chore(deps): update workflows (#935)

[![Mend
Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [actions/checkout](https://togithub.com/actions/checkout) | action |
patch | `v4.1.1` -> `v4.1.4` |
|
[actions/download-artifact](https://togithub.com/actions/download-artifact)
| action | patch | `v4.1.4` -> `v4.1.7` |
| [actions/setup-go](https://togithub.com/actions/setup-go) | action |
patch | `v5.0.0` -> `v5.0.1` |
|
[actions/upload-artifact](https://togithub.com/actions/upload-artifact)
| action | patch | `v4.3.1` -> `v4.3.3` |
| [codecov/codecov-action](https://togithub.com/codecov/codecov-action)
| action | patch | `v4.3.0` -> `v4.3.1` |
| [github/codeql-action](https://togithub.com/github/codeql-action) |
action | minor | `v3.24.10` -> `v3.25.3` |
|
[golangci/golangci-lint-action](https://togithub.com/golangci/golangci-lint-action)
| action | patch | `v4.0.0` -> `v4.0.1` |

---

### Release Notes

<details>
<summary>actions/checkout (actions/checkout)</summary>

###
[`v4.1.4`](https://togithub.com/actions/checkout/blob/HEAD/CHANGELOG.md#v414)

[Compare
Source](https://togithub.com/actions/checkout/compare/v4.1.3...v4.1.4)

- Disable `extensions.worktreeConfig` when disabling `sparse-checkout`
by [@&#8203;jww3](https://togithub.com/jww3) in
[actions/checkout#1692
- Add dependabot config by
[@&#8203;cory-miller](https://togithub.com/cory-miller) in
[actions/checkout#1688
- Bump the minor-actions-dependencies group with 2 updates by
[@&#8203;dependabot](https://togithub.com/dependabot) in
[actions/checkout#1693
- Bump word-wrap from 1.2.3 to 1.2.5 by
[@&#8203;dependabot](https://togithub.com/dependabot) in
[actions/checkout#1643

###
[`v4.1.3`](https://togithub.com/actions/checkout/releases/tag/v4.1.3)

[Compare
Source](https://togithub.com/actions/checkout/compare/v4.1.2...v4.1.3)

#### What's Changed

- Update `actions/checkout` version in `update-main-version.yml` by
[@&#8203;jww3](https://togithub.com/jww3) in
[actions/checkout#1650
- Check git version before attempting to disable `sparse-checkout` by
[@&#8203;jww3](https://togithub.com/jww3) in
[actions/checkout#1656
- Add SSH user parameter by
[@&#8203;cory-miller](https://togithub.com/cory-miller) in
[actions/checkout#1685

**Full Changelog**:
actions/checkout@v4.1.2...v4.1.3

###
[`v4.1.2`](https://togithub.com/actions/checkout/blob/HEAD/CHANGELOG.md#v412)

[Compare
Source](https://togithub.com/actions/checkout/compare/v4.1.1...v4.1.2)

- Fix: Disable sparse checkout whenever `sparse-checkout` option is not
present [@&#8203;dscho](https://togithub.com/dscho) in
[actions/checkout#1598

</details>

<details>
<summary>actions/download-artifact (actions/download-artifact)</summary>

###
[`v4.1.7`](https://togithub.com/actions/download-artifact/releases/tag/v4.1.7)

[Compare
Source](https://togithub.com/actions/download-artifact/compare/v4.1.6...v4.1.7)

#### What's Changed

- Update
[@&#8203;actions/artifact](https://togithub.com/actions/artifact)
dependency by [@&#8203;bethanyj28](https://togithub.com/bethanyj28) in
[actions/download-artifact#325

**Full Changelog**:
actions/download-artifact@v4.1.6...v4.1.7

###
[`v4.1.6`](https://togithub.com/actions/download-artifact/releases/tag/v4.1.6)

[Compare
Source](https://togithub.com/actions/download-artifact/compare/v4.1.5...v4.1.6)

#### What's Changed

- updating `@actions/artifact` dependency to v2.1.6 by
[@&#8203;eggyhead](https://togithub.com/eggyhead) in
[actions/download-artifact#324

