[katsugtgz]

Updates workflow action references to the current major versions in the CI, e2e, sast, semgrep, and codeql workflows.

Changes:

• actions/checkout v4 -> v7, actions/setup-go v5 -> v7, actions/setup-node v4 -> v7
• actions/upload-artifact v4 -> v7, actions/cache v4 -> v6
• actions/github-script v6/v7 -> v9; all scripts here use the injected github, context, and core objects and do not call require('@actions/github'), so the v9 ESM change does not affect them
• codecov/codecov-action v4.0.1 -> v7.1.1, with the file input renamed to files
• nick-fields/retry v3 -> v4
• golangci/golangci-lint-action v8 -> v9 and mshick/add-pr-comment v2 -> v3, both node 24 runtime bumps with no input changes
• docker/login-action v3 -> v4, docker/build-push-action v6 -> v7
• github/codeql-action init, analyze, upload-sarif v3 -> v4

Validation:

• actionlint on the modified files reports only two pre-existing findings on unmodified lines (the buildjet runner label and a workflow_call input that is both required and defaulted), same as on main

Notes:

• the go-version pins (1.23) resolve to the latest 1.23.x patch and satisfy the go.mod toolchain (1.23.9), so the setup-go v6+ toolchain handling is unaffected
• the node 20 pin in ci-nightly-performance-testing.yaml is EOL; left unchanged because that workflow only runs on dispatch and a runtime switch could not be validated here
• release, publish, labeler, and semantic-pr workflows are unchanged; labeler v7 needs a config format migration and is better done separately

Scope: .github/workflows only, the nine files in this diff.

---

Note

Low Risk
Workflow-only dependency bumps; main behavioral risk is CI/e2e breakage from major action upgrades, not production code or secrets handling changes.

Overview
Bumps third-party GitHub Actions references across nine workflow files (changelog check, CI, nightly performance, e2e, generate-files, reusable e2e, SAST/linters, Semgrep, and CodeQL). No application or node code changes—only uses: version pins and one Codecov input rename.

Core platform actions move to newer majors: actions/checkout v4→v7, setup-go/setup-node v5/v4→v7, upload-artifact v4→v7, cache v4→v6, and github-script v6/v7→v9 (inline scripts still use injected github/context/core). Docker steps use login-action v3→v4 and build-push-action v6→v7.

Tooling actions are updated similarly: codecov-action v4.0.1→v7.1.1 with file → files, nick-fields/retry v3→v4, golangci-lint-action v8→v9, add-pr-comment v2→v3, and codeql-action init/analyze/upload-sarif v3→v4. Release/publish/labeler workflows are out of scope and still pin older checkout versions.

^{Reviewed by Cursor Bugbot for commit 0990140. Configure here.}

Confidence Score: 5/5

The PR appears safe to merge; no actionable issue caused by the changes was found.

Summary

Updates action versions across nine GitHub Actions workflows and changes the Codecov input from file to files.

• CI checks now use newer actions for tests, coverage, and build files.
• End-to-end jobs now use newer actions to build images and run selected tests.
• Go lint and nosec checks now use newer actions.
• Semgrep and CodeQL workflows now use newer actions to publish security results.
• Utility workflows now check out code and upload reports with newer actions.

_{Reviews (1) · Last reviewed commit: "chore: update CI workflow actions to cur..." · Reviewed by Greptile}