deps: update GitHub action dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	minor	v4.1.7 -> v4.2.2
actions/setup-go	action	minor	v5.0.2 -> v5.1.0
actions/setup-python	action	minor	v5.1.1 -> v5.3.0
actions/upload-artifact	action	minor	v4.3.4 -> v4.4.3
azure/login	action	minor	v2.1.1 -> v2.2.0
docker/build-push-action	action	minor	v6.5.0 -> v6.10.0
docker/metadata-action	action	minor	v5.5.1 -> v5.6.1
errata-ai/vale-action	action	digest	91ac403 -> 2690bc9
github/codeql-action	action	minor	v3.25.15 -> v3.27.5
google-github-actions/auth	action	patch	v2.1.3 -> v2.1.7
google-github-actions/setup-gcloud	action	patch	v2.1.0 -> v2.1.2
hashicorp/setup-terraform	action	patch	v3.1.1 -> v3.1.2
lycheeverse/lychee-action	action	minor	v2.0.0 -> v2.1.0
sigstore/cosign-installer	action	minor	v3.5.0 -> v3.7.0
softprops/action-gh-release	action	minor	v2.0.8 -> v2.1.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

actions/checkout (actions/checkout)

v4.2.2

Compare Source

• url-helper.ts now leverages well-known environment variables by @​jww3 in https://github.com/actions/checkout/pull/1941
• Expand unit test coverage for isGhes by @​jww3 in https://github.com/actions/checkout/pull/1946

v4.2.1

Compare Source

• Check out other refs/* by commit if provided, fall back to ref by @​orhantoy in https://github.com/actions/checkout/pull/1924

v4.2.0

Compare Source

• Add Ref and Commit outputs by @​lucacome in https://github.com/actions/checkout/pull/1180
• Dependency updates by @​dependabot- https://github.com/actions/checkout/pull/1777, https://github.com/actions/checkout/pull/1872

actions/setup-go (actions/setup-go)

v5.1.0

Compare Source

What's Changed

• Add workflow file for publishing releases to immutable action package by @​Jcambass in https://github.com/actions/setup-go/pull/500
• Upgrade IA Publish by @​Jcambass in https://github.com/actions/setup-go/pull/502
• Add architecture to cache key by @​Zxilly in https://github.com/actions/setup-go/pull/493
  This addresses issues with caching by adding the architecture (arch) to the cache key, ensuring that cache keys are accurate to prevent conflicts.
  Note: This change may break previous cache keys as they will no longer be compatible with the new format.
• Enhance workflows and Upgrade micromatch Dependency by @​priyagupta108 in https://github.com/actions/setup-go/pull/510

Bug Fixes

• Revise isGhes logic by @​jww3 in https://github.com/actions/setup-go/pull/511

New Contributors

• @​Zxilly made their first contribution in https://github.com/actions/setup-go/pull/493
• @​Jcambass made their first contribution in https://github.com/actions/setup-go/pull/500
• @​jww3 made their first contribution in https://github.com/actions/setup-go/pull/511
• @​priyagupta108 made their first contribution in https://github.com/actions/setup-go/pull/510

Full Changelog: actions/setup-go@v5...v5.1.0

actions/setup-python (actions/setup-python)

v5.3.0

Compare Source

What's Changed

• Add workflow file for publishing releases to immutable action package by @​Jcambass in https://github.com/actions/setup-python/pull/941
• Upgrade IA publish by @​Jcambass in https://github.com/actions/setup-python/pull/943

Bug Fixes:

• Normalise Line Endings to Ensure Cross-Platform Consistency by @​priya-kinthali in https://github.com/actions/setup-python/pull/938
• Revise isGhes logic by @​jww3 in https://github.com/actions/setup-python/pull/963
• Bump pillow from 7.2 to 10.2.0 by @​aparnajyothi-y in https://github.com/actions/setup-python/pull/956

Enhancements:

• Enhance workflows and documentation updates by @​priya-kinthali in https://github.com/actions/setup-python/pull/965
• Bump default versions to latest by @​jeffwidman in https://github.com/actions/setup-python/pull/905

New Contributors

• @​Jcambass made their first contribution in https://github.com/actions/setup-python/pull/941
• @​jww3 made their first contribution in https://github.com/actions/setup-python/pull/963

Full Changelog: actions/setup-python@v5...v5.3.0

v5.2.0

Compare Source

actions/upload-artifact (actions/upload-artifact)

v4.4.3

Compare Source

What's Changed

• Undo indirect dependency updates from #​627 by @​joshmgross in https://github.com/actions/upload-artifact/pull/632

Full Changelog: actions/upload-artifact@v4.4.2...v4.4.3

v4.4.2

Compare Source

What's Changed

• Bump @actions/artifact to 2.1.11 by @​robherley in https://github.com/actions/upload-artifact/pull/627
  • Includes fix for relative symlinks not resolving properly

Full Changelog: actions/upload-artifact@v4.4.1...v4.4.2

v4.4.1

Compare Source

What's Changed

• Add a section about hidden files by @​joshmgross in https://github.com/actions/upload-artifact/pull/607
• Add workflow file for publishing releases to immutable action package by @​Jcambass in https://github.com/actions/upload-artifact/pull/621
• Update @​actions/artifact to latest version, includes symlink and timeout fixes by @​robherley in https://github.com/actions/upload-artifact/pull/625

New Contributors

• @​Jcambass made their first contribution in https://github.com/actions/upload-artifact/pull/621

Full Changelog: actions/upload-artifact@v4.4.0...v4.4.1

v4.4.0

Compare Source

v4.3.6

Compare Source

v4.3.5

Compare Source

azure/login (azure/login)

v2.2.0: Azure Login Action v2.2.0

Compare Source

What's Changed

• Replace az --version with az version by @​MoChilia in https://github.com/Azure/login/pull/450
• Update documentation for setting audience when environment is set by @​jcantosz in https://github.com/Azure/login/pull/455
• Fix #​459: Errors when registering cloud profile for AzureStack by @​MoChilia in https://github.com/Azure/login/pull/466
• Fix typo by @​KronosTheLate in https://github.com/Azure/login/pull/483
• move pre cleanup to main and add pre-if and post-if by @​YanaXu in https://github.com/Azure/login/pull/484

New Contributors

• @​jcantosz made their first contribution in https://github.com/Azure/login/pull/455
• @​KronosTheLate made their first contribution in https://github.com/Azure/login/pull/483

Full Changelog: Azure/login@v2.1.1...v2.2.0

docker/build-push-action (docker/build-push-action)

v6.10.0

Compare Source

v6.9.0

Compare Source

• Bump @​docker/actions-toolkit from 0.38.0 to 0.39.0 in https://github.com/docker/build-push-action/pull/1234
• Bump path-to-regexp from 6.2.2 to 6.3.0 in https://github.com/docker/build-push-action/pull/1232

Full Changelog: docker/build-push-action@v6.8.0...v6.9.0

v6.8.0

Compare Source

• Bump @​docker/actions-toolkit from 0.37.1 to 0.38.0 in https://github.com/docker/build-push-action/pull/1230

Full Changelog: docker/build-push-action@v6.7.0...v6.8.0

v6.7.0

Compare Source

v6.6.1

Compare Source

• Bump @​docker/actions-toolkit from 0.37.0 to 0.37.1 in https://github.com/docker/build-push-action/pull/1205

Full Changelog: docker/build-push-action@v6.6.0...v6.6.1

v6.6.0

Compare Source

docker/metadata-action (docker/metadata-action)

v5.6.1

Compare Source

• Fix GitHub API request fallback for commit date by @​crazy-max in https://github.com/docker/metadata-action/pull/478
• Revert to default commit SHA length of 7 by @​crazy-max in https://github.com/docker/metadata-action/pull/480

Full Changelog: docker/metadata-action@v5.6.0...v5.6.1

v5.6.0

Compare Source

• Add commit_date global expression by @​trim21 in https://github.com/docker/metadata-action/pull/471 https://github.com/docker/metadata-action/pull/475
• Increase short commit sha length to 12 for uniqueness by @​crazy-max in https://github.com/docker/metadata-action/pull/467
• Bump @​actions/core from 1.10.1 to 1.11.1 https://github.com/docker/metadata-action/pull/460
• Bump @​docker/actions-toolkit from 0.16.1 to 0.44.0 https://github.com/docker/metadata-action/pull/391 https://github.com/docker/metadata-action/pull/399 https://github.com/docker/metadata-action/pull/413 https://github.com/docker/metadata-action/pull/441
• Bump braces from 3.0.2 to 3.0.3 https://github.com/docker/metadata-action/pull/424
• Bump cross-spawn from 7.0.3 to 7.0.5 https://github.com/docker/metadata-action/pull/474
• Bump csv-parse from 5.5.5 to 5.5.6 https://github.com/docker/metadata-action/pull/412
• Bump moment-timezone from 0.5.44 to 0.5.46 https://github.com/docker/metadata-action/pull/383 https://github.com/docker/metadata-action/pull/470 https://github.com/docker/metadata-action/pull/459
• Bump path-to-regexp from 6.2.2 to 6.3.0 https://github.com/docker/metadata-action/pull/454
• Bump semver from 7.6.0 to 7.6.3 https://github.com/docker/metadata-action/pull/400 https://github.com/docker/metadata-action/pull/411 https://github.com/docker/metadata-action/pull/440
• Bump undici from 5.26.3 to 5.28.4 https://github.com/docker/metadata-action/pull/386 https://github.com/docker/metadata-action/pull/402

