diff --git a/.github/workflows/beta.yml b/.github/workflows/beta.yml
index 5c5ca6159a6..2f9117bd7af 100644
--- a/.github/workflows/beta.yml
+++ b/.github/workflows/beta.yml
@@ -14,7 +14,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/check-md-table-padding.yml b/.github/workflows/check-md-table-padding.yml
index 51d6706597d..9503c5a6bc3 100644
--- a/.github/workflows/check-md-table-padding.yml
+++ b/.github/workflows/check-md-table-padding.yml
@@ -14,7 +14,7 @@ jobs:
     if: github.repository == 'Kilo-Org/kilocode'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
diff --git a/.github/workflows/check-opencode-annotations.yml b/.github/workflows/check-opencode-annotations.yml
index e1588c0fc44..183587fcca5 100644
--- a/.github/workflows/check-opencode-annotations.yml
+++ b/.github/workflows/check-opencode-annotations.yml
@@ -21,7 +21,7 @@ jobs:
     if: github.repository == 'Kilo-Org/kilocode'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
           fetch-depth: 0
diff --git a/.github/workflows/close-issues.yml b/.github/workflows/close-issues.yml
index 04b6ae7ac80..cb90ff1349f 100644
--- a/.github/workflows/close-issues.yml
+++ b/.github/workflows/close-issues.yml
@@ -12,7 +12,7 @@ jobs:
       contents: read
       issues: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - uses: oven-sh/setup-bun@v2
         with:
diff --git a/.github/workflows/containers.yml b/.github/workflows/containers.yml
index 03bc1867873..9ea96d1df2b 100644
--- a/.github/workflows/containers.yml
+++ b/.github/workflows/containers.yml
@@ -26,7 +26,7 @@ jobs:
           OWNER: ${{ github.repository_owner }}
       # kilocode_change end
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - uses: ./.github/actions/setup-bun
 
diff --git a/.github/workflows/disabled/daily-issues-recap.yml.disabled b/.github/workflows/disabled/daily-issues-recap.yml.disabled
index 789712ef519..094b7e6f43c 100644
--- a/.github/workflows/disabled/daily-issues-recap.yml.disabled
+++ b/.github/workflows/disabled/daily-issues-recap.yml.disabled
@@ -14,7 +14,7 @@ jobs:
       issues: read
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 1
 
diff --git a/.github/workflows/disabled/daily-pr-recap.yml.disabled b/.github/workflows/disabled/daily-pr-recap.yml.disabled
index ff026917f81..a1c6af04916 100644
--- a/.github/workflows/disabled/daily-pr-recap.yml.disabled
+++ b/.github/workflows/disabled/daily-pr-recap.yml.disabled
@@ -14,7 +14,7 @@ jobs:
       pull-requests: read
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 1
 
diff --git a/.github/workflows/disabled/pr-management.yml.disabled b/.github/workflows/disabled/pr-management.yml.disabled
index 1e331bd6f2e..06c5373dad4 100644
--- a/.github/workflows/disabled/pr-management.yml.disabled
+++ b/.github/workflows/disabled/pr-management.yml.disabled
@@ -12,7 +12,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 1
 
diff --git a/.github/workflows/disabled/storybook.yml.disabled b/.github/workflows/disabled/storybook.yml.disabled
index 6d143a8a22f..322b37983e3 100644
--- a/.github/workflows/disabled/storybook.yml.disabled
+++ b/.github/workflows/disabled/storybook.yml.disabled
@@ -29,7 +29,7 @@ jobs:
     runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup Bun
         uses: ./.github/actions/setup-bun
diff --git a/.github/workflows/docs-build.yml b/.github/workflows/docs-build.yml
index b485662e482..5c9f43a4204 100644
--- a/.github/workflows/docs-build.yml
+++ b/.github/workflows/docs-build.yml
@@ -16,7 +16,7 @@ jobs:
     runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup Bun
         uses: ./.github/actions/setup-bun
diff --git a/.github/workflows/docs-check-links.yml b/.github/workflows/docs-check-links.yml
index 75b47a67077..e3d812dcef7 100644
--- a/.github/workflows/docs-check-links.yml
+++ b/.github/workflows/docs-check-links.yml
@@ -17,7 +17,7 @@ jobs:
     if: github.repository == 'Kilo-Org/kilocode'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Link Checker
         uses: Kilo-Org/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411
diff --git a/.github/workflows/duplicate-issues.yml b/.github/workflows/duplicate-issues.yml
index dfc5039ef24..c1b81985a5b 100644
--- a/.github/workflows/duplicate-issues.yml
+++ b/.github/workflows/duplicate-issues.yml
@@ -13,7 +13,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 1
 
@@ -128,7 +128,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 1
 
diff --git a/.github/workflows/generate.yml b/.github/workflows/generate.yml
index 25b03a7bfc2..45a76f23b10 100644
--- a/.github/workflows/generate.yml
+++ b/.github/workflows/generate.yml
@@ -14,7 +14,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup Bun
         uses: ./.github/actions/setup-bun
diff --git a/.github/workflows/nix-hashes.yml b/.github/workflows/nix-hashes.yml
index cfa4ee633a3..c359c60a73c 100644
--- a/.github/workflows/nix-hashes.yml
+++ b/.github/workflows/nix-hashes.yml
@@ -73,7 +73,7 @@ jobs:
           echo "Computed hash for ${SYSTEM}: $HASH"
 
       - name: Upload hash
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: hash-${{ matrix.system }}
           path: hash.txt
@@ -86,7 +86,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           persist-credentials: false
           fetch-depth: 0
@@ -106,7 +106,7 @@ jobs:
           git pull --rebase --autostash origin "$GITHUB_REF_NAME"
 
       - name: Download hash artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           path: hashes
           pattern: hash-*
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 346972018df..962ac01a75f 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -42,7 +42,7 @@ jobs:
     runs-on: blacksmith-4vcpu-ubuntu-2404
     if: github.repository == 'Kilo-Org/kilocode'
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
@@ -78,7 +78,7 @@ jobs:
     runs-on: blacksmith-4vcpu-ubuntu-2404
     if: github.repository == 'Kilo-Org/kilocode'
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v6
         with:
           fetch-tags: true
 
@@ -123,11 +123,11 @@ jobs:
     runs-on: blacksmith-4vcpu-ubuntu-2404
     if: github.repository == 'Kilo-Org/kilocode'
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v6
 
       - uses: ./.github/actions/setup-bun
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
           registry-url: "https://registry.npmjs.org"
@@ -156,7 +156,7 @@ jobs:
           KILO_PRE_RELEASE: ${{ inputs.pre_release }}
           GH_REPO: ${{ github.repository }}
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: kilo-vscode
           path: packages/kilo-vscode/out
@@ -183,7 +183,7 @@ jobs:
       - smoke-test
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v6
 
       - uses: ./.github/actions/setup-bun
 
@@ -200,7 +200,7 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: "24"
           registry-url: "https://registry.npmjs.org"
@@ -235,7 +235,7 @@ jobs:
           path: packages/kilo-vscode/out
 
       - name: Cache apt packages (AUR)
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: /var/cache/apt/archives
           key: ${{ runner.os }}-apt-aur-${{ hashFiles('.github/workflows/publish.yml') }}
diff --git a/.github/workflows/smoke-test.yml b/.github/workflows/smoke-test.yml
index a041bc72569..b81be7101ef 100644
--- a/.github/workflows/smoke-test.yml
+++ b/.github/workflows/smoke-test.yml
@@ -47,7 +47,7 @@ jobs:
       KILO_ORG_ID: ${{ secrets.KILO_ORG_ID }}
     steps:
       - name: Checkout kilo-bench
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: Kilo-Org/kilo-bench
           token: ${{ secrets.BENCH_GITHUB_TOKEN }}
@@ -122,7 +122,7 @@ jobs:
 
       - name: Upload results
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: smoke-test-results
           path: |
diff --git a/.github/workflows/source-check-links.yml b/.github/workflows/source-check-links.yml
index 60df85b4b54..e1d170e1470 100644
--- a/.github/workflows/source-check-links.yml
+++ b/.github/workflows/source-check-links.yml
@@ -16,7 +16,7 @@ jobs:
     if: github.repository == 'Kilo-Org/kilocode'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - uses: oven-sh/setup-bun@v2
 
diff --git a/.github/workflows/test-vscode.yml b/.github/workflows/test-vscode.yml
index a3e66fff459..4b205b98538 100644
--- a/.github/workflows/test-vscode.yml
+++ b/.github/workflows/test-vscode.yml
@@ -27,7 +27,7 @@ jobs:
         shell: bash
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index aa87889c3ac..26878798fcd 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -39,12 +39,12 @@ jobs:
         shell: bash
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: "24"
 
@@ -57,7 +57,7 @@ jobs:
           git config --global user.name "kilo-maintainer[bot]"
 
       - name: Cache Turbo
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: node_modules/.cache/turbo
           key: turbo-${{ runner.os }}-${{ hashFiles('turbo.json', '**/package.json')
@@ -83,7 +83,7 @@ jobs:
 
       - name: Upload unit artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: unit-${{ matrix.settings.name }}-${{ github.run_attempt }}
           include-hidden-files: true
diff --git a/.github/workflows/triage.yml b/.github/workflows/triage.yml
index b767380365e..cb6c7f24ef1 100644
--- a/.github/workflows/triage.yml
+++ b/.github/workflows/triage.yml
@@ -13,7 +13,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 1
 
diff --git a/.github/workflows/typecheck.yml b/.github/workflows/typecheck.yml
index 894f5dac6fe..c5eeebd03f0 100644
--- a/.github/workflows/typecheck.yml
+++ b/.github/workflows/typecheck.yml
@@ -12,7 +12,7 @@ jobs:
     runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup Bun
         uses: ./.github/actions/setup-bun
diff --git a/.github/workflows/visual-regression.yml b/.github/workflows/visual-regression.yml
index 4f49c4aa461..65bac2244ce 100644
--- a/.github/workflows/visual-regression.yml
+++ b/.github/workflows/visual-regression.yml
@@ -12,7 +12,7 @@ jobs:
       matched: ${{ steps.filter.outputs.matched }}
       is_fork: ${{ steps.fork-check.outputs.is_fork }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: Kilo-Org/paths-filter@master
         id: filter
         with:
@@ -47,7 +47,7 @@ jobs:
     steps:
       - name: Checkout (internal)
         if: needs.check-paths.outputs.is_fork != 'true'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           lfs: true
           token: ${{ secrets.BOT_PAT }}
@@ -55,7 +55,7 @@ jobs:
 
