chore(deps): Bump the development-dependencies group across 1 directory with 13 updates

.github/workflows/auto-merge.yml

@@ -11,5 +11,5 @@ jobs:
     permissions:
       contents: write
       pull-requests: write
-    uses: go-openapi/ci-workflows/.github/workflows/auto-merge.yml@cba06a2e6390abfedda6bf1067f44741cbe93650 # v0.6.2
+    uses: go-openapi/ci-workflows/.github/workflows/auto-merge.yml@69a76bc5d13145693ca13d24a418942b59fce727 # v0.6.3
     secrets: inherit

.github/workflows/bump-release.yml

@@ -31,7 +31,7 @@ jobs:
     permissions:
       contents: write
       pull-requests: write
-    uses: go-openapi/ci-workflows/.github/workflows/bump-release-monorepo.yml@cba06a2e6390abfedda6bf1067f44741cbe93650 # v0.6.2
+    uses: go-openapi/ci-workflows/.github/workflows/bump-release-monorepo.yml@69a76bc5d13145693ca13d24a418942b59fce727 # v0.6.3
     with:
       bump-type: ${{ inputs.bump-type }}
       tag-message-title: ${{ inputs.tag-message-title }}

.github/workflows/codeql.yml

@@ -18,5 +18,5 @@ jobs:
     permissions:
       contents: read
       security-events: write
-    uses: go-openapi/ci-workflows/.github/workflows/codeql.yml@cba06a2e6390abfedda6bf1067f44741cbe93650 # v0.6.2
+    uses: go-openapi/ci-workflows/.github/workflows/codeql.yml@69a76bc5d13145693ca13d24a418942b59fce727 # v0.6.3
     secrets: inherit

.github/workflows/contributors.yml

@@ -14,5 +14,5 @@ jobs:
     permissions:
       pull-requests: write
       contents: write
-    uses: go-openapi/ci-workflows/.github/workflows/contributors.yml@cba06a2e6390abfedda6bf1067f44741cbe93650 # v0.6.2
+    uses: go-openapi/ci-workflows/.github/workflows/contributors.yml@69a76bc5d13145693ca13d24a418942b59fce727 # v0.6.3
     secrets: inherit

.github/workflows/front-end-test.yml

@@ -40,7 +40,7 @@ jobs:
       # A called workflow cannot hold more than its caller grants, and an omitted scope
       # is 'none': without this the run is rejected before it starts.
       pull-requests: read
-    uses: go-openapi/ci-workflows/.github/workflows/changed-paths.yml@cba06a2e6390abfedda6bf1067f44741cbe93650 # v0.6.2
+    uses: go-openapi/ci-workflows/.github/workflows/changed-paths.yml@69a76bc5d13145693ca13d24a418942b59fce727 # v0.6.3
     with:
       preset: front-end
       # The producer of the -format=json envelope the app consumes. A change here can
@@ -76,7 +76,7 @@ jobs:
           sparse-checkout: hack/doc-site/genspec-wasi/
       -
         name: Set up node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ matrix.node-version }}
           cache: npm

.github/workflows/go-test.yml

@@ -13,7 +13,7 @@ on:
 
 jobs:
   test:
-    uses: go-openapi/ci-workflows/.github/workflows/go-test-monorepo.yml@cba06a2e6390abfedda6bf1067f44741cbe93650 # v0.6.2
+    uses: go-openapi/ci-workflows/.github/workflows/go-test-monorepo.yml@69a76bc5d13145693ca13d24a418942b59fce727 # v0.6.3
     with:
       # The suites emit the same document under any loader -- TestLoaderAgreement holds that over
       # the whole corpus -- so which one runs is a question about what the run costs, and this

.github/workflows/monitor-bot-pr.yml

@@ -15,5 +15,5 @@ jobs:
       contents: write
       pull-requests: write
       statuses: read
-    uses: go-openapi/ci-workflows/.github/workflows/monitor-bot-pr.yml@cba06a2e6390abfedda6bf1067f44741cbe93650 # v0.6.2
+    uses: go-openapi/ci-workflows/.github/workflows/monitor-bot-pr.yml@69a76bc5d13145693ca13d24a418942b59fce727 # v0.6.3
     secrets: inherit

.github/workflows/scanner.yml

@@ -15,5 +15,5 @@ jobs:
     permissions:
       contents: read
       security-events: write
-    uses: go-openapi/ci-workflows/.github/workflows/scanner.yml@cba06a2e6390abfedda6bf1067f44741cbe93650 # v0.6.2
+    uses: go-openapi/ci-workflows/.github/workflows/scanner.yml@69a76bc5d13145693ca13d24a418942b59fce727 # v0.6.3
     secrets: inherit

.github/workflows/tag-release.yml

@@ -13,7 +13,7 @@ jobs:
     name: Create release
     permissions:
       contents: write
-    uses: go-openapi/ci-workflows/.github/workflows/release.yml@cba06a2e6390abfedda6bf1067f44741cbe93650 # v0.6.2
+    uses: go-openapi/ci-workflows/.github/workflows/release.yml@69a76bc5d13145693ca13d24a418942b59fce727 # v0.6.3
     with:
       tag: ${{ github.ref_name }}
       is-monorepo: 'true'

.github/workflows/toolchain-independence.yml

@@ -40,7 +40,7 @@ jobs:
         run: |
           go test -c -o resolvers.test    ./internal/builders/resolvers/
           go test -c -o integration.test  ./internal/integration/
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: toolchain-test-binaries
           path: |
@@ -58,7 +58,7 @@ jobs:
     needs: build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: toolchain-test-binaries
       - name: Run resolvers tests with no Go present at all
@@ -89,7 +89,7 @@ jobs:
       - name: Warm the testdata module cache (normal toolchain, before divergence)
         working-directory: testdata
         run: go mod download
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: toolchain-test-binaries
       - name: Remove the build-time GOROOT so the divergence is deterministic

.github/workflows/update-doc.yml

@@ -37,7 +37,7 @@ jobs:
       # A called workflow cannot hold more than its caller grants, and an omitted scope
       # is 'none': without this the run is rejected before it starts.
       pull-requests: read
-    uses: go-openapi/ci-workflows/.github/workflows/changed-paths.yml@cba06a2e6390abfedda6bf1067f44741cbe93650 # v0.6.2
+    uses: go-openapi/ci-workflows/.github/workflows/changed-paths.yml@69a76bc5d13145693ca13d24a418942b59fce727 # v0.6.3
     with:
       preset: doc
       # The preset knows the go-openapi layout — markdown anywhere, the hugo tree under
@@ -129,7 +129,7 @@ jobs:
         # Pinned rather than taken from the runner image: the playground is built here
         # and nowhere else, so an image bumping its preinstalled node would move the
         # build with no change of ours. front-end-test.yml covers this version.
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '22'
           cache: npm

.github/workflows/webhook-announcements.yml

@@ -50,7 +50,7 @@ on:
 
 jobs:
   announce:
-    uses: go-openapi/ci-workflows/.github/workflows/webhook-announcements.yml@cba06a2e6390abfedda6bf1067f44741cbe93650 # v0.6.2
+    uses: go-openapi/ci-workflows/.github/workflows/webhook-announcements.yml@69a76bc5d13145693ca13d24a418942b59fce727 # v0.6.3
     with:
       scanned-markdown: README.md
       # On push: normal before..after diff (empty