Full Changelog: docker/metadata-action@v5.5.1...v5.6.0

github/codeql-action (github/codeql-action)

v3.27.5

Compare Source

v3.27.4

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

Note that the only difference between v2 and v3 of the CodeQL Action is the node version they support, with v3 running on node 20 while we continue to release v2 to support running on node 16. For example 3.22.11 was the first v3 release and is functionally identical to 2.22.11. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.

3.27.4 - 14 Nov 2024

No user facing changes.

See the full CHANGELOG.md for more information.

v3.27.3

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

Note that the only difference between v2 and v3 of the CodeQL Action is the node version they support, with v3 running on node 20 while we continue to release v2 to support running on node 16. For example 3.22.11 was the first v3 release and is functionally identical to 2.22.11. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.

3.27.3 - 12 Nov 2024

No user facing changes.

See the full CHANGELOG.md for more information.

v3.27.2

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

Note that the only difference between v2 and v3 of the CodeQL Action is the node version they support, with v3 running on node 20 while we continue to release v2 to support running on node 16. For example 3.22.11 was the first v3 release and is functionally identical to 2.22.11. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.

3.27.2 - 12 Nov 2024

• Fixed an issue where setting up the CodeQL tools would sometimes fail with the message "Invalid value 'undefined' for header 'authorization'". #​2590

See the full CHANGELOG.md for more information.

v3.27.1

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

Note that the only difference between v2 and v3 of the CodeQL Action is the node version they support, with v3 running on node 20 while we continue to release v2 to support running on node 16. For example 3.22.11 was the first v3 release and is functionally identical to 2.22.11. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.

3.27.1 - 08 Nov 2024

• The CodeQL Action now downloads bundles compressed using Zstandard on GitHub Enterprise Server when using Linux or macOS runners. This speeds up the installation of the CodeQL tools. This feature is already available to GitHub.com users. #​2573
• Update default CodeQL bundle version to 2.19.3. #​2576

See the full CHANGELOG.md for more information.

v3.27.0

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

Note that the only difference between v2 and v3 of the CodeQL Action is the node version they support, with v3 running on node 20 while we continue to release v2 to support running on node 16. For example 3.22.11 was the first v3 release and is functionally identical to 2.22.11. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.

3.27.0 - 22 Oct 2024

• Bump the minimum CodeQL bundle version to 2.14.6. #​2549
• Fix an issue where the upload-sarif Action would fail with "upload-sarif post-action step failed: Input required and not supplied: token" when called in a composite Action that had a different set of inputs to the ones expected by the upload-sarif Action. #​2557
• Update default CodeQL bundle version to 2.19.2. #​2552

See the full CHANGELOG.md for more information.

v3.26.13

Compare Source

v3.26.12

Compare Source

v3.26.11

Compare Source

v3.26.10

Compare Source

v3.26.9

Compare Source

v3.26.8

Compare Source

v3.26.7

Compare Source

v3.26.6

Compare Source

v3.26.5

Compare Source

v3.26.4

Compare Source

v3.26.3

Compare Source

v3.26.2

Compare Source

v3.26.1

Compare Source

v3.26.0

Compare Source

google-github-actions/auth (google-github-actions/auth)

v2.1.7

Compare Source

What's Changed

• fix: update relase workflows by @​verbanicm in https://github.com/google-github-actions/auth/pull/452
• Release: v2.1.7 by @​google-github-actions-bot in https://github.com/google-github-actions/auth/pull/453

Full Changelog: google-github-actions/auth@v2.1.6...v2.1.7

v2.1.6

Compare Source

What's Changed

• Recommend gcloud storage over gsutil by @​sethvargo in https://github.com/google-github-actions/auth/pull/438
• Add missing log line by @​sethvargo in https://github.com/google-github-actions/auth/pull/448
• Release: v2.1.6 by @​google-github-actions-bot in https://github.com/google-github-actions/auth/pull/449

