chore(deps): update github-actions

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
actions/attest-build-provenance	action	patch	v4.1.0 → v4.1.1
actions/cache	action	minor	v5.0.5 → v5.1.0
dorny/paths-filter	action	patch	v4.0.1 → v4.0.2
taiki-e/install-action	action	patch	v2.82.4 → v2.82.7	v2.82.9 (+1)
tombi-toml/setup-tombi	action	patch	v1.1.5 → v1.1.7	v1.2.0

---

Release Notes

actions/attest-build-provenance (actions/attest-build-provenance)

v4.1.1

Compare Source

[!NOTE]
As of version 4, actions/attest-build-provenance is simply a wrapper on top of actions/attest.

Existing applications may continue to use the attest-build-provenance action, but new implementations should use actions/attest instead.

What's Changed

• Update actions/attest to v4.1.1 by @​bdehamer in #​858

Full Changelog: actions/attest-build-provenance@v4.1.0...v4.1.1

actions/cache (actions/cache)

v5.1.0

Compare Source

What's Changed

• Bump @​actions/cache to v5.1.0 - handle read-only cache access by @​jasongin in #​1775

Full Changelog: actions/cache@v5...v5.1.0

dorny/paths-filter (dorny/paths-filter)

v4.0.2

Compare Source

• Work around git dubious ownership errors in container jobs
• Use rev-parse instead of branch --show-current for older git compat
• Fix warning message

taiki-e/install-action (taiki-e/install-action)

v2.82.7: 2.82.7

Compare Source

• Update tombi@latest to 1.1.6.

• Update kingfisher@latest to 1.105.0.

• Update gungraun-runner@latest to 0.19.3.

• Update editorconfig-checker@latest to 3.8.0.

• Update dprint@latest to 0.55.1.

• Update cargo-tarpaulin@latest to 0.36.0.

v2.82.6: 2.82.6

Compare Source

• Update vacuum@latest to 0.29.7.

• Update uv@latest to 0.11.25.

• Update syft@latest to 1.46.0.

• Update dprint@latest to 0.55.0.

• Update cargo-auditable@latest to 0.7.5.

v2.82.5: 2.82.5

Compare Source

• Update wasmtime@latest to 46.0.1.

• Update wasm-bindgen@latest to 0.2.126.

• Update vacuum@latest to 0.29.6.

• Update mise@latest to 2026.6.14.

• Update cargo-rdme@latest to 2.1.0.

tombi-toml/setup-tombi (tombi-toml/setup-tombi)

v1.1.7

Compare Source

This setup-tombi release matches tombi v1.1.7.

Full Changelog: tombi-toml/setup-tombi@v1...v1.1.7

v1.1.6

Compare Source

This setup-tombi release matches tombi v1.1.6.

What's Changed

• Update README checksum examples by @​ya7010 in #​44
• Fix README checksum regeneration by @​ya7010 in #​45

Full Changelog: tombi-toml/setup-tombi@v1...v1.1.6

---

Configuration

📅 Schedule: (in timezone Europe/Gibraltar)

• Branch creation
  • "before 9am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

⚠️ No Changeset found

Latest commit: eefc5b7

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[github-actions]

❌ Automation signals

Activity patterns show signs of automation.

View full analysis →

_{This is an automated analysis by AgentScan}

[codspeed-hq]

Merging this PR will degrade performance by 21.24%

⚡ 1 improved benchmark
❌ 3 regressed benchmarks
✅ 245 untouched benchmarks

Warning

Please fix the performance issues or acknowledge them on CodSpeed.

Performance Changes

	Benchmark	BASE	HEAD	Efficiency
❌	deserialize_from_json_str[biome.json]	389.4 µs	852.6 µs	-54.33%
❌	synthetic/vue-dynamic-args.vue[cached]	685.3 µs	806.4 µs	-15.02%
❌	index_d_ts[astro_server.mjs]	190.7 ms	209 ms	-8.76%
⚡	synthetic/void-elements.html[uncached]	1.6 ms	1.4 ms	+8.67%

Tip

Investigate this regression by commenting @codspeedbot fix this regression on this PR, or directly use the CodSpeed MCP with your agent.

---

_{Comparing renovate/github-actions (eefc5b7) with main (ef9076a)¹}

Footnotes

1. No successful run was found on main (3f9e3c9) during the generation of this report, so ef9076a was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