chore(deps): update github actions

.github/actions/setup-node-pnpm/action.yml

@@ -24,7 +24,7 @@ runs:
     using: "composite"
     steps:
         - name: Install pnpm
-          uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
+          uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
           with:
               version: ${{ inputs.pnpm-version }}
         - name: Get pnpm store directory
@@ -39,7 +39,7 @@ runs:
               restore-keys: |
                   ${{ runner.os }}-pnpm-store-
         - name: Setup Node.js
-          uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+          uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
           with:
               node-version: ${{ inputs.node-version }}
         - name: Install dependencies

.github/workflows/cli-release.yml

@@ -198,7 +198,7 @@ jobs:
                   rm -rf "$VERIFY_DIR"
 
             - name: Upload artifact
-              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+              uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
               with:
                   name: cli-${{ matrix.platform }}
                   path: |
@@ -230,7 +230,7 @@ jobs:
                   echo "tag=cli-v$VERSION" >> $GITHUB_OUTPUT
 
             - name: Download all artifacts
-              uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+              uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
               with:
                   path: artifacts
 
@@ -376,7 +376,7 @@ jobs:
 
         steps:
             - name: Download all artifacts
-              uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+              uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
               with:
                   path: artifacts
 

.github/workflows/code-qa.yml

@@ -133,7 +133,7 @@ jobs:
             - name: Package extension
               run: pnpm --filter ./src vsix
             - name: Upload test VSIX
-              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+              uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
               with:
                   name: zoo-code-vsix-pr-${{ github.event.pull_request.number }}
                   path: bin/*.vsix
@@ -246,7 +246,7 @@ jobs:
             # See https://docs.codecov.com/docs/flags
             - name: Upload non-core coverage to Codecov
               if: matrix.collect-coverage
-              uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+              uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
               with:
                   files: >-
                       src/coverage/merged/lcov.info,
@@ -258,31 +258,31 @@ jobs:
                   token: ${{ secrets.CODECOV_TOKEN }}
             - name: Upload webview JSDOM coverage to Codecov
               if: matrix.collect-coverage
-              uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+              uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
               with:
                   files: webview-ui/coverage/lcov.info
                   disable_search: true
                   flags: webview-ui
                   token: ${{ secrets.CODECOV_TOKEN }}
             - name: Upload core unit coverage to Codecov
               if: matrix.collect-coverage
-              uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+              uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
               with:
                   files: packages/core/coverage/unit/lcov.info
                   disable_search: true
                   flags: ${{ matrix.codecov-flag }},core-unit
                   token: ${{ secrets.CODECOV_TOKEN }}
             - name: Upload core integration coverage to Codecov
               if: matrix.collect-coverage
-              uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+              uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
               with:
                   files: packages/core/coverage/integration/lcov.info
                   disable_search: true
                   flags: ${{ matrix.codecov-flag }},core-integration
                   token: ${{ secrets.CODECOV_TOKEN }}
             - name: Upload coverage reports to GitHub
               if: matrix.collect-coverage
-              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+              uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
               with:
                   name: coverage-reports-${{ matrix.name }}
                   path: |

.github/workflows/codeql.yml

@@ -52,7 +52,7 @@ jobs:
 
             # Initializes the CodeQL tools for scanning.
             - name: Initialize CodeQL
-              uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+              uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
               with:
                   languages: ${{ matrix.language }}
                   build-mode: ${{ matrix.build-mode }}
@@ -80,6 +80,6 @@ jobs:
                   exit 1
 
             - name: Perform CodeQL Analysis
-              uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+              uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
               with:
                   category: "/language:${{matrix.language}}"

.github/workflows/mutation-testing.yml

@@ -58,7 +58,7 @@ jobs:
               id: mutation_report
               if: always() && github.event_name == 'pull_request'
               continue-on-error: true
-              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+              uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
               with:
                   name: changed-code-mutation-report
                   path: reports/mutation/

.github/workflows/solheim-provider-smoke.yml

@@ -67,7 +67,7 @@ jobs:
             # is missing, so metadata and video are uploaded separately.
             - name: Upload provider smoke verdict and trace
               if: ${{ !cancelled() && (steps.provider.outcome == 'success' || steps.provider.outcome == 'failure') }}
-              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+              uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
               with:
                   name: solheim-provider-smoke-${{ github.sha }}
                   path: |
@@ -80,7 +80,7 @@ jobs:
             # file behind, so a failed upload here reports the missing recording.
             - name: Upload provider smoke recording
               if: ${{ !cancelled() && (steps.provider.outcome == 'success' || steps.provider.outcome == 'failure') }}
-              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+              uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
               with:
                   name: solheim-provider-smoke-recording-${{ github.sha }}
                   path: ${{ runner.temp }}/solheim-provider-smoke/smoke.mp4

.github/workflows/visual-regression.yml

@@ -34,7 +34,7 @@ jobs:
         runs-on: ubuntu-latest
         timeout-minutes: 10
         container:
-            image: mcr.microsoft.com/playwright:v1.62.1-noble@sha256:dcc5531e97840b9b5e794f2814476b21571c5124a3fca2267d73041f56e7580e
+            image: mcr.microsoft.com/playwright:v1.64.1-noble@sha256:47b510dd9230bf0b9bfc9b20102241e577ea7a99334ab4c3ca19f19770e9b8ea
             options: --ipc=host
         steps:
             - name: Checkout code
@@ -49,15 +49,15 @@ jobs:
               run: pnpm --filter @roo-code/vscode-webview test:visual
             - name: Upload visual test coverage to Codecov
               if: always()
-              uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+              uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
               with:
                   files: webview-ui/coverage-ct/lcov.info
                   disable_search: true
                   flags: webview-ui-ct
                   token: ${{ secrets.CODECOV_TOKEN }}
             - name: Upload visual test artifacts
               if: failure()
-              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+              uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
               with:
                   name: webview-visual-regression
                   path: |
@@ -98,7 +98,7 @@ jobs:
         runs-on: ubuntu-latest
         timeout-minutes: 20
         container:
-            image: mcr.microsoft.com/playwright:v1.62.1-noble@sha256:dcc5531e97840b9b5e794f2814476b21571c5124a3fca2267d73041f56e7580e
+            image: mcr.microsoft.com/playwright:v1.64.1-noble@sha256:47b510dd9230bf0b9bfc9b20102241e577ea7a99334ab4c3ca19f19770e9b8ea
             options: --ipc=host
         env:
             LANG: en_US.UTF-8
@@ -127,7 +127,7 @@ jobs:
               run: xvfb-run -a pnpm --filter @roo-code/vscode-e2e test:visual:electron
             - name: Upload Extension Host visual artifacts
               if: failure()
-              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+              uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
               with:
                   name: extension-host-visual-regression
                   path: |