🧰⬆️ Bump CI deps and tame YAML lint tantrums

Fresh PLANTUML, pinned SCP action, and a shiny pre-commit lineup because “latest” is a lifestyle, not a strategy.

.gitea/workflows/publish.yaml

@@ -1,6 +1,7 @@
+---
 name: Publish diagram
 
-on:
+on: # yamllint disable-line rule:truthy
   push:
     branches:
       - main
@@ -24,7 +25,7 @@ jobs:
       - name: copy puml to workspace
         run: ls
       - name: Upload to cdn
-        uses: appleboy/scp-action@v0.1.7
+        uses: appleboy/scp-action@ff85246acaad7bdce478db94a363cd2bf7c90345 # v1.0.0
         with:
           host: bruynooghe.dev
           username: elizhium

.gitea/workflows/render.yaml

@@ -1,6 +1,7 @@
+---
 name: Render diagram
 
-on:
+on: # yamllint disable-line rule:truthy
   pull_request:
     types: [opened, reopened, edited]
   workflow_call:
@@ -9,7 +10,7 @@ jobs:
   render:
     runs-on: ubuntu-latest
     env:
-      PLANTUML_VERSION: '1.2025.4'
+      PLANTUML_VERSION: '1.2025.10'
     steps:
       - name: Check out repository code
         uses: actions/checkout@v4

.pre-commit-config.yaml

@@ -1,7 +1,7 @@
 ---
 repos:
     - repo: https://github.com/pre-commit/pre-commit-hooks
-      rev: v4.6.0
+      rev: v6.0.0
       hooks:
           - id: trailing-whitespace
           - id: end-of-file-fixer
@@ -9,15 +9,19 @@ repos:
             args: ['--unsafe']
           - id: check-added-large-files
     - repo: https://github.com/python-jsonschema/check-jsonschema
-      rev: 0.29.0
+      rev: 0.35.0
       hooks:
           - id: check-github-actions
             args: [--verbose]
     - repo: https://github.com/rhysd/actionlint
-      rev: v1.7.1
+      rev: v1.7.9
       hooks:
           - id: actionlint
     - repo: https://github.com/jorisroovers/gitlint
       rev: v0.19.1
       hooks:
           - id: gitlint
+    - repo: https://gitlab.com/vojko.pribudic.foss/pre-commit-update
+      rev: v0.9.0
+      hooks:
+        - id: pre-commit-update