chore(deps): pin dependencies (#1117)

This PR contains the following updates: | Package | Type | Update | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---|---|---| | [actions/checkout](https://github.com/actions/checkout) | action | pinDigest | → `3d3c42e` | | | | [actions/setup-go](https://github.com/actions/setup-go) | action | pinDigest | → `b7ad1da` | | | | [actions/setup-node](https://github.com/actions/setup-node) | action | pinDigest | → `8207627` | | | | [crazy-max/ghaction-import-gpg](https://github.com/crazy-max/ghaction-import-gpg) | action | pinDigest | → `2dc316d` | | | | [docker/build-push-action](https://github.com/docker/build-push-action) | action | pinDigest | → `53b7df9` | | | | [docker/login-action](https://github.com/docker/login-action) | action | pinDigest | → `abd2ef4` | | | | [docker/metadata-action](https://github.com/docker/metadata-action) | action | pinDigest | → `dc80280` | | | | [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | action | pinDigest | → `bb05f3f` | | | | [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) | action | pinDigest | → `96fe6ef` | | | | [go.yaml.in/yaml/v4](https://github.com/yaml/go-yaml) | require | patch | `v4.0.0-rc.3` → `v4.0.0-rc.6` | ![age](https://developer.mend.io/api/mc/badges/age/go/go.yaml.in%2fyaml%2fv4/v4.0.0-rc.6?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/go.yaml.in%2fyaml%2fv4/v4.0.0-rc.3/v4.0.0-rc.6?slim=true) | | [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) | action | pinDigest | → `f06c13b` | | | | ubuntu | final | major | `24.04` → `26.04` | ![age](https://developer.mend.io/api/mc/badges/age/docker/ubuntu/resolute?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/docker/ubuntu/24.04/resolute?slim=true) | --- ### Release Notes <details> <summary>yaml/go-yaml (go.yaml.in/yaml/v4)</summary> ### [`v4.0.0-rc.6`](https://github.com/yaml/go-yaml/compare/v4.0.0-rc.5...v4.0.0-rc.6) [Compare Source](https://github.com/yaml/go-yaml/compare/v4.0.0-rc.5...v4.0.0-rc.6) ### [`v4.0.0-rc.5`](https://github.com/yaml/go-yaml/compare/v4.0.0-rc.4...v4.0.0-rc.5) [Compare Source](https://github.com/yaml/go-yaml/compare/v4.0.0-rc.4...v4.0.0-rc.5) ### [`v4.0.0-rc.4`](https://github.com/yaml/go-yaml/compare/v4.0.0-rc.3...v4.0.0-rc.4) [Compare Source](https://github.com/yaml/go-yaml/compare/v4.0.0-rc.3...v4.0.0-rc.4) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).  --------- Co-authored-by: silverwind <me@silverwind.io> Reviewed-on: https://gitea.com/gitea/runner/pulls/1117 Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com>
2026-08-01 20:36:42 +00:00 · 2026-07-27 14:38:07 +00:00
parent 8c519ce318
commit 78a74f78f8
6 changed files with 30 additions and 24 deletions
--- a/.gitea/workflows/pull-pr-title.yml
+++ b/.gitea/workflows/pull-pr-title.yml
@@ -18,8 +18,8 @@ jobs:
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
-    - uses: actions/checkout@v7
-    - uses: actions/setup-node@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+    - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
      with:
        node-version: 24
    - run: make lint-pr-title
--- a/.gitea/workflows/release-nightly.yml
+++ b/.gitea/workflows/release-nightly.yml
@@ -17,7 +17,7 @@ jobs:
  goreleaser:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          fetch-depth: 0
      # Custom publishers (the R2 mirror below) run as the very last
@@ -32,11 +32,11 @@ jobs:
          R2_BUCKET: ${{ secrets.R2_BUCKET }}
          R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
          R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
-      - uses: actions/setup-go@v7
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
        with:
          go-version-file: "go.mod"
      - name: goreleaser
-        uses: goreleaser/goreleaser-action@v7
+        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7
        with:
          distribution: goreleaser-pro
          args: release --nightly
@@ -74,18 +74,18 @@ jobs:

    steps:
      - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          fetch-depth: 0 # all history for all branches and tags

      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4

      - name: Set up Docker BuildX
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4

      - name: Login to DockerHub
-        uses: docker/login-action@v4
+        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}
@@ -99,7 +99,7 @@ jobs:
          echo REPO_VERSION=$(git describe --tags --always | sed 's/-/+/' | sed 's/^v//') >> $GITHUB_OUTPUT

      - name: Build and push
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
        with:
          context: .
          file: ./Dockerfile
--- a/.gitea/workflows/release-tag.yml
+++ b/.gitea/workflows/release-tag.yml
@@ -9,7 +9,7 @@ jobs:
  goreleaser:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          fetch-depth: 0 # all history for all branches and tags
      # Custom publishers (the R2 mirror below) run as the very last
@@ -24,18 +24,18 @@ jobs:
          R2_BUCKET: ${{ secrets.R2_BUCKET }}
          R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
          R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
-      - uses: actions/setup-go@v7
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
        with:
          go-version-file: "go.mod"
      - name: Import GPG key
        id: import_gpg
-        uses: crazy-max/ghaction-import-gpg@v7
+        uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7
        with:
          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
          passphrase: ${{ secrets.PASSPHRASE }}
          fingerprint: CC64B1DB67ABBEECAB24B6455FC346329753F4B0
      - name: goreleaser
-        uses: goreleaser/goreleaser-action@v7
+        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7
        with:
          distribution: goreleaser-pro
          args: release
@@ -77,25 +77,25 @@ jobs:
      DOCKER_LATEST: latest
    steps:
      - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          fetch-depth: 0 # all history for all branches and tags

      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4

      - name: Set up Docker BuildX
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4

      - name: Login to DockerHub
-        uses: docker/login-action@v4
+        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: "Docker meta"
        id: docker_meta
-        uses: docker/metadata-action@v6
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6
        with:
          images: |
            ${{ env.DOCKER_ORG }}/runner
@@ -108,7 +108,7 @@ jobs:
            suffix=${{ matrix.variant.tag_suffix }},onlatest=true

      - name: Build and push
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
        with:
          context: .
          file: ./Dockerfile
--- a/.gitea/workflows/test.yml
+++ b/.gitea/workflows/test.yml
@@ -17,8 +17,8 @@ jobs:
      # to ~/.docker with the stale credentials.
      DOCKER_CONFIG: /tmp/docker-noauth
    steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-go@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
        with:
          go-version-file: 'go.mod'
      - name: prepare anonymous docker config
--- a/act/runner/testdata/actions/action1/Dockerfile
+++ b/act/runner/testdata/actions/action1/Dockerfile
@@ -1 +1 @@
-FROM ubuntu:24.04
+FROM ubuntu:26.04
--- a/renovate.json5
+++ b/renovate.json5
@@ -2,5 +2,11 @@
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "local>gitea/renovate-config"
-  ]
+  ],
+  "packageRules": [
+    {
+      "matchPackageNames": ["go.yaml.in/yaml/v4"],
+      "allowedVersions": "<4.0.0-rc.4", // rc.4 removes the error types actionlint builds against
+    },
+  ],
 }