chore(deps): update github-actions

[renovate]

Note: This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
CodSpeedHQ/action	action	minor	v4.3.3 -> v4.5.1
actions/checkout	action	patch	v6.0.0 -> v6.0.1
github/codeql-action	action	patch	v4.31.5 -> v4.31.9
oxc-project/release-plz	action	patch	v1.0.4 -> v1.0.5
oxc-project/setup-rust	action	patch	v1.0.11 -> v1.0.12
taiki-e/install-action	action	minor	v2.62.60 -> v2.65.3

---

Release Notes

CodSpeedHQ/action (CodSpeedHQ/action)

v4.5.1

Compare Source

Release Notes

🚀 Features

• Remove projects query from the exec polling by @​GuillaumeLagrange in #​173
• Fetch project from API when running outside of git repo by @​GuillaumeLagrange
• Add get or create project repository query by @​GuillaumeLagrange
• Automatically install exec-harness for exec subcommand by @​GuillaumeLagrange
• Auto install codspeed-memtrack during executor setup by @​GuillaumeLagrange
• Serialize events serially to allow streamed decoding by @​not-matthias in #​172
• Parse perf file for memmap events instead of relying on /proc/pid/maps by @​GuillaumeLagrange
• Use the projects upload enpdoint in exec command by @​GuillaumeLagrange
• Add exec subcommand and refactor run subcommand by @​GuillaumeLagrange
• Add exec-harness binary by @​GuillaumeLagrange
• Add memory executor by @​not-matthias
• Add memtrack crate by @​not-matthias
• Add artifact types by @​not-matthias
• Add shared fifo by @​not-matthias
• Add new fifo commands by @​not-matthias
• Support simulation for free-threaded python by @​adriencaccia in #​167

🐛 Bug Fixes

• fix: specify package when using branch/ref by @​not-matthias in #​162
• fix: properly check for allow_empty input by @​GuillaumeLagrange in #​164
• Filter out arm debugging symbols by @​GuillaumeLagrange in #​179
• Filter out empty named symbols when building perf-map by @​GuillaumeLagrange in #​176
• Do not break support for no reason when changing integration hooks protocol version by @​GuillaumeLagrange in #​175
• Remove dirty retry on timeout and simply increase timeout for GQL client by @​GuillaumeLagrange
• Stop hanging indefinitely if process fails to start in memory executor by @​GuillaumeLagrange in #​171
• Remove the password prompt from the run_with_sudo dialog by @​GuillaumeLagrange
• Collect events in thread to avoid mutex overhead by @​not-matthias
• Convert events in thread to avoid blocking at the end by @​not-matthias
• Compress only when size exceeds threshold by @​not-matthias
• Forward environment in memory executor by @​not-matthias
• Fix plan test in CI by @​GuillaumeLagrange in #​165
• Prevent nextest from running valgrind and memcheck concurrently by @​GuillaumeLagrange
• Stop ignoring samples by @​GuillaumeLagrange
• Use correct name for unwind_data trait declaration by @​GuillaumeLagrange
• Stop filtering out zero sized symbol by @​GuillaumeLagrange
• Request OIDC token after creating profile archive by @​fargito in #​170
• Remove snapshots that were not part of lfs by @​not-matthias in #​166
• Always print memory mapping logs by @​not-matthias

🏗️ Refactor

• Create a dedicated execution_context that holds runtime information by @​GuillaumeLagrange
• Move executor and instruments modules out of run module by @​GuillaumeLagrange

⚙️ Internals

• docs(examples): add go and cpp examples by @​fargito in #​161
• Ignore some tags in the changelog
• Bump protocol version by @​not-matthias in #​174
• Add CONTRIBUTING.md by @​GuillaumeLagrange
• Add cargo-dist arguments for release by @​GuillaumeLagrange
• Reset exec-harness and memtrack crate versions to 1.0.0 ahead of first release by @​GuillaumeLagrange
• Switch to pr run mode plan only for pr by @​GuillaumeLagrange
• Add test to ensure path is properly forwarded by @​not-matthias in #​169
• Make the exec command work outside of git repos by @​GuillaumeLagrange
• Do not publish memtrack to crates.io by @​adriencaccia
• Dont run valgrind and memory tests at the same time by @​not-matthias in #​164
• Add test-log to see output on failures by @​not-matthias
• Add workspace dependencies by @​not-matthias

Install codspeed-runner 4.5.1

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/CodSpeedHQ/runner/releases/download/v4.5.1/codspeed-runner-installer.sh | sh

Download codspeed-runner 4.5.1

File	Platform	Checksum
codspeed-runner-aarch64-unknown-linux-musl.tar.gz	ARM64 MUSL Linux	checksum
codspeed-runner-x86_64-unknown-linux-musl.tar.gz	x64 MUSL Linux	checksum

Full Runner Changelog: https://github.com/CodSpeedHQ/runner/blob/main/CHANGELOG.md

Full Changelog: CodSpeedHQ/action@v4.4.1...v4.5.1

v4.4.1

Compare Source

Release Notes

🚀 Features

• Display oidc as announcement by @​fargito
• Add --allow-empty run option by @​GuillaumeLagrange in #​160

