chore(deps): update codecov/codecov-action action to v5.5.3 (#212)

Author: renovate[bot]

.github/workflows/build-bin.yml

@@ -61,7 +61,7 @@ jobs:
               uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
             - name: setup-mise
-              uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3.6.3
+              uses: jdx/mise-action@c1ecc8f748cd28cdeabf76dab3cccde4ce692fe4 # v4.0.0
 
             - name: verify-rust-toolchain
               # Workaround for Windows rustup bug: https://github.com/rust-lang/rustup/issues/3104
@@ -80,10 +80,11 @@ jobs:
 
             - name: install-cross-compilation-dependencies
               if: matrix.target == 'aarch64-unknown-linux-gnu'
+              shell: bash
               run: |
                   sudo apt-get update
                   sudo apt-get install -y gcc-aarch64-linux-gnu
-                  echo "CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=aarch64-linux-gnu-gcc" >> $GITHUB_ENV
+                  echo "CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=aarch64-linux-gnu-gcc" >> "$GITHUB_ENV"
 
             - name: update-cargo-toml-version
               if: inputs.version != ''
@@ -96,7 +97,7 @@ jobs:
 
             - name: upload-binary-to-release
               if: inputs.upload_to_release == true && inputs.tag != ''
-              uses: svenstaro/upload-release-action@b98a3b12e86552593f3e4e577ca8a62aa2f3f22b # 2.11.4
+              uses: svenstaro/upload-release-action@29e53e917877a24fad85510ded594ab3c9ca12de # 2.11.5
               with:
                   repo_token: ${{ secrets.GITHUB_TOKEN }}
                   file: target/${{ matrix.target }}/release/${{ matrix.artifact_name }}

.github/workflows/pre-commit.yml

@@ -2,6 +2,11 @@ name: pre-commit
 
 on:
     workflow_call:
+        inputs:
+            python_version:
+                required: false
+                type: string
+                default: "3.14"
 
 jobs:
     pre-commit:
@@ -11,10 +16,10 @@ jobs:
               uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
             - name: setup-mise
-              uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3.6.3
+              uses: jdx/mise-action@c1ecc8f748cd28cdeabf76dab3cccde4ce692fe4 # v4.0.0
 
             - name: setup-rust-toolchain
-              uses: dtolnay/rust-toolchain@efa25f7f19611383d5b0ccf2d1c8914531636bf9 # stable
+              uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
               with:
                   toolchain: nightly
                   components: rustfmt, clippy
@@ -23,7 +28,7 @@ jobs:
               env:
                   CACHE_KEY_PREFIX: deps-${{ github.workflow }}-${{ github.job }}-${{ runner.os }}-py${{ inputs.python_version }}
                   CACHE_KEY_DEPS: ${{ hashFiles('uv.lock') }}
-              uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+              uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
               with:
                   path: |
                       ~/.cache/pre-commit
@@ -43,7 +48,8 @@ jobs:
               run: uv sync --all-extras --all-groups --frozen
 
             - name: setup-path
-              run: echo "${{ github.workspace }}/.venv/bin" >> $GITHUB_PATH
+              shell: bash
+              run: echo "${{ github.workspace }}/.venv/bin" >> "$GITHUB_PATH"
 
             - name: run-pre-commit
               run: uv run pre-commit run --all-files

.github/workflows/publish-crates.yml

@@ -20,12 +20,12 @@ jobs:
               uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
             - name: setup-mise
-              uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3.6.3
+              uses: jdx/mise-action@c1ecc8f748cd28cdeabf76dab3cccde4ce692fe4 # v4.0.0
 
             - name: cache-publish
               env:
                   CACHE_KEY_PREFIX: publish-${{ github.workflow }}-${{ github.job }}-${{ runner.os }}
-              uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+              uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
               with:
                   path: |
                       ~/.cargo/bin/
@@ -45,7 +45,7 @@ jobs:
               shell: bash
               run: |
                   uv sync --all-extras --all-groups --frozen
-                  echo "${{ github.workspace }}/.venv/bin" >> $GITHUB_PATH
+                  echo "${{ github.workspace }}/.venv/bin" >> "$GITHUB_PATH"
 
