fix: update third-party GitHub Actions

propose-safe-multisig-tx:
- actions/checkout v4.4.0 -> v7.0.1
- actions/setup-node v4.4.0 -> v7.0.0

docker-build-cloud:
- actions/checkout v6.1.0 -> v7.0.1
- docker/setup-buildx-action v4.3.0 -> v4.4.1
- docker/build-push-action v7.3.0 -> v7.4.0
- actions/attest v4.1.1 -> v4.2.2

java-build:
- actions/checkout v6.1.0 -> v7.0.1
- gradle/actions/setup-gradle v6.3.0 -> v6.4.0

rust-build:
- actions/checkout v6.1.0 -> v7.0.1
- actions/cache v5.1.0 -> v6.1.0
- dtolnay/rust-toolchain master 2026-09-04 -> master 2026-09-12
- SocketDev/action be1f253 -> 401464a (post-v1.3.2, includes sfw shims)

publish-npm:
- SocketDev/action be1f253 -> 401464a (post-v1.3.2, includes sfw shims)

Author: PierreJeanjacquot

.github/workflows/docker-build-cloud.yml

@@ -49,7 +49,7 @@ jobs:
 
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # Login MUST run before Set up Docker Buildx so the cloud driver can
       # authenticate to the Docker Build Cloud endpoint via ~/.docker/config.json.
@@ -60,14 +60,14 @@ jobs:
           password: ${{ secrets.dockerhub-password }}
 
       - name: Set up Docker Buildx (Docker Build Cloud)
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
         with:
           driver: cloud
           endpoint: ${{ inputs.cloud-builder-endpoint }}
 
       - name: Build and push multi-platform image
         id: build
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           build-args: ${{ inputs.build-args }}
           context: ${{ inputs.context }}
@@ -80,7 +80,7 @@ jobs:
       # Requires the permissions id-token: write + attestations: write.
       - name: Generate & sign SLSA provenance (keyless)
         if: ${{ inputs.attest }}
-        uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
         with:
           subject-name: ${{ inputs.image-name }}
           subject-digest: ${{ steps.build.outputs.digest }}

.github/workflows/java-build.yml

@@ -67,7 +67,7 @@ jobs:
 
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # Sonar needs the full history to attribute lines to authors, and the Gradle
           # build derives the project version from the tag pointing at HEAD.
@@ -80,7 +80,7 @@ jobs:
           java-version: ${{ inputs.java-version }}
 
       - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
+        uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6.4.0
 
       - name: Login to Docker Hub
         if: ${{ inputs.dockerhub-login }}

.github/workflows/propose-safe-multisig-tx.yml

@@ -51,12 +51,12 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: iExecBlockchainComputing/github-actions-workflows
 
       - name: Setup Node.js
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '22'
 

.github/workflows/publish-npm.yml

@@ -109,7 +109,7 @@ jobs:
           scope: ${{ inputs.scope }}
 
       - name: Enable Socket Firewall
-        uses: SocketDev/action@be1f253a41351d59095f8d7f1425985097dd1054 # unreleased: pre-v1.3.2, includes shim feature
+        uses: SocketDev/action@401464a6f605cfe154713e268aadd88daa25c0b4 # unreleased: post-v1.3.2, includes sfw shims
         with:
           mode: firewall-free
           shims: true

.github/workflows/rust-build.yml

@@ -32,24 +32,24 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@d1031067263f94b142dd6c0ce24c5eb9d02d52a0 # @master 2026-09-04 (action has no version tags)
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # @master 2026-09-12 (action has no version tags)
         with:
           toolchain: ${{ inputs.rust-version }}
           components: clippy, rustfmt
 
       - name: Enable Socket Firewall
-        uses: SocketDev/action@be1f253a41351d59095f8d7f1425985097dd1054
+        uses: SocketDev/action@401464a6f605cfe154713e268aadd88daa25c0b4 # unreleased: post-v1.3.2, includes sfw shims
         with:
           mode: firewall-free
           shims: true
 
       # https://github.com/actions/cache/blob/main/examples.md#rust---cargo
       - name: Cache dependencies
         if: ${{ inputs.enable-cache }}
-        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ~/.cargo/bin/

docker-build-cloud/workflow-sha256

@@ -1 +1 @@
-f364b67e9d5c3795461d15b7bab21adddcd63490e097a15aa82678f80212bff4
+9534ee4ca0e3ac583e44e73291978c1f83349585535e39fe1fe4804f651baee4

java-build/workflow-sha256

@@ -1 +1 @@
-0cfcab0eef18565a49557ca272394093e9d8d2a45dd09407b037f1ee0268f701
+9d50a67a87151b9c0d9e1ab6a067bd8b4bf5407601457779d25cb58a600c6c8b

propose-safe-multisig-tx/workflow-sha256

@@ -1 +1 @@
-2bc401eb56f124daf40536e5e7c2b46f93a6dc11752d05984d2031df30207b8b
+20270bfd49e14744aac321cd791e23f25aff4e36df2176bb9fb3eb52047cc624

publish-npm/workflow-sha256

@@ -1 +1 @@
-ec4d71529317633973e1487f89ce98e6f8abe43718a260de00b73156c56cd5d2
+dab7735b88503343e309fe28bd475e4cad2c85a1fdf3c90cb5ed60fabb331ff6

rust-build/workflow-sha256

@@ -1 +1 @@
-e26af861c1aabbbc1d5468e9153f8e1bb1878713ce4ae501f7aaff3626008bdc
+f8f6c2b5c094c1b6428ebfc93c59fc8e57459af796afa8bb9b6b4c64ac33ab2d