From 189f81710b6681bbdb95328da5332652480654ff Mon Sep 17 00:00:00 2001
From: "tmt-renovate-bot[bot]"
 <278025917+tmt-renovate-bot[bot]@users.noreply.github.com>
Date: Fri, 25 Sep 2026 03:48:51 +0000
Subject: [PATCH] Update GitHub Actions

---
 .github/workflows/ci.yml              | 2 +-
 .github/workflows/release.yml         | 2 +-
 .github/workflows/renovate.yml        | 2 +-
 .github/workflows/step-doc-tests.yml  | 2 +-
 .github/workflows/step-shellcheck.yml | 4 ++--
 5 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 72a927e4dc..31e5fee407 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -51,6 +51,6 @@ jobs:
     needs: [ pre-commit, build-wheel, shellcheck, doc-tests ]
     runs-on: ubuntu-slim
     steps:
-      - uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe # v1.2.2
+      - uses: re-actors/alls-green@b5b5b37504aa4183270bd3d855c52a67f212be35 # v1.3.0
         with:
           jobs: ${{ toJSON(needs) }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2bbc50e523..3a06591393 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -36,7 +36,7 @@ jobs:
           path: dist
 
       - name: Generate artifact attestation for sdist and wheel
-        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-path: "dist/*"
 
diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml
index 72520d88bd..64d1f731c4 100644
--- a/.github/workflows/renovate.yml
+++ b/.github/workflows/renovate.yml
@@ -30,7 +30,7 @@ jobs:
           client-id: ${{ secrets.RENOVATE_BOT_CLIENT_ID }}
           private-key: ${{ secrets.RENOVATE_BOT_PRIVATE_KEY }}
           owner: ${{ github.repository_owner }}
-      - uses: renovatebot/github-action@973d3e5a68e735a444e8c03432b66eedb343c302 # v46.2.0
+      - uses: renovatebot/github-action@9fea9f0fbf80401026d11d03911d62b1f70fef1f # v46.3.3
         with:
           configurationFile: .github/renovate-config.json
           token: '${{ steps.token.outputs.token }}'
diff --git a/.github/workflows/step-doc-tests.yml b/.github/workflows/step-doc-tests.yml
index ee5ba19106..aa450e4559 100644
--- a/.github/workflows/step-doc-tests.yml
+++ b/.github/workflows/step-doc-tests.yml
@@ -33,7 +33,7 @@ jobs:
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: 3.x
-      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
         with:
           activate-environment: true
       - name: Install tmt[docs]
diff --git a/.github/workflows/step-shellcheck.yml b/.github/workflows/step-shellcheck.yml
index 2a8086028b..c5a5be0d44 100644
--- a/.github/workflows/step-shellcheck.yml
+++ b/.github/workflows/step-shellcheck.yml
@@ -27,7 +27,7 @@ jobs:
 
       - id: ShellCheck
         name: Differential ShellCheck
-        uses: redhat-plumbers-in-action/differential-shellcheck@d965e66ec0b3b2f821f75c8eff9b12442d9a7d1e # v5.5.6
+        uses: redhat-plumbers-in-action/differential-shellcheck@f51c7c0d32777d00de777131d25918617a246415 # v5.5.7
         # Note: we do not use token here to have more control of when to upload the sarif.
         #  It might be incorrect to upload them for PRs.
         #  https://github.com/github/codeql-action/issues/3578
@@ -56,7 +56,7 @@ jobs:
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: Differential ShellCheck SARIF
-      - uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
+      - uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
         with:
           sarif_file: ${{ needs.lint.outputs.sarif }}
     if: ${{ inputs.upload_sarif }}