             - name: publish
               run: |

.github/workflows/publish-pypi.yml

@@ -46,7 +46,7 @@ jobs:
               uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
             - name: setup-mise
-              uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3.6.3
+              uses: jdx/mise-action@c1ecc8f748cd28cdeabf76dab3cccde4ce692fe4 # v4.0.0
 
             - name: verify-rust-toolchain
               # Workaround for Windows rustup bug: https://github.com/rust-lang/rustup/issues/3104
@@ -62,7 +62,7 @@ jobs:
             - name: cache-publish
               env:
                   CACHE_KEY_PREFIX: publish-${{ github.workflow }}-${{ github.job }}-${{ runner.os }}-${{ matrix.target }}
-              uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+              uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
               with:
                   path: |
                       ~/.cargo/bin/
@@ -81,18 +81,19 @@ jobs:
 
             - name: install-cross-compilation-dependencies
               if: matrix.target == 'aarch64-unknown-linux-gnu'
+              shell: bash
               run: |
                   sudo apt-get update
                   sudo apt-get install -y gcc-aarch64-linux-gnu
-                  echo "CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=aarch64-linux-gnu-gcc" >> $GITHUB_ENV
+                  echo "CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=aarch64-linux-gnu-gcc" >> "$GITHUB_ENV"
 
             - name: setup-path
               shell: bash
               run: |
                   if [ "$RUNNER_OS" == "Windows" ]; then
-                      echo "${{ github.workspace }}/.venv/Scripts" >> $GITHUB_PATH
+                      echo "${{ github.workspace }}/.venv/Scripts" >> "$GITHUB_PATH"
                   else
-                      echo "${{ github.workspace }}/.venv/bin" >> $GITHUB_PATH
+                      echo "${{ github.workspace }}/.venv/bin" >> "$GITHUB_PATH"
                   fi
 
             - name: publish

.github/workflows/security.yml

@@ -44,7 +44,7 @@ jobs:
               uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
             - name: setup-mise
-              uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3.6.3
+              uses: jdx/mise-action@c1ecc8f748cd28cdeabf76dab3cccde4ce692fe4 # v4.0.0
 
             - name: run-cargo-audit
               run: |

.github/workflows/shared-aggregate-lock-results.yml

@@ -35,7 +35,7 @@ jobs:
             lock_results_simple: ${{ steps.output.outputs.lock_results_simple }}
         steps:
             - name: download-lock-artifacts
-              uses: actions/download-artifact@v8
+              uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
               with:
                   pattern: ${{ inputs.artifact_pattern }}
                   path: lock-results
@@ -108,7 +108,9 @@ jobs:
                   FAILED=$(jq -c . failed-lock-keys.json)
                   RAW=$(jq -c . lock-results-raw.json)
                   SIMPLE=$(jq -c . lock-results-simple.json)
-                  echo "successful_lock_keys=$SUCCESSFUL" >> $GITHUB_OUTPUT
-                  echo "failed_lock_keys=$FAILED" >> $GITHUB_OUTPUT
-                  echo "lock_results_raw=$RAW" >> $GITHUB_OUTPUT
-                  echo "lock_results_simple=$SIMPLE" >> $GITHUB_OUTPUT
+                  {
+                      echo "successful_lock_keys=$SUCCESSFUL"
+                      echo "failed_lock_keys=$FAILED"
+                      echo "lock_results_raw=$RAW"
+                      echo "lock_results_simple=$SIMPLE"
+                  } >> "$GITHUB_OUTPUT"

.github/workflows/shared-check-pr-label-and-branch.yml

@@ -54,7 +54,7 @@ jobs:
                     '[.[] | select(.name == $target)] | length > 0')
 
                   echo "Has label: $HAS_LABEL"
-                  echo "has_label=$HAS_LABEL" >> $GITHUB_OUTPUT
+                  echo "has_label=$HAS_LABEL" >> "$GITHUB_OUTPUT"
 
                   if [ "$HAS_LABEL" = "true" ]; then
                     echo "✅ Label '$TARGET_LABEL' found"
@@ -64,10 +64,11 @@ jobs:
 
             - name: check-branch-exact
               id: check-branch-exact
+              env:
+                  CURRENT_BRANCH: ${{ github.head_ref }}
               run: |
                   # Escape JSON properly for bash
                   BRANCH_NAMES='${{ inputs.branch_names }}'
-                  CURRENT_BRANCH="${{ github.head_ref }}"
 
                   echo "Checking exact branch names: $BRANCH_NAMES"
                   echo "Current branch: $CURRENT_BRANCH"
@@ -79,7 +80,7 @@ jobs:
                       '[.[] | select(. == $branch)] | length > 0')
 
                     echo "Has exact match: $EXACT_MATCH"
-                    echo "has_exact_match=$EXACT_MATCH" >> $GITHUB_OUTPUT
+                    echo "has_exact_match=$EXACT_MATCH" >> "$GITHUB_OUTPUT"
 
                     if [ "$EXACT_MATCH" = "true" ]; then
                       echo "✅ Branch name matches exactly"
@@ -88,15 +89,16 @@ jobs:
                     fi
                   else
                     echo "ℹ️ No exact branch name restrictions"
-                    echo "has_exact_match=false" >> $GITHUB_OUTPUT
+                    echo "has_exact_match=false" >> "$GITHUB_OUTPUT"
                   fi
 
             - name: check-branch-prefixes
               id: check-branch-prefixes
+              env:
+                  CURRENT_BRANCH: ${{ github.head_ref }}
               run: |
                   # Escape JSON properly for bash
                   BRANCH_PREFIXES='${{ inputs.branch_prefixes }}'
-                  CURRENT_BRANCH="${{ github.head_ref }}"
 
                   echo "Checking branch prefixes: $BRANCH_PREFIXES"
                   echo "Current branch: $CURRENT_BRANCH"
@@ -114,7 +116,7 @@ jobs:
                     done < <(echo "$BRANCH_PREFIXES" | jq -r '.[]')
 
                     echo "Has prefix match: $PREFIX_MATCH"
-                    echo "has_prefix_match=$PREFIX_MATCH" >> $GITHUB_OUTPUT
+                    echo "has_prefix_match=$PREFIX_MATCH" >> "$GITHUB_OUTPUT"
 
                     if [ "$PREFIX_MATCH" = "true" ]; then
                       echo "✅ Branch prefix matches"
@@ -123,7 +125,7 @@ jobs:
                     fi
                   else
                     echo "ℹ️ No branch prefix restrictions"
-                    echo "has_prefix_match=false" >> $GITHUB_OUTPUT
+                    echo "has_prefix_match=false" >> "$GITHUB_OUTPUT"
                   fi
 
             - name: combine-results
@@ -160,7 +162,7 @@ jobs:
                     echo "Branch not valid (no match found)"
                   fi
 
-                  echo "is_valid_branch=$IS_VALID_BRANCH" >> $GITHUB_OUTPUT
+                  echo "is_valid_branch=$IS_VALID_BRANCH" >> "$GITHUB_OUTPUT"
 
                   # Final validation requires both label and valid branch
                   if [ "$HAS_LABEL" = "true" ] && [ "$IS_VALID_BRANCH" = "true" ]; then
@@ -177,9 +179,11 @@ jobs:
                     fi
                   fi
 
-                  echo "is_valid=$IS_VALID" >> $GITHUB_OUTPUT
+                  echo "is_valid=$IS_VALID" >> "$GITHUB_OUTPUT"
 
