chore(deps): bump the github-actions group across 1 directory with 9 updates

[dependabot]

Summary

Updates nine GitHub Actions dependencies to their current pinned commits, including checkout, Docker login, CodeQL, setup-python, setup-uv, OSSF Scorecard, and SARIF upload. Follow-up hardening preserves the repository's existing security and cache semantics by disabling checkout credential persistence in read-only workflows and explicitly retaining setup-uv cache pruning after the v9 default change.

Git Flow target

• dependabot/github_actions/develop/* → develop.

Verification

• Required GitHub Actions workflows run against head 762e11330e320d68175d832b0840222bcf01b518.
• CodeRabbit findings for checkout credential persistence and prune-cache were implemented in all affected workflows.
• Workflow action references remain pinned to immutable commit SHAs.

Notes

• release.yml intentionally keeps cache disabled and therefore does not need prune-cache.
• Auto-merge is enabled and remains gated by required checks and an independent approval.

Dependency updates

Package	From	To
actions/checkout	7.0.0	7.0.1
docker/login-action	4.4.0	4.5.2
github/codeql-action/*	4.37.0	4.37.3
actions/setup-python	6.3.0	7.0.0
astral-sh/setup-uv	8.3.2	9.0.0
ossf/scorecard-action	2.4.3	2.4.4

[coderabbitai]

📝 Walkthrough

Walkthrough

여러 GitHub Actions 워크플로우에서 uses: 항목의 고정 커밋 SHA가 새 버전으로 갱신되었습니다. 워크플로우의 트리거, 입력값, 권한 및 실행 구조는 변경되지 않았습니다.

Changes

워크플로우 액션 핀 업데이트

Layer / File(s)	Summary
컨테이너 빌드 액션 핀 업데이트 .github/workflows/build-ci-image.yml, .github/workflows/container-image.yml	컨테이너 이미지 빌드에 사용하는 checkout, Buildx 및 Docker 로그인 액션의 고정 커밋 SHA가 갱신되었습니다.
보안 및 품질 검사 액션 핀 업데이트 .github/workflows/clusterfuzzlite.yml, .github/workflows/codeql.yml, .github/workflows/dependency-review.yml, .github/workflows/scorecards.yml	체크아웃, CodeQL, 의존성 검토, Scorecards 및 SARIF 업로드 액션의 고정 커밋 SHA가 갱신되었습니다.
빌드 및 배포 액션 핀 업데이트 .github/workflows/gh-pages.yml, .github/workflows/quality-gate.yml, .github/workflows/release.yml, .github/workflows/tests.yml	checkout, Python 설정 및 uv 설정 액션의 고정 커밋 SHA가 갱신되었으며 기존 단계 설정은 유지되었습니다.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• ContextualWisdomLab/newsdom-api#15: 동일한 GitHub Actions 워크플로우의 고정 액션 SHA를 갱신합니다.
• ContextualWisdomLab/newsdom-api#20: 동일한 워크플로우에서 checkout 및 CodeQL 액션 핀을 업데이트합니다.
• ContextualWisdomLab/newsdom-api#108: GitHub 및 Docker 액션의 고정 커밋 SHA를 여러 워크플로우에서 갱신합니다.

Suggested reviewers: seonghobae

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	제목은 GitHub Actions 의존성 9건을 업데이트한 주요 변경 사항을 정확하고 간결하게 설명합니다.
Description check	✅ Passed	설명은 Summary, Git Flow target, Verification, Notes의 모든 필수 섹션을 포함하고 변경 사항과 검증 내용을 설명합니다.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Fix failing CI checks

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dependabot/github_actions/develop/github-actions-85eea91bec

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

.github/workflows/gh-pages.yml (1)

45-46: 🚀 Performance & Scalability | 🔵 Trivial | ⚡ Quick win

setup-uv 캐시 정리 동작을 모든 캐시 사용 워크플로에서 명시하세요.

setup-uv v9의 prune-cache 기본값 변경으로 캐시 정리 정책이 달라질 수 있습니다.

• .github/workflows/gh-pages.yml#L45-L46: prune-cache: true를 추가하세요.
• .github/workflows/quality-gate.yml#L26-L27: prune-cache: true를 추가하세요.
• .github/workflows/tests.yml#L26-L27: prune-cache: true를 추가하세요.

.github/workflows/release.yml은 캐시를 비활성화하므로 이 변경의 영향을 받지 않습니다.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/gh-pages.yml around lines 45 - 46, Explicitly set
prune-cache: true on the setup-uv steps in .github/workflows/gh-pages.yml lines
45-46, .github/workflows/quality-gate.yml lines 26-27, and
.github/workflows/tests.yml lines 26-27. No change is needed in
.github/workflows/release.yml because its cache is disabled.

Source: MCP tools

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/clusterfuzzlite.yml:
- Line 17: Disable checkout credential persistence in the checkout steps at
.github/workflows/clusterfuzzlite.yml:17-17 and
.github/workflows/dependency-review.yml:18-18 by adding the with configuration
with persist-credentials set to false.

---

Nitpick comments:
In @.github/workflows/gh-pages.yml:
- Around line 45-46: Explicitly set prune-cache: true on the setup-uv steps in
.github/workflows/gh-pages.yml lines 45-46, .github/workflows/quality-gate.yml
lines 26-27, and .github/workflows/tests.yml lines 26-27. No change is needed in
.github/workflows/release.yml because its cache is disabled.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 2bca0e3e-a9f4-49d8-884f-0acfe88ccd34

📥 Commits

Reviewing files that changed from the base of the PR and between 04491c0 and c6ded5b.

📒 Files selected for processing (10)

• .github/workflows/build-ci-image.yml
• .github/workflows/clusterfuzzlite.yml
• .github/workflows/codeql.yml
• .github/workflows/container-image.yml
• .github/workflows/dependency-review.yml
• .github/workflows/gh-pages.yml
• .github/workflows/quality-gate.yml
• .github/workflows/release.yml
• .github/workflows/scorecards.yml
• .github/workflows/tests.yml

[seonghobae]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

Reviewed the immutable action-SHA updates and the follow-up hardening. Checkout credential persistence is disabled in the read-only workflows identified by review, setup-uv v9 retains the prior cache-pruning behavior where caching is enabled, and release remains intentionally uncached. Current-head checks are the remaining merge gate.

[seonghobae]

@jules Please add a narrowly scoped governance regression test on this PR branch that prevents these reviewed workflow semantics from regressing: read-only checkout steps in clusterfuzzlite.yml and dependency-review.yml must set persist-credentials: false; setup-uv steps in gh-pages.yml, quality-gate.yml, and tests.yml must explicitly set prune-cache: true; release.yml must remain intentionally uncached. Keep the test deterministic and dependency-free, update no unrelated files, and run the full warnings-as-errors/100% branch-coverage suite plus workflow YAML validation.

[seonghobae]

Temporarily parking this workflow dependency update so the base-branch CVE remediation is the sole consumer of the constrained required-workflow queue. The hardened branch is preserved and will be reopened, rebased, and fully revalidated after the security base merge.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml