From fd1a8d930aa9e09e5f3f77b94c5393a77afac878 Mon Sep 17 00:00:00 2001
From: Aditya Gaurav <mr.x.l.r.8.pride@gmail.com>
Date: Sun, 18 Oct 2026 14:22:23 +0000
Subject: [PATCH 1/2] ci: bump GitHub Actions to current majors

---
 .github/workflows/ci.yml              | 12 ++++++------
 .github/workflows/deploy-backend.yml  | 10 +++++-----
 .github/workflows/deploy-frontend.yml |  4 ++--
 3 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2f9857e..40f7b12 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -32,8 +32,8 @@ jobs:
       frontend: ${{ steps.filter.outputs.frontend }}
       backend: ${{ steps.filter.outputs.backend }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: dorny/paths-filter@v3
+      - uses: actions/checkout@v7
+      - uses: dorny/paths-filter@v4
         id: filter
         with:
           filters: |
@@ -56,8 +56,8 @@ jobs:
       run:
         working-directory: frontend
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: "22"
           cache: npm
@@ -78,8 +78,8 @@ jobs:
       run:
         working-directory: backend
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
           cache: pip
diff --git a/.github/workflows/deploy-backend.yml b/.github/workflows/deploy-backend.yml
index 99129cc..d151ea4 100644
--- a/.github/workflows/deploy-backend.yml
+++ b/.github/workflows/deploy-backend.yml
@@ -39,10 +39,10 @@ jobs:
       run:
         working-directory: backend
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: "3.12"
           cache: pip
@@ -71,18 +71,18 @@ jobs:
       REGION: ${{ vars.CLOUD_RUN_REGION || 'us-central1' }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Authenticate to Google Cloud (WIF)
         id: auth
-        uses: google-github-actions/auth@v2
+        uses: google-github-actions/auth@v3
         with:
           workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
           service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }}
           project_id: ${{ env.PROJECT_ID }}
 
       - name: Setup gcloud
-        uses: google-github-actions/setup-gcloud@v2
+        uses: google-github-actions/setup-gcloud@v3
         with:
           project_id: ${{ env.PROJECT_ID }}
 
diff --git a/.github/workflows/deploy-frontend.yml b/.github/workflows/deploy-frontend.yml
index 09b918e..d380e27 100644
--- a/.github/workflows/deploy-frontend.yml
+++ b/.github/workflows/deploy-frontend.yml
@@ -51,7 +51,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Require Vercel secrets
         run: |
@@ -72,7 +72,7 @@ jobs:
           echo "All required Vercel secrets are present (values not logged)."
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: "22"
           cache: npm

From 2b5e8dad9fafd8d20b22c44b4c7ec23480f52fdb Mon Sep 17 00:00:00 2001
From: Aditya Gaurav <mr.x.l.r.8.pride@gmail.com>
Date: Sun, 18 Oct 2026 15:20:51 +0000
Subject: [PATCH 2/2] Update DEPLOY.md to auth@v3

---
 .github/DEPLOY.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/DEPLOY.md b/.github/DEPLOY.md
index ddf4458..b28d986 100644
--- a/.github/DEPLOY.md
+++ b/.github/DEPLOY.md
@@ -16,7 +16,7 @@ Manual runs: GitHub Actions, select workflow, **Run workflow**.
 1. Separate workflows with `paths:` filters so only the changed surface deploys.
 2. Vercel via CLI in Actions (`pull` then `build --prod` then `deploy --prebuilt`). See [Vercel + GitHub Actions](https://vercel.com/kb/guide/how-can-i-use-github-actions-with-vercel).
 3. Cloud Run via `gcloud run deploy --source` with Workload Identity Federation (OIDC). No JSON service-account key in git.
-4. Backend deploy requires `id-token: write` for `google-github-actions/auth@v2`.
+4. Backend deploy requires `id-token: write` for `google-github-actions/auth@v3`.
 5. Backend tests run with `ANTIGRAVITY_ENABLED=false` for deterministic CI.
 6. Production still needs a static `VERCEL_TOKEN` secret (no Vercel OIDC deploy path in this repo).
 7. Frontend `vercel.json` sets `"git": { "deploymentEnabled": false }` so only Actions deploys production.