**Full Changelog**:
actions/download-artifact@v4.1.5...v4.1.6

###
[`v4.1.5`](https://togithub.com/actions/download-artifact/releases/tag/v4.1.5)

[Compare
Source](https://togithub.com/actions/download-artifact/compare/v4.1.4...v4.1.5)

#### What's Changed

- Update readme with v3/v2/v1 deprecation notice by
[@&#8203;robherley](https://togithub.com/robherley) in
[actions/download-artifact#322
- Update dependencies `@actions/core` to v1.10.1 and `@actions/artifact`
to v2.1.5

**Full Changelog**:
actions/download-artifact@v4.1.4...v4.1.5

</details>

<details>
<summary>actions/setup-go (actions/setup-go)</summary>

###
[`v5.0.1`](https://togithub.com/actions/setup-go/releases/tag/v5.0.1)

[Compare
Source](https://togithub.com/actions/setup-go/compare/v5.0.0...v5.0.1)

#### What's Changed

- Bump undici from 5.28.2 to 5.28.3 and dependencies upgrade by
[@&#8203;dependabot](https://togithub.com/dependabot) ,
[@&#8203;HarithaVattikuti](https://togithub.com/HarithaVattikuti) in
[actions/setup-go#465
- Update documentation with latest V5 release notes by
[@&#8203;ab](https://togithub.com/ab) in
[actions/setup-go#459
- Update version documentation by
[@&#8203;178inaba](https://togithub.com/178inaba) in
[actions/setup-go#458
- Documentation update of `actions/setup-go` to v5 by
[@&#8203;chenrui333](https://togithub.com/chenrui333) in
[actions/setup-go#449

#### New Contributors

- [@&#8203;ab](https://togithub.com/ab) made their first contribution in
[actions/setup-go#459

**Full Changelog**:
actions/setup-go@v5.0.0...v5.0.1

</details>

<details>
<summary>actions/upload-artifact (actions/upload-artifact)</summary>

###
[`v4.3.3`](https://togithub.com/actions/upload-artifact/releases/tag/v4.3.3)

[Compare
Source](https://togithub.com/actions/upload-artifact/compare/v4.3.2...v4.3.3)

##### What's Changed

- updating `@actions/artifact` dependency to v2.1.6 by
[@&#8203;eggyhead](https://togithub.com/eggyhead) in
[actions/upload-artifact#565

**Full Changelog**:
actions/upload-artifact@v4.3.2...v4.3.3

###
[`v4.3.2`](https://togithub.com/actions/upload-artifact/releases/tag/v4.3.2)

[Compare
Source](https://togithub.com/actions/upload-artifact/compare/v4.3.1...v4.3.2)

#### What's Changed

- Update release-new-action-version.yml by
[@&#8203;konradpabjan](https://togithub.com/konradpabjan) in
[actions/upload-artifact#516
- Minor fix to the migration readme by
[@&#8203;andrewakim](https://togithub.com/andrewakim) in
[actions/upload-artifact#523
- Update readme with v3/v2/v1 deprecation notice by
[@&#8203;robherley](https://togithub.com/robherley) in
[actions/upload-artifact#561
- updating `@actions/artifact` dependency to v2.1.5 and `@actions/core`
to v1.0.1 by [@&#8203;eggyhead](https://togithub.com/eggyhead) in
[actions/upload-artifact#562

#### New Contributors

- [@&#8203;andrewakim](https://togithub.com/andrewakim) made their first
contribution in
[actions/upload-artifact#523

**Full Changelog**:
actions/upload-artifact@v4.3.1...v4.3.2

</details>

<details>
<summary>codecov/codecov-action (codecov/codecov-action)</summary>

###
[`v4.3.1`](https://togithub.com/codecov/codecov-action/compare/v4.3.0...v4.3.1)

[Compare
Source](https://togithub.com/codecov/codecov-action/compare/v4.3.0...v4.3.1)

</details>

<details>
<summary>github/codeql-action (github/codeql-action)</summary>

###
[`v3.25.3`](https://togithub.com/github/codeql-action/compare/v3.25.2...v3.25.3)

[Compare
Source](https://togithub.com/github/codeql-action/compare/v3.25.2...v3.25.3)

