Update GitHub Actions to latest versions

.github/workflows/build-extensions.yml

@@ -21,15 +21,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: "22"
       - name: Set up .NET 10 SDK
         # Required by tests/dotnetPfx.integration.test.ts: builds a tiny
         # console harness that loads our generated PFX via .NET's modern
         # PKCS#12 path (X509CertificateLoader.LoadPkcs12). Without this
         # step the test self-skips and we get no .NET interop coverage.
-        uses: actions/setup-dotnet@v4
+        uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
         with:
           dotnet-version: "10.0.x"
 
@@ -69,7 +69,7 @@ jobs:
     runs-on: windows-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: "22"
       - name: Install dependencies
@@ -88,7 +88,7 @@ jobs:
       - name: Set up .NET 10 SDK
         # Required only by tests/dotnetPfx.integration.test.ts, which validates
         # .NET's managed PKCS#12 loader and private-key attachment.
-        uses: actions/setup-dotnet@v4
+        uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
         with:
           dotnet-version: "10.0.x"
 
@@ -100,7 +100,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: "22"
 

.github/workflows/bump-version.yml

@@ -29,7 +29,7 @@ jobs:
           echo "next=$NEXT" >> "$GITHUB_OUTPUT"
           echo "Released $TAG → next dev version: $NEXT"
 
-      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 22
 
@@ -53,7 +53,7 @@ jobs:
           npm install --package-lock-only
 
       - name: Create pull request
-        uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7.0.11
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           branch: chore/bump-${{ steps.version.outputs.next }}
           commit-message: "Bump version to ${{ steps.version.outputs.next }}"

.github/workflows/release-feature.yml

@@ -71,6 +71,9 @@ jobs:
       attestations: write
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: "22"
 
       - name: Login to GHCR
         uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
@@ -79,15 +82,15 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Install devcontainer CLI
+        run: npm install -g @devcontainers/cli@0.86.0
+
       - name: Publish feature to GHCR
-        uses: devcontainers/action@1082abd5d2bf3a11abccba70eef98df068277772 # v1.4.3
-        with:
-          publish-features: "true"
-          base-path-to-features: src/devcontainer-feature/src
-          oci-registry: ghcr.io
-          features-namespace: ${{ github.repository }}
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          devcontainer features publish \
+            --namespace "${{ github.repository }}" \
+            src/devcontainer-feature/src
 
       - name: Resolve published manifest digest
         id: digest