chore(deps): update github actions dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	OpenSSF
docker/build-push-action	action	minor	v7.3.0 → v7.4.0
docker/setup-buildx-action	action	minor	v4.3.0 → v4.4.1
docker/setup-qemu-action	action	minor	v4.2.0 → v4.4.0
github/codeql-action	action	minor	v4.37.8 → v4.38.2
step-security/harden-runner	action	patch	v2.21.0 → v2.21.1

---

Release Notes

docker/build-push-action (docker/build-push-action)

v7.4.0

Compare Source

• Use the shared error helper for Buildx commands by @​crazy-max in #​1620
• Prevent workflow command injection in metadata logs by @​crazy-max in #​1617
• Bump @​docker/actions-toolkit from 0.92.0 to 0.100.0 in #​1614 #​1618 #​1621
• Bump @​humanfs/node from 0.16.7 to 0.16.8 in #​1609
• Bump brace-expansion from 1.1.13 to 1.1.18 in #​1592
• Bump csv-parse from 7.0.0 to 7.0.2 in #​1613
• Bump js-yaml from 4.3.0 to 4.3.2 in #​1605 #​1615
• Bump nanoid from 3.3.16 to 3.3.18 in #​1611
• Bump postcss from 8.5.10 to 8.5.25 in #​1590
• Bump postcss-selector-parser from 7.1.1 to 7.1.5 in #​1606
• Bump sigstore from 4.1.0 to 4.1.1 in #​1577
• Bump undici from 6.27.0 to 6.28.0 in #​1594

Full Changelog: docker/build-push-action@v7.3.0...v7.4.0

docker/setup-buildx-action (docker/setup-buildx-action)

v4.4.1

Compare Source

v4.4.0

Compare Source

• Use official Buildx releases for cloud driver by @​crazy-max in #​606
• Pull BuildKit image before builder creation by @​crazy-max in #​609
• Use shared error helpers for Buildx and Docker commands by @​crazy-max in #​620
• Bump @​docker/actions-toolkit from 0.95.0 to 0.100.0 in #​610 #​618 #​619
• Bump @​humanfs/node from 0.16.7 to 0.16.8 in #​614
• Bump js-yaml from 5.3.0 to 5.4.2 in #​608 #​617
• Bump postcss-selector-parser from 7.1.1 to 7.1.5 in #​611

Full Changelog: docker/setup-buildx-action@v4.3.0...v4.4.0

docker/setup-qemu-action (docker/setup-qemu-action)

v4.4.0

Compare Source

• Use the shared error helper for Docker commands by @​crazy-max in #​345
• Bump @​docker/actions-toolkit from 0.96.0 to 0.100.0 in #​344
• Bump @​humanfs/node from 0.16.7 to 0.16.8 in #​340
• Bump js-yaml from 4.3.1 to 4.3.2 in #​342
• Bump postcss-selector-parser from 7.1.1 to 7.1.5 in #​337

Full Changelog: docker/setup-qemu-action@v4.3.0...v4.4.0

v4.3.0

Compare Source

• Bump @​docker/actions-toolkit from 0.92.0 to 0.96.0 in #​336
• Bump @​sigstore/verify from 3.1.0 to 3.1.1 in #​316
• Bump brace-expansion from 1.1.15 to 1.1.18 in #​332
• Bump js-yaml from 4.2.0 to 4.3.1 in #​334
• Bump postcss from 8.5.10 to 8.5.25 in #​331
• Bump sigstore from 4.1.0 to 4.1.1 in #​317
• Bump undici from 6.27.0 to 6.28.0 in #​333

Full Changelog: docker/setup-qemu-action@v4.2.0...v4.3.0

github/codeql-action (github/codeql-action)

v4.38.2

Compare Source

• Update default CodeQL bundle version to 2.27.1. #​4160

v4.38.1

Compare Source

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #​4146

v4.38.0

Compare Source

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #​4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #​4072
• Update default CodeQL bundle version to 2.27.0. #​4129

v4.37.9

Compare Source

• Update default CodeQL bundle version to 2.26.4. #​4106

step-security/harden-runner (step-security/harden-runner)

v2.21.1

Compare Source

What's Changed

• Improved performance of the disable-sudo feature.
• Fixed an issue in the Community tier where new endpoints required by the GitHub Actions runner were not being implicitly allowed in block mode.
• Fixed the Harden-Runner post step failing on Linux distributions that do not have a merged /usr filesystem layout (for example Debian 11), where /usr/bin/echo does not exist. This mainly affected self-hosted runners.
• Documentation updates: clarified which features are in the Community (free) vs Enterprise tier.

Full Changelog: step-security/harden-runner@v2.21.0...v2.21.1

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 1f79ce11-f021-4ab3-b688-50087574eb0d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}