chore(deps): update github actions updates (minor)

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
aquasecurity/trivy-action	action	minor	v0.35.0 → v0.36.0
cloudoperators/common (changelog)	action	digest	17d3d6b → d138f99
goreleaser/goreleaser-action	action	minor	v7.1.0 → v7.2.1
korthout/backport-action	action	minor	v4.4.0 → v4.5.0	v4.5.2 (+1)

---

Release Notes

aquasecurity/trivy-action (aquasecurity/trivy-action)

v0.36.0

Compare Source

What's Changed

• chore(ci): update bump-trivy workflow by @​DmitriyLewen in #​546
• ci: use action.yaml as single source of truth for Trivy version by @​nikpivkin in #​552
• ci: replace peter-evans/create-pull-request with gh CLI by @​nikpivkin in #​550
• test: use pinned digests for trivy-db, trivy-java-db and trivy-checks by @​nikpivkin in #​555
• ci: add dependabot config by @​nikpivkin in #​556
• chore: add zizmor config by @​nikpivkin in #​557
• chore(deps): bump the actions group with 5 updates by @​dependabot[bot] in #​558
• fix: use portable shebang in entrypoint.sh by @​Hayao0819 in #​545
• Fix typo in GOOGLE_APPLICATION_CREDENTIALS env var name by @​patrik-csak in #​547
• Upgrade Trivy action version from 0.33.1 to 0.35.0 fixes #​549 by @​Aditya09-cse in #​548
• chore: use GitHub Actions as git commit author in bump-trivy workflow by @​nikpivkin in #​561
• chore(deps): Update trivy to v0.70.0 by @​Argon-DevOps-Mgt in #​559
• chore: update action version to v0.36.0 in examples by @​nikpivkin in #​563

New Contributors

• @​dependabot[bot] made their first contribution in #​558
• @​Hayao0819 made their first contribution in #​545
• @​patrik-csak made their first contribution in #​547
• @​Aditya09-cse made their first contribution in #​548
• @​Argon-DevOps-Mgt made their first contribution in #​559

Full Changelog: aquasecurity/trivy-action@v0.35.0...v0.36.0

goreleaser/goreleaser-action (goreleaser/goreleaser-action)

v7.2.1

Compare Source

This fully removes the usage of the old nightly moving tag.

Full Changelog: goreleaser/goreleaser-action@v7.2.0...v7.2.1

v7.2.0

Compare Source

What's Changed

• test: cover install across release eras by @​caarlos0 in #​555
• feat: add version-file input by @​caarlos0 in #​556
• feat: resolve nightly to latest vX.Y.Z--nightly release by @​caarlos0 in #​558

Full Changelog: goreleaser/goreleaser-action@v7...v7.2.0

korthout/backport-action (korthout/backport-action)

v4.5.0: Backport-action v4.5.0

Compare Source

What's Changed

This release introduces a new comment_style input with two options:

• legacy (default): one comment per target branch. This is the same behavior as you know from previous versions.
• summary: a single comment per workflow run that updates progressively as each target is processed. It links back to the workflow run, shows a status table for every target, and includes recovery hints for known failure modes (e.g. push permission denied, cherry-pick conflicts).

Here's what a summary comment looks like mid-run:

Backport-action is backporting this pull request in workflow run 15439584062.

Target	Status
stable/8.7	✅ Created #​612
stable/8.6	⚠️ Drafted with conflicts #​613
stable/8.5	❌ Failed
stable/8.4	➖ Skipped (PR already exists)
stable/8.3	⌛ Pending

❌ stable/8.5 — unable to cherry-pick

Tried to cherry-pick commits onto stable/8.5, but the cherry-pick failed.

Please cherry-pick the changes locally and resolve any conflicts.

git fetch origin stable/8.5
git worktree add -d .worktree/stable/8.5 origin/stable/8.5
cd .worktree/stable/8.5
git switch --create <backport-branch-name>
git cherry-pick -x a1b2c3d e4f5g6h

Opt in by adding comment_style: summary to your workflow:

- uses: korthout/backport-action@v4.5.0
  with:
    comment_style: summary

I'd love feedback on summary while it's opt-in. Drop a comment on #​611 with anything that's confusing, missing, or broken. Once it's proven stable in real workflows, I plan to make it the default and deprecate legacy in a future major release.

• Add summary comment style by @​korthout in #​611

Updated dependencies

• Update korthout/backport-action action to v4.4.0 by @​renovate[bot] in #​606
• Update dependency @​actions/github to v9.1.1 by @​renovate[bot] in #​614
• Update dependency vitest to v4.1.5 by @​renovate[bot] in #​612
• Update dependency @​actions/core to v3.0.1 by @​renovate[bot] in #​613
• Lock file maintenance by @​renovate[bot] in #​621

Maintenance changes

• ci(Mergify): configuration update by @​korthout in #​607
• Configure Mergify merge queue by @​korthout in #​608
• Use PAT for PR info workflow comments by @​korthout in #​615
• Skip PR info comment on Mergify merge queue PRs by @​korthout in #​618
• refactor: restructure backport.ts for readability by @​korthout in #​610
• ci: authenticate Publish/Release pushes via deploy key by @​korthout in #​622
• Automerge Renovate lock file maintenance PRs by @​korthout in #​623

Full Changelog: korthout/backport-action@v4.4.0...v4.5.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.