       - name: Checkout (fork)
         if: needs.check-paths.outputs.is_fork == 'true'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           lfs: true
 
@@ -77,7 +77,7 @@ jobs:
           bun-version: latest
 
       - name: Cache Bun modules
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: ~/.bun/install/cache
           key: bun-${{ hashFiles('bun.lock') }}
@@ -87,7 +87,7 @@ jobs:
 
       - name: Cache Playwright browsers
         id: playwright-cache
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: ~/.cache/ms-playwright
           key: playwright-${{ hashFiles('packages/kilo-ui/package.json') }}
@@ -103,7 +103,7 @@ jobs:
 
       - name: Cache Storybook build
         id: storybook-cache
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: packages/kilo-ui/storybook-static
           key: storybook-${{ hashFiles('packages/kilo-ui/src/**', 'packages/kilo-ui/.storybook/**', 'packages/ui/src/**', 'packages/kilo-ui/package.json') }}
@@ -195,7 +195,7 @@ jobs:
 
       - name: Upload test results on failure
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: visual-regression-results
           path: packages/kilo-ui/test-results/
@@ -211,7 +211,7 @@ jobs:
     steps:
       - name: Checkout (internal)
         if: needs.check-paths.outputs.is_fork != 'true'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           lfs: true
           token: ${{ secrets.BOT_PAT }}
@@ -219,7 +219,7 @@ jobs:
 
       - name: Checkout (fork)
         if: needs.check-paths.outputs.is_fork == 'true'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           lfs: true
 
@@ -241,7 +241,7 @@ jobs:
           bun-version: latest
 
       - name: Cache Bun modules
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: ~/.bun/install/cache
           key: bun-${{ hashFiles('bun.lock') }}
@@ -251,7 +251,7 @@ jobs:
 
       - name: Cache Playwright browsers
         id: playwright-cache-vscode
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: ~/.cache/ms-playwright
           key: playwright-vscode-${{ hashFiles('packages/kilo-vscode/package.json') }}
@@ -267,7 +267,7 @@ jobs:
 
       - name: Cache Storybook build
         id: storybook-cache-vscode
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: packages/kilo-vscode/storybook-static
           key: storybook-vscode-${{ hashFiles('packages/kilo-vscode/webview-ui/src/**', 'packages/kilo-vscode/.storybook/**', 'packages/kilo-ui/src/**', 'packages/ui/src/**', 'packages/kilo-vscode/package.json') }}
@@ -386,7 +386,7 @@ jobs:
 
       - name: Upload test results on failure
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: visual-regression-vscode-results
           path: packages/kilo-vscode/test-results/
diff --git a/packages/opencode/script/test-runner.ts b/packages/opencode/script/test-runner.ts
index 2ec0bfa4f74..afd0b7d80ab 100644
--- a/packages/opencode/script/test-runner.ts
+++ b/packages/opencode/script/test-runner.ts
@@ -280,11 +280,40 @@ console.log(
 )
 
 if (flaky.length > 0) {
+  const sorted = flaky.slice().sort((a, b) => a.file.localeCompare(b.file))
+
   console.log(`${bold(yellow("--- FLAKY (passed on retry) ---"))}\n`)
-  for (const r of flaky.slice().sort((a, b) => a.file.localeCompare(b.file))) {
+  for (const r of sorted) {
     console.log(`  ${yellow(r.file)} ${dim(`(passed on attempt ${r.attempts}/${retries + 1})`)}`)
   }
   console.log()
+
+  // Surface flakies to the GitHub Actions UI so reviewers don't have to scan
+  // the raw log. Annotations show up on the PR; the step summary is visible at
+  // the bottom of the job page and in the workflow summary email.
+  if (process.env.GITHUB_ACTIONS === "true") {
+    for (const r of sorted) {
+      const repo = `packages/opencode/test/${r.file}`
+      console.log(
+        `::warning file=${repo},title=Flaky test file::passed on attempt ${r.attempts} of ${retries + 1}`,
+      )
+    }
+
+    const summary = process.env.GITHUB_STEP_SUMMARY
+    if (summary) {
+      const md = [
+        "### ⚠️ Flaky test files (passed on retry)",
+        "",
+        `${sorted.length} file${sorted.length === 1 ? "" : "s"} needed more than one attempt to pass.`,
+        "",
+        "| File | Attempts |",
+        "|---|---|",
+        ...sorted.map((r) => `| \`${r.file}\` | ${r.attempts}/${retries + 1} |`),
+        "",
+      ].join("\n")
+      await fs.appendFile(summary, md + "\n")
+    }
+  }
 }
 
 // ---------------------------------------------------------------------------