chore(deps): Update GitHub Actions (major) (major)

.github/workflows/build.yml

@@ -117,7 +117,7 @@ jobs:
       # ── ccache (Linux + macOS) ──────────────────────────────────────
       - name: Restore ccache
         if: startsWith(matrix.CC, 'ccache ')
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
         with:
           path: ~/.ccache
           key: ccache-v2-${{ matrix.os }}-${{ matrix.CC }}-${{ matrix.meson_extra }}-${{ github.sha }}
@@ -129,13 +129,13 @@ jobs:
       # ── Python ──────────────────────────────────────────────────────
       - name: Setup python
         if: "!matrix.windows"
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: '3.14.6'
 
       - name: Setup python (Windows)
         if: matrix.windows
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: '3.14.6'
 
@@ -407,7 +407,7 @@ jobs:
       # ── Python tox (Linux + macOS) ───────────────────────────────────
       - name: Cache Netflix vmaf_resource fixtures
         if: startsWith(matrix.os, 'ubuntu') || matrix.os == 'macos-latest'
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
         with:
           path: python/test/resource
           key: vmaf-fixtures-resource-v1-${{ hashFiles('python/test/*_test.py', 'python/test/resource/test_*.py') }}

.github/workflows/docs.yml

@@ -24,7 +24,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: "3.14.6"
       - name: Install MkDocs Material

.github/workflows/e2e-k8s.yml

@@ -104,7 +104,7 @@ jobs:
         uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5  # v4.1.0
 
       - name: Cache Docker layers
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
         with:
           path: /tmp/.buildx-cache
           key: buildx-e2e-${{ runner.os }}-${{ hashFiles('cmd/**', 'pkg/**', 'go.sum', 'docker/Dockerfile.*') }}

.github/workflows/ffmpeg-integration.yml

@@ -62,7 +62,7 @@ jobs:
       CXX: ${{ matrix.CXX }}
     steps:
       - name: Setup python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: 3.14.6
       - name: Install meson and ninja
@@ -105,7 +105,7 @@ jobs:
       DEBIAN_FRONTEND: noninteractive
     steps:
       - name: Setup python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: 3.14.6
       - name: Install meson, ninja, and dependencies

.github/workflows/go-ci.yml

@@ -31,7 +31,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
           go-version: "1.26.4"
           cache: true

.github/workflows/libvmaf-build-matrix.yml

@@ -230,7 +230,7 @@ jobs:
       # — "C++ - ccache" example.
       - name: Restore ccache (Linux + macOS)
         if: startsWith(matrix.CC, 'ccache ')
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
         with:
           path: ~/.ccache
           # v2 prefix: forces fresh entries after actions/cache v4→v5
@@ -243,7 +243,7 @@ jobs:
             ccache-v2-${{ matrix.os }}-
 
       - name: Setup python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: 3.14.6
 
@@ -543,7 +543,7 @@ jobs:
         # raw.githubusercontent.com when fetching python/test/resource/
         # fixtures via download_reactively (compat/python-vmaf/config.py).
         if: "(startsWith(matrix.os, 'ubuntu') && !matrix.sycl && !matrix.cuda && !matrix.hip && !matrix.i686) || matrix.os == 'macos-latest'"
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
         with:
           path: python/test/resource
           key: vmaf-fixtures-resource-v1-${{ hashFiles('python/test/*_test.py', 'python/test/resource/test_*.py') }}
@@ -638,7 +638,7 @@ jobs:
           fetch-depth: 0
 
       - name: Cache ccache files
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
         with:
           path: .ccache
           key: ${{ runner.os }}-${{ matrix.msystem }}-0-${{ hashFiles('**/*.c') }}
@@ -752,7 +752,7 @@ jobs:
           fetch-depth: 1
 
       - name: Setup python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: '3.14.6'
 

.github/workflows/lint-and-format.yml

@@ -34,15 +34,15 @@ jobs:
           # against files no hook actually touched.
           lfs: true
           persist-credentials: false
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: "3.14.6"
       # pre-commit/action@v3.0.1 is the latest release (Feb 2024) and still
       # pins actions/cache@v4, which trips the Node.js 20 deprecation
       # warning (Node 20 removed from runners 2026-09-16). Inline the
       # three steps it would have run, using actions/cache@v5.
       - name: Cache pre-commit environments
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
         with:
           path: ~/.cache/pre-commit
           key: pre-commit-${{ runner.os }}-py3.14-${{ hashFiles('.pre-commit-config.yaml') }}
@@ -481,7 +481,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: "3.14.6"
       - name: Install
@@ -504,7 +504,7 @@ jobs:
           # bytes, not pointer files.
           lfs: true
           persist-credentials: false
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: "3.14.6"
       - name: Install jsonschema
@@ -527,7 +527,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: "3.14.6"
       - name: Install MkDocs Material
@@ -607,7 +607,7 @@ jobs:
           # multi-commit FF pushes; PR mode uses origin/${base_ref}...HEAD.
           fetch-depth: 0
           persist-credentials: false
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: "24.18.0"
       - name: Detect changed markdown files

.github/workflows/nightly-bisect.yml

@@ -33,7 +33,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
       - name: Set up Python 3.12
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: "3.14.6"
 

.github/workflows/sanitizers.yml

@@ -73,7 +73,7 @@ jobs:
       # cycle drops re-runs to <2 min for unchanged TUs. Mirrors the
       # build.yml / libvmaf-build-matrix.yml pattern.
       - name: Restore ccache
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
         with:
           path: ~/.ccache
           key: ccache-v2-sanitizer-asan-ubsan-${{ github.sha }}
@@ -163,7 +163,7 @@ jobs:
           sudo apt-get install -y meson ninja-build nasm clang-18 lld-18 \
             libclang-rt-18-dev ccache
       - name: Restore ccache
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
         with:
           path: ~/.ccache
           key: ccache-v2-sanitizer-tsan-${{ github.sha }}

.github/workflows/supply-chain.yml

@@ -184,7 +184,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           ref: ${{ github.event.inputs.tag || github.ref }}
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: "3.14.6"
       - name: Install build deps

.github/workflows/tests-and-quality-gates.yml

@@ -73,7 +73,7 @@ jobs:
           meson compile -C build
 
       - name: Cache Netflix vmaf_resource fixtures
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
         with:
           # Cache the entire python/test/resource tree — pytest's
           # download_reactively (python/vmaf/config.py) populates it
@@ -495,7 +495,7 @@ jobs:
       # that on a cold runner).
       - name: Cache ONNX Runtime tarball
         id: cache-ort
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
         with:
           path: /tmp/ort-cache
           key: ort-tarball-linux-x64-gpu-1.22.0