[v3-4-test] Bump the github-actions-updates group with 7 updates (#75293)

.github/workflows/airflow-e2e-tests.yml

@@ -135,7 +135,7 @@ jobs:
       # arch-specific auto-provisioned JDKs (the example pins a Java 11 toolchain).
       - name: "Setup Java for the Java SDK build"
         if: inputs.e2e_test_mode == 'java_sdk'
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6  # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad  # v6.1.0
         with:
           distribution: 'temurin'
           java-version: ${{ inputs.java-sdk-version }}

.github/workflows/asf-allowlist-check.yml

@@ -32,4 +32,4 @@ jobs:
         with:
           persist-credentials: false
       # yamllint disable-line rule:line-length
-      - uses: apache/infrastructure-actions/allowlist-check@df54e48ff76152790f317934c691cfa7fd7a1a46  # allowlist-check/v1.0.1
+      - uses: apache/infrastructure-actions/allowlist-check@47b297bbe90f580139129bee531bd84bd95b7f5d  # allowlist-check/v1.0.4

.github/workflows/basic-tests.yml

@@ -115,7 +115,7 @@ jobs:
       - name: "Install SVN"
         run: sudo apt-get update && sudo apt-get install -y subversion
       - name: "Install Java (for Apache RAT)"
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6  # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad  # v6.1.0
         with:
           distribution: 'temurin'
           java-version: '17'

.github/workflows/ci-amd.yml

@@ -1084,7 +1084,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Setup Java
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6  # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad  # v6.1.0
         with:
           distribution: 'temurin'
           java-version: ${{ env.JAVA_VERSION }}

.github/workflows/ci-arm.yml

@@ -1073,7 +1073,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Setup Java
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6  # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad  # v6.1.0
         with:
           distribution: 'temurin'
           java-version: ${{ env.JAVA_VERSION }}

.github/workflows/ci-image-build.yml

@@ -336,7 +336,7 @@ jobs:
         shell: bash
         if: inputs.upload-image-artifact == 'true' && steps.stashed-image.outputs.reusable != 'true'
       - name: "Stash CI docker image ${{ env.PYTHON_MAJOR_MINOR_VERSION }}"
-        uses: apache/infrastructure-actions/stash/save@f1a487181effd0b216892001abdfb524442bb24d  # save/v1.0.1
+        uses: apache/infrastructure-actions/stash/save@7d3afde57801d8c9a2db9730c28ae4e036cc2ab9  # save/v1.0.2
         with:
           key: ci-image-save-v3-${{ inputs.platform }}-${{ env.PYTHON_MAJOR_MINOR_VERSION }}
           path: "/mnt/ci-image-save-*-${{ env.PYTHON_MAJOR_MINOR_VERSION }}.tar"
@@ -350,7 +350,7 @@ jobs:
       # what a later publish of that same ref reads - hence a retention that outlives the shared
       # one, the same ref being rebuilt three days apart at the very least.
       - name: "Stash CI docker image built for ref ${{ inputs.image-stash-ref }}"
-        uses: apache/infrastructure-actions/stash/save@f1a487181effd0b216892001abdfb524442bb24d  # save/v1.0.1
+        uses: apache/infrastructure-actions/stash/save@7d3afde57801d8c9a2db9730c28ae4e036cc2ab9  # save/v1.0.2
         with:
           key: "ci-image-save-v3-${{ inputs.platform }}-${{ env.PYTHON_MAJOR_MINOR_VERSION }}\
             -${{ inputs.image-stash-ref }}"
@@ -364,7 +364,7 @@ jobs:
       # Saved last and with the image's retention, so that finding this commit is enough to
       # know the image it describes is there to be restored.
       - name: "Stash the commit the CI image for ref ${{ inputs.image-stash-ref }} was built from"
-        uses: apache/infrastructure-actions/stash/save@f1a487181effd0b216892001abdfb524442bb24d  # save/v1.0.1
+        uses: apache/infrastructure-actions/stash/save@7d3afde57801d8c9a2db9730c28ae4e036cc2ab9  # save/v1.0.2
         with:
           key: "ci-image-commit-v3-${{ inputs.platform }}-${{ env.PYTHON_MAJOR_MINOR_VERSION }}\
             -${{ inputs.image-stash-ref }}"
@@ -386,7 +386,7 @@ jobs:
       - name: >
           Stash cache mount ${{ inputs.platform }}:${{ env.PYTHON_MAJOR_MINOR_VERSION }}
           ${{ inputs.image-stash-ref != '' && format('for ref {0}', inputs.image-stash-ref) || '' }}
-        uses: apache/infrastructure-actions/stash/save@f1a487181effd0b216892001abdfb524442bb24d  # save/v1.0.1
+        uses: apache/infrastructure-actions/stash/save@7d3afde57801d8c9a2db9730c28ae4e036cc2ab9  # save/v1.0.2
         with:
           key: "ci-cache-mount-save-v4-${{ inputs.platform }}-${{ env.PYTHON_MAJOR_MINOR_VERSION }}\
             ${{ inputs.image-stash-ref != '' && format('-{0}', inputs.image-stash-ref) || '' }}"

