Bump the actions group across 1 directory with 4 updates

.github/workflows/ci.yml

@@ -94,8 +94,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: DeterminateSystems/determinate-nix-action@668647a33843b1f280cb2ef4c41736f86b29f826 # v3.22.1
-      - uses: DeterminateSystems/flakehub-cache-action@9ad836c31b7e8f416874ca582bf19b71cee755d0 # main 2026-07
+      - uses: DeterminateSystems/determinate-nix-action@021c8a1bd3570eb21f5c20a054812b0c4d9ca614 # v3.22.3
+      - uses: DeterminateSystems/flakehub-cache-action@e80fccc9c4e3a885ad51721c8b92ba3f839d2f6f # main 2026-07
       - run: nix flake check -L
 
   # flake check builds only checks.* ("build skipped" for packages), so the
@@ -109,8 +109,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: DeterminateSystems/determinate-nix-action@668647a33843b1f280cb2ef4c41736f86b29f826 # v3.22.1
-      - uses: DeterminateSystems/flakehub-cache-action@9ad836c31b7e8f416874ca582bf19b71cee755d0 # main 2026-07
+      - uses: DeterminateSystems/determinate-nix-action@021c8a1bd3570eb21f5c20a054812b0c4d9ca614 # v3.22.3
+      - uses: DeterminateSystems/flakehub-cache-action@e80fccc9c4e3a885ad51721c8b92ba3f839d2f6f # main 2026-07
       - run: nix build .#default -L
 
   # The devenv environment (devenv.nix, the flake devShell's twin) must keep
@@ -130,8 +130,8 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
       - run: bun scripts/sync-devenv-lock.ts --check
-      - uses: DeterminateSystems/determinate-nix-action@668647a33843b1f280cb2ef4c41736f86b29f826 # v3.22.1
-      - uses: DeterminateSystems/flakehub-cache-action@9ad836c31b7e8f416874ca582bf19b71cee755d0 # main 2026-07
+      - uses: DeterminateSystems/determinate-nix-action@021c8a1bd3570eb21f5c20a054812b0c4d9ca614 # v3.22.3
+      - uses: DeterminateSystems/flakehub-cache-action@e80fccc9c4e3a885ad51721c8b92ba3f839d2f6f # main 2026-07
       - run: nix run "github:NixOS/nixpkgs/$(jq -r '.nodes[.nodes[.root].inputs.nixpkgs].locked.rev' flake.lock)#devenv" -- test
 
   # Coverage, OUTSIDE the sandbox so the real-nix integration tests
@@ -150,8 +150,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: DeterminateSystems/determinate-nix-action@668647a33843b1f280cb2ef4c41736f86b29f826 # v3.22.1
-      - uses: DeterminateSystems/flakehub-cache-action@9ad836c31b7e8f416874ca582bf19b71cee755d0 # main 2026-07
+      - uses: DeterminateSystems/determinate-nix-action@021c8a1bd3570eb21f5c20a054812b0c4d9ca614 # v3.22.3
+      - uses: DeterminateSystems/flakehub-cache-action@e80fccc9c4e3a885ad51721c8b92ba3f839d2f6f # main 2026-07
       # rust-cache derives its key partly from the rustc it can see on PATH —
       # which here is the runner's preinstalled toolchain, not the devShell's.
       # The cargo below runs under `nix develop`, so the artifacts are built by

.github/workflows/flakehub-publish.yml

@@ -34,13 +34,13 @@ jobs:
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: DeterminateSystems/determinate-nix-action@668647a33843b1f280cb2ef4c41736f86b29f826 # v3.22.1
+      - uses: DeterminateSystems/determinate-nix-action@021c8a1bd3570eb21f5c20a054812b0c4d9ca614 # v3.22.3
 
-      - uses: DeterminateSystems/flakehub-cache-action@9ad836c31b7e8f416874ca582bf19b71cee755d0 # main 2026-07
+      - uses: DeterminateSystems/flakehub-cache-action@e80fccc9c4e3a885ad51721c8b92ba3f839d2f6f # main 2026-07
 
       - run: nix build .#default -L
 
-      - uses: DeterminateSystems/flakehub-push@f960928265d16ba43227dfd48812a8b1de17a441 # main 2026-07
+      - uses: DeterminateSystems/flakehub-push@e001ee821cdb763ef120c01f1048bfb2f938bb9c # main 2026-07
         with:
           visibility: public
           include-output-paths: true

.github/workflows/pages.yml

@@ -34,8 +34,8 @@ jobs:
       # The export shells out to nix for the manifest + source resolution;
       # Determinate Nix + FlakeHub cache also make `nix run .#` cheap (the
       # binary and its dep layer come from the cache pushed by CI).
-      - uses: DeterminateSystems/determinate-nix-action@668647a33843b1f280cb2ef4c41736f86b29f826 # v3.22.1
-      - uses: DeterminateSystems/flakehub-cache-action@9ad836c31b7e8f416874ca582bf19b71cee755d0 # main 2026-07
+      - uses: DeterminateSystems/determinate-nix-action@021c8a1bd3570eb21f5c20a054812b0c4d9ca614 # v3.22.3
+      - uses: DeterminateSystems/flakehub-cache-action@e80fccc9c4e3a885ad51721c8b92ba3f839d2f6f # main 2026-07
       - run: bun install --frozen-lockfile
       # This flake has no nixos/darwin configurations, so --all/--sources all
       # cost nothing today; they keep the demo complete if that changes.
@@ -67,4 +67,4 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
       - id: deployment
-        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1

.github/workflows/update-locks.yml

@@ -33,7 +33,7 @@ jobs:
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: DeterminateSystems/determinate-nix-action@668647a33843b1f280cb2ef4c41736f86b29f826 # v3.22.1
+      - uses: DeterminateSystems/determinate-nix-action@021c8a1bd3570eb21f5c20a054812b0c4d9ca614 # v3.22.3
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
       - run: nix flake update
       # The devenv CLI comes from the freshly locked nixpkgs rev — the same