chore(deps): update github actions

.github/actions/verify-signed/action.yml

@@ -5,7 +5,7 @@ description: >-
 runs:
   using: composite
   steps:
-    - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+    - uses: sigstore/cosign-installer@756fe2d284c7292c4e9b62c8a28f1e5629c59532 # v4.1.3
       with:
         cosign-release: v3.1.4
     - name: Verify provenance and the SBOM attestation with gh attestation verify

.github/workflows/build-signed.yml

@@ -75,7 +75,7 @@ jobs:
           dotnet restore --locked-mode
           dotnet build src/JellySin.Plugin.Lastfm/JellySin.Plugin.Lastfm.csproj -c Release --no-restore
       - name: Package the plugin, release metadata, checksums and SPDX SBOM
-        uses: jellysin/release-helper/actions/package@8e75bfdf6eb89283afb68c5bc50d5645c984752c # v1.7.0
+        uses: jellysin/release-helper/actions/package@fdc3bacd4a87749466c1af6d25a08fdefb4c500f # v1.7.2
         with:
           publish-directory: src/JellySin.Plugin.Lastfm/bin/Release/net10.0
           tag: ${{ inputs.tag }}
@@ -88,7 +88,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: jellysin/release-helper
-          ref: 8e75bfdf6eb89283afb68c5bc50d5645c984752c # v1.7.0
+          ref: fdc3bacd4a87749466c1af6d25a08fdefb4c500f # v1.7.2
           path: build/repro-tooling
           persist-credentials: false
       - name: Verify production artifact reproducibility with the embedded application
@@ -107,7 +107,7 @@ jobs:
         with:
           subject-path: dist/*.zip
           sbom-path: dist/sbom.spdx.json
-      - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+      - uses: sigstore/cosign-installer@756fe2d284c7292c4e9b62c8a28f1e5629c59532 # v4.1.3
         with:
           cosign-release: v3.1.4
       - name: Sign every artifact with cosign keyless

.github/workflows/ci.yml

@@ -100,8 +100,8 @@ jobs:
         run: |
           dotnet run --project benchmarks/JellySin.Plugin.Lastfm.Benchmarks -c Release --no-build -- --self-test
           dotnet run --project benchmarks/JellySin.Plugin.Lastfm.Benchmarks -c Release --no-build > build/playback-benchmark.json
-      - uses: jellysin/release-helper/actions/check@8e75bfdf6eb89283afb68c5bc50d5645c984752c # v1.7.0
-      - uses: jellysin/release-helper/actions/milestone@8e75bfdf6eb89283afb68c5bc50d5645c984752c # v1.7.0
+      - uses: jellysin/release-helper/actions/check@fdc3bacd4a87749466c1af6d25a08fdefb4c500f # v1.7.2
+      - uses: jellysin/release-helper/actions/milestone@fdc3bacd4a87749466c1af6d25a08fdefb4c500f # v1.7.2
       - name: Validate workflows and scan tracked history for secrets
         env:
           ACTIONLINT_SHA256: 8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8
@@ -155,7 +155,7 @@ jobs:
       - name: Enforce real-library search and playback budgets and scrobble delivery under that load on Jellyfin 12.1
         run: python tools/library_load.py --plugin src/JellySin.Plugin.Lastfm/bin/Release/net10.0/JellySin.Plugin.Lastfm.dll --tracks 10000 --server '12.1'
       - name: Validate installable package and release metadata
-        uses: jellysin/release-helper/actions/package@8e75bfdf6eb89283afb68c5bc50d5645c984752c # v1.7.0
+        uses: jellysin/release-helper/actions/package@fdc3bacd4a87749466c1af6d25a08fdefb4c500f # v1.7.2
         with:
           publish-directory: src/JellySin.Plugin.Lastfm/bin/Release/net10.0
           nuget-lock-path: src/JellySin.Plugin.Lastfm/packages.lock.json
@@ -166,7 +166,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: jellysin/release-helper
-          ref: 8e75bfdf6eb89283afb68c5bc50d5645c984752c # v1.7.0
+          ref: fdc3bacd4a87749466c1af6d25a08fdefb4c500f # v1.7.2
           path: build/repro-tooling
           persist-credentials: false
       # The helper holds the plugin's own server references at the floor; planted ones show that this pin does.

.github/workflows/codeql.yml

@@ -22,10 +22,10 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: github/codeql-action/init@1fc58d04a4d4374f921bdac573c3811c240f9c26 # v4.39.2
+      - uses: github/codeql-action/init@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3
         with:
           languages: ${{ matrix.language }}
           build-mode: none
-      - uses: github/codeql-action/analyze@1fc58d04a4d4374f921bdac573c3811c240f9c26 # v4.39.2
+      - uses: github/codeql-action/analyze@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3
         with:
           category: /language:${{ matrix.language }}

.github/workflows/prepare-release.yml

@@ -31,7 +31,7 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
       - name: Create the tag and one unpublished draft
-        uses: jellysin/release-helper/actions/prepare@8e75bfdf6eb89283afb68c5bc50d5645c984752c # v1.7.0
+        uses: jellysin/release-helper/actions/prepare@fdc3bacd4a87749466c1af6d25a08fdefb4c500f # v1.7.2
         with:
           tag: ${{ inputs.tag }}
           commit: ${{ inputs.commit }}

.github/workflows/release-automation.yml

@@ -15,4 +15,4 @@ jobs:
       issues: write
       pull-requests: write
       actions: write
-    uses: jellysin/release-helper/.github/workflows/release-please.yml@8e75bfdf6eb89283afb68c5bc50d5645c984752c # v1.7.0
+    uses: jellysin/release-helper/.github/workflows/release-please.yml@fdc3bacd4a87749466c1af6d25a08fdefb4c500f # v1.7.2

.github/workflows/release.yml

@@ -47,7 +47,7 @@ jobs:
           name: ${{ needs.build.outputs.artifact }}
       - uses: ./.github/actions/verify-signed
       - name: Verify bytes, resume missing draft uploads and publish
-        uses: jellysin/release-helper/actions/publish@8e75bfdf6eb89283afb68c5bc50d5645c984752c # v1.7.0
+        uses: jellysin/release-helper/actions/publish@fdc3bacd4a87749466c1af6d25a08fdefb4c500f # v1.7.2
         with:
           directory: dist
           tag: ${{ github.ref_name }}