Bump the github-actions group with 5 updates

[dependabot]

Bumps the github-actions group with 5 updates:

Package	From	To
ruby/setup-ruby	1.295.0	1.310.0
actions/cache	5.0.4	5.0.5
rhysd/actionlint	1.7.11	1.7.12
zizmorcore/zizmor-action	0.5.2	0.5.6
actions/upload-artifact	7.0.0	7.0.1

Updates ruby/setup-ruby from 1.295.0 to 1.310.0

Release notes

Sourced from ruby/setup-ruby's releases.

v1.310.0

What's Changed

• Add ruby-4.0.5 by @​ruby-builder-bot in ruby/setup-ruby#918

Full Changelog: ruby/setup-ruby@v1.309.0...v1.310.0

v1.309.0

What's Changed

• Update CRuby releases on Windows by @​ruby-builder-bot in ruby/setup-ruby#917

Full Changelog: ruby/setup-ruby@v1.308.0...v1.309.0

v1.308.0

What's Changed

• Update CRuby releases on Windows by @​ruby-builder-bot in ruby/setup-ruby#912

Full Changelog: ruby/setup-ruby@v1.307.0...v1.308.0

v1.307.0

What's Changed

• Update README: fix outdated URLs and Ruby version examples by @​fkmy in ruby/setup-ruby#910
• Add ruby-4.0.4 by @​ruby-builder-bot in ruby/setup-ruby#911

Full Changelog: ruby/setup-ruby@v1.306.0...v1.307.0

v1.306.0

What's Changed

• Add truffleruby-34.0.1,truffleruby+graalvm-34.0.1 by @​ruby-builder-bot in ruby/setup-ruby#909

Full Changelog: ruby/setup-ruby@v1.305.0...v1.306.0

v1.305.0

What's Changed

• Update CRuby releases on Windows by @​ruby-builder-bot in ruby/setup-ruby#908

Full Changelog: ruby/setup-ruby@v1.304.0...v1.305.0

v1.304.0

What's Changed

• Add jruby-10.1.0.0 by @​ruby-builder-bot in ruby/setup-ruby#906

Full Changelog: ruby/setup-ruby@v1.303.0...v1.304.0

... (truncated)

Commits

• afeafc3 Add ruby-4.0.5
• 28c65f7 Update CRuby releases on Windows
• 97ecb7b Update CRuby releases on Windows
• 6aaa311 Add ruby-4.0.4
• f02c009 Fix docs.github.com URLs to avoid 301 redirects
• 98bfeb1 Remove EOL Ruby versions from matrix example in README
• 59a7680 Update Ruby version examples in README to include 4.0
• 6459287 Replace outdated help.github.com URLs with docs.github.com
• c4e5b13 Add truffleruby-34.0.1,truffleruby+graalvm-34.0.1
• 0cb964f Update CRuby releases on Windows
• Additional commits viewable in compare view

Updates actions/cache from 5.0.4 to 5.0.5

Release notes

Sourced from actions/cache's releases.

v5.0.5

What's Changed

• Update ts-http-runtime dependency by @​yacaovsnc in actions/cache#1747

Full Changelog: actions/cache@v5...v5.0.5

Changelog

Sourced from actions/cache's changelog.

Releases

How to prepare a release

[!NOTE]
Relevant for maintainers with write access only.

1. Switch to a new branch from main.
2. Run npm test to ensure all tests are passing.
3. Update the version in https://github.com/actions/cache/blob/main/package.json.
4. Run npm run build to update the compiled files.
5. Update this https://github.com/actions/cache/blob/main/RELEASES.md with the new version and changes in the ## Changelog section.
6. Run licensed cache to update the license report.
7. Run licensed status and resolve any warnings by updating the https://github.com/actions/cache/blob/main/.licensed.yml file with the exceptions.
8. Commit your changes and push your branch upstream.
9. Open a pull request against main and get it reviewed and merged.
10. Draft a new release https://github.com/actions/cache/releases use the same version number used in package.json
    1. Create a new tag with the version number.
    2. Auto generate release notes and update them to match the changes you made in RELEASES.md.
    3. Toggle the set as the latest release option.
    4. Publish the release.
11. Navigate to https://github.com/actions/cache/actions/workflows/release-new-action-version.yml
    1. There should be a workflow run queued with the same version number.
    2. Approve the run to publish the new version and update the major tags for this action.

