보안(deps): Bump the gh-actions-all group across 1 directory with 12 updates

.github/workflows/ai-policy.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Block auto-merge label on coreloop PR
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const pr = context.payload.pull_request;

.github/workflows/buildKrxData.yml

@@ -38,10 +38,10 @@ jobs:
     timeout-minutes: 120
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v7
 
       - name: Set up Python
         run: uv python install 3.12

.github/workflows/buildKrxIndexData.yml

@@ -36,10 +36,10 @@ jobs:
     timeout-minutes: 120
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v7
 
       - name: Set up Python
         run: uv python install 3.12

.github/workflows/ci-fast.yml

@@ -55,7 +55,7 @@ jobs:
           - gate: sections-parity-fast
             timeout: 10
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           fetch-depth: ${{ matrix.fetch-depth || 1 }}
       - uses: actions/setup-python@v6
@@ -67,7 +67,7 @@ jobs:
             uv.lock
       # T13-5 — pip wheel cache (의존 설치 시간 단축, 평균 30-60 percent)
       - name: Cache pip wheels
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: ~/.cache/pip
           key: pip-wheels-${{ runner.os }}-py3.12-${{ hashFiles('pyproject.toml', 'uv.lock') }}
@@ -76,7 +76,7 @@ jobs:
       # T13-5 — HF dataset cache (smoke / test-fast gate 가 fixture 다운로드 시 hit)
       - name: Cache HuggingFace dataset
         if: ${{ matrix.gate == 'smoke' || matrix.gate == 'test-fast' || matrix.gate == 'schema-drift' }}
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: ~/.cache/huggingface
           key: hf-${{ runner.os }}-${{ hashFiles('src/dartlab/core/data/version.json') }}-v1
@@ -86,7 +86,7 @@ jobs:
         run: python -X utf8 tests/run.py gate ${{ matrix.gate }}
       - name: Upload artifact
         if: ${{ always() && matrix.artifact_name }}
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v7
         with:
           name: ${{ matrix.artifact_name }}
           path: ${{ matrix.artifact_path }}

.github/workflows/ci-full.yml

@@ -42,7 +42,7 @@ jobs:
             artifact_name: product-smoke-wheel-release
             artifact_path: product-smoke-wheel-release.json
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python || '3.12' }}
@@ -53,14 +53,14 @@ jobs:
             ${{ matrix.python && format('--python {0}', matrix.python) || '' }}
       - name: Upload coverage to Codecov
         if: ${{ matrix.gate == 'test-full' && matrix.python == '3.12' }}
-        uses: codecov/codecov-action@v4
+        uses: codecov/codecov-action@v6
         with:
           files: coverage.xml
           fail_ci_if_error: false
           token: ${{ secrets.CODECOV_TOKEN }}
       - name: Upload artifact
         if: ${{ always() && matrix.artifact_name }}
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v7
         with:
           name: ${{ matrix.artifact_name }}
           path: ${{ matrix.artifact_path }}
@@ -73,7 +73,7 @@ jobs:
       tests: ${{ steps.plan.outputs.tests }}
       hasAny: ${{ steps.plan.outputs.hasAny }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
       - uses: actions/setup-python@v6
@@ -94,7 +94,7 @@ jobs:
       matrix:
         test_file: ${{ fromJson(needs.realdata-plan.outputs.tests) }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - uses: actions/setup-python@v6
         with:
           python-version: "3.12"

.github/workflows/ci-nightly.yml

@@ -52,15 +52,15 @@ jobs:
           - gate: sections-parity-bulk
             timeout: 30
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - uses: actions/setup-python@v6
         with:
           python-version: "3.12"
       - name: Run ${{ matrix.gate }}
         run: python -X utf8 tests/run.py gate ${{ matrix.gate }}
       - name: Upload artifact
         if: ${{ always() && matrix.artifact_name }}
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v7
         with:
           name: ${{ matrix.artifact_name }}
           path: ${{ matrix.artifact_path }}
@@ -98,7 +98,7 @@ jobs:
           - test_search.py
           - test_topLevelApi.py
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - uses: actions/setup-python@v6
         with:
           python-version: "3.12"

