build: bump the github-actions group across 4 directories with 5 updates

.github/actions/check-jsonschema/action.yml

@@ -45,7 +45,7 @@ runs:
   using: composite
   steps:
     - name: Set up uv
-      uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+      uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
       with:
         python-version: ${{ inputs.python-version }}
 

.github/actions/pyright/action.yml

@@ -33,7 +33,7 @@ runs:
   using: composite
   steps:
     - name: Set up uv
-      uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+      uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
       with:
         python-version: ${{ inputs.python-version }}
 

.github/actions/ruff/action.yml

@@ -29,7 +29,7 @@ runs:
   using: composite
   steps:
     - name: Set up uv
-      uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+      uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
       with:
         python-version: ${{ inputs.python-version }}
 

.github/workflows/pr-require-checks.yml

@@ -67,7 +67,7 @@
           persist-credentials: false
       - name: Detect relevant lanes
         id: detect
         uses: ./.github/actions/detect-changes
         with:
           # Every group includes `.github/**`, so any workflow, action, or
           # bundled script change re-runs every scoped lane.
@@ -149,7 +149,7 @@
       # change-detection lists the pull request's files. A called workflow
       # cannot elevate, so the grant has to be here as well as in pr-run-checks.yml.
       pull-requests: read
     uses: ./.github/workflows/pr-run-checks.yml
     with:
       # This public repository's hosted lane is free; private consumers pass
       # their hardcoded fleet label instead.
@@ -187,7 +187,7 @@
         with:
           persist-credentials: false
       - name: Analyze PowerShell
         uses: ./.github/actions/psscriptanalyzer
       - name: Analyze composite action PowerShell
         # pwsh embedded in composite metadata is invisible to the lane action
         # and to actionlint; the lane action installed the pinned analyzer.
@@ -208,7 +208,7 @@
       - name: Resolve heading citations
         # Scope to the fixture corpus: the repo's own docs use no `file.md`
         # "Anchor" prose-cite convention, so the fixture is what exercises it.
         uses: ./.github/actions/check-markdown-references
         with:
           globs: fixtures/reference-integrity/*.md
 
@@ -223,7 +223,7 @@
         with:
           persist-credentials: false
       - name: Lint and format-check Python
         uses: ./.github/actions/ruff
         with:
           paths: fixtures/python/good
           config: fixtures/python/good/ruff.toml
@@ -239,7 +239,7 @@
         with:
           persist-credentials: false
       - name: Type-check Python
         uses: ./.github/actions/pyright
         with:
           config: fixtures/python/good/pyrightconfig.json
 
@@ -256,7 +256,7 @@
       - name: Lint and format-check JS/TS
         # Biome has no CLI exclude, so scope at the conforming fixture and the
         # selector's tested CommonJS source/generator/tests.
         uses: ./.github/actions/biome
         with:
           paths: fixtures/typescript/good .github/scripts
           config: fixtures/typescript/good/biome.json
@@ -274,7 +274,7 @@
       - name: Build .NET contract fixture
         # Scope at a self-contained fixture project; this lane verifies the
         # action contract without mirroring the standards catalog.
         uses: ./.github/actions/dotnet-build
         with:
           project: fixtures/dotnet/good/good.csproj
 
@@ -289,7 +289,7 @@
         with:
           persist-credentials: false
       - name: Verify .NET whitespace
         uses: ./.github/actions/dotnet-format
         with:
           project: fixtures/dotnet/good/good.csproj
 
@@ -563,7 +563,7 @@
       contents: read
       pull-requests: write
       id-token: write
-    uses: melodic-software/ci-workflows/.github/workflows/pr-review.yml@ab83b01273026ab5c23c6f3b40e946d97a863fa2 # v0.39.3
+    uses: melodic-software/ci-workflows/.github/workflows/pr-review.yml@a92020292976c2e9b50f7adc922693a45a6c1226 # v0.40.0
     secrets:
       CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
 
@@ -573,7 +573,7 @@
       contents: read
       pull-requests: write
       id-token: write
-    uses: melodic-software/ci-workflows/.github/workflows/pr-review-security.yml@ab83b01273026ab5c23c6f3b40e946d97a863fa2 # v0.39.3
+    uses: melodic-software/ci-workflows/.github/workflows/pr-review-security.yml@a92020292976c2e9b50f7adc922693a45a6c1226 # v0.40.0
     secrets:
       CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
 
@@ -583,7 +583,7 @@
     if: ${{ github.event_name == 'issues' }}
     permissions:
       issues: write
-    uses: melodic-software/ci-workflows/.github/workflows/intake-label-needs-triage.yml@ab83b01273026ab5c23c6f3b40e946d97a863fa2 # v0.39.3
+    uses: melodic-software/ci-workflows/.github/workflows/intake-label-needs-triage.yml@a92020292976c2e9b50f7adc922693a45a6c1226 # v0.40.0
 
   # Arms auto-merge on this repo's vendor Dependabot bumps, pinned so a bump
   # cannot redefine the code holding the write token. Never in `ci-status`:
@@ -593,7 +593,7 @@
     permissions:
       contents: write # enablePullRequestAutoMerge
       pull-requests: write # Arm or disarm auto-merge; list the PR's commits.
-    uses: melodic-software/ci-workflows/.github/workflows/pr-automerge-dependabot.yml@ab83b01273026ab5c23c6f3b40e946d97a863fa2 # v0.39.3
+    uses: melodic-software/ci-workflows/.github/workflows/pr-automerge-dependabot.yml@a92020292976c2e9b50f7adc922693a45a6c1226 # v0.40.0
     with:
       runner: ubuntu-24.04