chore(deps): bump the github-actions group across 1 directory with 9 updates

.github/workflows/ci.yml

@@ -81,7 +81,7 @@ jobs:
       - run: uv run pytest --cov=src --cov-report=term-missing --cov-report=xml --cov-fail-under=85
         env:
           UV_PYTHON: ${{ matrix.python-version }}
-      - uses: codecov/codecov-action@v5
+      - uses: codecov/codecov-action@v6
         if: matrix.os == 'ubuntu-latest' && matrix.python-version == '3.12' && matrix.adk-version == ''
         with:
           fail_ci_if_error: false

.github/workflows/codeql.yml

@@ -22,12 +22,12 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4
+        uses: github/codeql-action/init@v4.35.2
         with:
           languages: python
           queries: security-extended
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4
+        uses: github/codeql-action/analyze@v4.35.2
         with:
           category: "/language:python"

.github/workflows/publish.yml

@@ -80,7 +80,7 @@ jobs:
           echo "CLI entry point — OK"
 
       - name: Upload dist artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: dist
           path: dist/
@@ -109,7 +109,7 @@ jobs:
           enable-cache: false
           ignore-empty-workdir: true
       - name: Download dist artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: dist
           path: dist/
@@ -118,7 +118,7 @@ jobs:
         run: uv publish --trusted-publishing always --check-url https://pypi.org/simple/
 
       - name: Attest build provenance
-        uses: astral-sh/[email protected].5
+        uses: astral-sh/[email protected].6
         with:
           paths: dist/*
 
@@ -156,12 +156,12 @@ jobs:
         run: uv run mkdocs build
 
       - name: Configure GitHub Pages
-        uses: actions/configure-pages@v5
+        uses: actions/configure-pages@v6
 
       - name: Upload Pages artifact
-        uses: actions/upload-pages-artifact@v4
+        uses: actions/upload-pages-artifact@v5
         with:
           path: site/
 
       - name: Deploy to GitHub Pages
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5

.github/workflows/release-please.yml

@@ -19,7 +19,7 @@ jobs:
     steps:
       - name: Run release-please
         id: release
-        uses: googleapis/release-please-action@v4
+        uses: googleapis/release-please-action@v5
         with:
           # Use PAT to allow created releases to trigger publish workflow
           # Create PAT with 'repo' scope and add as RELEASE_PLEASE_TOKEN secret