Bump the github-actions group across 1 directory with 5 updates

.github/workflows/ci.yml

@@ -1,39 +1,39 @@
-name: CI
-
-# Builds the .NET 8 Control Panel (hMailCP) on every push / PR. This catches C#
-# regressions cheaply. The C++ server build + the 898-test regression suite need
-# the prebuilt native libraries (OpenSSL 4.0.x, Boost 1.91, PostgreSQL 18 libpq —
-# see libraries/build-dependencies.ps1) and a database service, so they run in the
-# separate, manually-triggered server-build workflow.
-
-on:
-  push:
-    branches: [ master ]
-  pull_request:
-    branches: [ master ]
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  control-panel:
-    name: Build Control Panel (.NET 8)
-    runs-on: windows-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Set up .NET 8
-        uses: actions/setup-dotnet@v4
-        with:
-          dotnet-version: '8.0.x'
-
-      - name: Restore
-        run: dotnet restore hmailserver/source/Tools/ControlPanel/ControlPanel.csproj
-
-      - name: Build (Release, warnings as errors)
-        run: dotnet build hmailserver/source/Tools/ControlPanel/ControlPanel.csproj -c Release --no-restore -warnaserror
-
-      - name: Publish (smoke check)
-        run: dotnet publish hmailserver/source/Tools/ControlPanel/ControlPanel.csproj -c Release -o publish --no-build
+name: CI
+
+# Builds the .NET 8 Control Panel (hMailCP) on every push / PR. This catches C#
+# regressions cheaply. The C++ server build + the 898-test regression suite need
+# the prebuilt native libraries (OpenSSL 4.0.x, Boost 1.91, PostgreSQL 18 libpq —
+# see libraries/build-dependencies.ps1) and a database service, so they run in the
+# separate, manually-triggered server-build workflow.
+
+on:
+  push:
+    branches: [ master ]
+  pull_request:
+    branches: [ master ]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  control-panel:
+    name: Build Control Panel (.NET 8)
+    runs-on: windows-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Set up .NET 8
+        uses: actions/setup-dotnet@v5
+        with:
+          dotnet-version: '8.0.x'
+
+      - name: Restore
+        run: dotnet restore hmailserver/source/Tools/ControlPanel/ControlPanel.csproj
+
+      - name: Build (Release, warnings as errors)
+        run: dotnet build hmailserver/source/Tools/ControlPanel/ControlPanel.csproj -c Release --no-restore -warnaserror
+
+      - name: Publish (smoke check)
+        run: dotnet publish hmailserver/source/Tools/ControlPanel/ControlPanel.csproj -c Release -o publish --no-build

.github/workflows/codeql.yml

@@ -1,48 +1,48 @@
-name: CodeQL
-
-# Static security analysis for the C# code (Control Panel). C++ CodeQL needs the
-# native server build (OpenSSL/Boost/libpq) and is deferred to the server-build
-# pipeline; this workflow scopes the build to the .NET 8 Control Panel.
-
-on:
-  push:
-    branches: [ master ]
-  pull_request:
-    branches: [ master ]
-  schedule:
-    - cron: '32 4 * * 1'   # weekly, Monday 04:32 UTC
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  analyze:
-    name: Analyze (csharp)
-    runs-on: windows-latest
-    permissions:
-      security-events: write
-      actions: read
-      contents: read
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Set up .NET 8
-        uses: actions/setup-dotnet@v4
-        with:
-          dotnet-version: '8.0.x'
-
-      - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
-        with:
-          languages: csharp
-          build-mode: manual
-
-      - name: Build Control Panel
-        run: dotnet build hmailserver/source/Tools/ControlPanel/ControlPanel.csproj -c Release
-
-      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
-        with:
-          category: "/language:csharp"
+name: CodeQL
+
+# Static security analysis for the C# code (Control Panel). C++ CodeQL needs the
+# native server build (OpenSSL/Boost/libpq) and is deferred to the server-build
+# pipeline; this workflow scopes the build to the .NET 8 Control Panel.
+
+on:
+  push:
+    branches: [ master ]
+  pull_request:
+    branches: [ master ]
+  schedule:
+    - cron: '32 4 * * 1'   # weekly, Monday 04:32 UTC
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze (csharp)
+    runs-on: windows-latest
+    permissions:
+      security-events: write
+      actions: read
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Set up .NET 8
+        uses: actions/setup-dotnet@v5
+        with:
+          dotnet-version: '8.0.x'
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: csharp
+          build-mode: manual
+
+      - name: Build Control Panel
+        run: dotnet build hmailserver/source/Tools/ControlPanel/ControlPanel.csproj -c Release
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: "/language:csharp"

