From 4e89b449489042e5bb0847fd06a82596e1cdb4fe Mon Sep 17 00:00:00 2001
From: "tmt-renovate-bot[bot]"
 <278025917+tmt-renovate-bot[bot]@users.noreply.github.com>
Date: Fri, 7 Aug 2026 02:41:49 +0000
Subject: [PATCH] Update GitHub Actions

---
 .github/workflows/release.yml         | 2 +-
 .github/workflows/renovate.yml        | 2 +-
 .github/workflows/step-shellcheck.yml | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2bbc50e523..3a06591393 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -36,7 +36,7 @@ jobs:
           path: dist
 
       - name: Generate artifact attestation for sdist and wheel
-        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-path: "dist/*"
 
diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml
index 72520d88bd..6f051c3374 100644
--- a/.github/workflows/renovate.yml
+++ b/.github/workflows/renovate.yml
@@ -30,7 +30,7 @@ jobs:
           client-id: ${{ secrets.RENOVATE_BOT_CLIENT_ID }}
           private-key: ${{ secrets.RENOVATE_BOT_PRIVATE_KEY }}
           owner: ${{ github.repository_owner }}
-      - uses: renovatebot/github-action@973d3e5a68e735a444e8c03432b66eedb343c302 # v46.2.0
+      - uses: renovatebot/github-action@316d7cd859606d6039a2182b7d69199e9b036835 # v46.2.1
         with:
           configurationFile: .github/renovate-config.json
           token: '${{ steps.token.outputs.token }}'
diff --git a/.github/workflows/step-shellcheck.yml b/.github/workflows/step-shellcheck.yml
index 2a8086028b..b663a7eba8 100644
--- a/.github/workflows/step-shellcheck.yml
+++ b/.github/workflows/step-shellcheck.yml
@@ -56,7 +56,7 @@ jobs:
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: Differential ShellCheck SARIF
-      - uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
+      - uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
         with:
           sarif_file: ${{ needs.lint.outputs.sarif }}
     if: ${{ inputs.upload_sarif }}