From 033b9a336208886b7e6ba06d64561e175756f064 Mon Sep 17 00:00:00 2001
From: "penpot-renovate[bot]"
 <338182062+penpot-renovate[bot]@users.noreply.github.com>
Date: Fri, 23 Oct 2026 11:53:02 +0200
Subject: [PATCH] :arrow_up: update GitHub Actions (#12598)

- actions/create-github-app-token v3.3.0 (.github/workflows/auto-label.yml)
- pnpm/setup v3.1.1 (.github/workflows/plugins-deploy-styles-doc.yml)
- pnpm/setup v3.1.1 (.github/workflows/plugins-deploy-api-doc.yml)
- zizmor 1.31.1 (.github/workflows/lint-workflows.yml)

Signed-off-by: penpot-renovate[bot] <338182062+penpot-renovate[bot]@users.noreply.github.com>
Co-authored-by: penpot-renovate[bot] <338182062+penpot-renovate[bot]@users.noreply.github.com>
---
 .github/workflows/auto-label.yml                | 2 +-
 .github/workflows/lint-workflows.yml            | 2 +-
 .github/workflows/plugins-deploy-api-doc.yml    | 2 +-
 .github/workflows/plugins-deploy-styles-doc.yml | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/auto-label.yml b/.github/workflows/auto-label.yml
index 84615efe4b..65dcc51875 100644
--- a/.github/workflows/auto-label.yml
+++ b/.github/workflows/auto-label.yml
@@ -25,7 +25,7 @@ jobs:
     steps:
       - name: Generate GitHub App token
         id: triage-app-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         with:
           client-id: ${{ secrets.TRIAGE_APP_CLIENT_ID }}
           private-key: ${{ secrets.TRIAGE_APP_PRIVATE_KEY }}
diff --git a/.github/workflows/lint-workflows.yml b/.github/workflows/lint-workflows.yml
index eb3ca73ed3..a9ad7d055c 100644
--- a/.github/workflows/lint-workflows.yml
+++ b/.github/workflows/lint-workflows.yml
@@ -34,7 +34,7 @@ permissions: {}
 
 env:
   ACTIONLINT_VERSION: '1.7.12'
-  ZIZMOR_VERSION: '1.30.1'
+  ZIZMOR_VERSION: '1.31.1'
 
 jobs:
   lint:
diff --git a/.github/workflows/plugins-deploy-api-doc.yml b/.github/workflows/plugins-deploy-api-doc.yml
index d9e7393859..bcbacd9b13 100644
--- a/.github/workflows/plugins-deploy-api-doc.yml
+++ b/.github/workflows/plugins-deploy-api-doc.yml
@@ -48,7 +48,7 @@ jobs:
       # No dependency cache here: a deploy must not restore a cache that
       # other workflows can write to.
       - name: Setup pnpm + Node.js
-        uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0
+        uses: pnpm/setup@a0881977cd8ea73b1ed212236c99ca10dcc80cf4 # v3.1.1
         with:
           working-directory: plugins
           runtime: node@24.22.0
diff --git a/.github/workflows/plugins-deploy-styles-doc.yml b/.github/workflows/plugins-deploy-styles-doc.yml
index 4f4d23e271..d64a702184 100644
--- a/.github/workflows/plugins-deploy-styles-doc.yml
+++ b/.github/workflows/plugins-deploy-styles-doc.yml
@@ -46,7 +46,7 @@ jobs:
       # No dependency cache here: a deploy must not restore a cache that
       # other workflows can write to.
       - name: Setup pnpm + Node.js
-        uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0
+        uses: pnpm/setup@a0881977cd8ea73b1ed212236c99ca10dcc80cf4 # v3.1.1
         with:
           working-directory: plugins
           runtime: node@24.22.0