github-actions-bumping-github-actionslisted

# Bumping GitHub Actions Audit `uses:` pins, research each upgrade against real release notes, land one commit per action, and close dependabot's pull requests by citing the commit that superseded them. Two reference files carry the parts that must not drift between this skill and the plugin's commands: - `references/action-pinning.md` — inventory, tag verification, annotated-tag dereferencing, pin granularity, and the per-repo gates to check before claiming an upgrade is safe. - `references/dependabot-closeout.md` — the one-way citation rule, the closing protocol, CI attribution, and scope discipline. ## Core principle Verify the target tag exists before writing it. Everything else in this procedure is recoverable; a pin naming a tag that does not resolve breaks every workflow that references it, in every repo, at once. ## Scope Own repositories only. Ownership by account name is not enough — a fork you own is still someone else's project, and its workflows belong upstream. Check whether the repository is a fork and skip it unless the user says otherwise. ## Phase 1 — Inventory Discover repositories with workflows, resolve each one's default branch, and read every `uses:` line from that branch. Follow the inventory section of the pinning reference, including its word-splitting warning: a naive loop silently drops repos with more than one workflow file and reports the fleet as clean. Record, per pin: repository, default branch, file, action, and current vers