chore(deps): bump the actions group across 1 directory with 8 updates

.github/workflows/auto-rebase.yml

@@ -38,5 +38,5 @@ jobs:
     permissions:
       contents: write      # update-branch via GITHUB_TOKEN (may touch .github/workflows/)
       pull-requests: write # post comments on PRs
-    uses: petry-projects/.github/.github/workflows/auto-rebase-reusable.yml@v1
+    uses: petry-projects/.github/.github/workflows/auto-rebase-reusable.yml@v2
     secrets: inherit

.github/workflows/dependabot-automerge.yml

@@ -35,5 +35,5 @@ jobs:
     permissions:
       contents: read
       pull-requests: read
-    uses: petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml@v1
+    uses: petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml@v2
     secrets: inherit

.github/workflows/dependency-audit.yml

@@ -30,4 +30,4 @@ permissions:
 
 jobs:
   dependency-audit:
-    uses: petry-projects/.github/.github/workflows/dependency-audit-reusable.yml@v1
+    uses: petry-projects/.github/.github/workflows/dependency-audit-reusable.yml@v2

.github/workflows/feature-ideation.yml

@@ -64,7 +64,7 @@ jobs:
       discussions: write
       id-token: write
       actions: read
-    uses: petry-projects/.github/.github/workflows/feature-ideation-reusable.yml@d3d768dabb7f28cc63283cdfe48630da53700e50 # v1
+    uses: petry-projects/.github/.github/workflows/feature-ideation-reusable.yml@376a4fcb1117444595e3e702fa450873d0e54310 # v2
     with:
       # === CUSTOMISE THIS PER REPO — the only required edit ===
       project_context: |

.github/workflows/idea-enhancer.yml

@@ -84,7 +84,7 @@ jobs:
         if: ${{ steps.gather.outputs.count != '0' }}
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        uses: anthropics/claude-code-action@787c5a0ce96a9a6cfb050ea0c8f4c05f2447c251 # v1.0.133
+        uses: anthropics/claude-code-action@d5726de019ec4498aa667642bc3a80fca83aa102 # v1.0.148
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           github_token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/idea-triage.yml

@@ -71,7 +71,7 @@ jobs:
       - name: Rank ripeness and refresh the queue
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        uses: anthropics/claude-code-action@787c5a0ce96a9a6cfb050ea0c8f4c05f2447c251 # v1.0.133
+        uses: anthropics/claude-code-action@d5726de019ec4498aa667642bc3a80fca83aa102 # v1.0.148
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           github_token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/initiative-planner.yml

@@ -89,7 +89,7 @@ jobs:
         id: bob
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        uses: anthropics/claude-code-action@787c5a0ce96a9a6cfb050ea0c8f4c05f2447c251 # v1.0.133
+        uses: anthropics/claude-code-action@d5726de019ec4498aa667642bc3a80fca83aa102 # v1.0.148
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           # CRITICAL (same gotcha as feature-ideation): pass the workflow's

.github/workflows/issue-triage-runner.yml

@@ -19,7 +19,7 @@ jobs:
       result: ${{ steps.run.outputs.result }}
       skip: ${{ steps.run.outputs.skip }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
         with:
           persist-credentials: false
 
@@ -68,7 +68,7 @@ jobs:
       contents: read
       issues: write
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
         with:
           persist-credentials: false
 

.github/workflows/repair-pr-approvals.yml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
 
       - name: Repair PR approvals
         env:

.github/workflows/sonarcloud.yml

@@ -29,7 +29,7 @@ jobs:
           java-version: '21'
       - name: SonarCloud Scan
         if: ${{ env.SONAR_TOKEN != '' }}
-        uses: SonarSource/sonarqube-scan-action@7006c4492b2e0ee0f816d36501671557c97f5995 # v8.1.0
+        uses: SonarSource/sonarqube-scan-action@713881670b6b3676cda39549040e2d88c70d582e # v8.2.0
         with:
           args: >
             -Dsonar.scanner.javaExePath=${{ steps.setup_java.outputs.path }}/bin/java

.github/workflows/test.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
 
       - name: Run copilot_chat tests
         run: bash tests/test_copilot_chat.sh

tests/dev-lead/integration/test_auto_rebase_stub.py

@@ -1,9 +1,9 @@
 #!/usr/bin/env python3
-"""Validate that auto-rebase.yml uses the @v1 version tag, not a SHA.
+"""Validate that auto-rebase.yml uses the @v2 version tag, not a SHA.
 
 AGENTS.md §"Release channel tags & the mutable-ref exception" exempts first-party
 reusable workflows from the SHA-pin standard. The correct reference for the
-auto-rebase reusable is the versioned tag `@v1`, matching the canonical stub at
+auto-rebase reusable is the versioned tag `@v2`, matching the canonical stub at
 standards/workflows/auto-rebase.yml in petry-projects/.github.
 
 Regression guard: a SHA-pinned reference is a compliance violation (issue #139).
@@ -20,7 +20,7 @@
 
 WORKFLOW = ".github/workflows/auto-rebase.yml"
 REUSABLE = "petry-projects/.github/.github/workflows/auto-rebase-reusable.yml"
-EXPECTED_REF = "@v1"
+EXPECTED_REF = "@v2"
 SHA_PATTERN = re.compile(r"@[0-9a-f]{40}\b")
 
 
@@ -63,7 +63,7 @@ def main() -> int:
             failures.append(
                 f"  SHA-pinned: {ref!r}\n"
                 f"  Expected:   '{REUSABLE}{EXPECTED_REF}'\n"
-                "  Reason: first-party reusable workflows must use the @v1 version\n"
+                "  Reason: first-party reusable workflows must use the @v2 version\n"
                 "  tag, not a SHA (AGENTS.md §Release channel tags)."
             )
         elif not ref.endswith(EXPECTED_REF):

tests/dev-lead/integration/test_dependency_audit_stub.py

@@ -1,8 +1,8 @@
 #!/usr/bin/env python3
-"""Validate that dependency-audit.yml is the canonical org stub pinned to @v1.
+"""Validate that dependency-audit.yml is the canonical org stub pinned to @v2.
 
 The org standard requires dependency-audit.yml to be a thin caller stub that
-delegates to the reusable at @v1 (not @v2 or any other ref).
+delegates to the reusable at @v2 (not a SHA or any other ref).
 
 Standard: petry-projects/.github/standards/ci-standards.md#centralization-tiers
 Source of truth: petry-projects/.github/standards/workflows/dependency-audit.yml
@@ -18,7 +18,7 @@
     sys.exit(2)
 
 WORKFLOW = ".github/workflows/dependency-audit.yml"
-EXPECTED_USES = "petry-projects/.github/.github/workflows/dependency-audit-reusable.yml@v1"
+EXPECTED_USES = "petry-projects/.github/.github/workflows/dependency-audit-reusable.yml@v2"
 
 
 def main() -> int:
@@ -53,7 +53,7 @@ def main() -> int:
                 print(
                     f"FAIL: {WORKFLOW} job '{job_key}' uses '{uses}'\n"
                     f"  Expected: '{EXPECTED_USES}'\n"
-                    f"  Fix: replace the `uses:` value with the canonical @v1 ref."
+                    f"  Fix: replace the `uses:` value with the canonical @v2 ref."
                 )
                 return 1