Bump the github-actions group with 4 updates

.github/workflows/build-quick-static-n-1.yml

@@ -28,7 +28,7 @@ jobs:
     steps:
     # ----- Spec-generated loader preamble (loader-head, see loader-integration.yml) -----
     - name: Checkout spec-head
-      uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         clean: true
         fetch-depth: 0
@@ -66,7 +66,7 @@ jobs:
           ghcr.io/oneapi-src/spec-build:latest \
           /opt/spec-venv/bin/python3 ./run.py --debug '--!html' '--!rst' '--!build' --ver $VER
     - name: Checkout loader-head
-      uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         clean: true
         repository: oneapi-src/level-zero
@@ -92,7 +92,7 @@ jobs:
         xargs -I{} cp -v ./{} ../loader-head/{}
     # ----- loader-base: plain loader master, built as-is (n-1 / static side) -----
     - name: Checkout loader-base
-      uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         clean: true
         repository: oneapi-src/level-zero

.github/workflows/build-quick-static.yml

@@ -27,7 +27,7 @@ jobs:
     steps:
     # ----- Spec-generated loader preamble (see loader-integration.yml) -----
     - name: Checkout spec-head
-      uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         clean: true
         fetch-depth: 0
@@ -65,7 +65,7 @@ jobs:
           ghcr.io/oneapi-src/spec-build:latest \
           /opt/spec-venv/bin/python3 ./run.py --debug '--!html' '--!rst' '--!build' --ver $VER
     - name: Checkout loader-head
-      uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         clean: true
         repository: oneapi-src/level-zero

.github/workflows/build-quick.yml

@@ -47,7 +47,7 @@ jobs:
     steps:
     # ----- Spec-generated loader preamble (see loader-integration.yml) -----
     - name: Checkout spec-head
-      uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         clean: true
         fetch-depth: 0
@@ -85,7 +85,7 @@ jobs:
           ghcr.io/oneapi-src/spec-build:latest \
           /opt/spec-venv/bin/python3 ./run.py --debug '--!html' '--!rst' '--!build' --ver $VER
     - name: Checkout loader-head
-      uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         clean: true
         repository: oneapi-src/level-zero

.github/workflows/cleanup-pr-docs.yml

@@ -19,7 +19,7 @@ jobs:
     if: github.repository_owner == 'intel-innersource'
     steps:
       - name: Checkout gh-pages branch
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: gh-pages
           path: gh-pages-repo

.github/workflows/codespell.yml

@@ -42,7 +42,7 @@ jobs:
     runs-on: [self-hosted, Linux]
     if: github.repository_owner == 'intel-innersource'
     steps:
-    - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Run codespell
       # Configuration (skip/ignore lists) is picked up from .codespellrc. A spelling
       # finding must not fail this step: the report has to be published to the PR
@@ -79,7 +79,7 @@ jobs:
         }' codespell.txt
     - name: Post or update PR comment
       if: github.event_name == 'pull_request'
-      uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
       with:
         script: |
           const fs = require('fs');

.github/workflows/deploy-docs.yml

@@ -29,7 +29,7 @@ jobs:
     if: github.repository_owner == 'intel-innersource'
     steps:
       - name: Checkout
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           clean: true
           fetch-depth: 0
@@ -103,7 +103,7 @@ jobs:
       # quote just the actionable lines rather than the whole build log.
       - name: Report documentation warnings
         if: steps.gen_docs.outcome == 'failure'
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
@@ -155,7 +155,7 @@ jobs:
       # doxygen runs -- with the actionable lines saved to docs/rst-errors.log.
       - name: Report reference errors
         if: steps.gen_docs.outcome == 'failure'
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
@@ -303,7 +303,7 @@ jobs:
           echo "Prepared documentation in directory: $DIR_NAME"
 
       - name: Checkout gh-pages branch
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: gh-pages
           path: gh-pages-repo

.github/workflows/loader-integration.yml

@@ -39,14 +39,14 @@ jobs:
         echo "=== Disk ==="
         df -h --output=target,size,used,avail,pcent | grep -E "^Filesystem|^/$|^/home|^/tmp"
     - name: Checkout spec-head
-      uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         clean: true
         fetch-depth: 0
         fetch-tags: true
         path: spec-head
     - name: Checkout spec-base
-      uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         ref: master
         clean: true
@@ -58,7 +58,7 @@ jobs:
       run: echo "sha=$(git -C spec-base rev-parse HEAD)" >> $GITHUB_OUTPUT
     - name: Restore spec-base artifacts cache
       id: cache-spec-base
-      uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: |
           spec-base/docs
@@ -146,7 +146,7 @@ jobs:
       run:  echo 'Artifact URL is ${{ steps.upload-diff-artifact.outputs.artifact-url }}'
     - name: Write comment to PR
       if: steps.include-diff.outputs.diff == '1'
-      uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
       with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
@@ -189,7 +189,7 @@ jobs:
       run:  echo 'RST Artifact URL is ${{ steps.upload-rst-diff-artifact.outputs.artifact-url }}'
     - name: Write RST diff comment to PR
       if: steps.rst-diff.outputs.diff == '1'
-      uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
       with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
@@ -232,7 +232,7 @@ jobs:
       run:  echo 'HTML Artifact URL is ${{ steps.upload-html-diff-artifact.outputs.artifact-url }}'
     - name: Write HTML diff comment to PR
       if: steps.html-diff.outputs.diff == '1'
-      uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
       with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
@@ -255,7 +255,7 @@ jobs:
         retention-days: 30
     - name: Comment with HTML preview info
       if: steps.html-diff.outputs.diff == '1'
-      uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
       with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
@@ -287,7 +287,7 @@ jobs:
               body: body
             });
     - name: Checkout loader-head
-      uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         clean: true
         repository: oneapi-src/level-zero
@@ -299,7 +299,7 @@ jobs:
       # as the cache key for base.dump — so we only rebuild the base when master
       # has actually changed, not on every PR run.
       id: loader-master-sha
-      uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
       with:
         github-token: ${{ secrets.LOADER_INNERSOURCE_TOKEN }}
         script: |
@@ -322,14 +322,14 @@ jobs:
       # Note: save-always is deprecated — saving is handled by the explicit
       # actions/cache/save step at the end of the job using if: always().
       id: cache-base-abi-dump
-      uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: base.dump
         key: base-abi-dump-${{ steps.loader-master-sha.outputs.sha }}
         restore-keys: |
           base-abi-dump-
     - name: Checkout loader-base
-      uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         clean: true
         repository: oneapi-src/level-zero
@@ -385,7 +385,7 @@ jobs:
       run:  echo 'Artifact URL is ${{ steps.upload-loader-diff-artifact.outputs.artifact-url }}'
     - name: Write loader diff comment to PR
       if: steps.loader-source-diff.outputs.diff == '1'
-      uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
       with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
@@ -433,7 +433,7 @@ jobs:
         make -j$(nproc)
         EOF
     - name: Checkout abi-dumper
-      uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         clean: true
         repository: lvc/abi-dumper
@@ -488,7 +488,7 @@ jobs:
 
     - name: Restore abi-compliance-checker cache
       id: cache-acc
-      uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: abi-compliance-checker
         key: abi-compliance-checker-2.3
@@ -560,7 +560,7 @@ jobs:
     - name: Check for reviewer approval of ABI failure
       id: check-approval
       if: steps.abi-check.outcome == 'failure'
-      uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
       with:
         github-token: ${{ secrets.GITHUB_TOKEN }}
         script: |
@@ -592,7 +592,7 @@ jobs:
     - name: Write loader ABI Report comment to PR
       continue-on-error: true
       if: "steps.loader-source-diff.outputs.diff == '1' || steps.include-diff.outputs.diff == '1' || steps.rst-diff.outputs.diff == '1' || steps.html-diff.outputs.diff == '1'"
-      uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
       with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
@@ -616,15 +616,15 @@ jobs:
             });
     - name: Save spec-base artifacts cache
       if: always() && steps.cache-spec-base.outputs.cache-primary-key != '' && steps.cache-spec-base.outputs.cache-hit != 'true'
-      uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+      uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: |
           spec-base/docs
           spec-base/include
         key: ${{ steps.cache-spec-base.outputs.cache-primary-key }}
     - name: Save abi-compliance-checker cache
       if: always() && steps.cache-acc.outputs.cache-primary-key != '' && steps.cache-acc.outputs.cache-hit != 'true'
-      uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+      uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: abi-compliance-checker
         key: ${{ steps.cache-acc.outputs.cache-primary-key }}
@@ -638,7 +638,7 @@ jobs:
       # The hashFiles guard ensures we never cache a missing base.dump under the
       # master-SHA key (which would poison subsequent runs on a false cache hit).
       if: always() && steps.cache-base-abi-dump.outputs.cache-primary-key != '' && steps.cache-base-abi-dump.outputs.cache-hit != 'true' && hashFiles('base.dump') != ''
-      uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+      uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: base.dump
         key: ${{ steps.cache-base-abi-dump.outputs.cache-primary-key }}

.github/workflows/scorecard.yml

@@ -36,7 +36,7 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 

.github/workflows/spec-validate.yml

@@ -42,7 +42,7 @@ jobs:
     if: github.repository_owner == 'intel-innersource'
     steps:
       - name: Checkout
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           clean: true
           # Full history + tags: the spec version is derived from the most recent tag.
@@ -98,7 +98,7 @@ jobs:
 
       - name: Report validation failure
         if: steps.generate.outcome == 'failure'
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
@@ -183,7 +183,7 @@ jobs:
       # PR does not keep showing an obsolete error at the top of the thread.
       - name: Resolve previous failure comment
         if: steps.generate.outcome == 'success' && github.event_name == 'pull_request'
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |