ci(deps): update GitHub Actions to latest versions

.github/workflows/agents-63-issue-intake.yml

@@ -226,7 +226,7 @@ jobs:
       issues: write # Only elevated when a sync actually mutates issues; early exits remain read-only.
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Echo received inputs
         run: |
@@ -362,7 +362,7 @@ jobs:
           fi
 
       - name: Sync issues
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         env:
           RUN_URL: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}
         with:
@@ -1093,7 +1093,7 @@ jobs:
         env:
           INPUT_ISSUE: ${{ needs.normalize_inputs.outputs.issue_number }}
           DEFAULT_AGENT: ${{ needs.normalize_inputs.outputs.bridge_agent }}
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           script: |
             const manual = (process.env.INPUT_ISSUE || '').trim();

.github/workflows/agents-64-verify-agent-assignment.yml

@@ -60,7 +60,7 @@ jobs:
     steps:
       - name: Inspect issue
         id: check
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         env:
           ISSUE_NUMBER: ${{ inputs.issue_number }}
           VALID_ASSIGNEES: ${{ inputs.valid_assignees }}

.github/workflows/agents-71-codex-belt-dispatcher.yml

@@ -142,7 +142,7 @@ jobs:
 
       - name: Resolve candidate issue
         id: pick
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           github-token: ${{ env.GH_DISPATCH_TOKEN }}
           script: |
@@ -211,7 +211,7 @@ jobs:
 
       - name: Checkout default branch
         if: ${{ steps.pick.outputs.issue != '' && steps.mode.outputs.dry_run != 'true' }}
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           ref: ${{ steps.pick.outputs.base }}
           token: ${{ env.GH_DISPATCH_TOKEN }}
@@ -237,7 +237,7 @@ jobs:
 
       - name: Transition issue to in-progress
         if: ${{ steps.pick.outputs.issue != '' && steps.mode.outputs.dry_run != 'true' }}
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           github-token: ${{ env.GH_DISPATCH_TOKEN }}
           script: |

.github/workflows/agents-72-codex-belt-worker.yml

@@ -187,7 +187,7 @@ jobs:
 
       - name: Determine worker mode
         id: mode
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           script: |
             const coerce = (value) => {
@@ -220,7 +220,7 @@ jobs:
 
       - name: Resolve worker context
         id: ctx
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           github-token: ${{ env.GH_BELT_TOKEN }}
           script: |
@@ -286,7 +286,7 @@ jobs:
 
       - name: Determine default branch
         id: base
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           github-token: ${{ env.GH_BELT_TOKEN }}
           script: |
@@ -301,7 +301,7 @@ jobs:
 
       - name: Check parallel allowance
         id: parallel
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           github-token: ${{ env.GH_BELT_TOKEN }}
           script: |
@@ -336,7 +336,7 @@ jobs:
       - name: Evaluate keepalive worker gate
         if: ${{ inputs.keepalive == true }}
         id: keepalive_gate
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         env:
           KEEPALIVE: ${{ inputs.keepalive && 'true' || 'false' }}
           ISSUE_NUMBER: ${{ steps.ctx.outputs.issue }}
@@ -393,7 +393,7 @@ jobs:
       - name: Prune merged step branches
         if: ${{ steps.parallel.outputs.allowed == 'true' && (inputs.keepalive != true || steps.keepalive_gate.outputs.action != 'skip') && steps.mode.outputs.dry_run != 'true' }}
         id: prune
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           github-token: ${{ env.GH_BELT_TOKEN }}
           script: |
@@ -466,7 +466,7 @@ jobs:
       - name: Re-verify issue labels
         if: ${{ steps.parallel.outputs.allowed == 'true' && (inputs.keepalive != true || steps.keepalive_gate.outputs.action != 'skip') }}
         id: verify
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           github-token: ${{ env.GH_BELT_TOKEN }}
           script: |
@@ -487,7 +487,7 @@ jobs:
 
       - name: Checkout branch
         if: ${{ steps.parallel.outputs.allowed == 'true' && (inputs.keepalive != true || steps.keepalive_gate.outputs.action != 'skip') }}
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           ref: ${{ steps.ctx.outputs.branch }}
           token: ${{ env.GH_BELT_TOKEN }}
@@ -851,7 +851,7 @@ jobs:
 
       - name: Ensure issue labels reflect in-progress state
         if: ${{ steps.parallel.outputs.allowed == 'true' && (inputs.keepalive != true || steps.keepalive_gate.outputs.action != 'skip') && steps.mode.outputs.dry_run != 'true' && steps.verify.outputs.has_in_progress != 'true' }}
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           github-token: ${{ env.GH_BELT_TOKEN }}
           script: |
@@ -865,7 +865,7 @@ jobs:
 
       - name: Remove residual status:ready label
         if: ${{ steps.parallel.outputs.allowed == 'true' && (inputs.keepalive != true || steps.keepalive_gate.outputs.action != 'skip') && steps.mode.outputs.dry_run != 'true' && steps.verify.outputs.has_ready == 'true' }}
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           github-token: ${{ env.GH_BELT_TOKEN }}
           script: |
@@ -882,7 +882,7 @@ jobs:
       - name: Open or refresh Codex PR
         if: ${{ steps.parallel.outputs.allowed == 'true' && (inputs.keepalive != true || steps.keepalive_gate.outputs.action != 'skip') && steps.mode.outputs.dry_run != 'true' }}
         id: pr
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           github-token: ${{ env.GH_BELT_TOKEN }}
           script: |
@@ -935,7 +935,7 @@ jobs:
 
