ci: bump the actions group across 1 directory with 7 updates (#9621)

Bumps the actions group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [useblacksmith/checkout](https://github.com/useblacksmith/checkout) | `1.8.1` | `1.8.2` |
| [actions/setup-java](https://github.com/actions/setup-java) | `5.7.0` | `6.1.0` |
| [actions/setup-dotnet](https://github.com/actions/setup-dotnet) | `5.4.0` | `6.0.0` |
| [actions/setup-go](https://github.com/actions/setup-go) | `6.5.0` | `7.0.0` |
| [tailscale/github-action](https://github.com/tailscale/github-action) | `4.2.0` | `4.4.0` |
| [oras-project/setup-oras](https://github.com/oras-project/setup-oras) | `2.0.2` | `2.0.3` |
| [helm/chart-releaser-action](https://github.com/helm/chart-releaser-action) | `1.7.0` | `1.9.0` |



Updates `useblacksmith/checkout` from 1.8.1 to 1.8.2
- [Changelog](https://github.com/useblacksmith/checkout/blob/main/CHANGELOG.md)
- [Commits](useblacksmith/checkout@25227e6...2b9fe87)

Updates `actions/setup-java` from 5.7.0 to 6.1.0
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](actions/setup-java@b6effb0...b843ebf)

Updates `actions/setup-dotnet` from 5.4.0 to 6.0.0
- [Release notes](https://github.com/actions/setup-dotnet/releases)
- [Commits](actions/setup-dotnet@26b0ec1...a98b568)

Updates `actions/setup-go` from 6.5.0 to 7.0.0
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](actions/setup-go@924ae3a...b7ad1da)

Updates `tailscale/github-action` from 4.2.0 to 4.4.0
- [Release notes](https://github.com/tailscale/github-action/releases)
- [Commits](tailscale/github-action@d1b6cd2...064b105)

Updates `oras-project/setup-oras` from 2.0.2 to 2.0.3
- [Release notes](https://github.com/oras-project/setup-oras/releases)
- [Commits](oras-project/setup-oras@005458a...5e2f248)

Updates `helm/chart-releaser-action` from 1.7.0 to 1.9.0
- [Release notes](https://github.com/helm/chart-releaser-action/releases)
- [Commits](helm/chart-releaser-action@cae68fe...92c6b97)

---
updated-dependencies:
- dependency-name: useblacksmith/checkout
  dependency-version: 1.8.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: actions/setup-java
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/setup-dotnet
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/setup-go
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: tailscale/github-action
  dependency-version: 4.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: oras-project/setup-oras
  dependency-version: 2.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: helm/chart-releaser-action
  dependency-version: 1.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Author: dependabot[bot]

.github/workflows/checks.yml

@@ -356,7 +356,7 @@ jobs:
       - &checkout-mirror
         name: Checkout code (mirror)
         if: (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork
-        uses: useblacksmith/checkout@25227e61ff9dafe400e22fa487b673eac4e4409a # v1.8.1
+        uses: useblacksmith/checkout@2b9fe87d796feea153b455ec2f3125b471a7b0e7 # v1.8.2
       - &checkout-plain
         name: Checkout code
         if: (vars.CI_PROVIDER != '' && vars.CI_PROVIDER != 'blacksmith') || github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork
@@ -578,7 +578,7 @@ jobs:
       # Same provider/trust split as the build jobs' checkout.
       - name: Checkout code (mirror)
         if: (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork
-        uses: useblacksmith/checkout@25227e61ff9dafe400e22fa487b673eac4e4409a # v1.8.1
+        uses: useblacksmith/checkout@2b9fe87d796feea153b455ec2f3125b471a7b0e7 # v1.8.2
         with:
           fetch-depth: 2
       - name: Checkout code
@@ -787,7 +787,7 @@ jobs:
     steps:
       - name: Checkout code (mirror)
         if: needs.changes.outputs.test_app == 'true' && (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork
-        uses: useblacksmith/checkout@25227e61ff9dafe400e22fa487b673eac4e4409a # v1.8.1
+        uses: useblacksmith/checkout@2b9fe87d796feea153b455ec2f3125b471a7b0e7 # v1.8.2
         with:
           fetch-depth: 2
       - name: Checkout code

.github/workflows/docs-negotiation.yml

@@ -357,18 +357,18 @@ jobs:
         run: tar -I zstd -xf docs-build.tar.zst -C apps/docs
       - name: Set up Java for copied request examples
         if: matrix.group == 'http'
-        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           distribution: temurin
           java-version: '17'
       - name: Set up .NET for copied request examples
         if: matrix.group == 'http'
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: '8.0.x'
       - name: Set up Go for copied request examples
         if: matrix.group == 'http'
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: '1.25.x'
           cache: false

.github/workflows/docs.yml

@@ -79,7 +79,7 @@ jobs:
       # Database IP restrictions admit the tailnet's app connector; see migrate.yml.
       - name: Join the tailnet
         if: vars.CI_DB_TAILNET == 'true'
-        uses: tailscale/github-action@d1b6cd204f8dceda5b3eaad7f1f767be390056cd # v4.2.0
+        uses: tailscale/github-action@064b10558093f38325e838ddea35486bdc6b1d5c # v4.4.0
         with:
           oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }}
           audience: ${{ secrets.TS_AUDIENCE }}

.github/workflows/helm.yml

@@ -41,7 +41,7 @@ jobs:
     steps:
       - name: Checkout code (mirror)
         if: github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork
-        uses: useblacksmith/checkout@25227e61ff9dafe400e22fa487b673eac4e4409a # v1.8.1
+        uses: useblacksmith/checkout@2b9fe87d796feea153b455ec2f3125b471a7b0e7 # v1.8.2
         with: &chart-checkout-options
           # Chart version checks need full history to compare against the PR base.
           fetch-depth: 0
@@ -403,7 +403,7 @@ jobs:
           push-to-registry: true
 
       - name: Set up ORAS
-        uses: oras-project/setup-oras@005458ad77f1c8facd38a094e4af2e69e5607ff4 # v2.0.2
+        uses: oras-project/setup-oras@5e2f2482b30b0cb3e14e67f89a80c88c659a7c63 # v2.0.3
 
       # Artifact Hub reads repository metadata from the reserved `artifacthub.io`
       # tag on the chart's own OCI repository. Pushed on every run, including
@@ -511,7 +511,7 @@ jobs:
       # packages stay reachable no matter which domain serves the index.
       - name: Run chart-releaser
         if: steps.pages.outputs.exists == 'true'
-        uses: helm/chart-releaser-action@cae68fefc6b5f367a0275617c9f83181ba54714f # v1.7.0
+        uses: helm/chart-releaser-action@92c6b97fa9f664492a2592e0d1d80bc6bf378957 # v1.9.0
         with:
           charts_dir: helm
           # Re-running on an already-released version must be a no-op, the same

.github/workflows/migrate.yml

@@ -87,7 +87,7 @@ jobs:
       # makes `tailscale up` reject the duplicate flag.
       - name: Join the tailnet
         if: vars.CI_DB_TAILNET == 'true'
-        uses: tailscale/github-action@d1b6cd204f8dceda5b3eaad7f1f767be390056cd # v4.2.0
+        uses: tailscale/github-action@064b10558093f38325e838ddea35486bdc6b1d5c # v4.4.0
         with:
           oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }}
           audience: ${{ secrets.TS_AUDIENCE }}