chore(deps): update github actions

.github/workflows/desktop-signing.yml

@@ -136,7 +136,7 @@ jobs:
           $build = Get-Content desktop/build-version.json -Raw | ConvertFrom-Json
           ./desktop/scripts/verify-windows-signatures.ps1 -ExpectedVersion $build.version
       - name: Retain verified binaries
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: openbot-windows-signed-${{ github.run_id }}-${{ github.run_attempt }}
           path: |
@@ -147,7 +147,7 @@ jobs:
           retention-days: 14
       - name: Retain verification evidence
         if: ${{ always() }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: openbot-windows-signatures-${{ github.run_id }}-${{ github.run_attempt }}
           path: desktop/signing-evidence/

.github/workflows/desktop.yml

@@ -160,7 +160,7 @@ jobs:
           if ($LASTEXITCODE -ne 0) { throw 'The native standard-user setup test failed.' }
       # Keep what was built. Without this the only way to try an installer is to build one on
       # the machine you are trying it on, which is not what anybody installs.
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: openbot-desktop-${{ matrix.platform.name }}
           path: |

.github/workflows/publish-release.yml

@@ -245,7 +245,7 @@ jobs:
           [[ "$DIGEST" =~ ^sha256:[0-9a-f]{64}$ ]]
           mkdir -p digests
           echo "$DIGEST" > "digests/$ARCH"
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: digest-${{ matrix.image }}-${{ matrix.platform.arch }}
           path: digests/
@@ -281,11 +281,11 @@ jobs:
       # match the other's digest artifacts too, and `merge-multiple` would overwrite this image's own
       # `amd64`/`arm64` file with the other's. That shipped once: this image's manifest list was built
       # from a digest that lived in the other's repository, so the join failed with "not found".
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: digest-${{ matrix.image }}-amd64
           path: digests
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: digest-${{ matrix.image }}-arm64
           path: digests
@@ -334,7 +334,7 @@ jobs:
           mkdir -p manifests
           jq -n --arg name "$NAME" --arg repository "$REPOSITORY" --arg digest "$DIGEST" \
             '{name: $name, repository: $repository, digest: $digest}' > "manifests/$NAME.json"
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: manifest-${{ matrix.image }}
           path: manifests/
@@ -357,7 +357,7 @@ jobs:
         with:
           ref: ${{ github.sha }}
           persist-credentials: false
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: manifest-*
           path: manifests