chore: bump action versions in common workflow templates

[adamwalach]

The common workflow templates pin actions/checkout@v2/@v3 and actions/stale@v4, which run on Node runtimes GitHub Actions no longer supports. actionlint (1.7.x) rejects them:

the runner of "actions/checkout@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

Downstream repositories had already been bumped by renovate, but the template sync overwrote those bumps with the older pins from here. In ory/k8s the Aug 28 sync (ory/k8s@6428f395) downgraded checkout@v7 to v2/v3, action-semantic-pull-request@v6 to v4 and stale@v11 to v4, which turned the Validation - GHA Linter workflow and the Lint GithubAction files CI job red on every PR touching .github/**. See ory/k8s#897, which restores the versions locally; this PR fixes the source so the next sync does not reintroduce the downgrade.

Changes, all in templates/repository/common/.github/workflows/:

File	Before	After
closed_references.yml	actions/checkout@v2	actions/checkout@v7
conventional_commits.yml	actions/checkout@v3	actions/checkout@v7
conventional_commits.yml	amannn/action-semantic-pull-request@v4	amannn/action-semantic-pull-request@v6
labels.yml	actions/checkout@v2	actions/checkout@v7
stale.yml	actions/stale@v4	actions/stale@v11

These are the exact versions that were in place in ory/k8s before the sync, so downstream behaviour is unchanged. actionlint 1.7.12 passes on the edited templates.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Maintenance
  • Updated repository automation workflows to use newer versions of their checkout, commit-validation, pull-request validation, and stale-item actions.
  • Existing workflow schedules, triggers, and configuration remain unchanged.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 21294e15-5a9a-4cbd-a632-71195ed695a6

📥 Commits

Reviewing files that changed from the base of the PR and between ab9812b and 3d7133d.

📒 Files selected for processing (4)

• templates/repository/common/.github/workflows/closed_references.yml
• templates/repository/common/.github/workflows/conventional_commits.yml
• templates/repository/common/.github/workflows/labels.yml
• templates/repository/common/.github/workflows/stale.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

Four repository workflow templates update GitHub Actions versions. The workflows retain their existing triggers, jobs, and configuration.

Changes

Workflow Action Version Updates

Layer / File(s)	Summary
Update workflow action versions templates/repository/common/.github/workflows/closed_references.yml, templates/repository/common/.github/workflows/conventional_commits.yml, templates/repository/common/.github/workflows/labels.yml, templates/repository/common/.github/workflows/stale.yml	The templates upgrade actions/checkout, amannn/action-semantic-pull-request, and actions/stale versions.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to 3d713

This updates outdated workflow action versions in shared templates without changing the intended workflow behavior; no actionable merge-blocking risk remains beyond normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: version bumps for GitHub Actions in common workflow templates.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (4 skipped: 4 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/workflow-template-action-versions

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}