chore(deps): update github actions

[renovate-sh-app]

This PR contains the following updates:

Package	Type	Update	Change
actions/attest-build-provenance	action	patch	v4.1.0 → v4.1.1
actions/cache	action	minor	v5.0.5 → v5.1.0
actions/checkout	action	patch	v6.0.2 → v6.0.3
actions/setup-go	action	minor	v6.4.0 → v6.5.0
actions/setup-node	action	minor	v6.4.0 → v6.5.0
golangci/golangci-lint-action	action	minor	v9.2.1 → v9.3.0
pnpm/action-setup	action	patch	v6.0.8 → v6.0.9
softprops/action-gh-release	action	patch	v3.0.0 → v3.0.2
step-security/harden-runner	action	minor	v2.19.4 → v2.20.0

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Release Notes

actions/attest-build-provenance (actions/attest-build-provenance)

v4.1.1

Compare Source

[!NOTE]
As of version 4, actions/attest-build-provenance is simply a wrapper on top of actions/attest.

Existing applications may continue to use the attest-build-provenance action, but new implementations should use actions/attest instead.

What's Changed

• Update actions/attest to v4.1.1 by @​bdehamer in #​858

Full Changelog: actions/attest-build-provenance@v4.1.0...v4.1.1

actions/cache (actions/cache)

v5.1.0

Compare Source

What's Changed

• Bump @​actions/cache to v5.1.0 - handle read-only cache access by @​jasongin in #​1775

Full Changelog: actions/cache@v5...v5.1.0

actions/checkout (actions/checkout)

v6.0.3

Compare Source

• Fix checkout init for SHA-256 repositories by @​yaananth in #​2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in #​2414

actions/setup-go (actions/setup-go)

v6.5.0

Compare Source

What's Changed

Dependency update

• Upgrade actions dependencies by @​priyagupta108 with @​Copilot in #​744
• Upgrade @​types/node and typescript-eslint dependencies to resolve npm audit findings by @​HarithaVattikuti in #​755
• Upgrade @​actions/cache to 5.1.0, log cache write denied by @​jasongin in #​758
• Upgrade version to 6.5.0 in package.json and package-lock.json by @​HarithaVattikuti in #​762

New Contributors

• @​priyagupta108 with @​Copilot made their first contribution in #​744
• @​jasongin made their first contribution in #​758

Full Changelog: actions/setup-go@v6...v6.5.0

actions/setup-node (actions/setup-node)

v6.5.0

Compare Source

What's Changed

• Update @​actions/cache to 5.1.0 and add security overrides for undici and fast-xml-parser by @​HarithaVattikuti in #​1579

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

golangci/golangci-lint-action (golangci/golangci-lint-action)

v9.3.0

Compare Source

What's Changed

Changes

• feat: add no-run-logs-group as experimental option by @​ldez in #​1403

Dependencies

• build(deps): bump github/codeql-action from 4.35.4 to 4.35.5 in the github-actions group by @​dependabot[bot] in #​1395
• build(deps): bump tmp from 0.2.5 to 0.2.6 by @​dependabot[bot] in #​1397
• build(deps): bump github/codeql-action from 4.35.5 to 4.36.0 in the github-actions group by @​dependabot[bot] in #​1398
• build(deps): bump tmp from 0.2.6 to 0.2.7 by @​dependabot[bot] in #​1399
• build(deps-dev): bump js-yaml from 4.1.1 to 4.2.0 by @​dependabot[bot] in #​1400

Full Changelog: golangci/golangci-lint-action@v9.2.1...v9.3.0

pnpm/action-setup (pnpm/action-setup)

v6.0.9

Compare Source

What's Changed

• fix: update pnpm to v11.7.0 by @​zkochan in #​267

Full Changelog: pnpm/action-setup@v6...v6.0.9

softprops/action-gh-release (softprops/action-gh-release)

v3.0.2

Compare Source

3.0.2 is a patch release focused on release reliability and compatibility. It
reuses existing draft releases when publishing prereleases, supports replacing
release assets on Gitea, hardens streamed asset uploads, and provides clearer
release-creation diagnostics. It also includes TypeScript, coverage, and tooling
maintenance merged since 3.0.1.

This release fixes #​795, #​438, and #​803. The upload transport hardening covers the
historical failure reported in #​790, although current hosted Node 24 runners did
not reproduce it naturally. The diagnostics work is related to #​786 and does not
claim a reproducible release-creation fix.

What's Changed

Exciting New Features 🎉

• feat: improve release error reporting and test coverage by @​chenrui333 in #​813

Bug fixes 🐛

• fix: publish existing draft releases as prereleases by @​godfengliang in #​801
• fix: upload small checksum assets reliably by @​chenrui333 in #​815
• fix: replace existing release assets on Gitea by @​chenrui333 in #​816
• fix: clarify release creation 404 errors by @​chenrui333 in #​817

Other Changes 🔄

• chore(deps): upgrade TypeScript to 7 by @​chenrui333 in #​812
• chore(deps): remove unused TypeScript tooling by @​chenrui333 in #​814
• dependency, Node 24 pin, and CI maintenance merged since 3.0.1

v3.0.1

Compare Source

3.0.1

• maintenance release with updated dependencies

step-security/harden-runner (step-security/harden-runner)

v2.20.0

Compare Source

What's Changed

• Support for block policy for MacOS and Windows GitHub-hosted runners
• Support for Bitrise MacOS GitHub Actions runners
• HTTPS monitoring support for Bun for Linux runners (enterprise tier)

Full Changelog: step-security/harden-runner@v2.19.4...v2.20.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

Need help?

You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section.