update from upstream

.github/workflows/cd-deploy-nodes-gcp.yml

@@ -205,7 +205,7 @@ jobs:
     if: ${{ !cancelled() && !failure() && ((github.event_name == 'push' && github.ref_name == 'main') || github.event_name == 'release') }}
 
     steps:
-      - uses: actions/[email protected].6
+      - uses: actions/[email protected].7
         with:
           persist-credentials: false
 
@@ -228,14 +228,14 @@ jobs:
       # Setup gcloud CLI
       - name: Authenticate to Google Cloud
         id: auth
-        uses: google-github-actions/[email protected].3
+        uses: google-github-actions/[email protected].4
         with:
           retries: '3'
           workload_identity_provider: '${{ vars.GCP_WIF }}'
           service_account: '${{ vars.GCP_DEPLOYMENTS_SA }}'
 
       - name: Set up Cloud SDK
-        uses: google-github-actions/[email protected].0
+        uses: google-github-actions/[email protected].1
 
       # TODO we should implement the fixes from https://github.com/ZcashFoundation/zebra/pull/5670 here
       # but the implementation is failing as it's requiring the disk names, contrary to what is stated in the official documentation
@@ -307,7 +307,7 @@ jobs:
     if: github.event_name == 'workflow_dispatch'
 
     steps:
-      - uses: actions/[email protected].6
+      - uses: actions/[email protected].7
         with:
           persist-credentials: false
 
@@ -330,14 +330,14 @@ jobs:
       # Setup gcloud CLI
       - name: Authenticate to Google Cloud
         id: auth
-        uses: google-github-actions/[email protected].3
+        uses: google-github-actions/[email protected].4
         with:
           retries: '3'
           workload_identity_provider: '${{ vars.GCP_WIF }}'
           service_account: '${{ vars.GCP_DEPLOYMENTS_SA }}'
 
       - name: Set up Cloud SDK
-        uses: google-github-actions/[email protected].0
+        uses: google-github-actions/[email protected].1
 
       # Create instance template from container image
       - name: Manual deploy of a single ${{ inputs.network }} instance running zebrad

.github/workflows/chore-delete-gcp-resources.yml

@@ -39,21 +39,21 @@ jobs:
       contents: 'read'
       id-token: 'write'
     steps:
-      - uses: actions/[email protected].6
+      - uses: actions/[email protected].7
         with:
           persist-credentials: false
 
       # Setup gcloud CLI
       - name: Authenticate to Google Cloud
         id: auth
-        uses: google-github-actions/[email protected].3
+        uses: google-github-actions/[email protected].4
         with:
           retries: '3'
           workload_identity_provider: '${{ vars.GCP_WIF }}'
           service_account: '${{ vars.GCP_DEPLOYMENTS_SA }}'
 
       - name: Set up Cloud SDK
-        uses: google-github-actions/[email protected].0
+        uses: google-github-actions/[email protected].1
 
       # Deletes all mainnet and testnet instances older than $DELETE_INSTANCE_DAYS days.
       #
@@ -107,22 +107,22 @@ jobs:
       contents: 'read'
       id-token: 'write'
     steps:
-      - uses: actions/[email protected].6
+      - uses: actions/[email protected].7
         with:
           persist-credentials: false
 
       # Setup gcloud CLI
       - name: Authenticate to Google Cloud
         id: auth
-        uses: google-github-actions/[email protected].3
+        uses: google-github-actions/[email protected].4
         with:
           retries: '3'
           workload_identity_provider: '${{ vars.GCP_WIF }}'
           service_account: '${{ vars.GCP_DEPLOYMENTS_SA }}'
           token_format: 'access_token'
 
       - name: Login to Google Artifact Registry
-        uses: docker/login-action@v3.2.0
+        uses: docker/login-action@v3.3.0
         with:
           registry: us-docker.pkg.dev
           username: oauth2accesstoken

.github/workflows/ci-build-crates.patch.yml

@@ -23,7 +23,7 @@ jobs:
     outputs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}
     steps:
-      - uses: actions/[email protected].6
+      - uses: actions/[email protected].7
 
       # Setup Rust with stable toolchain and minimal profile
       - name: Setup Rust

.github/workflows/ci-build-crates.yml

@@ -60,7 +60,7 @@ jobs:
     outputs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}
     steps:
-      - uses: actions/[email protected].6
+      - uses: actions/[email protected].7
       - uses: r7kamura/[email protected]
 
