chore(deps): bump the github-actions group across 1 directory with 6 updates

.github/workflows/benchmark_cpp.yml

@@ -28,7 +28,7 @@ jobs:
         os: [ubuntu-latest, windows-latest]
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Install OpenSSL (Linux)
         if: runner.os == 'Linux'
@@ -39,15 +39,15 @@ jobs:
         run: choco install openssl --no-progress -y
 
       - name: Restore FetchContent cache
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: cpp/build-bench/_deps
           key: fetchcontent-bench-${{ matrix.os }}-${{ hashFiles('cpp/CMakeLists.txt') }}
 
       # Restore baseline from last main-branch run (prefix match gets latest)
       - name: Restore benchmark baseline
         id: restore-baseline
-        uses: actions/cache/restore@v5
+        uses: actions/cache/restore@v6
         with:
           path: cpp/benchmark-results.json
           key: benchmark-baseline-${{ matrix.os }}-dummy
@@ -146,7 +146,7 @@ jobs:
       # Save new baseline only on pushes to main (immutable cache: unique key per run)
       - name: Save benchmark baseline
         if: github.ref == 'refs/heads/main' && github.event_name == 'push'
-        uses: actions/cache/save@v5
+        uses: actions/cache/save@v6
         with:
           path: cpp/benchmark-results.json
           key: benchmark-baseline-${{ matrix.os }}-${{ github.run_id }}

.github/workflows/build-electron-apps.yml

@@ -31,7 +31,7 @@ jobs:
       matrix: ${{ steps.discover.outputs.matrix }}
       has_apps: ${{ steps.discover.outputs.has_apps }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Free disk space
         uses: ./.github/actions/free-disk-space
@@ -89,7 +89,7 @@ jobs:
         app: ${{ fromJson(needs.discover-apps.outputs.matrix).app }}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Setup Node.js
         uses: actions/setup-node@v6

.github/workflows/build-installers.yml

@@ -177,7 +177,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0  # full history for any version calculations
           ref: ${{ inputs.tag || github.ref }}
@@ -194,7 +194,7 @@ jobs:
       # platform. Cross-runner cache paths are listed together — actions/cache
       # silently skips paths that don't exist on the current runner.
       - name: Cache electron + electron-builder
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: |
             ~/.cache/electron
@@ -735,7 +735,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Download Linux installer artifact
         uses: actions/download-artifact@v8
@@ -776,7 +776,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Download macOS installer artifact
         uses: actions/download-artifact@v8
@@ -805,7 +805,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Download Linux installer artifact
         uses: actions/download-artifact@v8
@@ -1064,7 +1064,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Download Linux installer artifact
         uses: actions/download-artifact@v8
@@ -1171,7 +1171,7 @@ jobs:
         os: [ubuntu-latest, windows-latest]
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up Python
         uses: actions/setup-python@v6
@@ -1212,7 +1212,7 @@ jobs:
   #     needs: build
   #     runs-on: ubuntu-24.04
   #     steps:
-  #       - uses: actions/checkout@v6
+  #       - uses: actions/checkout@v7
   #       - run: sudo apt-get install --yes cage grim imagemagick libfuse2
   #       - run: cage -s -- xvfb-run "${APPIMAGE}" &
   #       - run: sleep 20 && grim -t png /tmp/shot.png

.github/workflows/build_agent_package.yml

@@ -34,7 +34,7 @@ jobs:
     name: Build and share ${{ inputs.agent_id }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ inputs.ref || github.ref }}
 

.github/workflows/build_agents.yml

@@ -66,7 +66,7 @@ jobs:
       VCPKG_DEFAULT_BINARY_CACHE: ${{ github.workspace }}/.vcpkg-cache
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Set up Python
         uses: actions/setup-python@v6
@@ -81,15 +81,15 @@ jobs:
         run: mkdir -p "${VCPKG_DEFAULT_BINARY_CACHE}"
 
