deps(actions): bump the actions group across 1 directory with 6 updates

.github/workflows/cd-main.yml

@@ -35,15 +35,15 @@ jobs:
         with:
           fetch-depth: 0
 
-      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v3
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v3
       - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build and push
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v6
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v6
         with:
           context: .
           file: docker/Dockerfile.daemon

.github/workflows/ci.yml

@@ -78,7 +78,7 @@ jobs:
           fi
 
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v5
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v5
         if: github.event_name == 'push' || github.repository == 'rpuneet/mycel'
         with:
           files: coverage.out
@@ -245,7 +245,7 @@ jobs:
           # can remove; alerting on them is permanent noise.
           ignore-unfixed: true
       - name: Upload SARIF
-        uses: github/codeql-action/upload-sarif@v4.37.3
+        uses: github/codeql-action/upload-sarif@v4.38.1
         if: always()
         with:
           sarif_file: trivy-results.sarif

.github/workflows/pages.yml

@@ -53,4 +53,4 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
       - id: deployment
-        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1

.github/workflows/release.yml

@@ -196,7 +196,7 @@ jobs:
           cd dist && shasum -a 256 *.tar.gz > checksums-macos.txt
 
       - name: Upload to release
-        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v2
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v2
         with:
           tag_name: ${{ needs.prepare.outputs.tag }}
           files: |
@@ -400,7 +400,7 @@ jobs:
           esac
 
       - name: Upload to release
-        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v2
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v2
         with:
           tag_name: ${{ needs.prepare.outputs.tag }}
           files: dist/mycel-desktop_*
@@ -512,7 +512,7 @@ jobs:
           cat ../checksums-desktop.txt
 
       - name: Upload to release
-        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v2
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v2
         with:
           tag_name: ${{ needs.prepare.outputs.tag }}
           files: checksums-desktop.txt
@@ -535,7 +535,7 @@ jobs:
           output-file: sbom.spdx.json
 
       - name: Upload SBOM to release
-        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v2
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v2
         with:
           tag_name: ${{ needs.prepare.outputs.tag }}
           files: sbom.spdx.json

.github/workflows/security-nightly.yml

@@ -45,11 +45,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: github/codeql-action/init@v4.37.4
+      - uses: github/codeql-action/init@v4.38.1
         with:
           languages: go
-      - uses: github/codeql-action/autobuild@v4.37.4
-      - uses: github/codeql-action/analyze@v4.37.4
+      - uses: github/codeql-action/autobuild@v4.38.1
+      - uses: github/codeql-action/analyze@v4.38.1
         with:
           category: /language:go
 
@@ -72,7 +72,7 @@ jobs:
           # ones, and skip unfixed-upstream CVEs that no rebuild can remove.
           ignore-unfixed: true
       - name: Upload SARIF
-        uses: github/codeql-action/upload-sarif@v4.37.4
+        uses: github/codeql-action/upload-sarif@v4.38.1
         if: always()
         with:
           sarif_file: trivy-results.sarif