             - name: display-results
+              env:
+                  CURRENT_BRANCH: ${{ github.head_ref }}
               run: |
                   echo "=========================================="
                   echo "          VALIDATION SUMMARY"
@@ -190,7 +194,7 @@ jobs:
                   echo "  - Has label: ${{ steps.check-label.outputs.has_label }}"
                   echo ""
                   echo "Branch Validation:"
-                  echo "  - Current branch: ${{ github.head_ref }}"
+                  echo "  - Current branch: $CURRENT_BRANCH"
                   echo "  - Exact match: ${{ steps.check-branch-exact.outputs.has_exact_match }}"
                   echo "  - Prefix match: ${{ steps.check-branch-prefixes.outputs.has_prefix_match }}"
                   echo "  - Valid branch: ${{ steps.combine-results.outputs.is_valid_branch }}"

.github/workflows/shared-check-pr-labels-with-prefix.yml

@@ -53,7 +53,7 @@ jobs:
                     echo "filtered-labels<<EOF"
                     echo "$JSON_RESULT"
                     echo "EOF"
-                  } >> $GITHUB_OUTPUT
+                  } >> "$GITHUB_OUTPUT"
 
             - name: display-filter-result
               run: |

.github/workflows/shared-lock.yml

@@ -149,11 +149,12 @@ jobs:
             # Lock
             - name: prepare-lock-reason
               id: lock-reason
+              shell: bash
               run: |
                   # Simple reason with owner information
                   REASON="owner:${{ inputs.key_owner }}"
                   echo "Lock reason: $REASON"
-                  echo "reason=$REASON" >> $GITHUB_OUTPUT
+                  echo "reason=$REASON" >> "$GITHUB_OUTPUT"
               if: steps.check-lock.outputs.should_proceed == 'true'
 
             - name: lock
@@ -206,13 +207,14 @@ jobs:
             - name: create-lock-result
               if: always() && inputs.upload_result_artifact == true
               id: output
+              shell: bash
               run: |
                   RECHECK_LOCK_OUTCOME="${{ steps.recheck-lock.outcome }}"
                   LOCK_OUTCOME="${{ steps.lock.outcome }}"
 
                   # Determine final status
                   # Success only when recheck-lock succeeds (or lock succeeds if recheck is disabled)
-                  if [ "$RECHECK_LOCK_OUTCOME" = "success" ] || ([ "$RECHECK_LOCK_OUTCOME" = "skipped" ] && [ "$LOCK_OUTCOME" = "success" ]); then
+                  if [ "$RECHECK_LOCK_OUTCOME" = "success" ] || { [ "$RECHECK_LOCK_OUTCOME" = "skipped" ] && [ "$LOCK_OUTCOME" = "success" ]; }; then
                     FINAL_STATUS="success"
                   else
                     FINAL_STATUS="failure"
@@ -232,11 +234,11 @@ jobs:
                   cat lock-result.json
 
                   # Set job output
-                  echo "lock_status=$FINAL_STATUS" >> $GITHUB_OUTPUT
+                  echo "lock_status=$FINAL_STATUS" >> "$GITHUB_OUTPUT"
                   echo "Set output: lock_status=$FINAL_STATUS"
 
             - name: upload-lock-result-artifact
-              uses: actions/upload-artifact@v7
+              uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
               if: always() && inputs.upload_result_artifact == true
               with:
                   name: lock-result-${{ inputs.key }}

.github/workflows/shared-pr-unlock.yml

@@ -80,7 +80,7 @@ jobs:
                       echo "unlock_combinations<<EOF"
                       echo "$COMB_ARRAY"
                       echo "EOF"
-                  } >> $GITHUB_OUTPUT
+                  } >> "$GITHUB_OUTPUT"
 
     debug-unlock-combinations:
         needs: get-missing-deploy-labels