chore(deps): bump the actions group with 4 updates

.github/workflows/apply-workflow-pins.yml

@@ -56,7 +56,7 @@ jobs:
     timeout-minutes: 60
     steps:
       - name: Harden runner (egress audit)
-        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
         with:
           egress-policy: audit
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -150,7 +150,7 @@ jobs:
 
       - name: Upload the census
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: workflow-pin-census
           path: census.tsv

.github/workflows/dependabot-lock-regen.yml

@@ -41,7 +41,7 @@ jobs:
     timeout-minutes: 60
     steps:
       - name: Harden runner (egress audit)
-        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
         with:
           egress-policy: audit
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

.github/workflows/echidna-verify.yml

@@ -150,7 +150,7 @@ jobs:
 
       - name: Upload log
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: agda-verify-log
           path: agda-verify.log
@@ -230,7 +230,7 @@ jobs:
 
       - name: Upload log
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: idris2-avow-log
           path: idris2-avow.log

.github/workflows/hypatia-scan-reusable.yml

@@ -285,7 +285,7 @@ jobs:
           fi
 
       - name: Upload findings artifacts
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: hypatia-scan-findings
           path: |

.github/workflows/lockfile-drift-detect.yml

@@ -50,7 +50,7 @@ jobs:
     timeout-minutes: 45
     steps:
       - name: Harden runner (egress audit)
-        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
         with:
           egress-policy: audit
       - name: Checkout standards (for the checker script)
@@ -127,7 +127,7 @@ jobs:
 
       - name: Upload report
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
         with:
           name: lockfile-drift-report
           path: drift-report.tsv

.github/workflows/mirror-reusable.yml

@@ -408,7 +408,7 @@ jobs:
       # answers "are we configured to actually do it?".
       - name: Setup Rust
         if: ${{ env.RADICLE_KEY != '' }}
-        uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067 # stable
+        uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # stable
         with:
           toolchain: stable
       - name: Install Radicle

.github/workflows/propagate-hooks.yml

@@ -51,7 +51,7 @@ jobs:
 
     steps:
       - name: Harden runner (egress block)
-        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
         with:
           # Runs on a protected-branch push (RE002): block, not audit. This
           # job only talks to GitHub (checkout, the REST API, git transport).
@@ -189,7 +189,7 @@ jobs:
 
     steps:
       - name: Harden runner (egress block)
-        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
         with:
           # Runs on a protected-branch push (RE002): block, not audit. This
           # job only talks to GitHub (checkout, the REST API, git transport).

.github/workflows/rust-ci-reusable.yml

@@ -176,7 +176,7 @@ jobs:
         # `@stable`), but a SHA ref carries no version, so the action's "parse
         # toolchain version" step fails with `'toolchain' is a required input`.
         # See standards estate-wide rust-ci red.
-        uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067 # stable
+        uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # stable
         with:
           toolchain: stable
           components: clippy, rustfmt
@@ -225,7 +225,7 @@ jobs:
 
       - name: Install Rust toolchain
         # `toolchain:` mandatory under SHA pin — see Cargo check job above.
-        uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067 # stable
+        uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # stable
         with:
           toolchain: stable
 
@@ -274,7 +274,7 @@ jobs:
 
       - name: Install Rust toolchain
         # `toolchain:` mandatory under SHA pin — see Cargo check job above.
-        uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067 # stable
+        uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # stable
         with:
           toolchain: stable
 
@@ -310,7 +310,7 @@ jobs:
 
       - name: Install Rust toolchain
         # `toolchain:` mandatory under SHA pin — see Cargo check job above.
-        uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067 # stable
+        uses: dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f # stable
         with:
           toolchain: stable
           components: llvm-tools-preview

.github/workflows/scorecard-enforcer.yml

@@ -34,7 +34,7 @@ jobs:
           results_format: json
           publish_results: true
 
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: scorecard-results
           path: results.json
@@ -45,7 +45,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: scorecard-results
 

.github/workflows/scorecard-reusable.yml

@@ -104,7 +104,7 @@ jobs:
           sarif_file: ${{ steps.select-sarif.outputs.file }}
 
       - name: Upload results artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: scorecard-results
           path: |
@@ -247,7 +247,7 @@ jobs:
         with:
           sarif_file: ${{ steps.select-sarif.outputs.file }}
       - name: Retain scan evidence
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: scorecard-pr-results
           path: |

.github/workflows/settings-drift-detect.yml

@@ -59,7 +59,7 @@ jobs:
     timeout-minutes: 45
     steps:
       - name: Harden runner (egress audit)
-        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
         with:
           egress-policy: audit
       - name: Checkout
@@ -94,7 +94,7 @@ jobs:
 
       - name: Upload report
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: settings-drift
           path: drift.tsv

.github/workflows/signed-push-smoke.yml

@@ -28,7 +28,7 @@ jobs:
       contents: write
     steps:
       - name: Harden runner (egress audit)
-        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
         with:
           egress-policy: audit
       - name: Checkout

.github/workflows/tag-ruleset-canon.yml

@@ -44,7 +44,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Harden runner (egress audit)
-        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
         with:
           egress-policy: audit
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -172,7 +172,7 @@ jobs:
 
       - name: Publish the report
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: tag-ruleset-canon-report
           path: canon-*.tsv