       # Setup Rust with stable toolchain and minimal profile
@@ -122,7 +122,7 @@ jobs:
       matrix: ${{ fromJson(needs.matrix.outputs.matrix) }}
 
     steps:
-      - uses: actions/[email protected].6
+      - uses: actions/[email protected].7
         with:
           persist-credentials: false
       - uses: r7kamura/[email protected]

.github/workflows/ci-coverage.yml

@@ -69,7 +69,7 @@ jobs:
     runs-on: ubuntu-latest-xl
 
     steps:
-      - uses: actions/[email protected].6
+      - uses: actions/[email protected].7
         with:
           persist-credentials: false
 
@@ -103,4 +103,4 @@ jobs:
         run: cargo llvm-cov --lcov --no-run --output-path lcov.info
 
       - name: Upload coverage report to Codecov
-        uses: codecov/codecov-action@v4.4.1
+        uses: codecov/codecov-action@v4.5.0

.github/workflows/ci-lint.yml

@@ -37,7 +37,7 @@ jobs:
       rust: ${{ steps.changed-files-rust.outputs.any_changed == 'true' }}
       workflows: ${{ steps.changed-files-workflows.outputs.any_changed == 'true' }}
     steps:
-      - uses: actions/[email protected].6
+      - uses: actions/[email protected].7
         with:
           persist-credentials: false
           fetch-depth: 0
@@ -69,7 +69,7 @@ jobs:
     if: ${{ needs.changed-files.outputs.rust == 'true' }}
 
     steps:
-      - uses: actions/[email protected].6
+      - uses: actions/[email protected].7
         with:
           persist-credentials: false
 
@@ -119,7 +119,7 @@ jobs:
     if: ${{ needs.changed-files.outputs.rust == 'true' }}
 
     steps:
-      - uses: actions/[email protected].6
+      - uses: actions/[email protected].7
         with:
           persist-credentials: false
       - uses: r7kamura/[email protected]
@@ -149,7 +149,7 @@ jobs:
     needs: changed-files
     if: ${{ needs.changed-files.outputs.workflows == 'true' }}
     steps:
-      - uses: actions/[email protected].6
+      - uses: actions/[email protected].7
       - name: actionlint
         uses: reviewdog/[email protected]
         with:
@@ -166,7 +166,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: changed-files
     steps:
-      - uses: actions/[email protected].6
+      - uses: actions/[email protected].7
       - uses: codespell-project/[email protected]
         with:
           only_warn: 1

.github/workflows/ci-unit-tests-os.yml

@@ -94,7 +94,7 @@ jobs:
             rust: beta
 
     steps:
-      - uses: actions/[email protected].6
+      - uses: actions/[email protected].7
         with:
           persist-credentials: false
       - uses: r7kamura/[email protected]
@@ -183,7 +183,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/[email protected].6
+      - uses: actions/[email protected].7
         with:
           persist-credentials: false
       - uses: r7kamura/[email protected]
@@ -205,7 +205,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/[email protected].6
+      - uses: actions/[email protected].7
         with:
           persist-credentials: false
       - uses: r7kamura/[email protected]
@@ -248,13 +248,13 @@ jobs:
     continue-on-error: ${{ matrix.checks == 'advisories' }}
 
     steps:
-      - uses: actions/[email protected].6
+      - uses: actions/[email protected].7
         with:
           persist-credentials: false
       - uses: r7kamura/[email protected]
 
       - name: Check ${{ matrix.checks }} with features ${{ matrix.features }}
-        uses: EmbarkStudios/cargo-deny-action@v1
+        uses: EmbarkStudios/cargo-deny-action@v2
         with:
           # --all-features spuriously activates openssl, but we want to ban that dependency in
           # all of zebrad's production features for security reasons. But the --all-features job is
@@ -269,7 +269,7 @@ jobs:
 
     steps:
       - name: Checkout git repository
-        uses: actions/[email protected].6
+        uses: actions/[email protected].7
         with:
           persist-credentials: false
       - uses: r7kamura/[email protected]
@@ -280,7 +280,7 @@ jobs:
           curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain=stable --profile=minimal
 
       - name: Install cargo-machete
-        uses: baptiste0928/[email protected].0
+        uses: baptiste0928/[email protected].1
         with:
           crate: cargo-machete
 

.github/workflows/docs-deploy-firebase.yml

@@ -85,7 +85,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout the source code
-        uses: actions/[email protected].6
+        uses: actions/[email protected].7
         with:
           persist-credentials: false
 
@@ -106,7 +106,7 @@ jobs:
       # Setup gcloud CLI
       - name: Authenticate to Google Cloud
         id: auth
-        uses: google-github-actions/[email protected].3
+        uses: google-github-actions/[email protected].4
         with:
           retries: '3'
           workload_identity_provider: '${{ vars.GCP_WIF }}'
@@ -139,7 +139,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout the source code
-        uses: actions/[email protected].6
+        uses: actions/[email protected].7
         with:
           persist-credentials: false
 
@@ -165,7 +165,7 @@ jobs:
       # Setup gcloud CLI
       - name: Authenticate to Google Cloud
         id: auth
-        uses: google-github-actions/[email protected].3
+        uses: google-github-actions/[email protected].4
         with:
           retries: '3'
           workload_identity_provider: '${{ vars.GCP_WIF }}'

.github/workflows/docs-dockerhub-description.yml

@@ -17,7 +17,7 @@ jobs:
   dockerHubDescription:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/[email protected].6
+      - uses: actions/[email protected].7
         with:
           persist-credentials: false
 

.github/workflows/manual-zcashd-deploy.yml

@@ -29,7 +29,7 @@ jobs:
       id-token: 'write'
 
     steps:
-      - uses: actions/[email protected].6
+      - uses: actions/[email protected].7
         with:
           persist-credentials: false
 
@@ -52,14 +52,14 @@ jobs:
       # Setup gcloud CLI
       - name: Authenticate to Google Cloud
         id: auth
-        uses: google-github-actions/[email protected].3
+        uses: google-github-actions/[email protected].4
         with:
           retries: '3'
           workload_identity_provider: '${{ vars.GCP_WIF }}'
           service_account: '${{ vars.GCP_DEPLOYMENTS_SA }}'
 
       - name: Set up Cloud SDK
-        uses: google-github-actions/[email protected].0
+        uses: google-github-actions/[email protected].1
 
       # Create instance template from container image
       - name: Create instance template

.github/workflows/release-crates-io.yml

@@ -70,7 +70,7 @@ jobs:
       - uses: r7kamura/[email protected]
 
       - name: Checkout git repository
-        uses: actions/[email protected].6
+        uses: actions/[email protected].7
         with:
           persist-credentials: false
 
@@ -85,7 +85,7 @@ jobs:
           curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain=stable --profile=minimal
 
       - name: Install cargo-release
-        uses: baptiste0928/[email protected].0
+        uses: baptiste0928/[email protected].1
         with:
           crate: cargo-release
 

.github/workflows/sub-build-docker-image.yml

@@ -76,7 +76,7 @@ jobs:
       contents: 'read'
       id-token: 'write'
     steps:
-      - uses: actions/[email protected].6
+      - uses: actions/[email protected].7
         with:
           persist-credentials: false
       - uses: r7kamura/[email protected]
@@ -122,7 +122,7 @@ jobs:
 
       - name: Authenticate to Google Cloud
         id: auth
-        uses: google-github-actions/[email protected].3
+        uses: google-github-actions/[email protected].4
         with:
           retries: '3'
           workload_identity_provider: '${{ vars.GCP_WIF }}'
@@ -134,14 +134,14 @@ jobs:
           access_token_lifetime: 10800s
 
       - name: Login to Google Artifact Registry
-        uses: docker/login-action@v3.2.0
+        uses: docker/login-action@v3.3.0
         with:
           registry: us-docker.pkg.dev
           username: oauth2accesstoken
           password: ${{ steps.auth.outputs.access_token }}
 
       - name: Login to DockerHub
-        uses: docker/login-action@v3.2.0
+        uses: docker/login-action@v3.3.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -158,7 +158,7 @@ jobs:
       # Build and push image to Google Artifact Registry, and possibly DockerHub
       - name: Build & push
         id: docker_build
-        uses: docker/build-push-action@v5.3.0
+        uses: docker/build-push-action@v6.6.0
         with:
           target: ${{ inputs.dockerfile_target }}
           context: .