chore(deps): bump the all-actions group with 7 updates

.github/workflows/codeql.yaml

@@ -19,4 +19,4 @@ jobs:
       actions: read
       contents: read
       security-events: write
-    uses: thingzio/actions/.github/workflows/codeql-go.yaml@368b3e12df4c41d9079b26e41a03efcd90461d56  # v1.7.1
+    uses: thingzio/actions/.github/workflows/codeql-go.yaml@7276775800dbfef1d9671e60c337f3b4b479a4e8  # v1.8.0

.github/workflows/deploy.yaml

@@ -41,7 +41,7 @@ jobs:
     permissions:
       contents: read
       id-token: write
-    uses: thingzio/actions/.github/workflows/deploy-cloud-run.yaml@368b3e12df4c41d9079b26e41a03efcd90461d56  # v1.7.1
+    uses: thingzio/actions/.github/workflows/deploy-cloud-run.yaml@7276775800dbfef1d9671e60c337f3b4b479a4e8  # v1.8.0
     with:
       # Order matters and is part of the shared workflow's contract. Delivery
       # consumes outbox rows produced by serve, so the backward-compatible

.github/workflows/release.yaml

@@ -28,7 +28,7 @@ jobs:
   # builds one image; the three are independent and run in parallel.
   build-serve:
     needs: test
-    uses: thingzio/actions/.github/workflows/build-ko.yaml@368b3e12df4c41d9079b26e41a03efcd90461d56  # v1.7.1
+    uses: thingzio/actions/.github/workflows/build-ko.yaml@7276775800dbfef1d9671e60c337f3b4b479a4e8  # v1.8.0
     permissions:
       contents: read
       packages: write      # push to ghcr.io
@@ -41,7 +41,7 @@ jobs:
 
   build-deliver:
     needs: test
-    uses: thingzio/actions/.github/workflows/build-ko.yaml@368b3e12df4c41d9079b26e41a03efcd90461d56  # v1.7.1
+    uses: thingzio/actions/.github/workflows/build-ko.yaml@7276775800dbfef1d9671e60c337f3b4b479a4e8  # v1.8.0
     permissions:
       contents: read
       packages: write
@@ -57,7 +57,7 @@ jobs:
   # the syft/grype/trivy install scripts detect the host architecture.
   build-scan:
     needs: test
-    uses: thingzio/actions/.github/workflows/build-docker.yaml@368b3e12df4c41d9079b26e41a03efcd90461d56  # v1.7.1
+    uses: thingzio/actions/.github/workflows/build-docker.yaml@7276775800dbfef1d9671e60c337f3b4b479a4e8  # v1.8.0
     permissions:
       contents: read
       packages: write
@@ -79,7 +79,7 @@ jobs:
   # time this returns; only visibility is deferred.
   release:
     needs: test
-    uses: thingzio/actions/.github/workflows/release-go.yaml@368b3e12df4c41d9079b26e41a03efcd90461d56  # v1.7.1
+    uses: thingzio/actions/.github/workflows/release-go.yaml@7276775800dbfef1d9671e60c337f3b4b479a4e8  # v1.8.0
     permissions:
       contents: write      # create the draft release, upload artifacts
       id-token: write      # keyless signing

.github/workflows/test-on-call.yaml

@@ -35,7 +35,7 @@ jobs:
       # step this replaces read "1.27" out of .settings.yaml, which resolves to
       # whatever the latest 1.27.x happens to be on the day the job runs -- so
       # two runs of the same commit could use different toolchains.
-      - uses: thingzio/actions/.github/actions/setup-go@368b3e12df4c41d9079b26e41a03efcd90461d56  # v1.7.1
+      - uses: thingzio/actions/.github/actions/setup-go@7276775800dbfef1d9671e60c337f3b4b479a4e8  # v1.8.0
 
       # syft/grype/trivy so the scanner, converter, and canonicalizer live tests
       # actually run in CI (they skip when the binaries are absent).
@@ -57,7 +57,7 @@ jobs:
   # moved here from the test job below, which used to run it alongside the
   # Postgres-backed suite for no reason -- it needs no database.
   lint:
-    uses: thingzio/actions/.github/workflows/lint-go.yaml@368b3e12df4c41d9079b26e41a03efcd90461d56  # v1.7.1
+    uses: thingzio/actions/.github/workflows/lint-go.yaml@7276775800dbfef1d9671e60c337f3b4b479a4e8  # v1.8.0
 
   # API-contract check. Kept separate from the Go lint job so a spec-only change
   # is still gated without pulling in the Go toolchain.