chore(deps): Update GitHub Actions

Author: williaby

.github/workflows/codeql.yml

@@ -57,13 +57,13 @@ jobs:
         run: uv sync --no-dev
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@0daab03d71ff584ef619d027a3fd9146679c5d84 # v3.35.3
+        uses: github/codeql-action/init@7fd177fa680c9881b53cdab4d346d32574c9f7f4 # v3.35.4
         with:
           languages: python
           build-mode: none
           queries: security-extended,security-and-quality
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@0daab03d71ff584ef619d027a3fd9146679c5d84 # v3.35.3
+        uses: github/codeql-action/analyze@7fd177fa680c9881b53cdab4d346d32574c9f7f4 # v3.35.4
         with:
           category: "/language:python"

.github/workflows/release-drafter.yml

@@ -17,7 +17,7 @@ jobs:
       pull-requests: write
     runs-on: ubuntu-latest
     steps:
-      - uses: release-drafter/release-drafter@563bf132657a13ded0b01fcb723c5a58cdd824e2 # v7.2.1
+      - uses: release-drafter/release-drafter@c2e2804cc59f45f57076a99af580d0fedb697927 # v7.3.0
         with:
           # Use the actual commit SHA (or PR head SHA on PR events). The action
           # default of refs/pull/N/merge is rejected by GitHub's release API

.github/workflows/sbom.yml

@@ -35,7 +35,7 @@ permissions:
 jobs:
   sbom:
     name: SBOM & Security
-    uses: ByronWilliamsCPA/.github/.github/workflows/python-sbom.yml@e8fc83c98c2971ad1ece71573d28171463e30c16  # main
+    uses: ByronWilliamsCPA/.github/.github/workflows/python-sbom.yml@e5624cf6927d8653d6c768750ef7dcb4b80b0934  # main
     with:
       python-version: '3.12'
       fail-on-vulnerabilities: true

.github/workflows/scorecard.yml

@@ -27,6 +27,6 @@ jobs:
       id-token: write
       contents: read
       actions: read
-    uses: ByronWilliamsCPA/.github/.github/workflows/python-scorecard.yml@e8fc83c98c2971ad1ece71573d28171463e30c16  # main
+    uses: ByronWilliamsCPA/.github/.github/workflows/python-scorecard.yml@e5624cf6927d8653d6c768750ef7dcb4b80b0934  # main
     with:
       publish-results: true

.github/workflows/security-analysis.yml

@@ -22,7 +22,7 @@ jobs:
       security-events: write
       pull-requests: write
       actions: read
-    uses: ByronWilliamsCPA/.github/.github/workflows/python-security-analysis.yml@e8fc83c98c2971ad1ece71573d28171463e30c16 # main
+    uses: ByronWilliamsCPA/.github/.github/workflows/python-security-analysis.yml@e5624cf6927d8653d6c768750ef7dcb4b80b0934 # main
     with:
       python-version: "3.12"
       run-safety: false

{{cookiecutter.project_slug}}/.github/workflows/cifuzzy.yml

@@ -81,7 +81,7 @@ jobs:
 
       - name: Upload SARIF
         if: always() && steps.check-fuzz.outputs.has-targets == 'true'
-        uses: github/codeql-action/upload-sarif@0daab03d71ff584ef619d027a3fd9146679c5d84 # v3.35.3
+        uses: github/codeql-action/upload-sarif@7fd177fa680c9881b53cdab4d346d32574c9f7f4 # v3.35.4
         with:
           sarif_file: results.sarif
           category: fuzzing-{% raw %}${{  matrix.sanitizer  }}{% endraw %}

{{cookiecutter.project_slug}}/.github/workflows/scorecard.yml

@@ -54,7 +54,7 @@ jobs:
           publish_results: true
 
       - name: Upload SARIF results
-        uses: github/codeql-action/upload-sarif@0daab03d71ff584ef619d027a3fd9146679c5d84 # v3.35.3
+        uses: github/codeql-action/upload-sarif@7fd177fa680c9881b53cdab4d346d32574c9f7f4 # v3.35.4
         with:
           sarif_file: results.sarif