chore(deps): update github-actions (major)

[cheese-dipper]

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	major	v6 → v7
redhat-actions/podman-login	action	major	v1 → v2

---

Release Notes

actions/checkout (actions/checkout)

v7

Compare Source

• Skip running unsafe pr check if input is default by @​aiqiaoy in #​2518
• Trim only ascii whitespace for branch by @​aiqiaoy in #​2521
• Escape values passed to --unset by @​aiqiaoy in #​2530
• Various dependency updates

redhat-actions/podman-login (redhat-actions/podman-login)

v2

Compare Source

Breaking Changes

• Upgrade @actions/core 1.x to 3.x, @actions/exec 1.x to 3.x, @actions/io 1.x to 3.x
• Auth file path is now detected from podman's --verbose output instead of being hardcoded. The fallback path is used only if detection fails.
• Registry input is now automatically lowercased to comply with OCI spec

Bug Fixes

• Fix registryLogout() not cleaning up Docker config credentials in the post step (#​36)
• Fix auth file path mismatch with podman 5.x which changed from /tmp/podman-run-<uid> to /tmp/storage-run-<uid> (#​47)
• Fix ENOENT error when ~/.docker directory does not exist (#​42)

Features

• Add tls_verify input to skip TLS certificate verification for self-signed registries
• Support AWS OIDC temporary credentials for ECR login via AWS_SESSION_TOKEN (#​37)
• Automatically lowercase registry input to prevent OCI naming errors (#​44)

Dependency Upgrades

• TypeScript 5.x to 6.0.3
• ESLint 8 (EOL) to 10 with flat config
• @aws-sdk/client-ecr 3.535 to 3.1094
• @vercel/ncc 0.38 to 0.44
• Remove unused @aws-sdk/util-base64
• Resolve all npm audit vulnerabilities

CI & Infrastructure

• Upgrade actions/checkout v6 to v7, actions/setup-node v6 to v7
• Add workflow-level permissions: contents: read
• Add concurrency groups to cancel redundant CI runs
• Pin runs-on to ubuntu-24.04
• Add Dependabot for npm and GitHub Actions updates
• Add SECURITY.md
• Enable secret scanning and push protection
• Remove deprecated CRDA vulnerability scan workflow

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 6am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[cheese-dipper]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.