.github/workflows/dependency-review.yml

@@ -1,30 +1,30 @@
-name: Dependency review
-
-# On every pull request, fail if the change introduces a dependency with a known
-# high-or-critical CVE (GitHub Advisory Database). This is the merge-time gate
-# that complements Dependabot's continuous alerts and the SBOM workflow, giving
-# the B8 "dependency/CVE scanning" supply-chain requirement a green-gate.
-
-on:
-  pull_request:
-    branches: [ master ]
-
-permissions:
-  contents: read
-
-jobs:
-  dependency-review:
-    name: Dependency review
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: write
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Review dependencies
-        uses: actions/dependency-review-action@v4
-        with:
-          fail-on-severity: high
-          comment-summary-in-pr: on-failure
+name: Dependency review
+
+# On every pull request, fail if the change introduces a dependency with a known
+# high-or-critical CVE (GitHub Advisory Database). This is the merge-time gate
+# that complements Dependabot's continuous alerts and the SBOM workflow, giving
+# the B8 "dependency/CVE scanning" supply-chain requirement a green-gate.
+
+on:
+  pull_request:
+    branches: [ master ]
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    name: Dependency review
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Review dependencies
+        uses: actions/dependency-review-action@v5
+        with:
+          fail-on-severity: high
+          comment-summary-in-pr: on-failure

.github/workflows/sbom.yml

@@ -1,44 +1,44 @@
-name: SBOM
-
-# Generates a Software Bill of Materials for the repository on every push to
-# master and attaches it to every published GitHub release, so each shipped
-# build has an auditable inventory of its components. Syft (anchore/sbom-action)
-# inventories the .NET package references and the files in the tree; the SBOM is
-# emitted in both SPDX and CycloneDX JSON. Combined with Dependabot + the
-# dependency-review gate, this delivers the B8 "SBOM + dependency/CVE scanning"
-# supply-chain requirement.
-
-on:
-  push:
-    branches: [ master ]
-  release:
-    types: [ published ]
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  sbom:
-    name: Generate SBOM (SPDX + CycloneDX)
-    runs-on: ubuntu-latest
-    permissions:
-      # Required so the SBOM can be attached as an asset on release events.
-      contents: write
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Generate SPDX SBOM
-        uses: anchore/sbom-action@v0
-        with:
-          path: .
-          format: spdx-json
-          artifact-name: hmailserver.spdx.json
-
-      - name: Generate CycloneDX SBOM
-        uses: anchore/sbom-action@v0
-        with:
-          path: .
-          format: cyclonedx-json
-          artifact-name: hmailserver.cyclonedx.json
+name: SBOM
+
+# Generates a Software Bill of Materials for the repository on every push to
+# master and attaches it to every published GitHub release, so each shipped
+# build has an auditable inventory of its components. Syft (anchore/sbom-action)
+# inventories the .NET package references and the files in the tree; the SBOM is
+# emitted in both SPDX and CycloneDX JSON. Combined with Dependabot + the
+# dependency-review gate, this delivers the B8 "SBOM + dependency/CVE scanning"
+# supply-chain requirement.
+
+on:
+  push:
+    branches: [ master ]
+  release:
+    types: [ published ]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  sbom:
+    name: Generate SBOM (SPDX + CycloneDX)
+    runs-on: ubuntu-latest
+    permissions:
+      # Required so the SBOM can be attached as an asset on release events.
+      contents: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Generate SPDX SBOM
+        uses: anchore/sbom-action@v0
+        with:
+          path: .
+          format: spdx-json
+          artifact-name: hmailserver.spdx.json
+
+      - name: Generate CycloneDX SBOM
+        uses: anchore/sbom-action@v0
+        with:
+          path: .
+          format: cyclonedx-json
+          artifact-name: hmailserver.cyclonedx.json