From 075e5de2b0b02751d66a8d89414e5615b36d64a1 Mon Sep 17 00:00:00 2001
From: "Joseph T. French" <joey@harbinger.finance>
Date: Tue, 14 Jul 2026 01:58:39 -0500
Subject: [PATCH 1/2] chore(ci): bump workflow actions to Node 24 majors, add
 dependabot

GitHub flagged the Node 20 action runtimes as deprecated. Bumps checkout v4->v7, setup-python v5->v6, setup-uv v6->v8, action-gh-release v1->v3, and adds dependabot coverage for github-actions so versions stay current.
---
 .github/dependabot.yml               | 9 +++++++++
 .github/workflows/claude.yml         | 2 +-
 .github/workflows/create-release.yml | 6 +++---
 .github/workflows/publish.yml        | 4 ++--
 .github/workflows/tag-release.yml    | 4 ++--
 .github/workflows/test.yml           | 6 +++---
 6 files changed, 20 insertions(+), 11 deletions(-)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..424d83e
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,9 @@
+version: 2
+updates:
+  # GitHub Actions — pinned action versions
+  - package-ecosystem: 'github-actions'
+    directory: '/'
+    schedule:
+      interval: 'monthly'
+    labels:
+      - 'dependencies'
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index aab6650..4ffd9f1 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -27,7 +27,7 @@ jobs:
       actions: read # Required for Claude to read CI results on PRs
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 1
 
diff --git a/.github/workflows/create-release.yml b/.github/workflows/create-release.yml
index c64ad5d..3161f3c 100644
--- a/.github/workflows/create-release.yml
+++ b/.github/workflows/create-release.yml
@@ -22,7 +22,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           ref: main
           fetch-depth: 0
@@ -30,12 +30,12 @@ jobs:
           token: ${{ secrets.ACTIONS_TOKEN || github.token }}
 
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.13"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v6
+        uses: astral-sh/setup-uv@v8
 
       - name: Get current version
         id: current-version
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index d6aac23..ff216cd 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -16,10 +16,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.13"
 
diff --git a/.github/workflows/tag-release.yml b/.github/workflows/tag-release.yml
index 3babd44..a046eb7 100644
--- a/.github/workflows/tag-release.yml
+++ b/.github/workflows/tag-release.yml
@@ -33,7 +33,7 @@ jobs:
       release_url: ${{ steps.create-release.outputs.upload_url }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           ref: ${{ inputs.branch_ref }}
           # ACTIONS_TOKEN required to push tags to protected repo
@@ -228,7 +228,7 @@ jobs:
       - name: Create GitHub Release
         if: steps.check-tag.outputs.tag_exists == 'false'
         id: create-release
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@v3
         with:
           tag_name: v${{ steps.get-version.outputs.version }}
           name: Release v${{ steps.get-version.outputs.version }}
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 6270a4d..26d67b8 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -12,15 +12,15 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.13"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v6
+        uses: astral-sh/setup-uv@v8
 
       - name: Install dependencies
         run: |

From e67cae6c3973166880f1b4886a7775c07da776bf Mon Sep 17 00:00:00 2001
From: "Joseph T. French" <joey@harbinger.finance>
Date: Tue, 14 Jul 2026 02:00:29 -0500
Subject: [PATCH 2/2] chore(ci): pin setup-uv to v8.3.2 (no floating v8 major
 tag)

---
 .github/workflows/create-release.yml | 2 +-
 .github/workflows/test.yml           | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/create-release.yml b/.github/workflows/create-release.yml
index 3161f3c..bce11e8 100644
--- a/.github/workflows/create-release.yml
+++ b/.github/workflows/create-release.yml
@@ -35,7 +35,7 @@ jobs:
           python-version: "3.13"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v8
+        uses: astral-sh/setup-uv@v8.3.2
 
       - name: Get current version
         id: current-version
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 26d67b8..ba89265 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -20,7 +20,7 @@ jobs:
           python-version: "3.13"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v8
+        uses: astral-sh/setup-uv@v8.3.2
 
       - name: Install dependencies
         run: |