Bump GitHub Actions to current majors

.github/DEPLOY.md

@@ -16,7 +16,7 @@ Manual runs: GitHub Actions, select workflow, **Run workflow**.
 1. Separate workflows with `paths:` filters so only the changed surface deploys.
 2. Vercel via CLI in Actions (`pull` then `build --prod` then `deploy --prebuilt`). See [Vercel + GitHub Actions](https://vercel.com/kb/guide/how-can-i-use-github-actions-with-vercel).
 3. Cloud Run via `gcloud run deploy --source` with Workload Identity Federation (OIDC). No JSON service-account key in git.
-4. Backend deploy requires `id-token: write` for `google-github-actions/auth@v2`.
+4. Backend deploy requires `id-token: write` for `google-github-actions/auth@v3`.
 5. Backend tests run with `ANTIGRAVITY_ENABLED=false` for deterministic CI.
 6. Production still needs a static `VERCEL_TOKEN` secret (no Vercel OIDC deploy path in this repo).
 7. Frontend `vercel.json` sets `"git": { "deploymentEnabled": false }` so only Actions deploys production.

.github/workflows/ci.yml

@@ -32,8 +32,8 @@ jobs:
       frontend: ${{ steps.filter.outputs.frontend }}
       backend: ${{ steps.filter.outputs.backend }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: dorny/paths-filter@v3
+      - uses: actions/checkout@v7
+      - uses: dorny/paths-filter@v4
         id: filter
         with:
           filters: |
@@ -56,8 +56,8 @@ jobs:
       run:
         working-directory: frontend
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: "22"
           cache: npm
@@ -78,8 +78,8 @@ jobs:
       run:
         working-directory: backend
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
           cache: pip

.github/workflows/deploy-backend.yml

@@ -39,10 +39,10 @@ jobs:
       run:
         working-directory: backend
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: "3.12"
           cache: pip
@@ -71,18 +71,18 @@ jobs:
       REGION: ${{ vars.CLOUD_RUN_REGION || 'us-central1' }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Authenticate to Google Cloud (WIF)
         id: auth
-        uses: google-github-actions/auth@v2
+        uses: google-github-actions/auth@v3
         with:
           workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
           service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }}
           project_id: ${{ env.PROJECT_ID }}
 
       - name: Setup gcloud
-        uses: google-github-actions/setup-gcloud@v2
+        uses: google-github-actions/setup-gcloud@v3
         with:
           project_id: ${{ env.PROJECT_ID }}
 

.github/workflows/deploy-frontend.yml

@@ -51,7 +51,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Require Vercel secrets
         run: |
@@ -72,7 +72,7 @@ jobs:
           echo "All required Vercel secrets are present (values not logged)."
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: "22"
           cache: npm