From c28c254c5cf37f53b22bdf704c64307d59fb87b1 Mon Sep 17 00:00:00 2001
From: "home-infrastructure-renovate[bot]"
 <253672885+home-infrastructure-renovate[bot]@users.noreply.github.com>
Date: Sun, 30 Aug 2026 23:00:09 +0000
Subject: [PATCH] chore(github-action): update github-actions

---
 .github/actions/app-tests/action.yaml     | 2 +-
 .github/actions/app-versions/action.yaml  | 2 +-
 .github/workflows/app-builder.yaml        | 6 +++---
 .github/workflows/codeql.yaml             | 4 ++--
 .github/workflows/go-mod-cache.yaml       | 2 +-
 .github/workflows/labeler.yaml            | 2 +-
 .github/workflows/pull-request.yaml       | 4 ++--
 .github/workflows/vulnerability-scan.yaml | 6 +++---
 8 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/.github/actions/app-tests/action.yaml b/.github/actions/app-tests/action.yaml
index 0b9d1841c..dd51fa458 100644
--- a/.github/actions/app-tests/action.yaml
+++ b/.github/actions/app-tests/action.yaml
@@ -15,7 +15,7 @@ runs:
   using: composite
   steps:
     - name: Setup Mise
-      uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4
+      uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
       with:
         experimental: true
         install_args: --locked
diff --git a/.github/actions/app-versions/action.yaml b/.github/actions/app-versions/action.yaml
index d2f52ccda..2d4c4beed 100644
--- a/.github/actions/app-versions/action.yaml
+++ b/.github/actions/app-versions/action.yaml
@@ -37,7 +37,7 @@ runs:
         EOF
 
     - name: Setup Mise
-      uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4
+      uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
       with:
         experimental: true
         install_args: --locked
diff --git a/.github/workflows/app-builder.yaml b/.github/workflows/app-builder.yaml
index d61fa1c37..fa932c5b2 100644
--- a/.github/workflows/app-builder.yaml
+++ b/.github/workflows/app-builder.yaml
@@ -133,7 +133,7 @@ jobs:
           path: ${{ runner.temp }}
 
       - name: Setup Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
       - name: Build App
         uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7.3.0
@@ -266,13 +266,13 @@ jobs:
           password: ${{ github.token }}
 
       - name: Upload Dependency Snapshot
-        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
+        uses: anchore/sbom-action@aa80c8c5bd439a416a62804f2151ab38c671a638 # v0.24.1
         with:
           dependency-snapshot: true
           image: ghcr.io/${{ github.repository_owner }}/${{ inputs.app }}@${{ needs.merge.outputs.digest }}
 
       - name: Attestation
-        uses: actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d # v4.2.1
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
         with:
           push-to-registry: true
           subject-name: ghcr.io/${{ github.repository_owner }}/${{ inputs.app }}
diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yaml
index d42fff07a..b546ba4fd 100644
--- a/.github/workflows/codeql.yaml
+++ b/.github/workflows/codeql.yaml
@@ -33,13 +33,13 @@ jobs:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5
+        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
           source-root: ${{ matrix.source-root }}
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5
+        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           category: language:${{ matrix.language }}
diff --git a/.github/workflows/go-mod-cache.yaml b/.github/workflows/go-mod-cache.yaml
index b0b1d3614..64b12bf30 100644
--- a/.github/workflows/go-mod-cache.yaml
+++ b/.github/workflows/go-mod-cache.yaml
@@ -27,7 +27,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Mise
-        uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
         with:
           experimental: true
           install_args: --locked
diff --git a/.github/workflows/labeler.yaml b/.github/workflows/labeler.yaml
index 6ff1ce437..e7b2cd42e 100644
--- a/.github/workflows/labeler.yaml
+++ b/.github/workflows/labeler.yaml
@@ -40,7 +40,7 @@ jobs:
           permission-pull-requests: write
 
       - name: Setup Mise
-        uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
         with:
           experimental: true
           install_args: --locked
diff --git a/.github/workflows/pull-request.yaml b/.github/workflows/pull-request.yaml
index ff562082a..cf79ce652 100644
--- a/.github/workflows/pull-request.yaml
+++ b/.github/workflows/pull-request.yaml
@@ -42,7 +42,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Mise
-        uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
         with:
           experimental: true
           install_args: --locked
@@ -73,7 +73,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Mise
-        uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
         with:
           experimental: true
           install_args: --locked
diff --git a/.github/workflows/vulnerability-scan.yaml b/.github/workflows/vulnerability-scan.yaml
index 686c5e9f9..15453704e 100644
--- a/.github/workflows/vulnerability-scan.yaml
+++ b/.github/workflows/vulnerability-scan.yaml
@@ -44,7 +44,7 @@ jobs:
 
       - if: ${{ always() && steps.database-restore.outputs.cache-hit != 'true' }}
         name: Install Grype
-        uses: anchore/scan-action/download-grype@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v7.4.0
+        uses: anchore/scan-action/download-grype@8964e60c6fabdb85fdbbbfd9834d8f19c97a3086 # v7.4.1
         id: grype
 
       - if: ${{ always() && steps.database-restore.outputs.cache-hit != 'true' }}
@@ -88,7 +88,7 @@ jobs:
           path: ~/.cache/grype/db
 
       - name: Scan
-        uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v7.4.0
+        uses: anchore/scan-action@8964e60c6fabdb85fdbbbfd9834d8f19c97a3086 # v7.4.1
         id: scan
         with:
           fail-build: false
@@ -96,7 +96,7 @@ jobs:
           severity-cutoff: high
 
       - name: Upload Report
-        uses: github/codeql-action/upload-sarif@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           category: container:${{ matrix.app }}
           sarif_file: ${{ steps.scan.outputs.sarif }}