Bump actions to current majors; add Dependabot

.github/dependabot.yaml

@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly

.github/workflows/build-skill.yml

@@ -32,9 +32,9 @@ jobs:
     timeout-minutes: 5
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.11"
           cache: pip
@@ -64,7 +64,7 @@ jobs:
           "
 
       - name: Upload avp.skill as workflow artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: avp-skill
           path: dist/avp.skill

.github/workflows/conformance.yml

@@ -17,8 +17,8 @@ jobs:
     timeout-minutes: 5
 
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.11"
           cache: pip
@@ -36,14 +36,14 @@ jobs:
     needs: lint
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       # The repo is a uv workspace rooted at the repo root; `uv sync` installs
       # every Python member editable and resolves the cross-package deps (`avp`,
       # `avp-conformance`, ...) to the in-tree sources rather than PyPI. (There's
       # an unrelated `avp` package on PyPI; the workspace sources override it.)
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v10
         with:
           python-version: "3.11"
           enable-cache: true
@@ -78,17 +78,17 @@ jobs:
     if: github.event_name == 'workflow_dispatch'
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v10
         with:
           python-version: "3.11"
           enable-cache: true
 
       # The avp-claude-agent-sdk real_llm tests drive the Claude Agent SDK, which
       # shells out to the `claude` CLI; install it so it's on PATH.
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: "20"
       - name: Install the claude CLI

.github/workflows/release-claude-code.yml

@@ -28,10 +28,10 @@ jobs:
     timeout-minutes: 15
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v10
         with:
           python-version: "3.11"
 

.github/workflows/release-goose.yml

@@ -40,7 +40,7 @@ jobs:
           - { target: aarch64-unknown-linux-gnu, runner: ubuntu-24.04-arm }
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: System build deps (Linux)
         if: runner.os == 'Linux'
@@ -80,7 +80,7 @@ jobs:
           tar -czf "$asset" -C target/release avp-goose-conformance
           shasum -a 256 "$asset" > "$asset.sha256"
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: goose-${{ matrix.target }}
           path: agents/avp-goose/rust/avp-goose-conformance*-${{ matrix.target }}.tar.gz*
@@ -92,7 +92,7 @@ jobs:
     needs: build
     timeout-minutes: 10
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           path: dist
           merge-multiple: true

.github/workflows/release-pypi.yml

@@ -34,14 +34,14 @@ jobs:
     name: Build avp-cli wheel
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v10
         with:
           python-version: "3.11"
       - name: Build wheel
         run: uv build --wheel --package avp-cli --out-dir dist
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: dist
           path: dist/
@@ -54,7 +54,7 @@ jobs:
     permissions:
       id-token: write # OIDC token for Trusted Publishing
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: dist
           path: dist/

.github/workflows/sync-prices.yml

@@ -22,9 +22,9 @@ jobs:
     timeout-minutes: 10
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.11"