From dea64034aa50c79194c7d1420cb20d5f816bdb3f Mon Sep 17 00:00:00 2001
From: "John C. Bland II" <johncblandii@gmail.com>
Date: Thu, 13 Aug 2026 11:06:02 -0500
Subject: [PATCH] chore: upgrade actions to Node 24 runtime (SHA-pinned)

Combines the pending Renovate bumps (checkout v7, github-script v9,
release-drafter v7) with SHA pins and precise version comments.
Passes token explicitly to release-drafter per its v7 interface.
---
 action.yml | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/action.yml b/action.yml
index f788072..be00175 100644
--- a/action.yml
+++ b/action.yml
@@ -68,12 +68,12 @@ runs:
   using: "composite"
   steps:
     - name: Checkout commit
-      uses: actions/checkout@v4
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         token: ${{ inputs.token }}
         fetch-tags: true
 
-    - uses: actions/github-script@v7
+    - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
       name: Get PR labels
       id: pr-info
       with:
@@ -110,7 +110,7 @@ runs:
         echo "value=${tags}" >> $GITHUB_OUTPUT
 
     - name: Check for duplicates
-      uses: actions/github-script@v7
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
       id: has-duplicate
       with:
         retries: 3
@@ -147,11 +147,12 @@ runs:
           return false;
 
     # Drafts the next Release and compiles the notes as Pull Requests are merged into "main" (unless the `no-release` label is used on the PR)
-    - uses: release-drafter/release-drafter@v6
+    - uses: release-drafter/release-drafter@34d80673e067bdc0c24568d3af899c216adcfaa9 # v7.7.0
       name: Draft release
       id: release
       if: steps.has-duplicate.outputs.result == 'false'
       with:
+        token: ${{ inputs.token }}
         publish: ${{ inputs.publish == 'true' && !contains(fromJson(steps.pr-info.outputs.result).labels, 'no-release')}}
         prerelease: ${{ (inputs.prerelease != '' && inputs.prerelease) || contains(fromJson(steps.pr-info.outputs.result).labels, 'prerelease') }}
         latest: ${{ inputs.latest }}