From f1db943d81ca29160f4f1f4e64b65fcf183f95fb Mon Sep 17 00:00:00 2001
From: Thomas Niepraschk <niepi@niepi.org>
Date: Fri, 4 Sep 2026 19:06:15 +0200
Subject: [PATCH] Update legacy release GitHub Actions

---
 .github/workflows/ci.yml            | 18 +++++++++---------
 .github/workflows/release-notes.yml |  4 ++--
 2 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8ca8bb2..7f39136 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -16,10 +16,10 @@ jobs:
 
     steps:
       -   name: "Checkout code"
-          uses: actions/checkout@v3
+          uses: actions/checkout@v6
 
       -   name: Lint Dockerfile
-          uses: hadolint/hadolint-action@v3.0.0
+          uses: hadolint/hadolint-action@v3.1.0
           with:
             dockerfile: "Dockerfile"
             format: "tty"
@@ -48,7 +48,7 @@ jobs:
             DOCKER_REGISTRY_IMAGE: "temporary-build-image-linux-amd64"
 
       -   name: Run Alpine Trivy vulnerability scanner
-          uses: aquasecurity/trivy-action@master
+          uses: aquasecurity/trivy-action@v0.36.0
           with:
             image-ref: php-${{ env.PHP_VERSION }}
             format: 'table'
@@ -59,7 +59,7 @@ jobs:
 
       -   if: contains(github.ref, 'refs/heads/release/')
           name: Run Alpine Trivy vulnerability scanner and upload to github security tab
-          uses: aquasecurity/trivy-action@master
+          uses: aquasecurity/trivy-action@v0.36.0
           with:
             image-ref: php-${{ env.PHP_VERSION }}
             format: 'sarif'
@@ -67,13 +67,13 @@ jobs:
 
       -   if: contains(github.ref, 'refs/heads/release/')
           name: Upload Alpine Trivy scan results to GitHub Security tab
-          uses: github/codeql-action/upload-sarif@v2
+          uses: github/codeql-action/upload-sarif@v4
           with:
             sarif_file: 'trivy-results.sarif'
 #
       -   if: contains(github.ref, 'refs/heads/release/')
           name: Run Trivy in GitHub SBOM mode and submit results to Dependency Snapshots
-          uses: aquasecurity/trivy-action@master
+          uses: aquasecurity/trivy-action@v0.36.0
           with:
             format: 'github'
             output: 'dependency-results.sbom.json'
@@ -81,14 +81,14 @@ jobs:
             github-pat: ${{ secrets.PAT }}
       -   if: contains(github.ref, 'refs/heads/release/')
           name: Login to DockerHub
-          uses: docker/login-action@v2
+          uses: docker/login-action@v4
           with:
             username: ${{ secrets.DOCKER_USERNAME }}
             password: ${{ secrets.DOCKER_PASSWORD }}
 
       -   if: contains(github.ref, 'refs/heads/release/')
           name: Login to Quay.io
-          uses: docker/login-action@v2
+          uses: docker/login-action@v4
           with:
             registry: quay.io
             username: ${{ secrets.QUAY_USERNAME }}
@@ -96,7 +96,7 @@ jobs:
 
       -   if: contains(github.ref, 'refs/heads/release/')
           name: Login to ghcr.io
-          uses: docker/login-action@v2
+          uses: docker/login-action@v4
           with:
             registry: ghcr.io
             username: ${{ github.actor }}
diff --git a/.github/workflows/release-notes.yml b/.github/workflows/release-notes.yml
index c9c2901..f80ae38 100644
--- a/.github/workflows/release-notes.yml
+++ b/.github/workflows/release-notes.yml
@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v6
       - name: "Fetch all existing tags"
         run: curl -L -s 'https://registry.hub.docker.com/v2/repositories/endava/php/tags?page_size=9999'|jq -r '."results"[]["name"] | select(test( "^[0-9]+.[0-9]+.[0-9]+$"))' > existing_docker_tags.txt
       - name: "Store the current tag"
@@ -22,7 +22,7 @@ jobs:
       - name: Generate Changelog
         run: docker run --rm -v `pwd`/previous-php-i.txt:/usr/src/app/previous-php-i.txt -v `pwd`/generate-changelog.php:/usr/src/app/generate-changelog.php ghcr.io/endava/docker-php:${{ github.ref_name }} php /usr/src/app/generate-changelog.php ghcr.io/endava/docker-php:${{ github.ref_name }} > RELEASE_NOTES.txt
       - name: Release
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@v3
         if: startsWith(github.ref, 'refs/tags/')
         with:
           body_path: RELEASE_NOTES.txt