chore(deps): update github actions

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
SonarSource/sonarqube-scan-action	action	minor	v8.1.0 → v8.2.0
actions/checkout	action	patch	v6.0.2 → v6.0.3	v7.0.0 (+1)
anthropics/claude-code-action	action	patch	v1.0.133 → v1.0.148	v1.0.159 (+10)
codecov/codecov-action	action	major	v6.0.1 → v7.0.0
github/codeql-action	action	patch	v4.36.0 → v4.36.2
jdx/mise-action	action	minor	v4.0.1 → v4.1.0	v4.2.0
suzuki-shunsuke/pinact-action	action	major	v2.0.0 → v3.0.0

---

Release Notes

SonarSource/sonarqube-scan-action (SonarSource/sonarqube-scan-action)

v8.2.0

Compare Source

What's Changed

• SQSCANGHA-149 Add scannerBinariesAuthHeader input by @​henryju in #​246
• SQSCANGHA-88 Deprecate the SONARCLOUD_URL env variable support by @​henryju in #​249
• SQSCANGHA-84 Remove outdated wget/curl references by @​henryju in #​248
• SQSCANGHA-135 Fix scanner binaries always re-downloaded due to incompatible 4-part version by @​henryju in #​250
• SQSCANGHA-127 Rename downloaded file to .zip before extraction on Windows by @​henryju in #​251

Full Changelog: SonarSource/sonarqube-scan-action@v8...v8.2.0

v8.2

Compare Source

actions/checkout (actions/checkout)

v6.0.3

Compare Source

• Fix checkout init for SHA-256 repositories by @​yaananth in #​2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in #​2414

anthropics/claude-code-action (anthropics/claude-code-action)

v1.0.148

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.148

v1.0.147

Compare Source

What's Changed

• Add pr-stamp-sweep review workflow by @​ashwin-ant in #​1409

Full Changelog: anthropics/claude-code-action@v1...v1.0.147

v1.0.146

Compare Source

What's Changed

• test: add unit tests for parseGitHubContext and context type guards by @​mateuscmtropical in #​1404
• docs(faq): correct rebase FAQ to match actual behavior by @​bymle in #​1370
• fix: fall back to inherited env for auth when inputs are empty by @​kirsanium in #​1342
• fix: break SDK iterator after result message to prevent hang in pull_request runs by @​scobbe in #​1339
• Pin setup-bun binary for post-steps by @​kiwigitops in #​1365
• fix: clear stale claude-prompts dir before each write by @​kyungilpark in #​1288
• Include labels in formatContext() output for issues and PRs by @​joshpayne-joby in #​1298
• fix(sanitizer): match attribute quotes by type to avoid mangling content by @​bymle in #​1371
• docs: fix execution file parsing example by @​looooown2006 in #​1297
• fix(image-downloader): detect image type from magic bytes, not URL extension by @​pmespresso in #​1396

New Contributors

• @​mateuscmtropical made their first contribution in #​1404
• @​bymle made their first contribution in #​1370
• @​kirsanium made their first contribution in #​1342
• @​scobbe made their first contribution in #​1339
• @​kiwigitops made their first contribution in #​1365
• @​kyungilpark made their first contribution in #​1288
• @​joshpayne-joby made their first contribution in #​1298
• @​looooown2006 made their first contribution in #​1297
• @​pmespresso made their first contribution in #​1396

Full Changelog: anthropics/claude-code-action@v1...v1.0.146

v1.0.145

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.145

v1.0.144

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.144

v1.0.143

Compare Source

What's Changed

• Drop --tsconfig-override from Bun invocations to avoid runtime crash by @​chsmc-ant in #​1315

New Contributors

• @​chsmc-ant made their first contribution in #​1315

Full Changelog: anthropics/claude-code-action@v1...v1.0.143

v1.0.142

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.142

v1.0.141

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.141

v1.0.140

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.140

v1.0.139

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.139

v1.0.138

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.138

v1.0.137

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.137

v1.0.136

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.136

v1.0.135

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.135

v1.0.134

Compare Source

What's Changed

• Add workload identity federation support to base-action by @​ashwin-ant in #​1378
• chore: bump actions/setup-node from v4.4.0 to v6.4.0 (Node.js 24) by @​ant-kurt in #​1377
• ci: bump checkout and setup-bun in test workflows to Node 24 releases by @​ant-kurt in #​1379