🐛 Bug Fixes

• Do not espace trailing newlines in logger by @​fargito
• Make multiline logs appear correctly in summary by @​fargito in #​162
• Request OIDC token just before upload by @​fargito
• Update docs links to oidc by @​fargito in #​159

⚙️ Internals

• feat: make use of allow-empty in the ci of this action by @​GuillaumeLagrange in #​158
• chore: bump runner version to 4.4.1 by @​github-actions[bot] in #​159

Install codspeed-runner 4.4.1

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/CodSpeedHQ/runner/releases/download/v4.4.1/codspeed-runner-installer.sh | sh

Download codspeed-runner 4.4.1

File	Platform	Checksum
codspeed-runner-aarch64-unknown-linux-musl.tar.gz	ARM64 MUSL Linux	checksum
codspeed-runner-x86_64-unknown-linux-musl.tar.gz	x64 MUSL Linux	checksum

Full Runner Changelog: https://github.com/CodSpeedHQ/runner/blob/main/CHANGELOG.md

Full Changelog: CodSpeedHQ/action@v4.4.0...v4.4.1

v4.4.0

Compare Source

Release Notes

🚀 Features

• Add support for oidc token authentication by @​fargito in #​156
  • You can now use OIDC to authenticate your CodSpeed workflow and remove CODSPEED_TOKEN from your repositories secret! Learn more in the dedicated changelog entry
• Accept simulation as runner mode by @​GuillaumeLagrange in #​152
• Add a comment explaining why we do not check for emptiness in valgrind teardown by @​GuillaumeLagrange in #​157
• Validate walltime results before uploading by @​GuillaumeLagrange
• Import walltime_results from monorepo by @​GuillaumeLagrange
• Accept both simulation and instrumentation as a mode input by @​GuillaumeLagrange in #​155

🐛 Bug Fixes

• Dont start perf unless it's not already started by @​not-matthias in #​158
• Use a line buffer when reading stdout/stderr streams by @​GuillaumeLagrange

📚 Documentation

• docs: recommend OpenID Connect instead of static token by @​fargito in #​156

⚙️ Internals

• chore: bump runner version to 4.4.0 by @​github-actions[bot] in #​157

Install codspeed-runner 4.4.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/CodSpeedHQ/runner/releases/download/v4.4.0/codspeed-runner-installer.sh | sh

Download codspeed-runner 4.4.0

File	Platform	Checksum
codspeed-runner-aarch64-unknown-linux-musl.tar.gz	ARM64 MUSL Linux	checksum
codspeed-runner-x86_64-unknown-linux-musl.tar.gz	x64 MUSL Linux	checksum

Full Runner Changelog: https://github.com/CodSpeedHQ/runner/blob/main/CHANGELOG.md

Full Changelog: CodSpeedHQ/action@v4.3.4...v4.4.0

v4.3.4

Compare Source

Release Notes

🚀 Features

• Make get_commit_hash different based on the provider by @​GuillaumeLagrange in #​151

🐛 Bug Fixes

• Use GITHUB_WORKSPACE env var when computing root path by @​GuillaumeLagrange
• Ensure perf also fails when the command fails by @​not-matthias in #​150
• Ensure working directory is used when running the cmd by @​not-matthias
• Use debug! instead of println for debug data by @​art049

⚙️ Internals

• chore: bump runner version to 4.3.4 by @​github-actions[bot] in #​154

Install codspeed-runner 4.3.4

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/CodSpeedHQ/runner/releases/download/v4.3.4/codspeed-runner-installer.sh | sh

Download codspeed-runner 4.3.4

File	Platform	Checksum
codspeed-runner-aarch64-unknown-linux-musl.tar.gz	ARM64 MUSL Linux	checksum
codspeed-runner-x86_64-unknown-linux-musl.tar.gz	x64 MUSL Linux	checksum

Full Runner Changelog: https://github.com/CodSpeedHQ/runner/blob/main/CHANGELOG.md

Full Changelog: CodSpeedHQ/action@v4.3.3...v4.3.4

actions/checkout (actions/checkout)

v6.0.1

Compare Source

github/codeql-action (github/codeql-action)

v4.31.9

Compare Source

v4.31.8

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.31.8 - 11 Dec 2025

• Update default CodeQL bundle version to 2.23.8. #​3354

See the full CHANGELOG.md for more information.

v4.31.7

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.31.7 - 05 Dec 2025

• Update default CodeQL bundle version to 2.23.7. #​3343

See the full CHANGELOG.md for more information.

v4.31.6

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.31.6 - 01 Dec 2025

No user facing changes.

See the full CHANGELOG.md for more information.

oxc-project/release-plz (oxc-project/release-plz)

v1.0.5

Compare Source

oxc-project/setup-rust (oxc-project/setup-rust)

v1.0.12

Compare Source

taiki-e/install-action (taiki-e/install-action)

v2.65.3

Compare Source

Initial release

---

Configuration

📅 Schedule: Branch creation - "before 10am on monday" in timezone Asia/Shanghai, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codspeed-hq]

CodSpeed Performance Report

Merging #19 will not alter performance

_{Comparing renovate/github-actions (a7e15c8) with main (3a138ad)¹}

Summary

✅ 4 untouched

Footnotes

1. No successful run was found on main (80f041c) during the generation of this report, so 3a138ad was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