diff --git a/.github/workflows/ci-autofix.yml b/.github/workflows/ci-autofix.yml
index ca8b75f..6ddd169 100644
--- a/.github/workflows/ci-autofix.yml
+++ b/.github/workflows/ci-autofix.yml
@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout failed branch
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           ref: ${{ github.event.workflow_run.head_branch }}
 
@@ -40,7 +40,7 @@ jobs:
 
       - name: Set up Go
         if: steps.freshness.outputs.should_skip != 'true'
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
 
@@ -56,7 +56,7 @@ jobs:
         id: golangci_autofix
         if: steps.freshness.outputs.should_skip != 'true'
         continue-on-error: true
-        uses: golangci/golangci-lint-action@v7
+        uses: golangci/golangci-lint-action@v8
         with:
           version: v2.11.3
           args: --fix
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 78f3975..045a504 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -16,22 +16,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
-
-      - name: Cache Go modules
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.cache/go-build
-            ~/go/pkg/mod
-          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
-          restore-keys: |
-            ${{ runner.os }}-go-
+          cache: true
 
       - name: Download dependencies
         run: go mod download
@@ -46,15 +37,15 @@ jobs:
           fi
 
       - name: Run golangci-lint
-        uses: golangci/golangci-lint-action@v7
+        uses: golangci/golangci-lint-action@v8
         with:
           version: v2.11.3
 
-      - name: Run tests
-        run: go test -race -coverprofile=coverage.out ./...
-
       - name: Run go vet
         run: go vet ./...
 
       - name: Build
         run: go build ./...
+
+      - name: Run tests
+        run: go test -race -coverprofile=coverage.out ./...
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index fbaee5f..87d6e73 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Setup Pages
         uses: actions/configure-pages@v5
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 288ff7f..595f4ab 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -31,10 +31,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
 
@@ -95,7 +95,7 @@ jobs:
 
       - name: Checkout
         if: steps.tap-secret.outputs.configured == 'true'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Set version from tag
         if: steps.tap-secret.outputs.configured == 'true'
diff --git a/internal/publish/publish_test.go b/internal/publish/publish_test.go
index 3d02672..cdf13b2 100644
--- a/internal/publish/publish_test.go
+++ b/internal/publish/publish_test.go
@@ -10,8 +10,18 @@ import (
 )
 
 func TestSyncGitRepositoryExistingRepoPreservesRemoteFiles(t *testing.T) {
+	// syncGitRepository commits in its own clone, so the identity must come
+	// from the environment rather than per-repo config; CI runners have no
+	// global git identity.
+	t.Setenv("GIT_AUTHOR_NAME", "climate")
+	t.Setenv("GIT_AUTHOR_EMAIL", "climate@example.test")
+	t.Setenv("GIT_COMMITTER_NAME", "climate")
+	t.Setenv("GIT_COMMITTER_EMAIL", "climate@example.test")
+
 	remoteBare := filepath.Join(t.TempDir(), "remote.git")
-	if err := runGit("", "init", "--bare", remoteBare); err != nil {
+	// --initial-branch pins the bare repo's HEAD to main; otherwise it depends
+	// on the machine's init.defaultBranch and clones may check out nothing.
+	if err := runGit("", "init", "--bare", "--initial-branch=main", remoteBare); err != nil {
 		t.Fatalf("init bare repo: %v", err)
 	}