ci: update the pinned actions and keep dependencies current with Dependabot

[TusanHomichi]

Primary Issue

Refs #137

#137 stays open for one item: release attestation with attest-build-provenance v4.2.2. Its steps run only on release tags (if: startsWith(github.ref, 'refs/tags/v')), so it is checked with gh attestation verify at the next release, as on #95.

Problem And Outcome

The pinned actions were behind. Dependabot was configured for security updates only, and the maintainer wants "latest versions of packages here where it makes sense in general". After merge:

• the pins are at their latest releases;
• weekly grouped version updates arrive on their own;
• the holds are written into dependabot.yml with their reasons;
• CONTRIBUTING states the policy.

Changes

Action	Old → new
actions/checkout	v6.0.2 → v7.0.1 (3d3c42e5…)
actions/cache	v5.0.4 → v6.1.0 (55cc8345…)
actions/attest-build-provenance	v4.1.1 → v4.2.2 (4d101475…)
actions/setup-node	v7.1.0 (already the latest)

• checkout v7: the only breaking change refuses to check out fork code under pull_request_target or workflow_run, unless allow-unsafe-pr-checkout is set. We use neither trigger. The runtime is still node24 and persist-credentials: false is kept.
• cache v6: an ESM rework with new @actions/* majors. Its action.yml is identical to v5.0.4.
• attest-build-provenance v4.2.2: only its internal actions/attest pin moved. Its notes recommend actions/attest for new work; that switch is not made here.
• .github/dependabot.yml: weekly version updates for npm (/web), cargo (/), and github-actions (/).
  • Minor and patch updates are grouped; majors open individually.
  • A 7-day cooldown applies.
  • Commit prefixes are deps(web), deps(rust), and ci.
  • Two ignore rules carry their reasons: typescript >=7 (TS 7 has no JS API, and svelte-check peers ^5 || ^6) and @types/node >=23 (it tracks the Node 22 floor).
  • The keys were checked against GitHub's Dependabot options reference.
• CONTRIBUTING: a short dependency-policy paragraph after the list of what GitHub enforces. Dependabot proposes updates; it enforces nothing.

Scope

• In scope: the action pins, Dependabot version updates, and the policy line.
• Out of scope: switching to actions/attest, and rust-toolchain.toml updates. Dependabot does not manage the latter; deps(rust): move to the latest stable toolchain and current crates (sqlx 0.9 and five other majors) #136 set it to 1.99.

Verification

• Candidate revision: 683bc659a6b4802e6719e355cac5ca14933dfe92 (tree 3260cf5c).
• Local full proof (verifier role): scripts/proof.py passed 7/7 gates in 542 s.
  • 292 Rust tests passed, 0 failed, 3 ignored.
  • Browser: 62 expected, 0 unexpected, 0 flaky, 0 skipped, on system Google Chrome 155.
  • Receipt sha256 99156463…, archived on the maintainer machine.
• Hosted: this PR's own pr-gate run exercises checkout v7, cache v6, and setup-node, and build-x86_64/build-aarch64 exercise checkout v7.
• Static checks: all three YAML files parse. Every uses: matches actions/<name>@<40-hex> # vX.Y.Z.
• Listed the exact verification commands run below
• Added or updated tests when behavior changed (CI configuration only)
• Added or updated an ADR when a durable decision changed (none)
• All fixtures and examples are invented; no real agency data

- scripts/check-guidance-names.sh
- web/: npm ci, npm run check, npm run build
- cargo fmt --check
- cargo clippy --workspace --all-targets -- -D warnings
- cargo test --workspace
- cargo build -p consolebook-server
- web/: npm run e2e (system Google Chrome 155)
- YAML parse of dependabot.yml and both workflows

Review And Merge Notes

• Review performed: the worker role made the change from a fixed brief, read the release notes for both majors, and diffed each action.yml. The integrator reviewed it and moved the policy line out of the enforcement list. No independent reviewer role for this CI-config change.
• Authority: the maintainer's dependency policy and standing PR permission (2026-10-15).
• Operator impact: none at runtime. Expect weekly Dependabot PRs from next Monday.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-15T20:55:13.808693Z	683bc65	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.