New Contributors

• @​ant-kurt made their first contribution in #​1377

Full Changelog: anthropics/claude-code-action@v1...v1.0.134

codecov/codecov-action (codecov/codecov-action)

v7.0.0

Compare Source

⚠️ Due to migration issues with keybase, we are unable to update our keys under the codecovsecurity account. We have deleted the account and are using codecovsecops with the original gpg key

What's Changed

• ci: remove Enforce License Compliance workflow by @​thomasrockhu-codecov in #​1950
• chore(release): 7.0.0 by @​thomasrockhu-codecov in #​1957

Full Changelog: codecov/codecov-action@v6.0.1...v7.0.0

v7

Compare Source

v6.0.2

Compare Source

This is a copy of the v7.0.0 release to make updates easier

What's Changed

• ci: remove Enforce License Compliance workflow by @​thomasrockhu-codecov in #​1950
• chore(release): 7.0.0 by @​thomasrockhu-codecov in #​1957

Full Changelog: codecov/codecov-action@v6.0.1...v6.0.2

github/codeql-action (github/codeql-action)

v4.36.2

Compare Source

• Cache CodeQL CLI version information across Actions steps. #​3943
• Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #​3937
• Update default CodeQL bundle version to 2.25.6. #​3948

v4.36.1

Compare Source

No user facing changes.

jdx/mise-action (jdx/mise-action)

v4.1.0: : automatic --locked installs

Compare Source

This release adds automatic locked installs when a mise.lock is present, and fixes a long-standing cache-key collision that could poison tool installs when workflows migrate between runner providers.

Added

Automatic --locked install when mise.lock exists (#​495) by @​zeitlinger

When a repo contains mise.lock, the action now automatically passes --locked to mise install (on mise versions that support it). This removes the need to manually set install_args: --locked and prevents mise install from silently mutating the lockfile in CI. Explicit install_args and older mise versions are still respected.

Note: workflows with a stale lockfile may now fail earlier and more explicitly instead of silently updating mise.lock mid-run — this surfaces lockfile drift rather than hiding it.

Fixed

• Cache key collisions across runner providers (#​456) — the default cache key now includes the runner image (e.g. macos15, ubuntu24 for GitHub-hosted runners; self-hosted otherwise). Previously, repos migrating between providers like github-hosted, namespace.so, BuildJet, and self-hosted runners with the same OS/arch could restore a peer provider's ~/.local/share/mise/installs/*, causing failures like does not have an executable named '…' or SIGILL crashes from binaries built against a different glibc/CPU featureset. Expect a one-time cache miss after upgrading; thereafter the cache stays scoped per image.
• mise-shim.exe missing on Windows (#​476) by @​risu729 — the action now installs mise-shim.exe alongside mise.exe and repairs restored caches that lack the shim. Fixes #​475.

Changed

• Migrated the bundled action build from ncc (CommonJS) to Rollup (ESM) (#​436). No user-facing behavior change.

Full Changelog: jdx/mise-action@v4.0.1...v4.1.0

suzuki-shunsuke/pinact-action (suzuki-shunsuke/pinact-action)

v3.0.0

Compare Source

Issues | Pull Requests | suzuki-shunsuke/pinact-action@v2.0.0...v3.0.0 | Base revision

This release is largely driven by the update to pinact v4.0.0.
Please also refer to the pinact v4.0.0 release notes.

⚠️ Breaking Changes

#​1065 Upgrade pinact to v4.0.0
#​1065 Behavior change when skip_push: true

Behavior change when skip_push: true

Previously, this was equivalent to a -check mode. It has been changed to
simply skip committing.
By default, a commit is created.

With skip_push: true, fix: true, the code is fixed but not committed.
A subsequent step can create the commit on its own.
This is useful when you want to bundle the pinact changes with other
modifications into a single commit.

With skip_push: true, fix: false, validation is performed just like the
previous skip_push: true behavior.

Features

#​1065 Added inputs to support more pinact options

• files: lets you specify target files (positional arguments of pinact run)
• fix (--fix option)
• no_api (--no-api option)
• verify_min_age (--verify-min-age option)
• branch_to_tags (--branch-to-tags option)
• config (--config option)
• diff_file (--diff-file option)

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud