chore(deps): bump scorecard-action, codeql-action, and checkout

.github/workflows/modonome-review.yml

@@ -24,7 +24,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out the PR head with history
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 

.github/workflows/scorecard.yml

@@ -29,7 +29,7 @@ jobs:
       # ossf/scorecard-action and the actions below are tracked by Dependabot
       # (see .github/dependabot.yml) and may be pinned to a SHA later.
       - name: Run analysis
-        uses: ossf/scorecard-action@v2.4.3
+        uses: ossf/scorecard-action@v2.4.4
         with:
           results_file: results.sarif
           results_format: sarif

.modonome/snapshot/map.md

@@ -2,7 +2,7 @@
 
 Modonome snapshot. Read this before reading the repo. Tier 0 (signature.json) is the fingerprint: if merkle_root matches your last read, nothing changed. Tier 1 (map.json / map.md) lists modules, public API signatures, import edges, and attention ranking. Cite anchors (F: for files, S: for symbols); each resolves to a path and line so you can act without re-reading the whole repo.
 
-Merkle root: sha256:dca28c65d51d01c292b89d9192cb802ddac2149e6c74f1556ab04c4645f52fed
+Merkle root: sha256:0ca699520794d7a2d0d63439f6b5693e89ecc375905859274293c77129dcedd1
 Files: 1029  Bytes: 3805193  Map tokens: 135721/120000
 
 ## Modules

.modonome/snapshot/signature.json

@@ -1 +1 @@
-{"commands":{"build":"","lint":"","test":"npm test"},"entrypoints":["bin/modonome.mjs"],"generated_at":"2026-07-28T04:12:19.462Z","generated_for":"modonome","governance":{"armed":false,"autonomy_enabled":false,"dry_run":true},"instructions":["AGENTS.md","CLAUDE.md","CODEX.md","CONTRIBUTING.md","README.md"],"language_mix":{"(none)":12,"cff":1,"css":50,"diff":18,"html":9,"js":19,"json":139,"jsonl":8,"md":144,"mjs":351,"patch":40,"png":5,"py":4,"sh":1,"svg":2,"tf":4,"toml":2,"ts":61,"tsx":98,"txt":18,"webmanifest":1,"webp":1,"woff2":9,"xml":1,"yaml":9,"yml":22},"merkle_root":"sha256:dca28c65d51d01c292b89d9192cb802ddac2149e6c74f1556ab04c4645f52fed","preamble":"Modonome snapshot. Read this before reading the repo. Tier 0 (signature.json) is the fingerprint: if merkle_root matches your last read, nothing changed. Tier 1 (map.json / map.md) lists modules, public API signatures, import edges, and attention ranking. Cite anchors (F: for files, S: for symbols); each resolves to a path and line so you can act without re-reading the whole repo.","protected_paths":[".github",".github/CODEOWNERS","package-lock.json"],"schema_version":1,"size":{"bytes":3805193,"files":1029},"snapshot_version":1,"stack":{"name":"Node or TypeScript","pm":"npm"},"tier_hashes":{"map":"sha256:cb3c8d3b84c136a4c779462b3b71f54ca55b353b7495d3573cf076710ea3dfba","map_md":"sha256:809f6d1dacbcd64f812441062db4376c61a8eb77e0f11a60b7da2ae051d17e7f"}}
+{"commands":{"build":"","lint":"","test":"npm test"},"entrypoints":["bin/modonome.mjs"],"generated_at":"2026-07-28T04:22:27.418Z","generated_for":"modonome","governance":{"armed":false,"autonomy_enabled":false,"dry_run":true},"instructions":["AGENTS.md","CLAUDE.md","CODEX.md","CONTRIBUTING.md","README.md"],"language_mix":{"(none)":12,"cff":1,"css":50,"diff":18,"html":9,"js":19,"json":139,"jsonl":8,"md":144,"mjs":351,"patch":40,"png":5,"py":4,"sh":1,"svg":2,"tf":4,"toml":2,"ts":61,"tsx":98,"txt":18,"webmanifest":1,"webp":1,"woff2":9,"xml":1,"yaml":9,"yml":22},"merkle_root":"sha256:0ca699520794d7a2d0d63439f6b5693e89ecc375905859274293c77129dcedd1","preamble":"Modonome snapshot. Read this before reading the repo. Tier 0 (signature.json) is the fingerprint: if merkle_root matches your last read, nothing changed. Tier 1 (map.json / map.md) lists modules, public API signatures, import edges, and attention ranking. Cite anchors (F: for files, S: for symbols); each resolves to a path and line so you can act without re-reading the whole repo.","protected_paths":[".github",".github/CODEOWNERS","package-lock.json"],"schema_version":1,"size":{"bytes":3805193,"files":1029},"snapshot_version":2,"stack":{"name":"Node or TypeScript","pm":"npm"},"tier_hashes":{"map":"sha256:2c3c3eeacd5132cb72674bcb9121bf3d0563596f35f1f8acaa0b3ff98bbcec43","map_md":"sha256:618c556ce3632ae1f4deda14c876942e1b6eb87586ea365df84fe59cae5ee334"}}

action.yml

@@ -68,7 +68,7 @@ runs:
 
     - name: Upload SARIF to code scanning
       if: ${{ always() && inputs.upload-sarif == 'true' }}
-      uses: github/codeql-action/upload-sarif@v3
+      uses: github/codeql-action/upload-sarif@v4
       with:
         sarif_file: ${{ inputs.sarif-file }}
         category: modonome-gate-integrity