ci: bump the github-actions group with 3 updates

.github/workflows/benchmark.yaml

@@ -30,7 +30,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
         with:
           # Pin uv so CI resolves uv.lock identically to local (lock revision is
           # uv-version-tied), keeping `uv sync --locked` reliable.
@@ -42,7 +42,7 @@ jobs:
       # packages before they execute; sets UV_INDEX_URL/PIP_INDEX_URL to the
       # screened registry for this job). Blocking-only mode, no account needed.
       - name: Route installs through Takumi Guard
-        uses: flatt-security/setup-takumi-guard-pypi@733047c120b6377fa05fb77f714df8d8cd3a41a9 # v1.0.1
+        uses: flatt-security/setup-takumi-guard-pypi@bac24f8a97255d96a277f60de6906154ce0be096 # v1.1.0
 
       - name: Install (locked; dev + cli extras)
         run: uv sync --locked --extra dev --extra cli

.github/workflows/ci.yaml

@@ -32,7 +32,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
         with:
           # Pin uv so CI resolves uv.lock identically to local -- required for
           # the `uv sync --locked` guard to be reliable (lock revision is
@@ -46,7 +46,7 @@ jobs:
       # screened registry for this job). Blocking-only mode, no account needed.
       # Must precede any uv/pip install.
       - name: Route installs through Takumi Guard
-        uses: flatt-security/setup-takumi-guard-pypi@733047c120b6377fa05fb77f714df8d8cd3a41a9 # v1.0.1
+        uses: flatt-security/setup-takumi-guard-pypi@bac24f8a97255d96a277f60de6906154ce0be096 # v1.1.0
 
       # --locked fails if uv.lock drifts from pyproject.toml (e.g. a version
       # bump that forgot to sync the lock), catching it before a release tag.

.github/workflows/release.yaml

@@ -46,7 +46,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
         with:
           enable-cache: true
           version: "0.11.17"
@@ -57,7 +57,7 @@ jobs:
       # Blocking-only mode, no account needed. Must precede `uv build` so the
       # published artifact is built only from screened build dependencies.
       - name: Route installs through Takumi Guard
-        uses: flatt-security/setup-takumi-guard-pypi@733047c120b6377fa05fb77f714df8d8cd3a41a9 # v1.0.1
+        uses: flatt-security/setup-takumi-guard-pypi@bac24f8a97255d96a277f60de6906154ce0be096 # v1.1.0
 
       - name: Set up Python 3.11
         run: uv python install 3.11
@@ -100,7 +100,7 @@ jobs:
       # artifact from the PyPI PEP 740 attestation (verified with
       # `gh attestation verify`, not on PyPI). Kept separate on purpose.
       - name: Attest build provenance
-        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-path: "dist/*"