tool: cargo-audit@${{ inputs.cargo_audit_version }}
       - name: Run cargo-audit
@@ -124,7 +124,7 @@ jobs:
         with:
           toolchain: ${{ inputs.toolchain }}
       - name: Install cargo-machete
-        uses: taiki-e/install-action@94c31af3204a9f15ab40b35ad084410b905bbc73  # v2.87.17
+        uses: taiki-e/install-action@4cef1412cce204788f482e778a0b9187f9626a29  # v2.87.21
         with:
           tool: cargo-machete@${{ inputs.cargo_machete_version }}
       - name: Run cargo-machete

.github/workflows/zizmor-sarif.yml

@@ -82,7 +82,7 @@ jobs:
             "${ZIZMOR_TARGET}" > zizmor.sarif
 
       - name: Upload SARIF to code scanning
-        uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd  # v4.38.1
+        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2  # v4.38.2
         with:
           sarif_file: zizmor.sarif
           category: zizmor

catalog/action-images.yml

@@ -33,7 +33,7 @@ images:
       published-evidence path for the public tier, so a substituted image would
       change what the SARIF and JSON attest to.
   - action: bridgecrewio/checkov-action
-    image: docker://ghcr.io/bridgecrewio/checkov:3.3.19
+    image: docker://ghcr.io/bridgecrewio/checkov:3.3.20
     used_by:
       - .github/workflows/iac-scan.yml
     reason: >-

catalog/scorecard-evidence.yml

@@ -66,7 +66,7 @@ category_contract:
     guid: null
   source_urls:
     - https://github.com/ossf/scorecard/blob/v5.5.0/pkg/scorecard/sarif.go
-    - https://github.com/github/codeql-action/blob/1c5b675653bb5c22dbe9b12b556ec555138e09fd/src/upload-lib.ts
+    - https://github.com/github/codeql-action/blob/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2/src/upload-lib.ts
     - https://docs.github.com/en/code-security/reference/code-scanning/sarif-files/sarif-support-for-code-scanning
 attempts:
   - attempt: 1

catalog/tools.yml

@@ -118,8 +118,8 @@ tools:
     name: github/codeql-action
     homepage: "https://github.com/github/codeql-action"
     kind: action
-    current_version: "v4.38.1"
-    pin: "github/codeql-action@1c5b675653bb5c22dbe9b12b556ec555138e09fd"
+    current_version: "v4.38.2"
+    pin: "github/codeql-action@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2"
     used_by:
       - .github/workflows/nddev-security-bundle.yml
       - .github/workflows/public-codeql.yml
@@ -291,8 +291,8 @@ tools:
     name: gradle/actions/setup-gradle
     homepage: "https://github.com/gradle/actions"
     kind: action
-    current_version: "v6.3.0"
-    pin: "gradle/actions@9c971963bec38e04b3d30dcc455b5382be2fdbfb"
+    current_version: "v6.4.0"
+    pin: "gradle/actions@3f5f9adaf7d9fecd50b5935e54106014257a94e6"
     used_by:
       - .github/workflows/kotlin-android-ci.yml
     last_verified: "2026-09-21"
@@ -362,8 +362,8 @@ tools:
     name: crate-ci/typos
     homepage: "https://github.com/crate-ci/typos"
     kind: action
-    current_version: "v1.50.2"
-    pin: "crate-ci/typos@512fc24f32f44ab01972217aaaf3dc86ec234d53"
+    current_version: "v1.50.3"
+    pin: "crate-ci/typos@00f422f3b19c57bc6338715ebfe3316d38768461"
     used_by:
       - .github/workflows/docs-quality.yml
     last_verified: "2026-09-21"
@@ -464,8 +464,8 @@ tools:
     name: bridgecrewio/checkov-action
     homepage: "https://github.com/bridgecrewio/checkov-action"
     kind: action
-    current_version: "v12.3125.0"
-    pin: "bridgecrewio/checkov-action@444c9db6fa75e2d9c19ebf1fde7322089be9009e"
+    current_version: "v12.3126.0"
+    pin: "bridgecrewio/checkov-action@5798bad4f6dd9c1fb67ae3ec10d42d8fb67037c4"
     used_by:
       - .github/workflows/iac-scan.yml
     last_verified: "2026-09-21"
@@ -665,8 +665,8 @@ tools:
     name: taiki-e/install-action
     homepage: "https://github.com/taiki-e/install-action"
     kind: action
-    current_version: "v2.87.17"
-    pin: "taiki-e/install-action@94c31af3204a9f15ab40b35ad084410b905bbc73"
+    current_version: "v2.87.21"
+    pin: "taiki-e/install-action@4cef1412cce204788f482e778a0b9187f9626a29"
     used_by:
       - .github/workflows/rust-supply-chain.yml
     last_verified: "2026-09-21"