ci(deps): bump actions, excluding the MSRV toolchain pin

[doublegate]

Supersedes #5. Takes every action bump in that group except one that would have quietly disabled a gate.

The one I dropped

Dependabot proposed dtolnay/rust-toolchain@1.88 → @1.100.

That ref is not an action version — it selects which Rust toolchain to install, and the MSRV job pins it to the workspace rust-version. Applying it would have left the step named "Install Rust 1.88" while installing 1.100, so the MSRV gate would keep passing without ever testing the floor it exists to enforce.

The pin stays at 1.88, and dtolnay/rust-toolchain is now ignored in dependabot.yml — that pin must only ever move together with Cargo.toml.

The majors I checked rather than assumed

Action	Finding
upload-artifact v4 → v7	archive: still defaults to true, so zipping is unchanged. All call sites pass only name + path.
download-artifact v4 → v8	Now ESM; checks Content-Type before unzipping; errors on hash mismatch where it previously warned — strictly safer. Both call sites pass only name + path.
codecov-action v4 → v7	Inputs used here (files, flags, name, fail_ci_if_error, token) all survive the v5 CLI rewrite; files is already the plural form that replaced file.

Remaining bumps — checkout v7, cache v6, github-script v9, setup-buildx v4, login-action v4, build-push-action v7, configure/deploy/upload-pages, dependency-review v5 — are all used with default inputs.

All 16 workflow files re-validated as parseable YAML.

Sources: upload-artifact releases, download-artifact releases, GitHub Changelog: non-zipped artifacts

🤖 Generated with Claude Code

https://claude.ai/code/session_01NBDCJvLbq7nuor7RtT57rD

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: ff46c5fa-0739-410a-aa67-cd092c2c2cc7

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🤖 Hi @doublegate, I've received your request, and I'm working on it now! You can track my progress in the logs for more details.

[github-actions]

🤖 I'm sorry @doublegate, but I was unable to process your request. Please see the logs for more details.

[Copilot]

🟡 Changes recommended

There’s at least one confirmed inconsistency in action version annotation/pinning that should be corrected to avoid confusing (or breaking) the repository’s ratchet/pinning conventions.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Updates the repository’s GitHub Actions workflows to newer major versions while explicitly preserving the MSRV toolchain pin (dtolnay/rust-toolchain@1.88) and preventing Dependabot from “bumping” that toolchain selector independently of Cargo.toml.

Changes:

• Bump commonly used actions across workflows (checkout, cache, upload/download-artifact, github-script, Codecov, Docker build/login actions, Pages actions, dependency-review).
• Preserve and document the MSRV gate’s Rust toolchain selector pin (dtolnay/rust-toolchain@1.88) in the CI workflow.
• Configure Dependabot to ignore dtolnay/rust-toolchain updates in the github-actions ecosystem.

File summaries

File	Description
.github/workflows/release.yml	Bumps checkout/upload/download-artifact/github-script versions used for release automation.
.github/workflows/packages.yml	Bumps checkout/upload/download-artifact and Docker buildx/login/build-push actions for packaging/publishing.
.github/workflows/mdbook.yml	Bumps checkout and GitHub Pages actions used to build/deploy docs.
.github/workflows/markdown-links.yml	Bumps checkout for the link-check workflow.
.github/workflows/gemini-triage.yml	Updates pinned SHAs for github-script and create-github-app-token used by Gemini triage automation.
.github/workflows/gemini-scheduled-triage.yml	Updates pinned SHAs for github-script and create-github-app-token used by scheduled triage automation.
.github/workflows/gemini-review.yml	Updates pinned SHAs for checkout and create-github-app-token used by Gemini review automation.
.github/workflows/gemini-invoke.yml	Updates pinned SHA for create-github-app-token used by Gemini invocation workflow.
.github/workflows/gemini-dispatch.yml	Updates pinned SHAs for github-script and create-github-app-token used by Gemini dispatch automation.
.github/workflows/fuzz.yml	Bumps checkout/cache/upload-artifact used by fuzzing CI.
.github/workflows/dependency-review.yml	Bumps checkout and dependency-review-action.
.github/workflows/coverage.yml	Bumps checkout/codecov-action/upload-artifact/github-script used by coverage pipeline.
.github/workflows/codeql.yml	Bumps checkout for CodeQL workflow.
.github/workflows/ci.yml	Bumps checkout/codecov-action/docker actions and adds MSRV toolchain pin rationale comments.
.github/workflows/benchmarks.yml	Bumps checkout/cache/upload-artifact/github-script used by benchmark CI.
.github/dependabot.yml	Ignores dtolnay/rust-toolchain updates in GitHub Actions Dependabot config.

Review details

• Files reviewed: 16/16 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.