From df4c2eddd09204217718982f6229b98721e43e8a Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Thu, 6 Aug 2026 21:15:47 +0000
Subject: [PATCH] chore(deps): update github-actions

---
 .github/workflows/build-containers.yml       | 2 +-
 .github/workflows/build-skills.yml           | 2 +-
 .github/workflows/periodic-security-scan.yml | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/build-containers.yml b/.github/workflows/build-containers.yml
index 1c98afc0..2637f16f 100644
--- a/.github/workflows/build-containers.yml
+++ b/.github/workflows/build-containers.yml
@@ -727,7 +727,7 @@ jobs:
           output-format: "sarif"
 
       - name: Upload Grype results to GitHub Security
-        uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
+        uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
         if: always()
         with:
           sarif_file: ${{ steps.grype-scan.outputs.sarif }}
diff --git a/.github/workflows/build-skills.yml b/.github/workflows/build-skills.yml
index dddeed0e..0c717415 100644
--- a/.github/workflows/build-skills.yml
+++ b/.github/workflows/build-skills.yml
@@ -598,7 +598,7 @@ jobs:
 
       - name: Attest build provenance for skill artifact
         if: github.event_name != 'pull_request' && steps.build.outputs.digest != ''
-        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-name: ${{ steps.meta.outputs.image_name }}
           subject-digest: ${{ steps.build.outputs.digest }}
diff --git a/.github/workflows/periodic-security-scan.yml b/.github/workflows/periodic-security-scan.yml
index dbf9f6a4..77cc5290 100644
--- a/.github/workflows/periodic-security-scan.yml
+++ b/.github/workflows/periodic-security-scan.yml
@@ -102,7 +102,7 @@ jobs:
           output-format: "sarif"
 
       - name: Upload SARIF to GitHub Security
-        uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
+        uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
         if: always()
         with:
           sarif_file: ${{ steps.grype-scan.outputs.sarif }}