chore(github-action): update github-actions

[home-infrastructure-renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
actions/attest	action	patch	v4.2.1 → v4.2.2
anchore/sbom-action	action	patch	v0.24.0 → v0.24.1	v0.24.2
anchore/scan-action	action	patch	v7.4.0 → v7.4.1	v7.4.2
docker/setup-buildx-action	action	minor	v4.2.0 → v4.3.0
github/codeql-action	action	patch	v4.37.5 → v4.37.9
jdx/mise-action	action	minor	v4.2.4 → v4.3.0

---

Release Notes

actions/attest (actions/attest)

v4.2.2

Compare Source

What's Changed

• Bump @​sigstore/oci from 0.7.1 to 0.7.2 by @​bdehamer in #​469
• Bump brace-expansion by @​dependabot[bot] in #​468
• Bump ip-address from 10.2.0 to 10.4.0 by @​dependabot[bot] in #​467

Full Changelog: actions/attest@v4.2.1...v4.2.2

anchore/sbom-action (anchore/sbom-action)

v0.24.1

Compare Source

anchore/scan-action (anchore/scan-action)

v7.4.1

Compare Source

docker/setup-buildx-action (docker/setup-buildx-action)

v4.3.0

Compare Source

• Bump @​docker/actions-toolkit from 0.92.0 to 0.95.0 in #​595
• Bump brace-expansion from 1.1.13 to 1.1.18 in #​600
• Bump js-yaml from 5.2.0 to 5.3.0 in #​585
• Bump postcss from 8.5.10 to 8.5.25 in #​598
• Bump undici from 6.27.0 to 6.28.0 in #​601

Full Changelog: docker/setup-buildx-action@v4.2.0...v4.3.0

github/codeql-action (github/codeql-action)

v4.37.9

Compare Source

• Update default CodeQL bundle version to 2.26.4. #​4106

v4.37.8

Compare Source

No user facing changes.

v4.37.7

Compare Source

• Update default CodeQL bundle version to 2.26.3. #​4085

v4.37.6

Compare Source

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #​4070

jdx/mise-action (jdx/mise-action)

v4.3.0: : Install age-filtered mise releases

Compare Source

A small release that adds an opt-in way to hold back from installing brand-new mise releases.

Added

minimum_release_age input (#​604 by @​jdx)

When version is omitted, you can now set minimum_release_age to install the newest stable, non-draft mise release that is older than a given cutoff — a simple way to avoid picking up a mise release the moment it ships (closes #​603).

- uses: jdx/mise-action@v4
  with:
    minimum_release_age: 7d

It accepts relative durations (24h, 7d, 6mo, 1y) as well as absolute ISO dates and timestamps. Age-filtered versions are resolved from the GitHub Releases API (the CDN only serves the latest binary) and downloaded by their exact version. If mise is already present on disk, an age-filtered run updates it to the resolved version rather than keeping the existing binary. An explicit version always takes precedence over minimum_release_age, and invalid dates fail fast.

Full Changelog: jdx/mise-action@v4.2.5...v4.3.0

v4.2.5: : Resilient mise downloads with automatic retries

Compare Source

A small patch release that makes setup more resilient to transient network failures when downloading mise.

Fixed

Retry mise downloads after transient failures (#​597 by @​jdx)

The download helpers previously made a single curl or wget attempt, so a transient GitHub release-asset HTTP or TLS failure would abort setup before mise or any user command could run (see #​596).

Downloads now run through a retry wrapper that makes up to five attempts with a 2s pause between failures, logging a warning on each retry. This applies consistently to binary, checksum, signature, and version fetches. Checksum and minisign verification still run only after a successful download — never inside the retry loop — so integrity guarantees are unchanged.

Full Changelog: jdx/mise-action@v4.2.4...v4.2.5

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.