###
[`v3.25.2`](https://togithub.com/github/codeql-action/compare/v3.25.1...v3.25.2)

[Compare
Source](https://togithub.com/github/codeql-action/compare/v3.25.1...v3.25.2)

###
[`v3.25.1`](https://togithub.com/github/codeql-action/compare/v3.25.0...v3.25.1)

[Compare
Source](https://togithub.com/github/codeql-action/compare/v3.25.0...v3.25.1)

###
[`v3.25.0`](https://togithub.com/github/codeql-action/compare/v3.24.10...v3.25.0)

[Compare
Source](https://togithub.com/github/codeql-action/compare/v3.24.10...v3.25.0)

</details>

<details>
<summary>golangci/golangci-lint-action
(golangci/golangci-lint-action)</summary>

###
[`v4.0.1`](https://togithub.com/golangci/golangci-lint-action/releases/tag/v4.0.1)

[Compare
Source](https://togithub.com/golangci/golangci-lint-action/compare/v4.0.0...v4.0.1)

<!-- Release notes generated using configuration in .github/release.yml
at v4.0.1 -->

#### What's Changed

##### Documentation

- docs: update the version of the action used in the README example by
[@&#8203;178inaba](https://togithub.com/178inaba) in
[golangci/golangci-lint-action#977

##### Dependencies

- build(deps): bump
[@&#8203;types/semver](https://togithub.com/types/semver) from 7.5.6 to
7.5.7 by [@&#8203;dependabot](https://togithub.com/dependabot) in
[golangci/golangci-lint-action#969
- build(deps-dev): bump
[@&#8203;typescript-eslint/parser](https://togithub.com/typescript-eslint/parser)
from 6.20.0 to 6.21.0 by
[@&#8203;dependabot](https://togithub.com/dependabot) in
[golangci/golangci-lint-action#970
- build(deps-dev): bump eslint-plugin-simple-import-sort from 10.0.0 to
12.0.0 by [@&#8203;dependabot](https://togithub.com/dependabot) in
[golangci/golangci-lint-action#971
- build(deps-dev): bump
[@&#8203;typescript-eslint/eslint-plugin](https://togithub.com/typescript-eslint/eslint-plugin)
from 6.20.0 to 6.21.0 by
[@&#8203;dependabot](https://togithub.com/dependabot) in
[golangci/golangci-lint-action#973
- build(deps): bump
[@&#8203;types/node](https://togithub.com/types/node) from 20.11.16 to
20.11.17 by [@&#8203;dependabot](https://togithub.com/dependabot) in
[golangci/golangci-lint-action#972
- build(deps): bump
[@&#8203;types/node](https://togithub.com/types/node) from 20.11.17 to
20.11.19 by [@&#8203;dependabot](https://togithub.com/dependabot) in
[golangci/golangci-lint-action#979
- build(deps-dev): bump
[@&#8203;typescript-eslint/eslint-plugin](https://togithub.com/typescript-eslint/eslint-plugin)
from 6.21.0 to 7.0.0 by
[@&#8203;dependabot](https://togithub.com/dependabot) in
[golangci/golangci-lint-action#980
- build(deps): bump undici from 5.26.3 to 5.28.3 by
[@&#8203;dependabot](https://togithub.com/dependabot) in
[golangci/golangci-lint-action#976
- build(deps): bump
[@&#8203;types/node](https://togithub.com/types/node) from 20.11.19 to
20.11.20 by [@&#8203;dependabot](https://togithub.com/dependabot) in
[golangci/golangci-lint-action#985
- build(deps): bump
[@&#8203;types/semver](https://togithub.com/types/semver) from 7.5.7 to
7.5.8 by [@&#8203;dependabot](https://togithub.com/dependabot) in
[golangci/golangci-lint-action#986
