chore(ci): bump pinned actions to latest within their major

[thewrz]

This was written agentically; verify its assertions and edit accordingly:

Why

#127 edited the workflow files and put both routine action-bump PRs into conflict — #123 (Renovate) and #137 (Dependabot). This lands the same bumps directly.

What

Action	From	To
actions/checkout	v6.0.2	v6.1.0
actions/setup-node	v6.4.0	v6.5.0
softprops/action-gh-release	v3.0.0	v3.0.2

Every SHA was resolved from the upstream tag via the GitHub API, not copied out of a bot PR body, and each target is the newest release inside the major currently pinned. Pins remain full 40-character commit SHAs with the version in a trailing comment, per the repo's supply-chain convention.

Majors deliberately excluded

Left for individual review, not swept in here:

• actions/checkout v7
• actions/setup-node v7
• github/codeql-action v4
• actions/dependency-review-action v5 — the one that matters most. Its fail-on-severity behavior may differ across majors, which is exactly why chore(ci): run Dependabot alongside Renovate, repin dependency-review-action #125 pinned v4.9.0 rather than taking v5.

actions/upload-artifact (v7.0.1) and peter-evans/create-issue-from-file (v6.0.0) are already at their latest and unchanged.

Testing

• All five workflow files parse as valid YAML
• No stale SHAs remain (grepped for all three previous pins)
• Every resulting pin is a full 40-char SHA with a version comment
• CI green — checkout and setup-node are exercised by every job in this PR's own run, which is the real test

Supersedes

#123 and #137.

🤖 Co-authored by Claude Opus 5 (1M context).

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: a4ebb32a-47d3-4b9d-aec9-e7479402a196

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}