Changelog

5.0.4

• Bump minimatch to v3.1.5 (fixes ReDoS via globstar patterns)
• Bump undici to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)
• Bump fast-xml-parser to v5.5.6

5.0.3

• Bump @actions/cache to v5.0.5 (Resolves: https://github.com/actions/cache/security/dependabot/33)
• Bump @actions/core to v2.0.3

5.0.2

• Bump @actions/cache to v5.0.3 #1692

5.0.1

• Update @azure/storage-blob to ^12.29.1 via @actions/cache@5.0.1 #1685

5.0.0

[!IMPORTANT] actions/cache@v5 runs on the Node.js 24 runtime and requires a minimum Actions Runner version of 2.327.1.

... (truncated)

Commits

• 27d5ce7 Merge pull request #1747 from actions/yacaovsnc/update-dependency
• f280785 licensed changes
• 619aeb1 npm run build generated dist files
• bcf16c2 Update ts-http-runtime to 0.3.5
• See full diff in compare view

Updates rhysd/actionlint from 1.7.11 to 1.7.12

Release notes

Sourced from rhysd/actionlint's releases.

v1.7.12

• Support the timezone configuration in on.schedule with checks for IANA timezone string. See the documentation for more details. Note that actionlint starts to embed the timezone database in the executables from this version so the binary sizes slightly increase. (#641, thanks @​martincostello)

  on:
    schedule:
      # ERROR: The timezone is not a valid IANA timezone string
      - cron: '*/5 * * * *'
        timezone: 'Asia/Somewhere'

• Support the jobs.<job_name>.environment.deployment configuration. (#639, thanks @​springmeyer)
• Support the macos-26-intel runner label. (#629, thanks @​hugovk)
• Fix the outdated table of webhook activity types by rebuilding the script to scrape the table from scratch.
• Support Go 1.26 and drop the support for Go 1.24. Now supported versions are 1.25 and 1.26.
• Tests are run on arm64 Windows in CI.
• Update the popular actions data set to the latest.

Changelog

Sourced from rhysd/actionlint's changelog.

v1.7.12 - 2026-03-30

• Support the timezone configuration in on.schedule with checks for IANA timezone string. See the documentation for more details. Note that actionlint starts to embed the timezone database in the executables from this version so the binary sizes slightly increase. (#641, thanks @​martincostello)

  on:
    schedule:
      # ERROR: The timezone is not a valid IANA timezone string
      - cron: '*/5 * * * *'
        timezone: 'Asia/Somewhere'

• Support the jobs.<job_name>.environment.deployment configuration. (#639, thanks @​springmeyer)
• Support the macos-26-intel runner label. (#629, thanks @​hugovk)
• Fix the table of webhook activity types are outdated by rebuilding the script to scrape the table from scratch.
• Support Go 1.26 and drop the support for Go 1.24. Now supported versions are 1.25 and 1.26.
• Tests are run on arm64 Windows in CI.
• Update the popular actions data set to the latest.