- build(deps-dev): bump eslint from 8.56.0 to 8.57.0 by
[@&#8203;dependabot](https://togithub.com/dependabot) in
[golangci/golangci-lint-action#987
- build(deps): bump tmp from 0.2.1 to 0.2.3 by
[@&#8203;dependabot](https://togithub.com/dependabot) in
[golangci/golangci-lint-action#989
- build(deps-dev): bump
[@&#8203;typescript-eslint/parser](https://togithub.com/typescript-eslint/parser)
from 6.21.0 to 7.1.0 by
[@&#8203;dependabot](https://togithub.com/dependabot) in
[golangci/golangci-lint-action#988
- build(deps): bump
[@&#8203;types/node](https://togithub.com/types/node) from 20.11.20 to
20.11.24 by [@&#8203;dependabot](https://togithub.com/dependabot) in
[golangci/golangci-lint-action#990
- build(deps-dev): bump
[@&#8203;typescript-eslint/parser](https://togithub.com/typescript-eslint/parser)
from 7.1.0 to 7.1.1 by
[@&#8203;dependabot](https://togithub.com/dependabot) in
[golangci/golangci-lint-action#991
- build(deps): bump
[@&#8203;types/node](https://togithub.com/types/node) from 20.11.24 to
20.11.25 by [@&#8203;dependabot](https://togithub.com/dependabot) in
[golangci/golangci-lint-action#992
- build(deps-dev): bump typescript from 5.3.3 to 5.4.2 by
[@&#8203;dependabot](https://togithub.com/dependabot) in
[golangci/golangci-lint-action#993
- build(deps-dev): bump
[@&#8203;typescript-eslint/eslint-plugin](https://togithub.com/typescript-eslint/eslint-plugin)
from 7.1.0 to 7.1.1 by
[@&#8203;dependabot](https://togithub.com/dependabot) in
[golangci/golangci-lint-action#994
- build(deps): bump
[@&#8203;actions/http-client](https://togithub.com/actions/http-client)
from 2.2.0 to 2.2.1 by
[@&#8203;dependabot](https://togithub.com/dependabot) in
[golangci/golangci-lint-action#995
- build(deps): bump google.golang.org/protobuf from 1.28.0 to 1.33.0 in
/sample-go-mod by [@&#8203;dependabot](https://togithub.com/dependabot)
in
[golangci/golangci-lint-action#997
- build(deps-dev): bump
[@&#8203;typescript-eslint/parser](https://togithub.com/typescript-eslint/parser)
from 7.1.1 to 7.2.0 by
[@&#8203;dependabot](https://togithub.com/dependabot) in
[golangci/golangci-lint-action#998
- build(deps): bump
[@&#8203;types/node](https://togithub.com/types/node) from 20.11.25 to
20.11.28 by [@&#8203;dependabot](https://togithub.com/dependabot) in
[golangci/golangci-lint-action#1000
- build(deps-dev): bump
[@&#8203;typescript-eslint/eslint-plugin](https://togithub.com/typescript-eslint/eslint-plugin)
from 7.1.1 to 7.2.0 by
[@&#8203;dependabot](https://togithub.com/dependabot) in
[golangci/golangci-lint-action#999
- build(deps-dev): bump
[@&#8203;typescript-eslint/eslint-plugin](https://togithub.com/typescript-eslint/eslint-plugin)
from 7.2.0 to 7.3.1 by
[@&#8203;dependabot](https://togithub.com/dependabot) in
[golangci/golangci-lint-action#1003
- build(deps): bump
[@&#8203;types/node](https://togithub.com/types/node) from 20.11.28 to
20.11.30 by [@&#8203;dependabot](https://togithub.com/dependabot) in
[golangci/golangci-lint-action#1004
- build(deps-dev): bump typescript from 5.4.2 to 5.4.3 by
[@&#8203;dependabot](https://togithub.com/dependabot) in
