build(deps): update GitHub Actions to latest stable releases

.github/workflows/__main-ci.yml

@@ -35,7 +35,7 @@ jobs:
   release:
     needs: ci
     if: github.event_name != 'schedule'
-    uses: hoverkraft-tech/ci-github-publish/.github/workflows/release-actions.yml@b942fb00f3115ca70f98f45f2289cc9838eb9312 # 3.0.0
+    uses: hoverkraft-tech/ci-github-publish/.github/workflows/release-actions.yml@704e6c786af0f5dfd84a8851e428bb36b6cf180f # 3.0.1
     permissions:
       contents: read
     with:

.github/workflows/__prepare-release.yml

@@ -10,7 +10,7 @@ permissions: {}
 
 jobs:
   release:
-    uses: hoverkraft-tech/ci-github-publish/.github/workflows/prepare-release.yml@b942fb00f3115ca70f98f45f2289cc9838eb9312 # 3.0.0
+    uses: hoverkraft-tech/ci-github-publish/.github/workflows/prepare-release.yml@704e6c786af0f5dfd84a8851e428bb36b6cf180f # 3.0.1
     permissions:
       contents: read
       pull-requests: write

.github/workflows/__release.yml

@@ -53,15 +53,15 @@ jobs:
 
       - name: Plan release
         id: plan-release
-        uses: hoverkraft-tech/ci-github-publish/actions/release/plan@b942fb00f3115ca70f98f45f2289cc9838eb9312 # 3.0.0
+        uses: hoverkraft-tech/ci-github-publish/actions/release/plan@704e6c786af0f5dfd84a8851e428bb36b6cf180f # 3.0.1
         with:
           target-ref: ${{ github.sha }}
           force: ${{ github.event_name == 'workflow_dispatch' && inputs.force }}
           github-token: ${{ steps.generate-token.outputs.token }}
 
       - name: Create and publish release
         if: steps.plan-release.outputs.should-release == 'true' && steps.plan-release.outputs.tag != ''
-        uses: hoverkraft-tech/ci-github-publish/actions/release/create@b942fb00f3115ca70f98f45f2289cc9838eb9312 # 3.0.0
+        uses: hoverkraft-tech/ci-github-publish/actions/release/create@704e6c786af0f5dfd84a8851e428bb36b6cf180f # 3.0.1
         env:
           OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }} # zizmor: ignore[secrets-outside-env] repository secret is scoped to the release summary step
         with:

.github/workflows/__renovate.yml

@@ -31,7 +31,7 @@ jobs:
           permission-workflows: write
 
       - name: Run Renovate
-        uses: renovatebot/github-action@1c0cf989c02653fba0efe7ca5772338860ca71dc # v46.3.12
+        uses: renovatebot/github-action@266fef21329c44765ad42f9dea1f01f5d2d91084 # v46.3.13
         with:
           token: ${{ steps.generate-token.outputs.token }}
         env:

actions/release/draft/action.yml

@@ -34,7 +34,7 @@ runs:
         persist-credentials: false
     - id: configuration
       if: inputs.package-name != ''
-      uses: hoverkraft-tech/ci-github-publish/actions/release/get-configuration@b942fb00f3115ca70f98f45f2289cc9838eb9312 # 3.0.0
+      uses: hoverkraft-tech/ci-github-publish/actions/release/get-configuration@704e6c786af0f5dfd84a8851e428bb36b6cf180f # 3.0.1
       with:
         working-directory: ${{ inputs.working-directory }}
     - id: independent-configuration
@@ -83,7 +83,7 @@ runs:
             );
           await io.mkdirP(path.dirname(destination));
           fs.writeFileSync(destination, configuration);
-    - uses: hoverkraft-tech/ci-github-publish/actions/release/create@b942fb00f3115ca70f98f45f2289cc9838eb9312 # 3.0.0
+    - uses: hoverkraft-tech/ci-github-publish/actions/release/create@704e6c786af0f5dfd84a8851e428bb36b6cf180f # 3.0.1
       with:
         config-overrides: ${{ inputs.release-config }}
         tag: ${{ inputs.tag }}

actions/release/finalize/action.yml

@@ -44,7 +44,7 @@ runs:
         name: release-pending-assets-${{ steps.assets.outputs.release-id }}-${{ github.run_id }}-${{ github.run_attempt }}
         path: ${{ steps.assets.outputs.pending-directory }}/*.tgz
         if-no-files-found: error
-    - uses: hoverkraft-tech/ci-github-publish/actions/release/update@b942fb00f3115ca70f98f45f2289cc9838eb9312 # 3.0.0
+    - uses: hoverkraft-tech/ci-github-publish/actions/release/update@704e6c786af0f5dfd84a8851e428bb36b6cf180f # 3.0.1
       if: steps.assets.outputs.published != 'true'
       with:
         tag: ${{ inputs.tag }}

actions/release/prepare/action.yml

@@ -68,7 +68,7 @@ runs:
     - name: Plan release with HoverKraft
       id: plan
       if: steps.inspect.outputs.tag == '' && steps.inspect.outputs.independent != 'true'
-      uses: hoverkraft-tech/ci-github-publish/actions/release/plan@b942fb00f3115ca70f98f45f2289cc9838eb9312 # 3.0.0
+      uses: hoverkraft-tech/ci-github-publish/actions/release/plan@704e6c786af0f5dfd84a8851e428bb36b6cf180f # 3.0.1
       with:
         github-token: ${{ inputs.github-token }}
         target-ref: ${{ github.sha }}

actions/release/verify/action.yml

@@ -45,7 +45,7 @@ runs:
           core.setOutput('releases', releases);
           core.setOutput('packages', packages);
     - id: identity
-      uses: hoverkraft-tech/ci-github-publish/actions/release/verify@b942fb00f3115ca70f98f45f2289cc9838eb9312 # 3.0.0
+      uses: hoverkraft-tech/ci-github-publish/actions/release/verify@704e6c786af0f5dfd84a8851e428bb36b6cf180f # 3.0.1
       with:
         artifact-ids: ${{ steps.prepare.outputs.artifact-ids }}
         tags: ${{ steps.prepare.outputs.tags }}