ci: bump the github-actions group across 1 directory with 7 updates (#…

…401)

Bumps the github-actions group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `4.1.7` | `4.2.1` |
| [github/codeql-action](https://github.com/github/codeql-action) | `3.26.2` | `3.26.12` |
| [actions/setup-python](https://github.com/actions/setup-python) | `5.1.1` | `5.2.0` |
| [actions/cache](https://github.com/actions/cache) | `4.0.2` | `4.1.1` |
| [python-semantic-release/python-semantic-release](https://github.com/python-semantic-release/python-semantic-release) | `9.8.6` | `9.10.0` |
| [hynek/build-and-inspect-python-package](https://github.com/hynek/build-and-inspect-python-package) | `2.8.0` | `2.9.0` |
| [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) | `1.9.0` | `1.10.3` |



Updates `actions/checkout` from 4.1.7 to 4.2.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@692973e...eef6144)

Updates `github/codeql-action` from 3.26.2 to 3.26.12
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@429e197...c36620d)

Updates `actions/setup-python` from 5.1.1 to 5.2.0
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@39cd149...f677139)

Updates `actions/cache` from 4.0.2 to 4.1.1
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@0c45773...3624ceb)

Updates `python-semantic-release/python-semantic-release` from 9.8.6 to 9.10.0
- [Release notes](https://github.com/python-semantic-release/python-semantic-release/releases)
- [Changelog](https://github.com/python-semantic-release/python-semantic-release/blob/master/CHANGELOG.md)
- [Commits](python-semantic-release/python-semantic-release@dec06aa...18399a7)

Updates `hynek/build-and-inspect-python-package` from 2.8.0 to 2.9.0
- [Release notes](https://github.com/hynek/build-and-inspect-python-package/releases)
- [Changelog](https://github.com/hynek/build-and-inspect-python-package/blob/main/CHANGELOG.md)
- [Commits](hynek/build-and-inspect-python-package@2dbbf2b...73aea39)

Updates `pypa/gh-action-pypi-publish` from 1.9.0 to 1.10.3
- [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases)
- [Commits](pypa/gh-action-pypi-publish@ec4db0b...f760068)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: actions/setup-python
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: actions/cache
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: python-semantic-release/python-semantic-release
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: hynek/build-and-inspect-python-package
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: pypa/gh-action-pypi-publish
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.github/workflows/codeql.yml

@@ -18,11 +18,11 @@ jobs:
  contents: read
  security-events: write
  steps:
- - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+ - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
  # Ref: https://github.com/github/codeql-action
  - name: Initialize CodeQL
- uses: github/codeql-action/init@429e1977040da7a23b6822b13c129cd1ba93dbb2 # v3.26.2
+ uses: github/codeql-action/init@c36620d31ac7c881962c3d9dd939c40ec9434f2b # v3.26.12
  with:
  languages: python
  - name: Perform CodeQL Analysis
- uses: github/codeql-action/analyze@429e1977040da7a23b6822b13c129cd1ba93dbb2 # v3.26.2
+ uses: github/codeql-action/analyze@c36620d31ac7c881962c3d9dd939c40ec9434f2b # v3.26.12

.github/workflows/docs.yml

@@ -21,14 +21,14 @@ jobs:
  permissions:
  contents: write
  steps:
- - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+ - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
  with:
  fetch-depth: 0 # fetch all commits and branches
  - name: Set up Python 3.12
- uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v5.1.1
+ uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0
  with:
  python-version: '3.12'
- - uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
+ - uses: actions/cache@3624ceb22c1c5a301c8db4169662070a689d9ea8 # v4.1.1
  with:
  key: docs-${{ hashFiles('pyproject.toml') }}
  path: ~/.cache/pip

.github/workflows/main.yml

@@ -28,12 +28,12 @@ jobs:
  needs:
  - test
  steps:
- - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+ - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
  with:
  fetch-depth: 0 # get all commits and tags
  token: ${{ secrets.SEMANTIC_RELEASE_TOKEN }}
  - name: Create semantic release
- uses: python-semantic-release/python-semantic-release@dec06aa649fddae6610bc64878868498bfcbad7b # v9.8.6
+ uses: python-semantic-release/python-semantic-release@18399a7209118c6f0bcc923857ef7052cc5de5e3 # v9.10.0
  with:
  # allows for python-semantic-release to push to protected main branch
  github_token: ${{ secrets.SEMANTIC_RELEASE_TOKEN }}

.github/workflows/publish.yml

@@ -18,8 +18,8 @@ jobs:
  attestations: write
  id-token: write
  steps:
- - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
- - uses: hynek/build-and-inspect-python-package@2dbbf2b252d3a3c7cec7a810e3ed5983bd17b13a # v2.8.0
+ - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
+ - uses: hynek/build-and-inspect-python-package@73aea398b9c8de9ea9e4464c6b13cb8b1f3d6294 # v2.9.0
  with:
  attest-build-provenance-github: 'true'
  upload:
@@ -55,4 +55,4 @@ jobs:
  name: Packages
  path: dist
  - name: Publish package to PyPI
- uses: pypa/gh-action-pypi-publish@ec4db0b4ddc65acdf4bff5fa45ac92d78b56bdf0 # v1.9.0
+ uses: pypa/gh-action-pypi-publish@f7600683efdcb7656dec5b29656edb7bc586e597 # v1.10.3

.github/workflows/scorecards.yml

@@ -25,7 +25,7 @@ jobs:
  # Needed for GitHub OIDC token if publish_results is true
  id-token: write
  steps:
- - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+ - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
  with:
  persist-credentials: false
  # Ref: https://github.com/ossf/scorecard-action
@@ -39,6 +39,6 @@ jobs:
 
  # required for Code scanning alerts
  - name: Upload SARIF results to code scanning
- uses: github/codeql-action/upload-sarif@429e1977040da7a23b6822b13c129cd1ba93dbb2 # v3.26.2
+ uses: github/codeql-action/upload-sarif@c36620d31ac7c881962c3d9dd939c40ec9434f2b # v3.26.12
  with:
  sarif_file: results.sarif

.github/workflows/test.yml

@@ -18,9 +18,9 @@ jobs:
  matrix:
  python-version: ['3.10', '3.11', '3.12']
  steps:
- - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+ - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
  - name: Set up Python ${{ matrix.python-version }}
- uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v5.1.1
+ uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0
  with:
  python-version: ${{ matrix.python-version }}
  cache: pip
@@ -64,8 +64,8 @@ jobs:
  matrix:
  os: [ubuntu-latest, windows-latest, macos-latest]
  steps:
- - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
- - uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v5.1.1
+ - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
+ - uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0
  with:
  python-version: '3.12'
  cache: pip
@@ -96,5 +96,5 @@ jobs:
  runs-on: ubuntu-24.04
  steps:
  - run: sudo apt-get install tree # workaround for "tree: command not found" in baipp
- - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
- - uses: hynek/build-and-inspect-python-package@2dbbf2b252d3a3c7cec7a810e3ed5983bd17b13a # v2.8.0
+ - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
+ - uses: hynek/build-and-inspect-python-package@73aea398b9c8de9ea9e4464c6b13cb8b1f3d6294 # v2.9.0