[golangci/golangci-lint-action#1005
- build(deps-dev): bump
[@&#8203;typescript-eslint/parser](https://togithub.com/typescript-eslint/parser)
from 7.2.0 to 7.3.1 by
[@&#8203;dependabot](https://togithub.com/dependabot) in
[golangci/golangci-lint-action#1006
- build(deps): bump
[@&#8203;types/node](https://togithub.com/types/node) from 20.11.30 to
20.12.2 by [@&#8203;dependabot](https://togithub.com/dependabot) in
[golangci/golangci-lint-action#1007
- build(deps-dev): bump
[@&#8203;typescript-eslint/eslint-plugin](https://togithub.com/typescript-eslint/eslint-plugin)
from 7.3.1 to 7.4.0 by
[@&#8203;dependabot](https://togithub.com/dependabot) in
[golangci/golangci-lint-action#1008
- build(deps-dev): bump
[@&#8203;typescript-eslint/parser](https://togithub.com/typescript-eslint/parser)
from 7.3.1 to 7.4.0 by
[@&#8203;dependabot](https://togithub.com/dependabot) in
[golangci/golangci-lint-action#1009
- build(deps): bump undici from 5.28.3 to 5.28.4 by
[@&#8203;dependabot](https://togithub.com/dependabot) in
[golangci/golangci-lint-action#1010
- build(deps-dev): bump typescript from 5.4.3 to 5.4.4 by
[@&#8203;dependabot](https://togithub.com/dependabot) in
[golangci/golangci-lint-action#1011
- build(deps): bump
[@&#8203;types/node](https://togithub.com/types/node) from 20.12.2 to
20.12.5 by [@&#8203;dependabot](https://togithub.com/dependabot) in
[golangci/golangci-lint-action#1012
- build(deps-dev): bump
[@&#8203;typescript-eslint/eslint-plugin](https://togithub.com/typescript-eslint/eslint-plugin)
from 7.4.0 to 7.5.0 by
[@&#8203;dependabot](https://togithub.com/dependabot) in
[golangci/golangci-lint-action#1013
- build(deps-dev): bump
[@&#8203;typescript-eslint/parser](https://togithub.com/typescript-eslint/parser)
from 7.4.0 to 7.5.0 by
[@&#8203;dependabot](https://togithub.com/dependabot) in
[golangci/golangci-lint-action#1014
- build(deps): bump
[@&#8203;types/node](https://togithub.com/types/node) from 20.12.5 to
20.12.7 by [@&#8203;dependabot](https://togithub.com/dependabot) in
[golangci/golangci-lint-action#1016
- build(deps-dev): bump typescript from 5.4.4 to 5.4.5 by
[@&#8203;dependabot](https://togithub.com/dependabot) in
[golangci/golangci-lint-action#1017
- build(deps-dev): bump
[@&#8203;typescript-eslint/eslint-plugin](https://togithub.com/typescript-eslint/eslint-plugin)
from 7.5.0 to 7.6.0 by
[@&#8203;dependabot](https://togithub.com/dependabot) in
[golangci/golangci-lint-action#1019
- build(deps-dev): bump eslint-plugin-simple-import-sort from 12.0.0 to
12.1.0 by [@&#8203;dependabot](https://togithub.com/dependabot) in
[golangci/golangci-lint-action#1018
- build(deps-dev): bump
[@&#8203;typescript-eslint/parser](https://togithub.com/typescript-eslint/parser)
from 7.5.0 to 7.7.0 by
[@&#8203;dependabot](https://togithub.com/dependabot) in
[golangci/golangci-lint-action#1022
- build(deps-dev): bump
[@&#8203;typescript-eslint/eslint-plugin](https://togithub.com/typescript-eslint/eslint-plugin)
from 7.6.0 to 7.7.0 by
[@&#8203;dependabot](https://togithub.com/dependabot) in
[golangci/golangci-lint-action#1023