       - name: Restore vcpkg binary cache
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: ${{ github.workspace }}/.vcpkg-cache
           key: vcpkg-${{ matrix.triplet }}-${{ hashFiles('cpp/vcpkg.json') }}
           restore-keys: |
             vcpkg-${{ matrix.triplet }}-
 
       - name: Restore FetchContent cache
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: cpp/build/_deps
           key: fetchcontent-agents-${{ matrix.platform }}-${{ hashFiles('cpp/CMakeLists.txt') }}

.github/workflows/build_cpp.yml

@@ -46,7 +46,7 @@ jobs:
         os: [ubuntu-latest, windows-latest]
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Install OpenSSL (Linux)
         if: runner.os == 'Linux'
@@ -58,7 +58,7 @@ jobs:
 
       - name: Restore FetchContent cache
         id: cache-deps
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: cpp/build/_deps
           key: fetchcontent-${{ matrix.os }}-${{ hashFiles('cpp/CMakeLists.txt') }}
@@ -84,14 +84,14 @@ jobs:
         os: [ubuntu-latest, windows-latest]
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Install OpenSSL (Linux)
         if: runner.os == 'Linux'
         run: sudo apt-get install -y libssl-dev
 
       - name: Restore FetchContent cache
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: cpp/build/_deps
           key: fetchcontent-install-${{ matrix.os }}-${{ hashFiles('cpp/CMakeLists.txt') }}
@@ -133,7 +133,7 @@ jobs:
         os: [ubuntu-latest, windows-latest]
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Install OpenSSL (Linux)
         if: runner.os == 'Linux'
@@ -144,7 +144,7 @@ jobs:
         run: choco install openssl --no-progress -y
 
       - name: Restore FetchContent cache
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: cpp/build-shared/_deps
           key: fetchcontent-shared-${{ matrix.os }}-${{ hashFiles('cpp/CMakeLists.txt') }}
@@ -165,7 +165,7 @@ jobs:
     if: github.event_name != 'pull_request' || github.event.pull_request.draft == false || contains(github.event.pull_request.labels.*.name, 'ready_for_ci')
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Setup Python environment
         uses: ./.github/actions/setup-venv
@@ -243,7 +243,7 @@ jobs:
           Write-Host "Build tools ready"
 
       - name: Restore FetchContent cache
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: cpp/build-integration/_deps
           key: fetchcontent-integration-windows-${{ hashFiles('cpp/CMakeLists.txt') }}

.github/workflows/build_cpp_email.yml

@@ -58,7 +58,7 @@ jobs:
         os: [ubuntu-latest, windows-latest]
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       # Guard: the C++ email agent module must exist before we try to build it.
       # The path filters above mean this job normally only runs once
@@ -85,7 +85,7 @@ jobs:
 
       - name: Restore FetchContent cache
         id: cache-deps
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: cpp/build/_deps
           key: fetchcontent-email-${{ matrix.os }}-${{ hashFiles('cpp/CMakeLists.txt', 'cpp/agents/email/**/CMakeLists.txt') }}

.github/workflows/build_tui.yml

@@ -37,7 +37,7 @@ jobs:
       run:
         working-directory: tui
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v6
         with:
@@ -73,7 +73,7 @@ jobs:
       run:
         working-directory: tui
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v6
         with:

.github/workflows/check_doc_links.yml

@@ -36,7 +36,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Set up Python
         uses: actions/setup-python@v6
@@ -54,7 +54,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Set up Python
         uses: actions/setup-python@v6
@@ -72,7 +72,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Set up Python
         uses: actions/setup-python@v6

.github/workflows/claude-auth-canary.yml

@@ -29,7 +29,7 @@ jobs:
         # NO continue-on-error: an auth failure MUST fail the job so the notify step
         # fires. Same OAuth-preferred / API-key-fallback wiring as claude.yml. Haiku +
         # 1 turn keeps the monthly subscription-quota cost negligible.
-        uses: anthropics/claude-code-action@fbda2eb1bdc90d319b8d853f5deb53bca199a7c1  # v1.0.140
+        uses: anthropics/claude-code-action@a92e7c70a4da9793dc164451d829089dc057a464  # v1.0.159
         with:
           anthropic_api_key: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN == '' && secrets.ANTHROPIC_API_KEY || '' }}
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}

