chore(ci): refresh verified GitHub Actions

[Pal Lakatos-Toth (pallakatos)]

Summary

Consolidates five individually-green Dependabot updates against current main and corrects every full-SHA version comment:

• docker/setup-buildx-action v3.6.1 → v4.3.0 (build(deps): bump docker/setup-buildx-action from 3.6.1 to 4.3.0 #502)
• actions/checkout v4.2.2 → v7.0.1 (build(deps): bump actions/checkout from 4.2.2 to 7.0.1 #503)
• actions/attest-build-provenance v4.1.0 → v4.2.2 (build(deps): bump actions/attest-build-provenance from 4.1.0 to 4.2.2 #504)
• actions/setup-python v5/v6 → v7.0.0 (build(deps): bump actions/setup-python from 5.6.0 to 7.0.0 #505)
• actions/download-artifact v4.3.0 → v8.0.1 (build(deps): bump actions/download-artifact from 4.3.0 to 8.0.1 #507)

Supply-chain verification

Every action remains full-SHA pinned; every SHA was independently verified against its exact upstream tag. All 46 checkout and 11 buildx comments now match their actual versions, no old SHAs remain, and all 14 changed workflows parse without conflict markers.

Kars uses only supported inputs. All runners are GitHub-hosted and satisfy the Node 24 runner requirement. Download-artifact v8 now fails closed on digest mismatch instead of warning.

Evidence

• each source PR passed 33 checks plus one neutral skip
• independent supply-chain/compatibility review found no significant issue
• release-only workflows are not exercised by PR CI; their first run will intentionally fail closed on any artifact digest mismatch

Supersedes #502, #503, #504, #505, and #507 after merge.

[Pal Lakatos-Toth (pallakatos)]

Temporarily closing and reopening to retrigger repository pull_request workflows; only dynamic CodeQL registered on the initial events despite valid workflow YAML.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
actions/actions/checkout	3d3c42e5aac5ba805825da76410c181273ba90b1	🟢 7	Details Check Score Reason Maintained 🟢 10 24 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Code-Review 🟢 10 all changesets reviewed Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed Packaging ⚠️ -1 packaging workflow not detected License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 Security-Policy 🟢 9 security policy file detected SAST 🟢 10 SAST tool is run on all commits Branch-Protection 🟢 6 branch protection is not maximal on development and all release branches
actions/actions/checkout	3d3c42e5aac5ba805825da76410c181273ba90b1	🟢 7	Details Check Score Reason Maintained 🟢 10 24 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Code-Review 🟢 10 all changesets reviewed Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed Packaging ⚠️ -1 packaging workflow not detected License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 Security-Policy 🟢 9 security policy file detected SAST 🟢 10 SAST tool is run on all commits Branch-Protection 🟢 6 branch protection is not maximal on development and all release branches
actions/actions/download-artifact	3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c	🟢 5.1	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained ⚠️ 0 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected SAST 🟢 10 SAST tool is run on all commits Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches
actions/docker/setup-buildx-action	37fe631027851001ddb9b187196cc803df7f5f0e	🟢 8.6	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10 Security-Policy 🟢 9 security policy file detected Binary-Artifacts 🟢 10 no binaries found in the repo Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration Signed-Releases ⚠️ -1 no releases found Packaging 🟢 10 packaging workflow detected Pinned-Dependencies 🟢 7 dependency not pinned by hash detected -- score normalized to 7 SAST 🟢 10 SAST tool is run on all commits
actions/actions/checkout	3d3c42e5aac5ba805825da76410c181273ba90b1	🟢 7	Details Check Score Reason Maintained 🟢 10 24 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Code-Review 🟢 10 all changesets reviewed Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed Packaging ⚠️ -1 packaging workflow not detected License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 Security-Policy 🟢 9 security policy file detected SAST 🟢 10 SAST tool is run on all commits Branch-Protection 🟢 6 branch protection is not maximal on development and all release branches

Scanned Files

• .github/workflows/codeql.yml
• .github/workflows/release-internal.yml
• .github/workflows/secret-scanning.yml