#### New Contributors

- [@&#8203;178inaba](https://togithub.com/178inaba) made their first
contribution in
[golangci/golangci-lint-action#977

**Full Changelog**:
golangci/golangci-lint-action@v4.0.0...v4.0.1

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "before 6am on monday" in timezone
Australia/Sydney, Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config help](https://togithub.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View
repository job log
[here](https://developer.mend.io/github/google/osv-scanner).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4zMTMuMSIsInVwZGF0ZWRJblZlciI6IjM3LjM0MC4xMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19-->

.github/workflows/checks.yml

@@ -39,7 +39,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
         with:
           persist-credentials: false
       - run: scripts/report_uncleaned_snapshots.py
@@ -50,7 +50,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
         with:
           persist-credentials: false
       - name: Run lint action
@@ -62,11 +62,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
         with:
           persist-credentials: false
       - name: Set up Go
-        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
+        uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # v5.0.1
         with:
           go-version-file: .go-version
           check-latest: true
@@ -78,11 +78,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
         with:
           persist-credentials: false
       - run: scripts/build_test_images.sh
-      - uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
+      - uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
         with:
           name: image-fixtures-${{ github.run_number }}-${{ github.run_attempt }}
           path: internal/image/fixtures/*.tar
@@ -100,15 +100,15 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out code
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
         with:
           persist-credentials: false
-      - uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427 # v4.1.4
+      - uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
         with:
           name: image-fixtures-${{ github.run_number }}-${{ github.run_attempt }}
           path: internal/image/fixtures/
       - name: Set up Go
-        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
+        uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # v5.0.1
         with:
           go-version-file: .go-version
           check-latest: true

.github/workflows/codeql-analysis.yml

@@ -42,15 +42,15 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
       # Update go to the latest version to support minor go versions is go.mod file
       - name: Install Go
-        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
+        uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # v5.0.1
         with:
           go-version-file: go.mod
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@4355270be187e1b672a7a1c7c7bae5afdc1ab94a # v3.24.10
+        uses: github/codeql-action/init@d39d31e687223d841ef683f52467bd88e9b21c14 # v3.25.3
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -61,7 +61,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@4355270be187e1b672a7a1c7c7bae5afdc1ab94a # v3.24.10
+        uses: github/codeql-action/autobuild@d39d31e687223d841ef683f52467bd88e9b21c14 # v3.25.3
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 https://git.io/JvXDl
@@ -75,4 +75,4 @@ jobs:
       #   make release
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@4355270be187e1b672a7a1c7c7bae5afdc1ab94a # v3.24.10
+        uses: github/codeql-action/analyze@d39d31e687223d841ef683f52467bd88e9b21c14 # v3.25.3

.github/workflows/goreleaser.yml

@@ -22,12 +22,12 @@ jobs:
       DOCKER_CLI_EXPERIMENTAL: "enabled"
     steps:
       - name: Checkout
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
         with:
           fetch-depth: 0
           ref: ${{ inputs.commit }}
       - name: Set up Go
-        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
+        uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # v5.0.1
         with:
           go-version-file: .go-version
           check-latest: true

.github/workflows/link-check-on-push.yml

@@ -12,7 +12,7 @@ jobs:
       contents: read # to fetch code (actions/checkout)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
       - uses: gaurav-nelson/github-action-markdown-link-check@25b2c436c653f0d4500d3c2df86e5c14e71e44e1
         with:
           use-quiet-mode: "yes"

.github/workflows/link-check.yml

@@ -14,7 +14,7 @@ jobs:
       contents: read # to fetch code (actions/checkout)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
       - uses: gaurav-nelson/github-action-markdown-link-check@25b2c436c653f0d4500d3c2df86e5c14e71e44e1
         with:
           use-quiet-mode: "yes"

.github/workflows/lint-action/action.yml

@@ -19,7 +19,7 @@ runs:
   using: composite
   steps:
     - name: Run golangci-lint
-      uses: golangci/golangci-lint-action@3cfe3a4abbb849e10058ce4af15d205b6da42804 # v4.0.0
+      uses: golangci/golangci-lint-action@d6238b002a20823d52840fda27e2d4891c5952dc # v4.0.1
       with:
         # Optional: version of golangci-lint to use in form of v1.2 or v1.2.3 or `latest` to use the latest version
         version: v1.56.2