       - name: Configure auto-merge strategy
         if: ${{ steps.parallel.outputs.allowed == 'true' && (inputs.keepalive != true || steps.keepalive_gate.outputs.action != 'skip') && steps.mode.outputs.dry_run != 'true' && steps.pr.outputs.number }}
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           github-token: ${{ env.GH_BELT_TOKEN }}
           script: |
@@ -967,7 +967,7 @@ jobs:
 
       - name: Apply automation labels
         if: ${{ steps.parallel.outputs.allowed == 'true' && (inputs.keepalive != true || steps.keepalive_gate.outputs.action != 'skip') && steps.mode.outputs.dry_run != 'true' && steps.pr.outputs.number }}
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           github-token: ${{ env.GH_BELT_TOKEN }}
           script: |
@@ -982,7 +982,7 @@ jobs:
 
       - name: Ensure PR assignees include automation
         if: ${{ steps.parallel.outputs.allowed == 'true' && (inputs.keepalive != true || steps.keepalive_gate.outputs.action != 'skip') && steps.mode.outputs.dry_run != 'true' && steps.pr.outputs.number }}
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           github-token: ${{ env.GH_BELT_TOKEN }}
           script: |
@@ -1000,7 +1000,7 @@ jobs:
 
       - name: Post activation comment
         if: ${{ steps.parallel.outputs.allowed == 'true' && (inputs.keepalive != true || steps.keepalive_gate.outputs.action != 'skip') && steps.mode.outputs.dry_run != 'true' && steps.pr.outputs.number && inputs.keepalive != true }}
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           github-token: ${{ env.GH_BELT_TOKEN }}
           script: |
@@ -1042,7 +1042,7 @@ jobs:
 
       - name: Sync issue comment with PR link
         if: ${{ steps.parallel.outputs.allowed == 'true' && (inputs.keepalive != true || steps.keepalive_gate.outputs.action != 'skip') && steps.mode.outputs.dry_run != 'true' && steps.pr.outputs.number }}
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           github-token: ${{ env.GH_BELT_TOKEN }}
           script: |

.github/workflows/agents-73-codex-belt-conveyor.yml

@@ -153,7 +153,7 @@ jobs:
 
       - name: Summarise invocation
         id: summary
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           script: |
             const summary = core.summary;
@@ -212,7 +212,7 @@ jobs:
 
       - name: Load PR details
         id: pr
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           github-token: ${{ env.GH_CONVEYOR_TOKEN }}
           script: |
@@ -251,7 +251,7 @@ jobs:
 
       - name: Ensure Gate succeeded
         id: gate
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           github-token: ${{ env.GH_CONVEYOR_TOKEN }}
           script: |
@@ -270,7 +270,7 @@ jobs:
 
       - name: Detect bootstrap-only placeholder change
         id: bootstrap
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           github-token: ${{ env.GH_CONVEYOR_TOKEN }}
           script: |
@@ -335,7 +335,7 @@ jobs:
       - name: Merge PR with squash
         if: ${{ steps.mode.outputs.dry_run != 'true' && steps.bootstrap.outputs.bootstrap != 'true' }}
         id: merge
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           github-token: ${{ env.GH_CONVEYOR_TOKEN }}
           script: |
@@ -350,7 +350,7 @@ jobs:
 
       - name: Delete branch after merge
         if: ${{ steps.mode.outputs.dry_run != 'true' && steps.bootstrap.outputs.bootstrap != 'true' && steps.merge.outputs.merged == 'true' }}
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           github-token: ${{ env.GH_CONVEYOR_TOKEN }}
           script: |
@@ -364,7 +364,7 @@ jobs:
 
       - name: Close source issue
         if: ${{ steps.mode.outputs.dry_run != 'true' && steps.bootstrap.outputs.bootstrap != 'true' && steps.merge.outputs.merged == 'true' }}
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           github-token: ${{ env.GH_CONVEYOR_TOKEN }}
           script: |
@@ -394,7 +394,7 @@ jobs:
 
       - name: Leave merge confirmation on PR
         if: ${{ steps.mode.outputs.dry_run != 'true' && steps.bootstrap.outputs.bootstrap != 'true' && steps.merge.outputs.merged == 'true' }}
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           github-token: ${{ env.GH_CONVEYOR_TOKEN }}
           script: |
@@ -416,7 +416,7 @@ jobs:
 
       - name: Re-dispatch dispatcher
         if: ${{ steps.mode.outputs.dry_run != 'true' && steps.bootstrap.outputs.bootstrap != 'true' && steps.merge.outputs.merged == 'true' }}
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           github-token: ${{ env.GH_CONVEYOR_TOKEN }}
           script: |

.github/workflows/agents-autofix-loop.yml

@@ -39,15 +39,15 @@ jobs:
       security_reason: ${{ steps.security_gate.outputs.reason }}
     steps:
       - name: Checkout (for security gate)
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           sparse-checkout: |
             .github/scripts/prompt_injection_guard.js
           sparse-checkout-cone-mode: false
 
       - name: Security gate - prompt injection guard
         id: security_gate
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
@@ -102,7 +102,7 @@ jobs:
 
       - name: Evaluate workflow_run
         id: evaluate
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           script: |
             const run = context.payload.workflow_run;
@@ -350,7 +350,7 @@ jobs:
     environment: agent-standard
     steps:
       - name: Add needs-human label and comment
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           script: |
             const prNumber = Number('${{ needs.prepare.outputs.pr_number }}');
@@ -404,7 +404,7 @@ jobs:
     steps:
       - name: Collect metrics
         id: collect
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |

.github/workflows/agents-bot-comment-handler.yml

@@ -61,7 +61,7 @@ jobs:
     steps:
       - name: Resolve PR number and check conditions
         id: resolve
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           script: |
             const eventName = context.eventName;
@@ -162,7 +162,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Remove trigger label
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           script: |
             try {