.github/workflows/codeql.yml

@@ -18,15 +18,15 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@v4
         with:
           languages: python
           queries: +security-extended
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@v4
         with:
           category: "/language:python"

.github/workflows/dartNewStocks.yml

@@ -34,10 +34,10 @@ jobs:
     timeout-minutes: 180
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v7
 
       - name: Set up Python
         run: uv python install 3.12

.github/workflows/dataAudit.yml

@@ -32,10 +32,10 @@ jobs:
     timeout-minutes: 10
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v7
 
       - name: Set up Python
         run: uv python install 3.12

.github/workflows/dataPrebuild.yml

@@ -33,10 +33,10 @@ jobs:
     if: ${{ github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success' || github.event.workflow_run.conclusion == 'failure' }}
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v7
 
       - name: Set up Python
         run: uv python install 3.12

.github/workflows/dataSync.yml

@@ -55,10 +55,10 @@ jobs:
     timeout-minutes: 90
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v7
 
       - name: Set up Python
         run: uv python install 3.12
@@ -177,10 +177,10 @@ jobs:
     timeout-minutes: 150
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v7
 
       - name: Set up Python
         run: uv python install 3.12
@@ -277,10 +277,10 @@ jobs:
         category: ${{ github.event_name == 'workflow_dispatch' && fromJSON(format('["{0}"]', inputs.category == 'all' && 'finance","report","docs' || inputs.category)) || fromJSON('["finance","report","docs"]') }}
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v7
 
       - name: Set up Python
         run: uv python install 3.12

.github/workflows/docs.yml

@@ -37,10 +37,10 @@ jobs:
     runs-on: ubuntu-latest
     if: ${{ github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success' }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v7
 
       - name: Set up Python (for HF seed)
         run: uv python install 3.12
@@ -77,7 +77,7 @@ jobs:
           DARTLAB_MARKET_CURATORS: ${{ github.repository_owner }}
 
       - name: Set up Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v6
         with:
           node-version: "20"
 
@@ -88,7 +88,7 @@ jobs:
           BASE_PATH=/dartlab npm run build
 
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v4
+        uses: actions/upload-pages-artifact@v5
         with:
           path: landing/build/
 

.github/workflows/edgarSafetyGate.yml

@@ -33,10 +33,10 @@ jobs:
     timeout-minutes: 30
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v7
 
       - name: Set up Python
         run: uv python install 3.12
@@ -115,7 +115,7 @@ jobs:
       # ── 결과 artifact 보존 (4 주 카운터 추적용) ──
       - name: Upload parity.json artifact
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: edgar-parity-${{ github.run_id }}
           path: |

.github/workflows/edgarSync.yml

@@ -35,10 +35,10 @@ jobs:
     timeout-minutes: 180
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v7
 
       - name: Set up Python
         run: uv python install 3.12

.github/workflows/kindlist.yml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
 
       - name: Set up Python
         uses: actions/setup-python@v6

.github/workflows/macroData.yml

@@ -31,10 +31,10 @@ jobs:
     timeout-minutes: 120
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v7
 
       - name: Set up Python
         run: uv python install 3.12

.github/workflows/mapBuild.yml

@@ -29,10 +29,10 @@ jobs:
     if: ${{ github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success' || github.event.workflow_run.conclusion == 'failure' }}
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v7
 
       - name: Set up Python
         run: uv python install 3.12

.github/workflows/metrics.yml

@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0   # git log 분석 필요
 
@@ -56,7 +56,7 @@ jobs:
             --output landing/static/metrics/rolling.json
 
       - name: Upload metrics artifact
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v7
         with:
           name: metrics-${{ github.run_id }}
           path: landing/static/metrics/

.github/workflows/newsArchiveSync.yml

@@ -39,10 +39,10 @@ jobs:
     timeout-minutes: 45
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v7
 
       - name: Set up Python
         run: uv python install 3.12