.github/workflows/ci-image-checks.yml

@@ -312,7 +312,7 @@ jobs:
         env:
           SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
       - name: "Save docs inventory cache"
-        uses: apache/infrastructure-actions/stash/save@f1a487181effd0b216892001abdfb524442bb24d  # save/v1.0.1
+        uses: apache/infrastructure-actions/stash/save@7d3afde57801d8c9a2db9730c28ae4e036cc2ab9  # save/v1.0.2
         with:
           path: ./generated/_inventory_cache/
           key: cache-docs-inventory-v1

.github/workflows/codeql-analysis.yml

@@ -130,27 +130,27 @@ jobs:
 
       - name: Setup Java
         if: matrix.language == 'java'
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6  # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad  # v6.1.0
         with:
           distribution: 'temurin'
           java-version: '11'
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d  # v4.38.3
+        uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee  # v4.39.0
         with:
           languages: ${{ matrix.language }}
 
       - name: Autobuild
         if: matrix.language != 'java'
-        uses: github/codeql-action/autobuild@24c54180a607b1449ed407dd24f251e4e9147c8d  # v4.38.3
+        uses: github/codeql-action/autobuild@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee  # v4.39.0
 
       - name: Build Java SDK
         if: matrix.language == 'java'
         working-directory: java-sdk
         run: ./gradlew classes testClasses
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d  # v4.38.3
+        uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee  # v4.39.0
         with:
           # Provide more context to the SARIF output (shows up in run.automationDetails.id field)
           category: "/language:${{matrix.language}}"

.github/workflows/java-sdk-dependabot-verification-metadata.yml

@@ -77,7 +77,7 @@ jobs:
           persist-credentials: false
       # 11: main build toolchain, 17/21: example toolchains + Gradle runtime.
       - name: Install JDK toolchains
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6  # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad  # v6.1.0
         with:
           distribution: temurin
           java-version: |

.github/workflows/java-sdk-dependency-security.yml

@@ -49,7 +49,7 @@ jobs:
       # 17: toolchain for scala_spark_example/
       # 21: runs Gradle itself — the last entry listed is the one that sets JAVA_HOME
       - name: Install JDK toolchains
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6  # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad  # v6.1.0
         with:
           distribution: temurin
           java-version: |

.github/workflows/java-sdk-release-verify.yml

@@ -76,7 +76,7 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
       - name: Set up JDK ${{ env.JAVA_VERSION }}
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6  # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad  # v6.1.0
         with:
           distribution: temurin
           java-version: ${{ env.JAVA_VERSION }}
@@ -133,7 +133,7 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
       - name: Set up JDK ${{ env.JAVA_VERSION }}
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6  # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad  # v6.1.0
         with:
           distribution: temurin
           java-version: ${{ env.JAVA_VERSION }}

.github/workflows/k8s-tests.yml

@@ -204,7 +204,7 @@ jobs:
           restore-keys: |
             lang-sdk-go-v1-${{ runner.os }}-${{ runner.arch }}-
       - name: "Setup Java for lang-SDK build"
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6  # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad  # v6.1.0
         with:
           distribution: 'temurin'
           java-version: ${{ inputs.java-sdk-version }}

.github/workflows/prod-image-build.yml

@@ -289,7 +289,7 @@ jobs:
           breeze prod-image save --platform "${PLATFORM}" --image-file-dir "/mnt"
         if: inputs.upload-image-artifact == 'true'
       - name: "Stash PROD docker image ${{ env.PYTHON_MAJOR_MINOR_VERSION }}"
-        uses: apache/infrastructure-actions/stash/save@f1a487181effd0b216892001abdfb524442bb24d  # save/v1.0.1
+        uses: apache/infrastructure-actions/stash/save@7d3afde57801d8c9a2db9730c28ae4e036cc2ab9  # save/v1.0.2
         with:
           key: prod-image-save-v3-${{ inputs.platform }}-${{ env.PYTHON_MAJOR_MINOR_VERSION }}
           path: "/mnt/prod-image-save-*-${{ env.PYTHON_MAJOR_MINOR_VERSION }}.tar"

.github/workflows/publish-docs-to-s3.yml

@@ -388,7 +388,7 @@ jobs:
             breeze build-docs ${SPHINX_INCLUDE_DOCS} ${DOCS_ONLY} ${FAIL_ON_INVENTORIES}
           fi
       - name: "Save docs inventory cache"
-        uses: apache/infrastructure-actions/stash/save@f1a487181effd0b216892001abdfb524442bb24d  # save/v1.0.1
+        uses: apache/infrastructure-actions/stash/save@7d3afde57801d8c9a2db9730c28ae4e036cc2ab9  # save/v1.0.2
         if: >-
           steps.restore-docs-inventory-cache.outputs.stash-hit != 'true' &&
           steps.build-sphinx-docs.outputs.sphinx-build-skipped != 'true'

.github/workflows/scheduled-legacy-prod-image-canary.yml

@@ -129,7 +129,7 @@ jobs:
       # Same artifact name and layout as generate-constraints.yml uploads, which is what the PROD image
       # build downloads.
       - name: "Upload constraint artifacts"
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
         with:
           name: constraints-${{ matrix.python-version }}
           path: ./files/constraints-${{ matrix.python-version }}/constraints-*.txt