Update all dependencies on GitHub Actions

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	minor	v4.2.2 → v4.3.1
actions/setup-go	action	minor	v5.4.0 → v5.6.0
actions/setup-go	action	minor	v4.2.1 → v4.3.0
aquasecurity/trivy-action	action	minor	0.30.0 → v0.35.0
golangci/golangci-lint-action	action	patch	v3.7.0 → v3.7.1
marocchino/sticky-pull-request-comment	action	patch	v2.9.1 → v2.9.4

---

Release Notes

actions/checkout (actions/checkout)

v4.3.1

Compare Source

What's Changed

• Port v6 cleanup to v4 by @​ericsciple in #​2305

Full Changelog: actions/checkout@v4...v4.3.1

v4.3.0

Compare Source

What's Changed

• docs: update README.md by @​motss in #​1971
• Add internal repos for checking out multiple repositories by @​mouismail in #​1977
• Documentation update - add recommended permissions to Readme by @​benwells in #​2043
• Adjust positioning of user email note and permissions heading by @​joshmgross in #​2044
• Update README.md by @​nebuk89 in #​2194
• Update CODEOWNERS for actions by @​TingluoHuang in #​2224
• Update package dependencies by @​salmanmkc in #​2236
• Prepare release v4.3.0 by @​salmanmkc in #​2237

New Contributors

• @​motss made their first contribution in #​1971
• @​mouismail made their first contribution in #​1977
• @​benwells made their first contribution in #​2043
• @​nebuk89 made their first contribution in #​2194
• @​salmanmkc made their first contribution in #​2236

Full Changelog: actions/checkout@v4...v4.3.0

actions/setup-go (actions/setup-go)

v5.6.0

Compare Source

What's Changed

• Fall back to downloading from go.dev/dl instead of storage.googleapis.com/golang by @​aparnajyothi-y in #​689

Full Changelog: actions/setup-go@v5...v5.6.0

v5.5.0

Compare Source

What's Changed

Bug fixes:

• Update self-hosted environment validation by @​priyagupta108 in #​556
• Add manifest validation and improve error handling by @​priyagupta108 in #​586
• Update template link by @​jsoref in #​527

Dependency updates:

• Upgrade @​action/cache from 4.0.2 to 4.0.3 by @​aparnajyothi-y in #​574
• Upgrade @​actions/glob from 0.4.0 to 0.5.0 by @​dependabot in #​573
• Upgrade ts-jest from 29.1.2 to 29.3.2 by @​dependabot in #​582
• Upgrade eslint-plugin-jest from 27.9.0 to 28.11.0 by @​dependabot in #​537

New Contributors

• @​jsoref made their first contribution in #​527

Full Changelog: actions/setup-go@v5...v5.5.0

aquasecurity/trivy-action (aquasecurity/trivy-action)

v0.35.0: Release: v0.35.0

Compare Source

This release is a duplicate of 0.35.0 which was not compromised.

As part of our response to the recent supply chain attack, we have migrated all tags to use the v prefix (e.g., v0.35.0 instead of 0.35.0). Going forward, all new releases will use the v prefix convention.

We have intentionally kept the 0.35.0 tag intact to avoid breaking existing workflows that depend on it.

If you are currently using 0.35.0, your workflows are safe — no action is required.

v0.35.0

Compare Source

What's Changed

• chore(deps): Update trivy to v0.69.3 by @​aqua-bot in #​519

Full Changelog: aquasecurity/trivy-action@0.34.2...0.35.0

v0.34.0

Compare Source

v0.34.0

Compare Source

What's Changed

• ci: use setup-bats in bump-trivy workflow by @​nikpivkin in #​494
• chore: update README by @​nikpivkin in #​493
• ci: install trivy in bump-trivy workflow and update tests by @​nikpivkin in #​495
• chore(deps): Update trivy to v0.68.1 by @​aqua-bot in #​496
• ci: use checks bundle v2 in sync workflow by @​nikpivkin in #​505
• chore(deps): Update trivy to v0.69.1 by @​aqua-bot in #​506

Full Changelog: aquasecurity/trivy-action@0.33.1...0.34.0

v0.33.1: Release: v0.33.1

Compare Source

What's Changed

• Update setup-trivy action to version v0.2.4 by @​martincostello in #​486

Full Changelog: aquasecurity/trivy-action@v0.33.0...v0.33.1

v0.33.1

Compare Source

What's Changed

• Update setup-trivy action to version v0.2.4 by @​martincostello in #​486

Full Changelog: aquasecurity/trivy-action@0.33.0...0.33.1

v0.33.0: Release: v0.33.0

Compare Source

What's Changed

• Update dependencies in README by @​ibakshay in #​378
• doc: correct sbom fs scan by @​yxtay in #​458
• Pin actions/cache by SHA by @​martincostello in #​480
• chore(ci): Add oras to correctly setup sync jobs by @​simar7 in #​482
• chore(deps): Update trivy to v0.65.0 by @​aqua-bot in #​481

