chore: update dependencies

.github/workflows/release.yml

@@ -48,16 +48,16 @@ jobs:
           - { image: launcher-webapp,   dockerfile: Dockerfile.launcher-webapp,   arch: amd64, runner: ubuntu-latest }
           - { image: launcher-webapp,   dockerfile: Dockerfile.launcher-webapp,   arch: arm64, runner: ubuntu-24.04-arm }
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Prepare image name
         run: echo "IMAGE=ghcr.io/${GITHUB_REPOSITORY,,}" >> "$GITHUB_ENV"
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Log in to GHCR
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -67,7 +67,7 @@ jobs:
       # manifest list from all per-arch digests.
       - name: Build & push by digest
         id: build
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: ${{ matrix.dockerfile }}
@@ -84,7 +84,7 @@ jobs:
           touch "/tmp/digests/${digest#sha256:}"
 
       - name: Upload digest
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: digest-${{ matrix.image }}-${{ matrix.arch }}
           path: /tmp/digests/*
@@ -101,17 +101,17 @@ jobs:
         image: [standard, max, launcher-schedule, launcher-api, launcher-webapp]
     steps:
       - name: Download digests for ${{ matrix.image }}
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           path: /tmp/digests
           pattern: digest-${{ matrix.image }}-*
           merge-multiple: true
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Log in to GHCR
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}

.github/workflows/test.yml

@@ -23,16 +23,16 @@ jobs:
     name: build · lint · test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       # Build the dev image once, cached across runs, tagged as the Makefile's
       # DEV_IMAGE default (awman-better-agent-engine:latest). `--load` puts it in the
       # local engine so the subsequent `make` targets reuse it instead of rebuilding.
       - name: Build dev toolchain image (cached)
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: Dockerfile.dev

Dockerfile

@@ -8,6 +8,8 @@
 #   docker run -p 8080:8080 -v bae-data:/var/lib/bae better-agent-engine
 
 FROM rust:1-bookworm AS build
+RUN apt-get update && apt-get install -y --no-install-recommends cmake \
+    && rm -rf /var/lib/apt/lists/*
 WORKDIR /build
 # Two independently-buildable crates share this stage: baesrv (server/) builds
 # for the native gnu target, baectl builds as a static musl binary. They are

Dockerfile.dev

@@ -16,6 +16,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     curl \
     make \
     build-essential \
+    cmake \
     musl-tools \
     pkg-config \
     libssl-dev \

Dockerfile.max

@@ -12,6 +12,8 @@
 #   docker run -p 8080:8080 -p 3000:3000 -v bae-data:/var/lib/bae better-agent-engine:max
 
 FROM rust:1-bookworm AS rust-build
+RUN apt-get update && apt-get install -y --no-install-recommends cmake \
+    && rm -rf /var/lib/apt/lists/*
 WORKDIR /build
 # See Dockerfile's identical stage for why server/ and baectl/ are COPYed into
 # distinct subdirectories rather than flattened.