chore: upgrade actions to Node 24 runtime (SHA-pinned)

.github/workflows/feature-branch.yml

@@ -32,24 +32,24 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
 
       - name: Test Snapshot Release
-        uses: goreleaser/goreleaser-action@v5
+        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
         with:
           distribution: goreleaser
           version: latest
           args: release --config ./dev.goreleaser.yaml --clean --snapshot
 
       - name: Upload Test Release Assets
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: github-status-updater
           path: dist/*
@@ -59,12 +59,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: "Checkout source code at current commit"
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Build
         id: build
-        uses: cloudposse/github-action-docker-build-push@1.15.1
+        uses: cloudposse/github-action-docker-build-push@02993d675b44dcc7082e6de7485c1ff8740bce9d # v3.1.0
         with:
+          # v3's step-summary generation fails on images without a CMD (jq join on null); disable until fixed upstream
+          summary: "false"
           registry: ghcr.io
           organization: "${{ github.event.repository.owner.login }}"
           repository: "${{ github.event.repository.name }}"

.github/workflows/validate-codeowners.yml

@@ -4,26 +4,12 @@ on:
 
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
-  validate-codeowners:
-    runs-on: ubuntu-latest
-    steps:
-    - name: "Checkout source code at current commit"
-      uses: actions/checkout@v4
-    - uses: mszostok/codeowners-validator@v0.7.1
-      if: github.event.pull_request.head.repo.full_name == github.repository
-      name: "Full check of CODEOWNERS"
-      with:
-        # For now, remove "files" check to allow CODEOWNERS to specify non-existent
-        # files so we can use the same CODEOWNERS file for Terraform and non-Terraform repos
-        #   checks: "files,syntax,owners,duppatterns"
-        checks: "syntax,owners,duppatterns"
-        owner_checker_allow_unowned_patterns: "false"
-        # GitHub access token is required only if the `owners` check is enabled
-        github_access_token: "${{ secrets.PUBLIC_REPO_ACCESS_TOKEN }}"
-    - uses: mszostok/codeowners-validator@v0.7.1
-      if: github.event.pull_request.head.repo.full_name != github.repository
-      name: "Syntax check of CODEOWNERS"
-      with:
-        checks: "syntax,duppatterns"
-        owner_checker_allow_unowned_patterns: "false"
+  ci-codeowners:
+    uses: cloudposse/.github/.github/workflows/shared-codeowners.yml@main
+    with:
+      is_fork: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository }}
+    secrets: inherit

dev.goreleaser.yaml

@@ -1,3 +1,5 @@
+version: 2
+
 builds:
   - env:
       # goreleaser does not work with CGO, it could also complicate
@@ -24,7 +26,7 @@ builds:
       - '-s -w'
 
 archives:
-  - format: binary
+  - formats: [binary]
     name_template: '{{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}'
 
 checksum:
@@ -36,4 +38,4 @@ release:
 # draft: true
 
 changelog:
-  skip: true
+  disable: true