[Changes][v1.7.12]

v1.7.11 - 2026-02-14

• Support the case() function in ${{ }} expressions which was recently added to GitHub Actions. (#612, #614, thanks @​heppu)

  env:
    # ERROR: case() requires an odd number of arguments
    ENVIRONMENT: |-
      ${{ case(
        github.ref == 'refs/heads/main', 'production',
        github.ref == 'refs/heads/staging', 'staging'
      ) }}

• Support new macos-26-large and windows-2025-vs2026 runner labels. See the GitHub's announce for more details. (#615, thanks @​hugovk and @​muzimuzhi)
• Enable Artifact attestations for the released binaries. From v1.7.11 gh command can verify the integrity of the downloaded binaries as follows. The verification is highly recommended in terms of supply chain security. (#608, thanks @​takaram)

  $ gh release download --repo rhysd/actionlint --pattern '*_darwin_amd64.tar.gz' v1.7.11
  $ gh attestation verify --repo rhysd/actionlint actionlint_1.7.11_darwin_amd64.tar.gz
  Loaded digest sha256:17ffc17fed8f0258ef6ad4aed932d3272464c7ef7d64e1cb0d65aa97c9752107 for file://actionlint_1.7.11_darwin_amd64.tar.gz
  Loaded 1 attestation from GitHub API
  The following policy criteria will be enforced:
  
  Predicate type must match:................ https://slsa.dev/provenance/v1
  Source Repository Owner URI must match:... https://github.com/rhysd
  Source Repository URI must match:......... https://github.com/rhysd/actionlint
  Subject Alternative Name must match regex: (?i)^https://github.com/rhysd/actionlint/
  OIDC Issuer must match:................... https://token.actions.githubusercontent.com
  
  ✓ Verification succeeded!

... (truncated)

Commits

• 914e7df bump up version to v1.7.12
• f1fe8a1 update popular actions data set to the latest
• 0ef3e18 add support for https://github.blog/changelog/2026-03-19-github-actions-late-...
• d2f9e65 update document to describe the timezone check in on.schedule
• c03b271 Merge branch 'followup-issue641' (#641)
• c9efd91 fix staticcheck checks files inside ./playground/node_modules
• 08e2336 include timezone database in executable statically
• f48c0a4 fix timezone check is incomplete
• 6b811d3 fix problem matcher test fails due to line ending in test data
• 4897c1d Merge pull request #641 from martincostello/gh-638
• Additional commits viewable in compare view

Updates zizmorcore/zizmor-action from 0.5.2 to 0.5.6

Release notes

Sourced from zizmorcore/zizmor-action's releases.

v0.5.6

• 1.25.2 is now available via the action
• 1.25.2 is now the default version of zizmor used by the action

v0.5.5

This is a no-op release.

v0.5.4

• 1.25.0 is now available via the action
• 1.25.0 is now the default version of zizmor used by the action

v0.5.3

What's Changed

• 1.24.0 and 1.24.1 are now available via the action
• 1.24.1 is now the default version of zizmor used by the action

Full Changelog: zizmorcore/zizmor-action@v0.5.2...v0.5.3

Commits

• 5f14fd0 Sync zizmor versions (#114)
• a16621b Bump pins in README (#112)
• 1c03e04 chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3 in the github-ac...
• b572f7b Sync zizmor versions (#111)
• 06928c5 chore(deps): bump github/codeql-action in the github-actions group (#109)
• 5ea8b96 docs: Update link to GitHub docs (#108)
• 849ac26 chore(deps): bump the github-actions group with 2 updates (#106)
• 814f977 Bump pins in README (#103)
• b1d7e1f Sync zizmor versions (#102)
• a195b57 Sync zizmor versions (#100)
• Additional commits viewable in compare view

Updates actions/upload-artifact from 7.0.0 to 7.0.1

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.1

What's Changed

• Update the readme with direct upload details by @​danwkennedy in actions/upload-artifact#795
• Readme: bump all the example versions to v7 by @​danwkennedy in actions/upload-artifact#796
• Include changes in typespec/ts-http-runtime 0.3.5 by @​yacaovsnc in actions/upload-artifact#797

Full Changelog: actions/upload-artifact@v7...v7.0.1

Commits

• 043fb46 Merge pull request #797 from actions/yacaovsnc/update-dependency
• 634250c Include changes in typespec/ts-http-runtime 0.3.5
• e454baa Readme: bump all the example versions to v7 (#796)
• 74fad66 Update the readme with direct upload details (#795)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.