chore(deps): update GitHub Actions dependencies

[github-actions]

Summary

Update all GitHub Actions dependencies to their latest stable versions. This is a simple version bump pull request with no code changes required.

Dependencies Updated

Action	Current	Updated
actions/cache	v5	v5.0.5
actions/checkout	v6	v6.0.2
actions/dependency-review-action	v4	v5.0.0
actions/download-artifact	v8	v8.0.1
actions/setup-dotnet	v5	v5.2.0
actions/setup-node	v6	v6.4.0
actions/upload-artifact	v7	v7.0.1
github/codeql-action/init	v4	v4.36.0
github/codeql-action/analyze	v4	v4.36.0

Grouping Rationale

All dependencies in this pull request are simple version bumps within the GitHub Actions ecosystem. They require no workflow syntax changes, no new input parameters, and no job structure modifications. These updates can be applied and validated together as a single cohesive change.

Classification

Simple version bump — only action version references change. No workflow syntax, job structure, or input parameter changes are required.

Notable Changes

actions/dependency-review-action v4 → v5

• Breaking change: Requires Node.js 24 runtime
• Minimum runner version: Actions Runner v2.327.1 or later
• Impact: This is a major version update, but it requires no workflow changes. The new runtime requirement is automatically satisfied by GitHub-hosted runners.

Other Updates

All other updates are patch or minor version releases containing bug fixes, dependency updates, and minor enhancements. No breaking changes or best-practice recommendations in these releases.

Best-Practice Changes

Status: No best-practice changes introduced or suggested by these updates.

Decision: Do not implement now — no action required.

Validation

YAML Syntax Validation

✅ Passed — All workflow files parsed successfully with PowerShell YAML validation.

Repository Validation

⚠️ Skipped — Network proxy restrictions prevented running the full validation suite locally (dotnet restore, pnpm install, etc.). These commands will be validated by GitHub Actions CI when the pull request is opened.

The following validation commands are expected to run successfully in the GitHub Actions environment:

cd backend
dotnet restore MenuApi.sln
dotnet build MenuApi.sln --configuration Release --no-restore
cd ../ui/menu-website
corepack enable pnpm
pnpm install --frozen-lockfile
pnpm run generate-openapi
pnpm run lint
pnpm run build
pnpm run test

Risk Assessment

Low risk — These are all patch/minor version updates (except dependency-review-action v5 which is a major update but requires no workflow changes). All updates maintain backward compatibility with existing workflow syntax and functionality.

---

Warning

Protected Files — Push Permission Denied

This was originally intended as a pull request, but the patch modifies protected files. A human must create the pull request manually.

Protected files

• .github/workflows/codeql.yml

• .github/workflows/main.yml

The push was rejected because GitHub Actions does not have workflows permission to push these changes, and is never allowed to make such changes, or other authorization being used does not have this permission.

Create the pull request manually

# Download the patch from the workflow run
gh run download 26416795728 -n agent -D /tmp/agent-26416795728

# Create a new branch
git checkout -b copilot/dependency-update/github-actions/simple main

# Apply the patch (--3way handles cross-repo patches)
git am --3way /tmp/agent-26416795728/aw-dgee2-menu-copilot-dependency-update-github-actions-simple.patch

# Push the branch and create the pull request
git push origin copilot/dependency-update/github-actions/simple
gh pr create --title 'chore(deps): update GitHub Actions dependencies' --base main --head copilot/dependency-update/github-actions/simple --repo dgee2/Menu

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• api.nuget.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.nuget.org"

See Network Configuration for more information.

Generated by Dependency Update GitHub Actions · ● 14.3M · ◷

[dgee2]

Fixed by PR #1080. The dependency update workflow now successfully creates PRs — confirmed by #1084.