chore(deps): update github actions

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
actions/checkout	action	patch	v6.0.2 → v6.0.3	v7.0.0 (+1)
anthropics/claude-code-action	action	patch	v1.0.133 → v1.0.137	v1.0.152 (+14)
github/codeql-action	action	patch	v4.36.0 → v4.36.2
jdx/mise-action	action	minor	v4.0.1 → v4.1.0	v4.2.0
suzuki-shunsuke/pinact-action	action	major	v2.0.0 → v3.0.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

actions/checkout (actions/checkout)

v6.0.3

Compare Source

• Fix checkout init for SHA-256 repositories by @​yaananth in #​2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in #​2414

anthropics/claude-code-action (anthropics/claude-code-action)

v1.0.137

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.137

v1.0.136

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.136

v1.0.135

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.135

v1.0.134

Compare Source

What's Changed

• Add workload identity federation support to base-action by @​ashwin-ant in #​1378
• chore: bump actions/setup-node from v4.4.0 to v6.4.0 (Node.js 24) by @​ant-kurt in #​1377
• ci: bump checkout and setup-bun in test workflows to Node 24 releases by @​ant-kurt in #​1379

New Contributors

• @​ant-kurt made their first contribution in #​1377

Full Changelog: anthropics/claude-code-action@v1...v1.0.134

github/codeql-action (github/codeql-action)

v4.36.2

Compare Source

• Cache CodeQL CLI version information across Actions steps. #​3943
• Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #​3937
• Update default CodeQL bundle version to 2.25.6. #​3948

v4.36.1

Compare Source

No user facing changes.

jdx/mise-action (jdx/mise-action)

v4.1.0: : automatic --locked installs

Compare Source

This release adds automatic locked installs when a mise.lock is present, and fixes a long-standing cache-key collision that could poison tool installs when workflows migrate between runner providers.

Added

Automatic --locked install when mise.lock exists (#​495) by @​zeitlinger

When a repo contains mise.lock, the action now automatically passes --locked to mise install (on mise versions that support it). This removes the need to manually set install_args: --locked and prevents mise install from silently mutating the lockfile in CI. Explicit install_args and older mise versions are still respected.

Note: workflows with a stale lockfile may now fail earlier and more explicitly instead of silently updating mise.lock mid-run — this surfaces lockfile drift rather than hiding it.

Fixed

• Cache key collisions across runner providers (#​456) — the default cache key now includes the runner image (e.g. macos15, ubuntu24 for GitHub-hosted runners; self-hosted otherwise). Previously, repos migrating between providers like github-hosted, namespace.so, BuildJet, and self-hosted runners with the same OS/arch could restore a peer provider's ~/.local/share/mise/installs/*, causing failures like does not have an executable named '…' or SIGILL crashes from binaries built against a different glibc/CPU featureset. Expect a one-time cache miss after upgrading; thereafter the cache stays scoped per image.
• mise-shim.exe missing on Windows (#​476) by @​risu729 — the action now installs mise-shim.exe alongside mise.exe and repairs restored caches that lack the shim. Fixes #​475.

Changed

• Migrated the bundled action build from ncc (CommonJS) to Rollup (ESM) (#​436). No user-facing behavior change.

Full Changelog: jdx/mise-action@v4.0.1...v4.1.0

suzuki-shunsuke/pinact-action (suzuki-shunsuke/pinact-action)

v3.0.0

Compare Source

Issues | Pull Requests | suzuki-shunsuke/pinact-action@v2.0.0...v3.0.0 | Base revision

This release is largely driven by the update to pinact v4.0.0.
Please also refer to the pinact v4.0.0 release notes.

⚠️ Breaking Changes

#​1065 Upgrade pinact to v4.0.0
#​1065 Behavior change when skip_push: true

Behavior change when skip_push: true

Previously, this was equivalent to a -check mode. It has been changed to
simply skip committing.
By default, a commit is created.

With skip_push: true, fix: true, the code is fixed but not committed.
A subsequent step can create the commit on its own.
This is useful when you want to bundle the pinact changes with other
modifications into a single commit.

With skip_push: true, fix: false, validation is performed just like the
previous skip_push: true behavior.

Features

#​1065 Added inputs to support more pinact options

• files: lets you specify target files (positional arguments of pinact run)
• fix (--fix option)
• no_api (--no-api option)
• verify_min_age (--verify-min-age option)
• branch_to_tags (--branch-to-tags option)
• config (--config option)
• diff_file (--diff-file option)

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud