[18-stable] Update GitHub Actions Dependencies (18-stable) (major)

[ospk8s-renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/setup-go	action	major	v6 → v7
actions/setup-node	action	major	v6 → v7
actions/setup-python	action	major	v6 → v7
redhat-actions/buildah-build	action	major	v2 → v3
redhat-actions/openshift-tools-installer	action	major	v1 → v2
redhat-actions/podman-login	action	major	v1 → v2
redhat-actions/push-to-registry	action	major	v2 → v3

---

Release Notes

actions/setup-go (actions/setup-go)

v7.0.0

Compare Source

What's Changed

• Migrate to ESM and upgrade dependencies by @​priyagupta108 in #​763
• chore(deps): bump @​actions/cache to 6.2.0 by @​philip-gai in #​771

New Contributors

• @​philip-gai made their first contribution in #​771

Full Changelog: actions/setup-go@v6...v7.0.0

v7

Compare Source

actions/setup-node (actions/setup-node)

v7.0.0

Compare Source

What's Changed

Enhancements:

• Add cache-primary-key and cache-matched-key as outputs by @​gowridurgad in #​1577
• Migrate to ESM and upgrade dependencies by @​gowridurgad in #​1574

Bug fixes:

• Remove dummy NODE_AUTH_TOKEN export by @​gowridurgad in #​1558
• Only use mirrorToken in getManifest if it's provided by @​deiga in #​1548

Documentation updates:

• Add documentation for publishing to npm with Trusted Publisher (OIDC) by @​chiranjib-swain in #​1536
• docs: Update restore-only cache documentation by @​priya-kinthali in #​1550
• docs: Update caching recommendations to mitigate cache poisoning risks by @​chiranjib-swain in #​1567

Dependency update:

• Upgrade @​actions/cache to 5.1.0, log cache write denied by @​jasongin in #​1569

New Contributors

• @​chiranjib-swain made their first contribution in #​1536
• @​deiga made their first contribution in #​1548
• @​jasongin made their first contribution in #​1569

Full Changelog: actions/setup-node@v6...v7.0.0

v7

Compare Source

actions/setup-python (actions/setup-python)

v7.0.0

Compare Source

What's Changed

Enhancements

• Migrate to ESM and upgrade dependencies by @​priyagupta108 in #​1330
• Pin SHA commits and update docs with latest versions by @​HarithaVattikuti in #​1338
• Remove the pip-install input by @​gowridurgad in #​1336

Bug Fix

• Fix to Classify stderr warning messages as warnings instead of errors in annotations by @​lmvysakh in #​1335
• Validate and retry manifest fetch to prevent silent failures by @​priyagupta108 in #​1332

Dependency Upgrade

• Bump certifi from 2020.6.20 to 2024.7.4 in /tests/data by @​dependabot in #​1328
• Remove EOL Python versions and Bumps numpy text fixture by @​priya-kinthali in #​1333
• Upgrade @​actions/cache to 6.2.0 by @​philip-gai in #​1337

New Contributors

• @​lmvysakh made their first contribution in #​1335
• @​philip-gai made their first contribution in #​1337

Full Changelog: actions/setup-python@v6...v7.0.0

v7

Compare Source

redhat-actions/buildah-build (redhat-actions/buildah-build)

v3.0.1

Compare Source

Bug Fixes

• Fix container mode storage permission error: The buildah-image feature hardcoded the rootful storage path /var/lib/containers/storage, which fails with permission denied on rootless runners. The action now detects the host's actual storage root via podman info at runtime, with a fallback to the previous path. #​175

CI & Infrastructure

• Add unit test suite using vitest and a test job in CI. #​175

v3.0.0

Compare Source

Breaking Changes

• Node.js 24 runtime: The action now runs on the Node.js 24 runtime (runs.using: node24). GitHub Actions runners must support this runtime. #​154
• Squash defaults to true: The squash input now defaults to true, matching common usage. Set squash: false to preserve intermediate layers. #​161

New Features

• Annotations input: Add OCI annotations to images using the new annotations input. Separate multiple annotations by newline. Only supported by OCI images. #​161
• Container mode (buildah-image input): Run buildah from a container image instead of the host-installed version. Useful for getting a newer buildah than what the runner provides. For example, buildah-image: quay.io/buildah/stable. #​168
• Podman fallback: When buildah is not installed on the runner, the action automatically falls back to using podman build for containerfile builds. Scratch builds still require buildah. #​169
• Multiple ports: The port input now accepts multiple ports separated by newline. #​165
• Parallel multi-arch builds: When building for multiple architectures, each architecture is now built in parallel for significantly faster builds. #​167
• Architecture verification: After each multi-arch build, the action verifies the output image matches the expected architecture, catching misconfigured emulation early. #​166
• Image digest output: The digest output now reliably returns the content digest of the built image. #​153, #​165

Bug Fixes

• Fix empty entrypoint being set when the input is not provided. #​161
• Fix containerfile path resolution to check both workspace and context directory. #​165
• Fix digest retrieval using buildah images --format {{.Digest}} instead of buildah inspect which returned the wrong type. #​165

CI & Infrastructure

• Modernize all CI workflows: upgrade to actions/checkout@v7, actions/setup-node@v7, ubuntu-24.04 runners. #​156
• Add workflow permissions, concurrency groups, and path filters. #​156
• Remove broken install_latest_buildah.sh script and simplify CI matrices. #​164
• Remove defunct CRDA vulnerability scan workflow. #​170
• Enable Dependabot for npm and GitHub Actions dependencies. #​156
• Add CODEOWNERS, SECURITY.md. #​156

Dependency Updates

• Upgrade TypeScript to 6.x. #​163
• Upgrade ESLint to 10 with flat config. #​156
• Upgrade @actions/core, @actions/exec, @actions/io to latest versions. #​150, #​156
• Upgrade @types/node to v26. #​159
• Upgrade redhat-actions/common to v2. #​158

v3

Compare Source

Bug Fixes

• Fix container mode storage permission error: The buildah-image feature hardcoded the rootful storage path /var/lib/containers/storage, which fails with permission denied on rootless runners. The action now detects the host's actual storage root via podman info at runtime, with a fallback to the previous path. #​175

CI & Infrastructure

• Add unit test suite using vitest and a test job in CI. #​175

v2.13

Compare Source

• Update action to run on Node20. https://github.blog/changelog/2023-09-22-github-actions-transitioning-from-node-16-to-node-20/

v2.12

Compare Source

• Forcibly remove existing manifest before creating a new one. #​103

v2.11

Compare Source

• Update action to run on Node16. https://github.blog/changelog/2022-05-20-actions-can-now-run-in-a-node-js-16-runtime/

v2.10

Compare Source

• Make image and tag in lowercase, if found in uppercase. #​89
• Add --tls-verify and extra-args input for buildah from command. #​92
• Remove kubic packages from test workflows. #​93

v2.9

Compare Source

• Add support for multiple archs and platforms.
• Allow building image manifest if multi arch or platform is provided.

v2.8

Compare Source

• Allow fully qualified image names in tags input, for compatibility with docker/metadata-action`. #​74
• Support for --platform argument #​65

v2.7

Compare Source

• Add output image-with-tag which provides image name and its corresponding first tag present.
• Replace input dockerfiles with containerfiles. Input dockerfiles will be present as alias of containerfiles.
• Add matrix to install latest buildah. (Internal)

redhat-actions/openshift-tools-installer (redhat-actions/openshift-tools-installer)

v2.0

Compare Source

Breaking Changes

• Action runtime upgraded from Node.js 16 to Node.js 24 (runs.using: node24). Requires GitHub Actions runner v2.320.0+ or GHES 3.12+.
• Removed odo tool (archived upstream)

Features

• Add butane tool support (OpenShift mirror) (#​100, #​148)
• Add ocm CLI tool support (GitHub) (#​115, #​148)
• Add skip_cache_for input for per-client cache skipping (#​2, #​150)
• Enable caching on GHES 3.5+ — removed the hardcoded GHES cache skip (#​111, #​148)
• Add arm64 Linux support for OCP tools (#​139)

Bug Fixes

• Fix arm64 OCP installs and mirror URL resolution (#​139)
• Fix macOS arm64 CI failures for tools lacking arm64 builds (#​139)
• Change warning to info for multiple file notice (#​121)

Dependencies & Infrastructure

• Upgrade to TypeScript 6, ESLint 10 with flat config (#​134)
• Upgrade @octokit/core 5→7, @octokit/plugin-paginate-rest 9→14, @octokit/openapi-types 22→27 (#​149)
• Upgrade webpack-cli 6→7 (#​149)
• Upgrade redhat-actions/common 1→2 (#​141)
• Upgrade @types/node to 26.x (#​144)
• Replace dead CRDA vulnerability scan with npm audit (#​140)
• Reduce CI matrix from ~53 to ~28 jobs

v2

Compare Source

redhat-actions/podman-login (redhat-actions/podman-login)

v2.0

Compare Source

Breaking Changes

• Upgrade @actions/core 1.x to 3.x, @actions/exec 1.x to 3.x, @actions/io 1.x to 3.x
• Auth file path is now detected from podman's --verbose output instead of being hardcoded. The fallback path is used only if detection fails.
• Registry input is now automatically lowercased to comply with OCI spec

Bug Fixes

• Fix registryLogout() not cleaning up Docker config credentials in the post step (#​36)
• Fix auth file path mismatch with podman 5.x which changed from /tmp/podman-run-<uid> to /tmp/storage-run-<uid> (#​47)
• Fix ENOENT error when ~/.docker directory does not exist (#​42)

Features

• Add tls_verify input to skip TLS certificate verification for self-signed registries
• Support AWS OIDC temporary credentials for ECR login via AWS_SESSION_TOKEN (#​37)
• Automatically lowercase registry input to prevent OCI naming errors (#​44)

Dependency Upgrades

• TypeScript 5.x to 6.0.3
• ESLint 8 (EOL) to 10 with flat config
• @aws-sdk/client-ecr 3.535 to 3.1094
• @vercel/ncc 0.38 to 0.44
• Remove unused @aws-sdk/util-base64
• Resolve all npm audit vulnerabilities

CI & Infrastructure

• Upgrade actions/checkout v6 to v7, actions/setup-node v6 to v7
• Add workflow-level permissions: contents: read
• Add concurrency groups to cancel redundant CI runs
• Pin runs-on to ubuntu-24.04
• Add Dependabot for npm and GitHub Actions updates
• Add SECURITY.md
• Enable secret scanning and push protection
• Remove deprecated CRDA vulnerability scan workflow

v2

Compare Source

Breaking Changes

• Upgrade @actions/core 1.x to 3.x, @actions/exec 1.x to 3.x, @actions/io 1.x to 3.x
• Auth file path is now detected from podman's --verbose output instead of being hardcoded. The fallback path is used only if detection fails.
• Registry input is now automatically lowercased to comply with OCI spec

Bug Fixes

• Fix registryLogout() not cleaning up Docker config credentials in the post step (#​36)
• Fix auth file path mismatch with podman 5.x which changed from /tmp/podman-run-<uid> to /tmp/storage-run-<uid> (#​47)
• Fix ENOENT error when ~/.docker directory does not exist (#​42)

Features

• Add tls_verify input to skip TLS certificate verification for self-signed registries
• Support AWS OIDC temporary credentials for ECR login via AWS_SESSION_TOKEN (#​37)
• Automatically lowercase registry input to prevent OCI naming errors (#​44)

Dependency Upgrades

• TypeScript 5.x to 6.0.3
• ESLint 8 (EOL) to 10 with flat config
• @aws-sdk/client-ecr 3.535 to 3.1094
• @vercel/ncc 0.38 to 0.44
• Remove unused @aws-sdk/util-base64
• Resolve all npm audit vulnerabilities

CI & Infrastructure

• Upgrade actions/checkout v6 to v7, actions/setup-node v6 to v7
• Add workflow-level permissions: contents: read
• Add concurrency groups to cancel redundant CI runs
• Pin runs-on to ubuntu-24.04
• Add Dependabot for npm and GitHub Actions updates
• Add SECURITY.md
• Enable secret scanning and push protection
• Remove deprecated CRDA vulnerability scan workflow

v1.7

Compare Source

• Update action to run on Node20.https://github.blog/changelog/2023-09-22-github-actions-transitioning-from-node-16-to-node-20/

v1.6

Compare Source

• Update action/core dependency to 1.10.0

v1.5

Compare Source

• Update action to run on Node16. https://github.blog/changelog/2022-05-20-actions-can-now-run-in-a-node-js-16-runtime/

v1.4

Compare Source

• Add ability to login to AWS ECR repositories. More details at #​23

v1.3

Compare Source

• Add support to provide custom auth file path instead of using default ones set by podman. More details here.
• Add --verbose flag in the login command that will give more detailed output.

v1.2

Compare Source

• Add ability to pull image from docker after login. #​15

redhat-actions/push-to-registry (redhat-actions/push-to-registry)

v3.0.0

Compare Source

Breaking Changes

• Upgrade action runtime from Node 20 to Node 24. #​113
• Tags are no longer lowercased. Per the OCI distribution spec, only image names and registries are normalized to lowercase; tag case is now preserved. #​112, #​121

Features

• Add Sigstore signing support via sigstore-private-key and sign-passphrase inputs. #​120
• Add podman-args input for global podman flags (e.g. --storage-driver=vfs) that apply to all podman invocations, not just push. #​102, #​121
• Add remote input for podman remote mode (--remote). When enabled, Docker image storage checks are skipped. #​95, #​122

Bug Fixes

• Prefix unqualified source images with localhost/ when pushing to prevent podman from resolving to remote registries. #​66, #​121
• Fix default tag fallback when tags input is empty. #​109
• Fix registry input not being lowercased for OCI compliance. #​110
• Fix deprecated fs.rmdir usage, replace with fs.rm. #​113
• Fix typo in createDockerPodmanImageStorage function name. #​113

Dependency Updates

• Upgrade @actions/core from 1.x to 3.x. #​113
• Upgrade @actions/exec from 1.x to 3.x. #​113
• Upgrade @actions/io from 1.x to 3.x. #​113
• Upgrade TypeScript from 5.3 to 6.0. #​113
• Migrate ESLint from v8 to v10 with flat config. #​113
• Bump ini from 5.0.0 to 7.0.0. #​118

CI & Infrastructure

• Modernize all CI workflows: update to ubuntu-24.04, latest action versions, add permissions and concurrency groups. #​114
• Enable secret scanning and push protection. #​114
• Add Dependabot configuration for npm and GitHub Actions. #​114
• Add CODEOWNERS and SECURITY.md. #​114

Documentation

• Add Required Permissions section to README. #​107, #​121
• Document multi-line tag support using YAML pipe syntax. #​101, #​121
• Add qemu version guidance for multi-arch manifest builds. #​85, #​121
• Document podman remote mode usage. #​122

v3

Compare Source

Breaking Changes

• Upgrade action runtime from Node 20 to Node 24. #​113
• Tags are no longer lowercased. Per the OCI distribution spec, only image names and registries are normalized to lowercase; tag case is now preserved. #​112, #​121

Features

• Add Sigstore signing support via sigstore-private-key and sign-passphrase inputs. #​120
• Add podman-args input for global podman flags (e.g. --storage-driver=vfs) that apply to all podman invocations, not just push. #​102, #​121
• Add remote input for podman remote mode (--remote). When enabled, Docker image storage checks are skipped. #​95, #​122

Bug Fixes

• Prefix unqualified source images with localhost/ when pushing to prevent podman from resolving to remote registries. #​66, #​121
• Fix default tag fallback when tags input is empty. #​109
• Fix registry input not being lowercased for OCI compliance. #​110
• Fix deprecated fs.rmdir usage, replace with fs.rm. #​113
• Fix typo in createDockerPodmanImageStorage function name. #​113

Dependency Updates

• Upgrade @actions/core from 1.x to 3.x. #​113
• Upgrade @actions/exec from 1.x to 3.x. #​113
• Upgrade @actions/io from 1.x to 3.x. #​113
• Upgrade TypeScript from 5.3 to 6.0. #​113
• Migrate ESLint from v8 to v10 with flat config. #​113
• Bump ini from 5.0.0 to 7.0.0. #​118

CI & Infrastructure

• Modernize all CI workflows: update to ubuntu-24.04, latest action versions, add permissions and concurrency groups. #​114
• Enable secret scanning and push protection. #​114
• Add Dependabot configuration for npm and GitHub Actions. #​114
• Add CODEOWNERS and SECURITY.md. #​114

Documentation

• Add Required Permissions section to README. #​107, #​121
• Document multi-line tag support using YAML pipe syntax. #​101, #​121
• Add qemu version guidance for multi-arch manifest builds. #​85, #​121
• Document podman remote mode usage. #​122

v2.8

Compare Source

• Update action to run on Node20. https://github.blog/changelog/2023-09-22-github-actions-transitioning-from-node-16-to-node-20/

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • "every weekend"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: ospk8s-renovate[bot]
Once this PR has been reviewed and has the lgtm label, please assign adrianfusco for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

Hi @ospk8s-renovate[bot]. Thanks for your PR.

I'm waiting for a openstack-k8s-operators member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.