chore(deps): update github-actions

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
actions/checkout	action	patch	v6.0.2 → v6.0.3
anthropics/claude-code-action	action	patch	v1.0.123 → v1.0.140	v1.0.148 (+7)
docker/build-push-action	action	minor	v7.1.0 → v7.2.0
docker/login-action	action	minor	v4.1.0 → v4.2.0
docker/metadata-action	action	minor	v6.0.0 → v6.1.0
docker/setup-buildx-action	action	minor	v4.0.0 → v4.1.0
github/codeql-action	action	minor	v4.35.5 → v4.36.2

---

Release Notes

actions/checkout (actions/checkout)

v6.0.3

Compare Source

• Fix checkout init for SHA-256 repositories by @​yaananth in #​2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in #​2414

anthropics/claude-code-action (anthropics/claude-code-action)

v1.0.140

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.140

v1.0.139

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.139

v1.0.138

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.138

v1.0.137

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.137

v1.0.136

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.136

v1.0.135

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.135

v1.0.134

Compare Source

What's Changed

• Add workload identity federation support to base-action by @​ashwin-ant in #​1378
• chore: bump actions/setup-node from v4.4.0 to v6.4.0 (Node.js 24) by @​ant-kurt in #​1377
• ci: bump checkout and setup-bun in test workflows to Node 24 releases by @​ant-kurt in #​1379

New Contributors

• @​ant-kurt made their first contribution in #​1377

Full Changelog: anthropics/claude-code-action@v1...v1.0.134

v1.0.133

Compare Source

What's Changed

• Use workload identity federation for Claude auth in CI workflows by @​ashwin-ant in #​1344

Full Changelog: anthropics/claude-code-action@v1...v1.0.133

v1.0.132

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.132

v1.0.131

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.131

v1.0.130

Compare Source

What's Changed

• Add Workload Identity Federation (OIDC) authentication support by @​ashwin-ant in #​1338

Full Changelog: anthropics/claude-code-action@v1...v1.0.130

v1.0.129

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.129

v1.0.128

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.128

v1.0.127

Compare Source

What's Changed

• Refactor allowed_bots actor resolution by @​ashwin-ant in #​1330

Full Changelog: anthropics/claude-code-action@v1...v1.0.127

v1.0.126

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.126

v1.0.125

Compare Source

What's Changed

• Simplify comment tool instructions in prompt by @​ashwin-ant in #​1328

Full Changelog: anthropics/claude-code-action@v1...v1.0.125

v1.0.124

Compare Source

What's Changed

• fix: add parentheses to fix operator precedence in co-author check by @​FuturizeRush in #​1199
• Strengthen simplified tag-mode prompt (USE_SIMPLE_PROMPT) by @​ashwin-ant in #​1313
• Fix prettier formatting in create-prompt by @​ashwin-ant in #​1325

New Contributors

• @​FuturizeRush made their first contribution in #​1199

Full Changelog: anthropics/claude-code-action@v1...v1.0.124

docker/build-push-action (docker/build-push-action)

v7.2.0

Compare Source

docker/login-action (docker/login-action)

v4.2.0

Compare Source

• Bump @​actions/core from 3.0.0 to 3.0.1 in #​976
• Bump @​aws-sdk/client-ecr and @​aws-sdk/client-ecr-public to 3.1050.0 in #​960
• Bump @​docker/actions-toolkit from 0.86.0 to 0.90.0 in #​970
• Bump brace-expansion from 2.0.1 to 5.0.6 in #​993
• Bump fast-xml-builder from 1.1.4 to 1.2.0 in #​985
• Bump fast-xml-parser from 5.3.6 to 5.8.0 in #​963
• Bump http-proxy-agent and https-proxy-agent to 9.0.0 in #​961
• Bump postcss from 8.5.6 to 8.5.10 in #​979
• Bump tar from 6.2.1 to 7.5.15 in #​991
• Bump vite from 7.3.1 to 7.3.3 in #​986

Full Changelog: docker/login-action@v4.1.0...v4.2.0

docker/metadata-action (docker/metadata-action)

v6.1.0

Compare Source

• Bump @​docker/actions-toolkit from 0.79.0 to 0.90.0 in #​613
• Bump brace-expansion from 1.1.12 to 5.0.6 in #​658 #​630
• Bump csv-parse from 6.1.0 to 6.2.1 in #​617
• Bump fast-xml-parser from 5.4.2 to 5.8.0 in #​620
• Bump flatted from 3.3.3 to 3.4.2 in #​623
• Bump glob from 10.3.15 to 10.5.0 in #​621
• Bump handlebars from 4.7.8 to 4.7.9 in #​629
• Bump lodash from 4.17.23 to 4.18.1 in #​639
• Bump moment-timezone from 0.6.0 to 0.6.1 in #​619
• Bump picomatch from 4.0.3 to 4.0.4 in #​626
• Bump postcss from 8.5.6 to 8.5.10 in #​649
• Bump tar from 6.2.1 to 7.5.15 in #​657
• Bump undici from 6.23.0 to 6.25.0 in #​614
• Bump vite from 7.3.1 to 7.3.2 in #​637

Full Changelog: docker/metadata-action@v6.0.0...v6.1.0

docker/setup-buildx-action (docker/setup-buildx-action)

v4.1.0

Compare Source

• Bump @​docker/actions-toolkit from 0.79.0 to 0.90.0 in #​489
• Bump brace-expansion from 1.1.12 to 5.0.6 in #​547 #​508
• Bump fast-xml-builder from 1.0.0 to 1.2.0 in #​540
• Bump fast-xml-parser from 5.4.2 to 5.8.0 in #​496
• Bump flatted from 3.3.3 to 3.4.2 in #​499
• Bump glob from 10.3.12 to 13.0.6 in #​495
• Bump handlebars from 4.7.8 to 4.7.9 in #​504
• Bump lodash from 4.17.23 to 4.18.1 in #​523
• Bump picomatch from 4.0.3 to 4.0.4 in #​503
• Bump postcss from 8.5.6 to 8.5.10 in #​537
• Bump tar from 6.2.1 to 7.5.15 in #​545
• Bump undici from 6.23.0 to 6.25.0 in #​492
• Bump vite from 7.3.1 to 7.3.2 in #​520

Full Changelog: docker/setup-buildx-action@v4.0.0...v4.1.0

github/codeql-action (github/codeql-action)

v4.36.2

Compare Source

v4.36.1

Compare Source

v4.36.0

Compare Source

• Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #​3894
• Add support for SHA-256 Git object IDs. #​3893
• Update default CodeQL bundle version to 2.25.5. #​3926

---

Configuration

📅 Schedule: (in timezone Australia/Melbourne)

• Branch creation
  • "before 4am on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.