chore(deps): update dependency workflow-notification to v4

[renovate]

This PR contains the following updates:

Package	Update	Change
Kong/public-shared-actions/slack-actions/workflow-notification (source)	major	2 -> 4.0.1

---

Caution

This PR upgrades Kong/public-shared-actions sub-action to v4+ and pins it to the commit digest. It is prioritized (bypasses schedules/rate limits).

Closing this PR will not stop it; Renovate will automatically reopen or recreate it until it is merged.

---

Mandatory upgrade to v4+ with automatic digest pinning for Kong/public-shared-actions

Renovate is configured to upgrade any Kong/public-shared-actions sub-action still on versions below 4 to the latest v4+ version. As part of this upgrade, it will automatically pin each reference to the exact commit digest (and keep that digest refreshed over time).

Background

The Kong/public-shared-actions monorepo now publishes per-sub-action tags in the form <sub-action>@<version> (for example, [email protected]) instead of plain vX.Y.Z tags. Older references like ...@v2 cannot be auto-migrated by tag alone.

Why tag-only migration is not supported

Important: Renovate will not change the tag format for you. Migrating from the older plain vX.Y.Z tags to the new per-sub-action tags while keeping tag-only references would require rewriting refs such as ...@v2 to a different tag name like ...@[email protected]. This contradicts the goal of dependency update automation because it relies on humans to manage tag-name changes and ongoing updates, which our automation is not designed to perform. For this reason, tag-only migration is not supported.

Instead, this preset enforces digest pinning. Renovate resolves releases by tag, then writes the reference as the commit SHA for that release with a trailing human-friendly comment (e.g., ...@<sha> # v5.1.1). Tracking commits rather than tag names keeps updates automated and robust even if tag naming conventions change.

Security

GitHub Actions security guidance recommends pinning third-party actions to a full commit SHA to protect against tag moving and supply-chain attacks.

References

• https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions

---

Release Notes

Kong/public-shared-actions (workflow-notification)

v4.0.1

Compare Source

♻️ Chores

• ci: pin actions (#​231) (b20e862)

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - Monday through Friday ( * * * * 1-5 ) in timezone America/New_York.

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.