.github/workflows/osv-scanner-reusable-pr.yml

@@ -49,7 +49,7 @@ jobs:
       security-events: write # for uploading SARIF files
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
         with:
           fetch-depth: 0
           # Do persist credentials, as we need it for the git checkout later
@@ -86,28 +86,28 @@ jobs:
       # format to the repository Actions tab.
       - name: "Upload artifact"
         if: "!cancelled()"
-        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
+        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
         with:
           name: SARIF file
           path: ${{ inputs.results-file-name }}
           retention-days: 5
       - name: "Upload old scan json results"
         if: "!cancelled()"
-        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
+        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
         with:
           name: old-json-results
           path: old-results.json
           retention-days: 5
       - name: "Upload new scan json results"
         if: "!cancelled()"
-        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
+        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
         with:
           name: new-json-results
           path: new-results.json
           retention-days: 5
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
         if: ${{ !cancelled() && inputs.upload-sarif == true }}
-        uses: github/codeql-action/upload-sarif@4355270be187e1b672a7a1c7c7bae5afdc1ab94a # v3.24.10
+        uses: github/codeql-action/upload-sarif@d39d31e687223d841ef683f52467bd88e9b21c14 # v3.25.3
         with:
           sarif_file: ${{ inputs.results-file-name }}

.github/workflows/osv-scanner-reusable.yml

@@ -54,11 +54,11 @@ jobs:
       security-events: write # for uploading SARIF files
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
         with:
           persist-credentials: false
       - name: "Download custom artifact if specified"
-        uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427 # v4.1.4
+        uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
         if: "${{ inputs.download-artifact != '' }}"
         with:
           name: "${{ inputs.download-artifact }}"
@@ -83,14 +83,14 @@ jobs:
       # format to the repository Actions tab.
       - name: "Upload artifact"
         if: "!cancelled()"
-        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
+        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
         with:
           name: SARIF file
           path: ${{ inputs.results-file-name }}
           retention-days: 5
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
         if: "${{ !cancelled() && inputs.upload-sarif == true }}"
-        uses: github/codeql-action/upload-sarif@4355270be187e1b672a7a1c7c7bae5afdc1ab94a # v3.24.10
+        uses: github/codeql-action/upload-sarif@d39d31e687223d841ef683f52467bd88e9b21c14 # v3.25.3
         with:
           sarif_file: ${{ inputs.results-file-name }}

.github/workflows/prerelease-check.yml

@@ -36,7 +36,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
         with:
           persist-credentials: false
       - name: Run lint action
@@ -48,12 +48,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
         with:
           persist-credentials: false
           ref: ${{ inputs.commit }}
       - name: Set up Go
-        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
+        uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # v5.0.1
         with:
           go-version-file: .go-version
           check-latest: true
@@ -65,11 +65,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
         with:
           persist-credentials: false
       - run: scripts/build_test_images.sh
-      - uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
+      - uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
         with:
           name: image-fixtures-${{ github.run_number }}-${{ github.run_attempt }}
           path: internal/image/fixtures/*.tar
@@ -87,16 +87,16 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out code
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
         with:
           persist-credentials: false
           ref: ${{ inputs.commit }}
-      - uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427 # v4.1.4
+      - uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
         with:
           name: image-fixtures-${{ github.run_number }}-${{ github.run_attempt }}
           path: internal/image/fixtures/
       - name: Set up Go
-        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
+        uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # v5.0.1
         with:
           go-version-file: .go-version
           check-latest: true

.github/workflows/scorecards.yml

@@ -33,7 +33,7 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
         with:
           persist-credentials: false
 
@@ -60,14 +60,14 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
+        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
         with:
           name: SARIF file
           path: results.sarif
           retention-days: 5
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@4355270be187e1b672a7a1c7c7bae5afdc1ab94a # v3.24.10
+        uses: github/codeql-action/upload-sarif@d39d31e687223d841ef683f52467bd88e9b21c14 # v3.25.3
         with:
           sarif_file: results.sarif

.github/workflows/test-action/action.yml

@@ -29,7 +29,7 @@ runs:
         TEST_ACCEPTANCE: true
       run: ./scripts/run_tests.sh
     - name: Upload coverage to Codecov
-      uses: codecov/codecov-action@84508663e988701840491b86de86b666e8a86bed # v4.3.0
+      uses: codecov/codecov-action@5ecb98a3c6b747ed38dc09f787459979aebb39be # v4.3.1
       with:
         token: ${{ inputs.codecov_token }}
         fail_ci_if_error: true