chore(deps): update github actions (minor)

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
aquasecurity/trivy-action	action	minor	0.32.0 → v0.36.0
sigstore/cosign-installer	action	minor	v3.9.1 → v3.10.1

Warnings (1)

Please correct - or verify that you can safely ignore - these warnings before you merge this PR.

• aquasecurity/trivy-action: Could not determine new digest for update (github-tags package aquasecurity/trivy-action)

---

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

aquasecurity/trivy-action (aquasecurity/trivy-action)

v0.36.0

Compare Source

What's Changed

• chore(ci): update bump-trivy workflow by @​DmitriyLewen in #​546
• ci: use action.yaml as single source of truth for Trivy version by @​nikpivkin in #​552
• ci: replace peter-evans/create-pull-request with gh CLI by @​nikpivkin in #​550
• test: use pinned digests for trivy-db, trivy-java-db and trivy-checks by @​nikpivkin in #​555
• ci: add dependabot config by @​nikpivkin in #​556
• chore: add zizmor config by @​nikpivkin in #​557
• chore(deps): bump the actions group with 5 updates by @​dependabot[bot] in #​558
• fix: use portable shebang in entrypoint.sh by @​Hayao0819 in #​545
• Fix typo in GOOGLE_APPLICATION_CREDENTIALS env var name by @​patrik-csak in #​547
• Upgrade Trivy action version from 0.33.1 to 0.35.0 fixes #​549 by @​Aditya09-cse in #​548
• chore: use GitHub Actions as git commit author in bump-trivy workflow by @​nikpivkin in #​561
• chore(deps): Update trivy to v0.70.0 by @​Argon-DevOps-Mgt in #​559
• chore: update action version to v0.36.0 in examples by @​nikpivkin in #​563

New Contributors

• @​dependabot[bot] made their first contribution in #​558
• @​Hayao0819 made their first contribution in #​545
• @​patrik-csak made their first contribution in #​547
• @​Aditya09-cse made their first contribution in #​548
• @​Argon-DevOps-Mgt made their first contribution in #​559

Full Changelog: aquasecurity/trivy-action@v0.35.0...v0.36.0

v0.35.0: Release: v0.35.0

Compare Source

This release is a duplicate of 0.35.0 which was not compromised.

As part of our response to the recent supply chain attack, we have migrated all tags to use the v prefix (e.g., v0.35.0 instead of 0.35.0). Going forward, all new releases will use the v prefix convention.

We have intentionally kept the 0.35.0 tag intact to avoid breaking existing workflows that depend on it.

If you are currently using 0.35.0, your workflows are safe — no action is required.

v0.35.0

Compare Source

What's Changed

• chore(deps): Update trivy to v0.69.3 by @​aqua-bot in #​519

Full Changelog: aquasecurity/trivy-action@0.34.2...0.35.0

v0.34.0

Compare Source

v0.33.1: Release: v0.33.1

Compare Source

What's Changed

• Update setup-trivy action to version v0.2.4 by @​martincostello in #​486

Full Changelog: aquasecurity/trivy-action@v0.33.0...v0.33.1

v0.33.0: Release: v0.33.0

Compare Source

What's Changed

• Update dependencies in README by @​ibakshay in #​378
• doc: correct sbom fs scan by @​yxtay in #​458
• Pin actions/cache by SHA by @​martincostello in #​480
• chore(ci): Add oras to correctly setup sync jobs by @​simar7 in #​482
• chore(deps): Update trivy to v0.65.0 by @​aqua-bot in #​481

New Contributors

• @​ibakshay made their first contribution in #​378
• @​yxtay made their first contribution in #​458

Full Changelog: aquasecurity/trivy-action@v0.32.0...v0.33.0

sigstore/cosign-installer (sigstore/cosign-installer)

v3.10.1

Compare Source

What's Changed?

Note: cosign-installer v3.x cannot be used to install Cosign v3.x. You must upgrade to cosign-installer v4 in order to use Cosign v3.

Note: This is planned to be the final release of Cosign v2, though we will cut new releases for any critical security or bug fixes. We recommend transitioning to Cosign v3.

• Bump default Cosign to v2.6.1 (#​203)

v3.10.0

Compare Source

What's Changed

• Bump default Cosign to v2.6.0 in #​200

Full Changelog: sigstore/cosign-installer@v3.9.2...v3.10.0

v3.9.2

Compare Source

What's Changed

• not fail fast and setup permissions in #​195
• drop old unsupported versions <v2.0.0 in #​192
• Update default to v2.5.3 in #​196

Full Changelog: sigstore/cosign-installer@v3.9.1...v3.9.2

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.