ci(deps): bump the github-actions group with 3 updates

actions/checkout v4 -> v7, actions/setup-node v4 -> v7 and
pnpm/action-setup v4 -> v6.

Also bumps the two pins in .github/actions/setup-workspace, which
dependabot's github-actions updater never proposed: `directory: /`
scans .github/workflows only, so a composite action's own `uses:`
lines are invisible to it. Left alone they would have kept the repo
on setup-node v4 in every lane that goes through the composite —
which is every lane except the checkout steps themselves.

.github/actions/setup-workspace/action.yml

@@ -13,9 +13,9 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: pnpm/action-setup@v4
+    - uses: pnpm/action-setup@v6
 
-    - uses: actions/setup-node@v4
+    - uses: actions/setup-node@v7
       with:
         node-version-file: ${{ inputs.node-version-file }}
         cache: pnpm

.github/workflows/checks.yml

@@ -23,7 +23,7 @@ jobs:
     if: github.event_name == 'workflow_dispatch' || github.event.pull_request.draft == false
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           # turbo --affected diffs against the PR base; it needs full history.
           fetch-depth: 0
@@ -61,7 +61,7 @@ jobs:
     if: github.event_name == 'pull_request' && github.event.pull_request.draft == false
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 

.github/workflows/publish.yml

@@ -43,15 +43,15 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v6
 
       # Not the setup-workspace composite: this job needs registry-url, which
       # is what writes the .npmrc that NODE_AUTH_TOKEN binds to.
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version-file: .nvmrc
           cache: pnpm

.github/workflows/release.yml

@@ -21,11 +21,11 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v6
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version-file: .nvmrc
           cache: pnpm