chore(ci): Update github-actions

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	minor	v6.0.2 → v6.1.0
actions/setup-node	action	minor	v6.4.0 → v6.5.0
softprops/action-gh-release	action	patch	v3.0.0 → v3.0.2

---

Release Notes

actions/checkout (actions/checkout)

v6.1.0

Compare Source

v6.0.3

Compare Source

• Fix checkout init for SHA-256 repositories by @​yaananth in #​2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in #​2414

actions/setup-node (actions/setup-node)

v6.5.0

Compare Source

What's Changed

• Update @​actions/cache to 5.1.0 and add security overrides for undici and fast-xml-parser by @​HarithaVattikuti in #​1579

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

softprops/action-gh-release (softprops/action-gh-release)

v3.0.2

Compare Source

3.0.2 is a patch release focused on release reliability and compatibility. It
reuses existing draft releases when publishing prereleases, supports replacing
release assets on Gitea, hardens streamed asset uploads, and provides clearer
release-creation diagnostics. It also includes TypeScript, coverage, and tooling
maintenance merged since 3.0.1.

This release fixes #​795, #​438, and #​803. The upload transport hardening covers the
historical failure reported in #​790, although current hosted Node 24 runners did
not reproduce it naturally. The diagnostics work is related to #​786 and does not
claim a reproducible release-creation fix.

What's Changed

Exciting New Features 🎉

• feat: improve release error reporting and test coverage by @​chenrui333 in #​813

Bug fixes 🐛

• fix: publish existing draft releases as prereleases by @​godfengliang in #​801
• fix: upload small checksum assets reliably by @​chenrui333 in #​815
• fix: replace existing release assets on Gitea by @​chenrui333 in #​816
• fix: clarify release creation 404 errors by @​chenrui333 in #​817

Other Changes 🔄

• chore(deps): upgrade TypeScript to 7 by @​chenrui333 in #​812
• chore(deps): remove unused TypeScript tooling by @​chenrui333 in #​814
• dependency, Node 24 pin, and CI maintenance merged since 3.0.1

v3.0.1

Compare Source

3.0.1

• maintenance release with updated dependencies

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[thewrz]

This was written agentically; verify its assertions and edit accordingly:

Closing — superseded by #143.

#127 edited the workflow files, putting this PR into conflict. #143 lands the same three bumps directly: actions/checkout v6.0.2 → v6.1.0, actions/setup-node v6.4.0 → v6.5.0, softprops/action-gh-release v3.0.0 → v3.0.2 — with each SHA resolved from the upstream tag through the GitHub API rather than copied from a PR body.

Majors are deliberately left out of #143 for individual review: checkout v7, setup-node v7, codeql-action v4, and dependency-review-action v5.

🤖 Co-authored by Claude Opus 5 (1M context).