From 24215ecbf9dc9080d0b866e8a980197149050b05 Mon Sep 17 00:00:00 2001
From: Nayan <xNayanKumar@gmail.com>
Date: Tue, 11 Aug 2026 05:23:30 +0530
Subject: [PATCH] ci(deps): bump the github-actions group with 3 updates
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

actions/checkout v4 -> v7, actions/setup-node v4 -> v7 and
pnpm/action-setup v4 -> v6.

Also bumps the two pins in .github/actions/setup-workspace, which
dependabot's github-actions updater never proposed: `directory: /`
scans .github/workflows only, so a composite action's own `uses:`
lines are invisible to it. Left alone they would have kept the repo
on setup-node v4 in every lane that goes through the composite —
which is every lane except the checkout steps themselves.
---
 .github/actions/setup-workspace/action.yml | 4 ++--
 .github/workflows/checks.yml               | 4 ++--
 .github/workflows/publish.yml              | 6 +++---
 .github/workflows/release.yml              | 6 +++---
 4 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/.github/actions/setup-workspace/action.yml b/.github/actions/setup-workspace/action.yml
index 8d3b61e..0b37422 100644
--- a/.github/actions/setup-workspace/action.yml
+++ b/.github/actions/setup-workspace/action.yml
@@ -13,9 +13,9 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: pnpm/action-setup@v4
+    - uses: pnpm/action-setup@v6
 
-    - uses: actions/setup-node@v4
+    - uses: actions/setup-node@v7
       with:
         node-version-file: ${{ inputs.node-version-file }}
         cache: pnpm
diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index 6110a86..700d26f 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -23,7 +23,7 @@ jobs:
     if: github.event_name == 'workflow_dispatch' || github.event.pull_request.draft == false
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           # turbo --affected diffs against the PR base; it needs full history.
           fetch-depth: 0
@@ -61,7 +61,7 @@ jobs:
     if: github.event_name == 'pull_request' && github.event.pull_request.draft == false
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 9a81037..b22f877 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -43,15 +43,15 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v6
 
       # Not the setup-workspace composite: this job needs registry-url, which
       # is what writes the .npmrc that NODE_AUTH_TOKEN binds to.
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version-file: .nvmrc
           cache: pnpm
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 30cee67..d85816c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -21,11 +21,11 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v6
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version-file: .nvmrc
           cache: pnpm