[develop-2023]: Bump the gha group with 6 updates

.github/workflows/alpha.yaml

@@ -27,9 +27,9 @@ jobs:
     permissions:
       contents: write
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
 
-    - uses: actions/setup-node@v6
+    - uses: actions/setup-node@v7
       with:
         node-version: 24
         registry-url: 'https://packages.nuxeo.com/repository/npm-public/'

.github/workflows/codeql.yml

@@ -57,7 +57,7 @@ jobs:
         # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
 
     # Add any setup steps before running the `github/codeql-action/init` action.
     # This includes steps like installing compilers or runtimes (`actions/setup-node`

.github/workflows/crowdin.yaml

@@ -40,13 +40,13 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: develop-2023
 
       - name: Crowdin Action
         id: crowdin-sync
-        uses: crowdin/github-action@7ca9c452bfe9197d3bb7fa83a4d7e2b0c9ae835d # v2.16.0
+        uses: crowdin/github-action@9c23991700c0ec5256fd41089b9d9d7d540e424e # v3.3.0
         with:
           # Disable 'git checkout "${GITHUB_REF#refs/heads/}"'
           skip_ref_checkout: true

.github/workflows/dependency-review.yaml

@@ -16,9 +16,9 @@ jobs:
     name: Dependency Review
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Review dependency changes
-        uses: actions/dependency-review-action@v4
+        uses: actions/dependency-review-action@v5
         with:
           fail-on-severity: moderate

.github/workflows/lint.yaml

@@ -23,13 +23,13 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           # Honour an explicit workflow_call branch. Empty on pull_request, which leaves
           # checkout on the PR merge commit instead of the head branch.
           ref: ${{ inputs.branch }}
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: 24
           registry-url: 'https://packages.nuxeo.com/repository/npm-public/'

.github/workflows/main.yaml

@@ -74,9 +74,9 @@ jobs:
             ;;
         esac
 
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
 
-    - uses: actions/setup-node@v6
+    - uses: actions/setup-node@v7
       with:
         node-version: 24
         registry-url: 'https://packages.nuxeo.com/repository/npm-public/'

.github/workflows/preview.yaml

@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     if: (github.event.action == 'labeled' && github.event.label.name == 'webui-preview') || contains(github.event.pull_request.labels.*.name, 'webui-preview')
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Prepare environment
         run: |

.github/workflows/promote.yaml

@@ -25,13 +25,13 @@ jobs:
   promote:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: 24
           registry-url: 'https://packages.nuxeo.com/repository/npm-public/'
           scope: '@nuxeo'
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: v${{ github.event.inputs.version }}
           token: ${{ secrets.GIT_ADMIN_TOKEN }}
@@ -81,7 +81,7 @@ jobs:
         run: |
           npx ${{ env.LERNA }} exec --ignore @nuxeo/nuxeo-elements-storybook -- npm publish --@nuxeo:registry=https://packages.nuxeo.com/repository/npm-public/
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           token: ${{ secrets.GIT_ADMIN_TOKEN }}
           ref: ${{ github.event.inputs.referenceBranch }}

.github/workflows/sonar.yaml

@@ -39,7 +39,7 @@ jobs:
           comment_on_pr: false
 
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: ${{ inputs.branch }}
           fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis
@@ -48,14 +48,14 @@ jobs:
         run: git config user.name "nuxeo-webui-jx-bot" && git config user.email "webui@hyland.com"
 
       - name: Setup Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           registry-url: 'https://packages.nuxeo.com/repository/npm-public/'
           node-version: 24
           scope: '@nuxeo'
 
       - name: Cache npm packages
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: ~/.npm
           key: ${{ runner.os }}-node-${{ hashFiles('**/package.json') }}
@@ -94,7 +94,7 @@ jobs:
         id: sonar_scan
         env:
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
-        uses: SonarSource/sonarqube-scan-action@59db25f34e16620e48ab4bb9e4a5dce155cb5432 # v8.0.0
+        uses: SonarSource/sonarqube-scan-action@d209202bc7d53ff1cc128f7f907dac145c9d6ae9 # v8.3.0
         with:
           projectBaseDir: ${{ github.workspace }}
           args: >

.github/workflows/storybook.yaml

@@ -26,13 +26,13 @@ jobs:
   storybook:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           # Honour an explicit workflow_call branch. Empty on pull_request, which leaves
           # checkout on the PR merge commit instead of the head branch.
           ref: ${{ inputs.branch }}
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: 24
           registry-url: 'https://packages.nuxeo.com/repository/npm-public/'

.github/workflows/sync-release-to-dev.yaml

@@ -31,7 +31,7 @@ jobs:
   sync:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 

.github/workflows/test.yaml

@@ -26,13 +26,13 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           # Honour an explicit workflow_call branch. Empty on pull_request, which leaves
           # checkout on the PR merge commit instead of the head branch.
           ref: ${{ inputs.branch }}
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: 24
           registry-url: 'https://packages.nuxeo.com/repository/npm-public/'