chore: update packages, GHA versions, add Dependabot

.github/actions/php/action.yml

@@ -9,4 +9,4 @@ runs:
         php-version: "8.3"
         coverage: none
 
-    - uses: "ramsey/composer-install@v3"
+    - uses: "ramsey/composer-install@v4"

.github/dependabot.yml

@@ -0,0 +1,12 @@
+version: 2
+updates:
+  # Composer is handled by auto-package-update.yml (weekly, Sunday)
+  # Dependabot covers GitHub Actions only to avoid duplicate PRs
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "sunday"
+      time: "00:00"
+      timezone: "UTC"
+    open-pull-requests-limit: 5

.github/workflows/auto-package-update.yml

@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           ref: ${{ github.head_ref }}
           # Must be used to trigger workflow after push
@@ -25,7 +25,7 @@ jobs:
         run: composer update && composer bump && composer update
 
       - # commit only to core contributors who have repository access
-        uses: stefanzweifel/git-auto-commit-action@v5
+        uses: stefanzweifel/git-auto-commit-action@v7
         with:
           commit_message: "[ci] package-updates"
           commit_author: "GitHub Action <actions@github.com>"

.github/workflows/main.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: .env
         run: php -r "copy('.env.ci', '.env');"
@@ -30,7 +30,7 @@ jobs:
         test_suite: [Unit, Feature]
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: .env
         run: php -r "copy('.env.ci', '.env');"
@@ -43,7 +43,7 @@ jobs:
 
       - name: Upload Laravel Logs
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: TestLaravelLog-${{ matrix.test_suite }}
           path: storage/logs
@@ -55,7 +55,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Install SSH key
         run: >

.github/workflows/rector.yml

@@ -11,7 +11,7 @@ jobs:
     if: github.event.pull_request.head.repo.full_name == '128na/SimutransCrossSearch'
     steps:
       - if: github.event.pull_request.head.repo.full_name == github.repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           # Must be used to trigger workflow after push
           token: ${{ secrets.ACCESS_TOKEN }}
@@ -23,7 +23,7 @@ jobs:
       - run: vendor/bin/pint
 
       - # commit only to core contributors who have repository access
-        uses: stefanzweifel/git-auto-commit-action@v5
+        uses: stefanzweifel/git-auto-commit-action@v7
         with:
           commit_message: "[rector] Rector fixes"
           commit_author: "GitHub Action <actions@github.com>"