Bump the actions group with 5 updates (#11016)

Bumps the actions group with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `5` | `6` |
| [actions/cache](https://github.com/actions/cache) | `4` | `5` |
| [codecov/codecov-action](https://github.com/codecov/codecov-action) | `5.5.1` | `5.5.2` |
| [xarray-contrib/minimum-dependency-versions](https://github.com/xarray-contrib/minimum-dependency-versions) | `0.1.1` | `1.0.0` |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `6` | `7` |


Updates `actions/upload-artifact` from 5 to 6
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@v5...v6)

Updates `actions/cache` from 4 to 5
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@v4...v5)

Updates `codecov/codecov-action` from 5.5.1 to 5.5.2
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](codecov/codecov-action@v5.5.1...v5.5.2)

Updates `xarray-contrib/minimum-dependency-versions` from 0.1.1 to 1.0.0
- [Release notes](https://github.com/xarray-contrib/minimum-dependency-versions/releases)
- [Commits](xarray-contrib/minimum-dependency-versions@e2ac8ff...3db8e1c)

Updates `actions/download-artifact` from 6 to 7
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@v6...v7)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/cache
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: codecov/codecov-action
  dependency-version: 5.5.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: xarray-contrib/minimum-dependency-versions
  dependency-version: 1.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/download-artifact
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Author: dependabot[bot]

.github/workflows/benchmarks-last-release.yml

@@ -73,7 +73,7 @@ jobs:
           cp benchmarks/README_CI.md benchmarks.log .asv/results/
         working-directory: ${{ env.ASV_DIR }}
 
-      - uses: actions/upload-artifact@v5
+      - uses: actions/upload-artifact@v6
         if: always()
         with:
           name: asv-benchmark-results-${{ runner.os }}

.github/workflows/benchmarks.yml

@@ -70,7 +70,7 @@ jobs:
           cp benchmarks/README_CI.md benchmarks.log .asv/results/
         working-directory: ${{ env.ASV_DIR }}
 
-      - uses: actions/upload-artifact@v5
+      - uses: actions/upload-artifact@v6
         if: always()
         with:
           name: asv-benchmark-results-${{ runner.os }}

.github/workflows/cache-pixi-lock.yml

@@ -24,7 +24,7 @@ jobs:
       - name: Get current date
         id: date
         run: echo "date=$(date +'%Y-%m-%d')" >> "$GITHUB_OUTPUT"
-      - uses: actions/cache/restore@v4
+      - uses: actions/cache/restore@v5
         id: restore
         with:
           path: |
@@ -38,15 +38,15 @@ jobs:
       - name: Run pixi lock
         if: ${{ !steps.restore.outputs.cache-hit }}
         run: pixi lock
-      - uses: actions/cache/save@v4
+      - uses: actions/cache/save@v5
         if: ${{ !steps.restore.outputs.cache-hit }}
         id: cache
         with:
           path: |
             pixi.lock
           key: ${{ steps.restore.outputs.cache-primary-key }}
       - name: Upload pixi.lock
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v6
         with:
           name: pixi-lock
           path: pixi.lock

.github/workflows/ci-additional.yaml

@@ -59,7 +59,7 @@ jobs:
           echo "TODAY=$(date  +'%Y-%m-%d')" >> $GITHUB_ENV
 
       - name: Restore cached pixi lockfile
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@v5
         id: restore-pixi-lock
         with:
           enableCrossOsArchive: true
@@ -101,7 +101,7 @@ jobs:
         with:
           fetch-depth: 0 # Fetch all history for all branches and tags.
       - name: Restore cached pixi lockfile
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@v5
         id: restore-pixi-lock
         with:
           enableCrossOsArchive: true
@@ -127,7 +127,7 @@ jobs:
           pixi run -e ${{env.PIXI_ENV}} -- python -m mypy --install-types --non-interactive --cobertura-xml-report mypy_report
 
       - name: Upload mypy coverage to Codecov
-        uses: codecov/[email protected].1
+        uses: codecov/[email protected].2
         with:
           file: mypy_report/cobertura.xml
           flags: mypy
@@ -150,7 +150,7 @@ jobs:
         with:
           fetch-depth: 0 # Fetch all history for all branches and tags.
       - name: Restore cached pixi lockfile
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@v5
         id: restore-pixi-lock
         with:
           enableCrossOsArchive: true
@@ -176,7 +176,7 @@ jobs:
           pixi run -e ${{env.PIXI_ENV}} -- python -m mypy --install-types --non-interactive --cobertura-xml-report mypy_report
 
       - name: Upload mypy coverage to Codecov
-        uses: codecov/[email protected].1
+        uses: codecov/[email protected].2
         with:
           file: mypy_report/cobertura.xml
           flags: mypy-min
@@ -207,7 +207,7 @@ jobs:
           fetch-depth: 0 # Fetch all history for all branches and tags.
 