.github/workflows/claude-run.yml

@@ -62,7 +62,7 @@ jobs:
       #     checkout the PR head and diff it against base. ---
       - name: Checkout PR head
         if: github.event_name == 'pull_request_target' || github.event_name == 'pull_request_review_comment'
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 0
@@ -114,7 +114,7 @@ jobs:
       #     the comment is on a PR conversation. ---
       - name: Checkout repository
         if: github.event_name == 'issues' || github.event_name == 'issue_comment'
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -189,7 +189,7 @@ jobs:
       # not red-X a contributor's PR CI. Visibility comes from the verification step.
       - name: Run Claude (attempt 1)
         id: a1
-        uses: anthropics/claude-code-action@fbda2eb1bdc90d319b8d853f5deb53bca199a7c1  # v1.0.140
+        uses: anthropics/claude-code-action@a92e7c70a4da9793dc164451d829089dc057a464  # v1.0.159
         continue-on-error: true
         with:
           # Prefer subscription OAuth, fall back to API key — see claude.yml "Authentication".
@@ -212,7 +212,7 @@ jobs:
       - name: Run Claude (attempt 2 — retry install-phase crash)
         id: a2
         if: "!cancelled() && steps.a1.outcome == 'failure' && steps.a1.outputs.execution_file == ''"
-        uses: anthropics/claude-code-action@fbda2eb1bdc90d319b8d853f5deb53bca199a7c1  # v1.0.140
+        uses: anthropics/claude-code-action@a92e7c70a4da9793dc164451d829089dc057a464  # v1.0.159
         continue-on-error: true
         with:
           anthropic_api_key: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN == '' && secrets.ANTHROPIC_API_KEY || '' }}

.github/workflows/claude.yml

@@ -772,7 +772,7 @@ jobs:
       cancel-in-progress: true
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -790,7 +790,7 @@ jobs:
 
       - name: Attempt auto-fix
         id: claude   # referenced by the Notify step's execution_file check below
-        uses: anthropics/claude-code-action@fbda2eb1bdc90d319b8d853f5deb53bca199a7c1  # v1.0.140
+        uses: anthropics/claude-code-action@a92e7c70a4da9793dc164451d829089dc057a464  # v1.0.159
         with:
           # Prefer subscription OAuth, fall back to API key — see "Authentication" in the file header.
           anthropic_api_key: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN == '' && secrets.ANTHROPIC_API_KEY || '' }}
@@ -1140,7 +1140,7 @@ jobs:
 
       - name: Checkout repository
         if: steps.tag.outputs.SKIP != 'true'
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: main       # Checkout main branch (not tag) so we can commit
           fetch-depth: 0  # Full history for tag comparison
@@ -1258,7 +1258,7 @@ jobs:
         # continue-on-error: a rate-limit / expired-token / outage failure here is
         # caught by the "Verify and validate release notes" step (which fails the job)
         # and the "Notify on failure" step opens a tracking issue.
-        uses: anthropics/claude-code-action@fbda2eb1bdc90d319b8d853f5deb53bca199a7c1  # v1.0.140
+        uses: anthropics/claude-code-action@a92e7c70a4da9793dc164451d829089dc057a464  # v1.0.159
         continue-on-error: true
         with:
           # Prefer subscription OAuth, fall back to API key — see "Authentication" in the file header.

.github/workflows/dependency-review.yml

@@ -31,7 +31,7 @@ jobs:
     if: github.event_name != 'pull_request' || github.event.pull_request.draft == false || contains(github.event.pull_request.labels.*.name, 'ready_for_ci')
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Dependency Review
         uses: actions/dependency-review-action@v5

.github/workflows/deploy_website.yml

@@ -43,7 +43,7 @@ jobs:
     name: Deploy website to Railway
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-node@v6
         with: