ci: Bump the actions group across 1 directory with 4 updates

.github/workflows/agent.yml

@@ -38,7 +38,7 @@ jobs:
       - name: Enable rust
         # The runner image installs rust under ~/.cargo/bin but doesn't put it on PATH.
         run: echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Compile agent with eBPF
         # --features ebpf: build.rs compiles the BPF object (nightly + bpf-linker, baked
         # into the runner image) and the userspace aya loader links it in. Full check.
@@ -58,7 +58,7 @@ jobs:
       attestations: write # JEF-275: write the Sigstore-signed SLSA build-provenance attestation
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Log into registry
         if: github.event_name != 'pull_request'
         uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4
@@ -138,7 +138,7 @@ jobs:
       # `provenance: true` above is the unsigned variant the observer never reads.
       - name: Attest build provenance (Sigstore-signed SLSA)
         if: ${{ github.event_name != 'pull_request' && startsWith(github.ref, 'refs/tags/v') }}
-        uses: actions/attest-build-provenance@96b4a1ef7235a096b17240c259729fdd70c83d45 # v2
+        uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2
         with:
           subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           subject-digest: ${{ steps.build-and-push.outputs.digest }}

.github/workflows/chart.yml

@@ -19,7 +19,7 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       # First-party (Microsoft) Helm installer, pinned by commit SHA.
       - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
         with:

.github/workflows/e2e-tools-refresh.yml

@@ -21,7 +21,7 @@ jobs:
       WF: .github/workflows/e2e.yml
       BRANCH: ci/refresh-e2e-tools
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Resolve latest versions + checksums, rewrite pins
         id: bump
         run: |

.github/workflows/e2e.yml

@@ -34,7 +34,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout protector
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install k3d
         # Pinned version + sha256 verification — no `curl | bash` of a mutable
         # upstream script (the repo pins all GitHub Actions to a SHA for the same

.github/workflows/rust.yml

@@ -38,8 +38,8 @@ jobs:
       # automatically. Durable follow-up: bake sccache/nextest/cargo-audit into the runner image.
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-    - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # stable
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # stable
       with:
         toolchain: stable
         components: clippy, rustfmt
@@ -59,7 +59,7 @@ jobs:
       # cache, but not the binary, so a plain binstall skips and sccache is absent
       # from PATH (RUSTC_WRAPPER then fails). Force a real install every run.
       run: cargo binstall --no-confirm --force sccache
-    - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+    - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
         node-version: "22"
     - name: Build dashboard bundle
@@ -94,8 +94,8 @@ jobs:
       # automatically. Durable follow-up: bake sccache/nextest/cargo-audit into the runner image.
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-    - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # stable
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # stable
       with:
         toolchain: stable
     - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
@@ -106,7 +106,7 @@ jobs:
         cache-targets: false
     - name: Install sccache
       run: cargo binstall --no-confirm --force sccache
-    - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+    - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
         node-version: "22"
     - name: Build dashboard bundle
@@ -163,7 +163,7 @@ jobs:
       attestations: write # JEF-275: write the Sigstore-signed SLSA build-provenance attestation
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Log into registry
         if: github.event_name != 'pull_request'
         uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4
@@ -240,7 +240,7 @@ jobs:
       # the observer (which reads signed signature/referrer layers) never sees.
       - name: Attest build provenance (Sigstore-signed SLSA)
         if: ${{ github.event_name != 'pull_request' }}
-        uses: actions/attest-build-provenance@96b4a1ef7235a096b17240c259729fdd70c83d45 # v2
+        uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2
         with:
           subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           subject-digest: ${{ steps.build-and-push.outputs.digest }}