Full Changelog: google-github-actions/auth@v2.1.5...v2.1.6

v2.1.5

Compare Source

What's Changed

• Document ID Token lifetimes by @​sethvargo in https://github.com/google-github-actions/auth/pull/433
• fix !project_id error message typo by @​seth-acuitymd in https://github.com/google-github-actions/auth/pull/435
• Update deps by @​sethvargo in https://github.com/google-github-actions/auth/pull/436
• Release: v2.1.5 by @​google-github-actions-bot in https://github.com/google-github-actions/auth/pull/437

New Contributors

• @​seth-acuitymd made their first contribution in https://github.com/google-github-actions/auth/pull/435

Full Changelog: google-github-actions/auth@v2.1.4...v2.1.5

v2.1.4

Compare Source

What's Changed

• security: bump braces from 3.0.2 to 3.0.3 in the npm_and_yarn group by @​dependabot in https://github.com/google-github-actions/auth/pull/420
• Update spelling and workflow versions by @​sethvargo in https://github.com/google-github-actions/auth/pull/422
• Update deps by @​sethvargo in https://github.com/google-github-actions/auth/pull/430
• Release: v2.1.4 by @​google-github-actions-bot in https://github.com/google-github-actions/auth/pull/431

Full Changelog: google-github-actions/auth@v2.1.3...v2.1.4

google-github-actions/setup-gcloud (google-github-actions/setup-gcloud)

v2.1.2

Compare Source

What's Changed

• fix: update release workflows by @​verbanicm in https://github.com/google-github-actions/setup-gcloud/pull/698
• Release: v2.1.2 by @​google-github-actions-bot in https://github.com/google-github-actions/setup-gcloud/pull/699

Full Changelog: google-github-actions/setup-gcloud@v2.1.1...v2.1.2

v2.1.1

Compare Source

What's Changed

• security: bump undici from 5.28.2 to 5.28.3 by @​dependabot in https://github.com/google-github-actions/setup-gcloud/pull/681
• Fix typo in sample workflow shown in README.md. by @​msng in https://github.com/google-github-actions/setup-gcloud/pull/682
• Fix ADC documentation, issue#685 by @​eeaton in https://github.com/google-github-actions/setup-gcloud/pull/686
• security: bump undici from 5.28.3 to 5.28.4 in the npm_and_yarn group by @​dependabot in https://github.com/google-github-actions/setup-gcloud/pull/687
• Disable prompts by @​sethvargo in https://github.com/google-github-actions/setup-gcloud/pull/688
• Update deps and switch to autodoc by @​sethvargo in https://github.com/google-github-actions/setup-gcloud/pull/690
• Update deps by @​sethvargo in https://github.com/google-github-actions/setup-gcloud/pull/691
• Release: v2.1.1 by @​google-github-actions-bot in https://github.com/google-github-actions/setup-gcloud/pull/692

New Contributors

• @​msng made their first contribution in https://github.com/google-github-actions/setup-gcloud/pull/682
• @​eeaton made their first contribution in https://github.com/google-github-actions/setup-gcloud/pull/686

Full Changelog: google-github-actions/setup-gcloud@v2.1.0...v2.1.1

hashicorp/setup-terraform (hashicorp/setup-terraform)

v3.1.2

Compare Source

NOTES:

• This release introduces no functional changes. It does however include dependency updates which address upstream CVEs. (#​430)

lycheeverse/lychee-action (lycheeverse/lychee-action)

v2.1.0: Version 2.1.0

Compare Source

What's Changed

• Add missing argument failIfEmpty by @​LitoMore in https://github.com/lycheeverse/lychee-action/pull/261
• Fix bugs about the exit code by @​YDX-2147483647 in https://github.com/lycheeverse/lychee-action/pull/262
• Bump lychee version to 0.17.0 by @​mre in https://github.com/lycheeverse/lychee-action/pull/263

New Contributors

• @​LitoMore made their first contribution in https://github.com/lycheeverse/lychee-action/pull/261
• @​YDX-2147483647 made their first contribution in https://github.com/lycheeverse/lychee-action/pull/262

Full Changelog: lycheeverse/lychee-action@v2...v2.1.0

v2.0.2: Version 2.0.2

Compare Source

What's Changed

• Fix a typos by @​szepeviktor in https://github.com/lycheeverse/lychee-action/pull/257
• Document and use correct permissions in the GitHub workflows by @​dscho in https://github.com/lycheeverse/lychee-action/pull/258
• Add security policy by @​mondeja in https://github.com/lycheeverse/lychee-action/pull/259

New Contributors

• @​szepeviktor made their first contribution in https://github.com/lycheeverse/lychee-action/pull/257
• @​mondeja made their first contribution in https://github.com/lycheeverse/lychee-action/pull/259

Full Changelog: lycheeverse/lychee-action@v2...v2.0.2

v2.0.1: Version 2.0.1

Compare Source

What's Changed

• Don't remove the lychee config file by @​dmathieu in https://github.com/lycheeverse/lychee-action/pull/255
• Bump lycheeverse/lychee-action from 1 to 2 by @​dependabot in https://github.com/lycheeverse/lychee-action/pull/252
• Fix variable name in docs by @​kdeldycke in https://github.com/lycheeverse/lychee-action/pull/253

New Contributors

• @​dmathieu made their first contribution in https://github.com/lycheeverse/lychee-action/pull/255

Full Changelog: lycheeverse/lychee-action@v2...v2.0.1

sigstore/cosign-installer (sigstore/cosign-installer)

v3.7.0

Compare Source

What's Changed

• Bump actions/checkout from 4.1.7 to 4.2.0 by @​dependabot in https://github.com/sigstore/cosign-installer/pull/172
• bump for latest cosign v2.4.1 release by @​bobcallaway in https://github.com/sigstore/cosign-installer/pull/173

Full Changelog: sigstore/cosign-installer@v3.6.0...v3.7.0

v3.6.0

Compare Source

What's Changed

• Bump actions/checkout from 4.1.2 to 4.1.3 by @​dependabot in https://github.com/sigstore/cosign-installer/pull/161
• Bump actions/checkout from 4.1.3 to 4.1.4 by @​dependabot in https://github.com/sigstore/cosign-installer/pull/162
• Bump actions/setup-go from 5.0.0 to 5.0.1 by @​dependabot in https://github.com/sigstore/cosign-installer/pull/163
• Bump actions/checkout from 4.1.4 to 4.1.5 by @​dependabot in https://github.com/sigstore/cosign-installer/pull/164
• Bump actions/checkout from 4.1.5 to 4.1.6 by @​dependabot in https://github.com/sigstore/cosign-installer/pull/165
• Bump actions/checkout from 4.1.6 to 4.1.7 by @​dependabot in https://github.com/sigstore/cosign-installer/pull/166
• Bump actions/setup-go from 5.0.1 to 5.0.2 by @​dependabot in https://github.com/sigstore/cosign-installer/pull/167
• pin public key used for verification by @​bobcallaway in https://github.com/sigstore/cosign-installer/pull/169
• bump default version to v2.4.0 release by @​bobcallaway in https://github.com/sigstore/cosign-installer/pull/168
• update readme for new release by @​bobcallaway in https://github.com/sigstore/cosign-installer/pull/170

Full Changelog: sigstore/cosign-installer@v3...v3.6.0

softprops/action-gh-release (softprops/action-gh-release)

v2.1.0

Compare Source

What's Changed

Exciting New Features 🎉

• feat: add support for release assets with multiple spaces within the name by @​dukhine in https://github.com/softprops/action-gh-release/pull/518
• feat: preserve upload order by @​richarddd in https://github.com/softprops/action-gh-release/pull/500

Other Changes 🔄

• chore(deps): bump @​types/node from 22.8.2 to 22.8.7 by @​dependabot in https://github.com/softprops/action-gh-release/pull/539

New Contributors

• @​dukhine made their first contribution in https://github.com/softprops/action-gh-release/pull/518
• @​richarddd made their first contribution in https://github.com/softprops/action-gh-release/pull/500

Full Changelog: softprops/action-gh-release@v2...v2.1.0

v2.0.9

Compare Source

What's Changed

• maintenance release with updated dependencies

New Contributors

• @​kbakdev made their first contribution in https://github.com/softprops/action-gh-release/pull/521

Full Changelog: softprops/action-gh-release@v2...v2.0.9

---

Configuration

📅 Schedule: Branch creation - "before 8am on tuesday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[netlify]

✅ Deploy Preview for constellation-docs canceled.

Name	Link
🔨 Latest commit	1bb2204
🔍 Latest deploy log	https://app.netlify.com/sites/constellation-docs/deploys/67488373465718000824be37