chore(deps): update github-actions

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
actions/attest	action	patch	v4.1.0 → v4.1.1	v4.2.0
actions/attest-build-provenance	action	patch	v4.1.0 → v4.1.1
docker/build-push-action	action	minor	v7.2.0 → v7.3.0
docker/login-action	action	minor	v4.2.0 → v4.4.0	v4.5.1 (+1)
docker/metadata-action	action	minor	v6.1.0 → v6.2.0
docker/setup-buildx-action	action	minor	v4.1.0 → v4.2.0
docker/setup-qemu-action	action	minor	v4.1.0 → v4.2.0
dorny/paths-filter	action	patch	v4.0.1 → v4.0.2
github/codeql-action	action	minor	v4.36.3 → v4.37.0	v4.37.3 (+2)
qltysh/qlty-action	action	minor	v2.2.1 → v2.3.0
step-security/harden-runner	action	minor	v2.19.4 → v2.20.0

---

Release Notes

actions/attest (actions/attest)

v4.1.1

Compare Source

What's Changed

• Bump tar from 7.5.9 to 7.5.10 by @​dependabot[bot] in #​371
• Bump tar from 7.5.10 to 7.5.11 by @​dependabot[bot] in #​375
• Bump the npm-production group across 1 directory with 2 updates by @​dependabot[bot] in #​404
• Bump minimatch by @​dependabot[bot] in #​399
• Bump brace-expansion from 1.1.12 to 1.1.14 by @​dependabot[bot] in #​397
• Bump undici from 6.23.0 to 6.24.1 by @​dependabot[bot] in #​381
• Bump ip-address from 10.1.0 to 10.2.0 by @​dependabot[bot] in #​411
• Bump undici from 7.25.0 to 8.2.0 by @​dependabot[bot] in #​409
• Bump tar from 7.5.11 to 7.5.17 by @​dependabot[bot] in #​429
• Bump csv-parse from 5.6.0 to 6.2.1 by @​dependabot[bot] in #​414
• Bump @​sigstore/oci from 0.6.1 to 0.7.1 by @​bdehamer in #​432

Full Changelog: actions/attest@v4.1.0...v4.1.1

actions/attest-build-provenance (actions/attest-build-provenance)

v4.1.1

Compare Source

[!NOTE]
As of version 4, actions/attest-build-provenance is simply a wrapper on top of actions/attest.

Existing applications may continue to use the attest-build-provenance action, but new implementations should use actions/attest instead.

What's Changed

• Update actions/attest to v4.1.1 by @​bdehamer in #​858

Full Changelog: actions/attest-build-provenance@v4.1.0...v4.1.1

docker/build-push-action (docker/build-push-action)

v7.3.0

Compare Source

docker/login-action (docker/login-action)

v4.4.0

Compare Source

v4.3.0

Compare Source

• Preserve names in esbuild bundle by @​crazy-max in #​1022
• Bump @​aws-sdk/client-ecr and @​aws-sdk/client-ecr-public to 3.1076.0 #​999 #​1030
• Bump @​docker/actions-toolkit from 0.90.0 to 0.92.0 in #​1004 #​1027
• Bump @​sigstore/core from 3.1.0 to 3.2.1 in #​1023
• Bump @​sigstore/verify from 3.1.0 to 3.1.1 in #​1029
• Bump http-proxy-agent and https-proxy-agent to 9.1.0 in #​1017
• Bump js-yaml from 4.1.1 to 5.2.0 in #​1028
• Bump sigstore from 4.1.0 to 4.1.1 in #​1031
• Bump tmp from 0.2.5 to 0.2.7 in #​1002
• Bump undici from 6.24.1 to 6.27.0 in #​1020
• Bump vite from 7.3.3 to 7.3.6 in #​1019

Full Changelog: docker/login-action@v4.2.0...v4.3.0

docker/metadata-action (docker/metadata-action)

v6.2.0

Compare Source

docker/setup-buildx-action (docker/setup-buildx-action)

v4.2.0

Compare Source

• Preserve names in esbuild bundle by @​crazy-max in #​572
• Bump @​actions/core from 3.0.0 to 3.0.1 in #​551
• Bump @​docker/actions-toolkit from 0.90.0 to 0.92.0 in #​557 #​580
• Bump @​sigstore/core from 3.1.0 to 3.2.1 in #​573
• Bump @​sigstore/verify from 3.1.0 to 3.1.1 in #​576
• Bump js-yaml from 4.1.1 to 5.2.0 in #​562
• Bump sigstore from 4.1.0 to 4.1.1 in #​577
• Bump tmp from 0.2.5 to 0.2.7 in #​556
• Bump undici from 6.25.0 to 6.27.0 in #​570
• Bump vite from 7.3.2 to 7.3.6 in #​569

Full Changelog: docker/setup-buildx-action@v4.1.0...v4.2.0

docker/setup-qemu-action (docker/setup-qemu-action)

v4.2.0

Compare Source

dorny/paths-filter (dorny/paths-filter)

v4.0.2

Compare Source

• Work around git dubious ownership errors in container jobs
• Use rev-parse instead of branch --show-current for older git compat
• Fix warning message

github/codeql-action (github/codeql-action)

v4.37.0

Compare Source

• Update default CodeQL bundle version to 2.26.0. #​3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@​ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #​3973

qltysh/qlty-action (qltysh/qlty-action)

v2.3.0

Compare Source

New

• Add a selected input to the coverage action for marking an upload as covering a selected subset of the test suite, which contributes to diff coverage only and is excluded from total coverage (#​200)

v2.2.3

Compare Source

• Internal release process improvements (no user-facing changes) (#​196)

v2.2.2

Compare Source

Fixed

• Security updates to bundled dependencies (#​190, #​191)

step-security/harden-runner (step-security/harden-runner)

v2.20.0

Compare Source

What's Changed

• Support for block policy for MacOS and Windows GitHub-hosted runners
• Support for Bitrise MacOS GitHub Actions runners
• HTTPS monitoring support for Bun for Linux runners (enterprise tier)

Full Changelog: step-security/harden-runner@v2.19.4...v2.20.0

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • "before 6am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
drydock-website	Ready	Preview, Comment	Jul 27, 2026 10:25pm
drydockdemo-website	Ready	Preview, Comment	Jul 27, 2026 10:25pm

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 7deb7a87-088b-4e0a-8b71-771df1d9c88a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

Walkthrough

Changes

Updates pinned GitHub Actions commit SHAs across CI/CD workflow files: actions/checkout (v6.0.2→v6.0.3), actions/cache (v5.0.4→v5.0.5), github/codeql-action (v4.36.0→v4.36.2), crowdin/github-action (v2.16.2→v2.16.3), zizmorcore/zizmor-action (v0.5.6→v0.5.7), qltysh/qlty-action/install (v2.2.0→v2.2.1), and projectdiscovery/nuclei-action (v3.1.0→v3.1.1). Corresponding test fixtures in crowdin-workflow.test.ts and github-action-pins.ts are updated with new expected pin values.

Related PRs: none identified.

Suggested labels: dependencies, ci, github-actions

Suggested reviewers: none identified.

No source code logic reviewed here—just SHA bumps. Verify each new SHA actually resolves to the claimed tag before merge; a mismatched SHA-to-tag comment is a silent supply-chain risk, not a typo.

git ls-remote --tags https://github.com/actions/checkout v6.0.3

Confirm output SHA matches the pinned hash in every file before approving.

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch renovate/github-actions

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.