chore: upgrade and SHA-pin GitHub Actions dependencies

[cristi-]

Summary

• Upgrade all GitHub Actions to latest versions
• SHA-pin all action references for supply chain security
• Verify all SHAs against upstream repos

🤖 Generated with Claude Code

[greptile-apps]

Greptile Summary

This PR SHA-pins all GitHub Actions workflow dependencies to specific commit hashes and upgrades them to their latest versions, following supply chain security best practices. The changes are purely in CI/CD workflow files with no application code changes.

All SHAs have been verified against their corresponding version tags — golangci/golangci-lint-action notably jumps from v7 to v9.2.0, and both actions/checkout and actions/setup-go upgrade to their v6 major versions.

Confidence Score: 5/5

Safe to merge — all SHA pins verified against upstream tags, no application code changed.

All SHAs were independently verified against their upstream version tags. The only finding is a P2 note about a one-time cache miss from the setup-go v6 cache key change, which has no correctness impact. No blocking issues.

No files require special attention.

Vulnerabilities

SHA-pinning GitHub Actions is a positive supply chain security improvement; all added SHA hashes were verified against their respective upstream version tags. No security regressions were identified.

Important Files Changed

Filename	Overview
.github/workflows/ci.yml	SHA-pinned all actions and upgraded to latest: checkout@v6.0.2, setup-go@v6.4.0, setup-task@v2.0.0, setup-protoc@v3.0.0, golangci-lint-action@v9.2.0; all SHAs verified.
.github/workflows/release.yml	SHA-pinned checkout@v6.0.2, changelog-reader-action@v2.2.3, action-gh-release@v2.6.1; all SHAs verified.
.github/workflows/sync_specs.yaml	SHA-pinned checkout@v6.0.2, update-git-submodules upgraded from v2.1.1 to v2.1.3, setup-go@v6.4.0, setup-task@v2.0.0, setup-protoc@v3.0.0, create-pull-request@v8.1.0; all SHAs verified.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Push / PR Event] --> B{Workflow Triggered}
    B --> C[ci.yml]
    B --> D[release.yml]
    B --> E[sync_specs.yaml]

    C --> C1[build-examples job\ncheckout@v6.0.2\nsetup-go@v6.4.0\nsetup-task@v2.0.0\nsetup-protoc@v3.0.0]
    C --> C2[test job\ncheckout@v6.0.2\nsetup-go@v6.4.0\nsetup-task@v2.0.0\nsetup-protoc@v3.0.0]
    C --> C3[integration job\ncheckout@v6.0.2\nsetup-go@v6.4.0\nsetup-task@v2.0.0\nsetup-protoc@v3.0.0]
    C --> C4[lint job\ncheckout@v6.0.2\nsetup-go@v6.4.0\ngolangci-lint-action@v9.2.0]
    C --> C5[bento-integration job\ncheckout@v6.0.2\nsetup-go@v6.4.0]

    D --> D1[release job\ncheckout@v6.0.2\nchangelog-reader-action@v2.2.3\naction-gh-release@v2.6.1]

    E --> E1[sync job\ncheckout@v6.0.2\nupdate-git-submodules@v2.1.3\nsetup-go@v6.4.0\nsetup-task@v2.0.0\nsetup-protoc@v3.0.0\ncreate-pull-request@v8.1.0]

Loading

Comments Outside Diff (1)

1. .github/workflows/ci.yml, line 47-50 (link)

   actions/setup-go@v6 cache key breaking change

   actions/setup-go@v6 changed the default cache key from go.sum-based to go.mod-based. Existing caches keyed on go.sum will miss on first run after this upgrade, causing a cold-cache build. This is a one-time cost and won't affect correctness, but worth being aware of if CI appears slower after merging.

   Prompt To Fix With AI

   This is a comment left during a code review.
   Path: .github/workflows/ci.yml
   Line: 47-50
   
   Comment:
   **`actions/setup-go@v6` cache key breaking change**
   
   `actions/setup-go@v6` changed the default cache key from `go.sum`-based to `go.mod`-based. Existing caches keyed on `go.sum` will miss on first run after this upgrade, causing a cold-cache build. This is a one-time cost and won't affect correctness, but worth being aware of if CI appears slower after merging.
   
   How can I resolve this? If you propose a fix, please make it concise.

Prompt To Fix All With AI

This is a comment left during a code review.
Path: .github/workflows/ci.yml
Line: 47-50

Comment:
**`actions/setup-go@v6` cache key breaking change**

`actions/setup-go@v6` changed the default cache key from `go.sum`-based to `go.mod`-based. Existing caches keyed on `go.sum` will miss on first run after this upgrade, causing a cold-cache build. This is a one-time cost and won't affect correctness, but worth being aware of if CI appears slower after merging.

How can I resolve this? If you propose a fix, please make it concise.

_{Reviews (1): Last reviewed commit: "ci: upgrade and SHA-pin GitHub Actions" | Re-trigger Greptile}