New Contributors

• @​ibakshay made their first contribution in #​378
• @​yxtay made their first contribution in #​458

Full Changelog: aquasecurity/trivy-action@v0.32.0...v0.33.0

v0.33.0

Compare Source

What's Changed

• Update dependencies in README by @​ibakshay in #​378
• doc: correct sbom fs scan by @​yxtay in #​458
• Pin actions/cache by SHA by @​martincostello in #​480
• chore(ci): Add oras to correctly setup sync jobs by @​simar7 in #​482
• chore(deps): Update trivy to v0.65.0 by @​aqua-bot in #​481

New Contributors

• @​ibakshay made their first contribution in #​378
• @​yxtay made their first contribution in #​458
• @​martincostello made their first contribution in #​480

Full Changelog: aquasecurity/trivy-action@0.32.0...0.33.0

v0.32.0: Release: v0.32.0

Compare Source

What's Changed

• chore(deps): Update trivy to v0.64.1 by @​aqua-bot in #​474

Full Changelog: aquasecurity/trivy-action@v0.31.0...v0.32.0

v0.32.0

Compare Source

What's Changed

• chore(deps): Update trivy to v0.64.1 by @​aqua-bot in #​474

Full Changelog: aquasecurity/trivy-action@0.31.0...0.32.0

v0.31.0: Release: v0.31.0

Compare Source

What's Changed

• docs: add info that unix:/ prefix is required for docker-host input by @​DmitriyLewen in #​455
• Fix Trivy action inputs leaking between invocations (#​422) by @​rvesse in #​454
• Pin aquasecuriy/setup-trivy to hash instead of tag by @​lhotari in #​456
• Bump Trivy version to fix GitHub actions by @​maximmasiutin in #​460
• refactor: use ubuntu 24.04 in example code by @​simar7 in #​465
• ci: fix workflow to bump Trivy by @​nikpivkin in #​466
• chore(deps): Update trivy to v0.63.0 by @​aqua-bot in #​467

New Contributors

• @​lhotari made their first contribution in #​456
• @​maximmasiutin made their first contribution in #​460

Full Changelog: aquasecurity/trivy-action@v0.30.0...v0.31.0

v0.31.0

Compare Source

What's Changed

• docs: add info that unix:/ prefix is required for docker-host input by @​DmitriyLewen in #​455
• Fix Trivy action inputs leaking between invocations (#​422) by @​rvesse in #​454
• Pin aquasecuriy/setup-trivy to hash instead of tag by @​lhotari in #​456
• Bump Trivy version to fix GitHub actions by @​maximmasiutin in #​460
• refactor: use ubuntu 24.04 in example code by @​simar7 in #​465
• ci: fix workflow to bump Trivy by @​nikpivkin in #​466
• chore(deps): Update trivy to v0.63.0 by @​aqua-bot in #​467

New Contributors

• @​lhotari made their first contribution in #​456
• @​maximmasiutin made their first contribution in #​460
• @​aqua-bot made their first contribution in #​467

Full Changelog: aquasecurity/trivy-action@0.30.0...0.31.0

golangci/golangci-lint-action (golangci/golangci-lint-action)

v3.7.1

Compare Source

marocchino/sticky-pull-request-comment (marocchino/sticky-pull-request-comment)

v2.9.4

Compare Source

What's Changed

• build(deps-dev): Bump @​biomejs/biome from 2.0.0 to 2.0.2 by @​dependabot[bot] in #​1554
• build(deps-dev): Bump @​types/node from 24.0.3 to 24.0.11 by @​dependabot[bot] in #​1561
• build(deps-dev): Bump @​biomejs/biome from 2.0.4 to 2.1.1 by @​dependabot[bot] in #​1562
• build(deps-dev): Bump @​types/node from 24.0.11 to 24.0.12 by @​dependabot[bot] in #​1563
• build(deps-dev): Bump @​types/node from 24.0.12 to 24.0.13 by @​dependabot[bot] in #​1564

Full Changelog: marocchino/sticky-pull-request-comment@v2.9.3...v2.9.4

v2.9.3

Compare Source

What's Changed

• Update deps (including security issues)
• Test with vitest instead of jest
• Use biome

Full Changelog: marocchino/sticky-pull-request-comment@v2.9.2...v2.9.3

v2.9.2

Compare Source

What's Changed

• Update @​octokit/graphql-schema & use biome by @​marocchino in #​1517
• build(deps): Bump undici from 5.28.4 to 5.28.5 by @​dependabot in #​1476
• build(deps-dev): Bump @​types/node from 22.10.7 to 22.14.0 by @​dependabot in #​1515
• build(deps): Bump @​octokit/request-error from 5.0.1 to 5.1.1 by @​dependabot in #​1490
• build(deps): Bump @​octokit/request from 8.1.4 to 8.4.1 by @​dependabot in #​1494
• build(deps): Bump @​octokit/plugin-paginate-rest from 9.1.2 to 9.2.2 by @​dependabot in #​1493

Full Changelog: marocchino/sticky-pull-request-comment@v2.9.1...v2.9.2

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.