       - name: Restore cached pixi lockfile
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@v5
         id: restore-pixi-lock
         with:
           enableCrossOsArchive: true
@@ -233,7 +233,7 @@ jobs:
           pixi run -e ${{ matrix.pixi-env }} -- python -m pyright xarray/
 
       - name: Upload pyright coverage to Codecov
-        uses: codecov/[email protected].1
+        uses: codecov/[email protected].2
         with:
           file: pyright_report/cobertura.xml
           flags: pyright
@@ -265,13 +265,13 @@ jobs:
           python-version: "3.x"
 
       - name: All-deps minimum versions policy
-        uses: xarray-contrib/minimum-dependency-versions@e2ac8ff0a76e8603d8536ef5d64743a375961ce9 # v0.1.1
+        uses: xarray-contrib/minimum-dependency-versions@3db8e1c17328ee1e27dfe4db90d908644856eb61 # v1.0.0
         with:
           policy: ci/policy.yaml
           environment-paths: ci/requirements/min-all-deps.yml
 
       - name: Bare minimum versions policy
-        uses: xarray-contrib/minimum-dependency-versions@e2ac8ff0a76e8603d8536ef5d64743a375961ce9 # v0.1.1
+        uses: xarray-contrib/minimum-dependency-versions@3db8e1c17328ee1e27dfe4db90d908644856eb61 # v1.0.0
         with:
           policy: ci/policy.yaml
           environment-paths: ci/requirements/bare-minimum.yml

.github/workflows/ci.yaml

@@ -84,7 +84,7 @@ jobs:
         with:
           fetch-depth: 0 # Fetch all history for all branches and tags.
       - name: Restore cached pixi lockfile
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@v5
         id: restore-pixi-lock
         with:
           enableCrossOsArchive: true
@@ -135,7 +135,7 @@ jobs:
           pixi run -e ${{ matrix.pixi-env }} -- python -c "import xarray"
 
       - name: Restore cached hypothesis directory
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: .hypothesis/
           key: cache-hypothesis
@@ -152,13 +152,13 @@ jobs:
 
       - name: Upload test results
         if: always()
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v6
         with:
           name: Test results for OS ${{ runner.os }} pixi-env ${{ matrix.pixi-env }} pytest-addopts ${{ matrix.pytest-addopts }}
           path: pytest.xml
 
       - name: Upload code coverage to Codecov
-        uses: codecov/[email protected].1
+        uses: codecov/[email protected].2
         env:
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
         with:
@@ -174,7 +174,7 @@ jobs:
     if: github.repository == 'pydata/xarray'
     steps:
       - name: Upload
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v6
         with:
           name: Event File
           path: ${{ github.event_path }}

.github/workflows/hypothesis.yaml

@@ -63,7 +63,7 @@ jobs:
           fetch-depth: 0 # Fetch all history for all branches and tags.
 
       - name: Restore cached pixi lockfile
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@v5
         id: restore-pixi-lock
         with:
           enableCrossOsArchive: true
@@ -89,7 +89,7 @@ jobs:
       # https://github.com/actions/cache/blob/main/tips-and-workarounds.md#update-a-cache
       - name: Restore cached hypothesis directory
         id: restore-hypothesis-cache
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@v5
         with:
           path: .hypothesis/
           key: cache-hypothesis-${{ runner.os }}-${{ github.run_id }}
@@ -107,7 +107,7 @@ jobs:
       - name: Save cached hypothesis directory
         id: save-hypothesis-cache
         if: always() && steps.status.outcome != 'skipped'
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@v5
         with:
           path: .hypothesis/
           key: cache-hypothesis-${{ runner.os }}-${{ github.run_id }}

.github/workflows/pypi-release.yaml

@@ -49,7 +49,7 @@ jobs:
           else
             echo "✅ Looks good"
           fi
-      - uses: actions/upload-artifact@v5
+      - uses: actions/upload-artifact@v6
         with:
           name: releases
           path: dist
@@ -62,7 +62,7 @@ jobs:
         name: Install Python
         with:
           python-version: "3.12"
-      - uses: actions/download-artifact@v6
+      - uses: actions/download-artifact@v7
         with:
           name: releases
           path: dist
@@ -89,7 +89,7 @@ jobs:
       id-token: write
 
     steps:
-      - uses: actions/download-artifact@v6
+      - uses: actions/download-artifact@v7
         with:
           name: releases
           path: dist
@@ -112,7 +112,7 @@ jobs:
       id-token: write
 
     steps:
-      - uses: actions/download-artifact@v6
+      - uses: actions/download-artifact@v7
         with:
           name: releases
           path: dist

.github/workflows/upstream-dev-ci.yaml

@@ -64,7 +64,7 @@ jobs:
         with:
           fetch-depth: 0 # Fetch all history for all branches and tags.
       - name: Restore cached pixi lockfile
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@v5
         id: restore-pixi-lock
         with:
           enableCrossOsArchive: true
@@ -121,7 +121,7 @@ jobs:
           fetch-depth: 0 # Fetch all history for all branches and tags.
 
       - name: Restore cached pixi lockfile
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@v5
         id: restore-pixi-lock
         with:
           enableCrossOsArchive: true
@@ -146,7 +146,7 @@ jobs:
         run: |
           pixi run -e ${{matrix.pixi-env}} -- python -m mypy --install-types --non-interactive --cobertura-xml-report mypy_report
       - name: Upload mypy coverage to Codecov
-        uses: codecov/[email protected].1
+        uses: codecov/[email protected].2
         with:
           file: mypy_report/cobertura.xml
           flags: mypy