chore: bump the github-actions group across 1 directory with 2 updates

[dependabot]

Bumps the github-actions group with 2 updates in the / directory: dataaxiom/ghcr-cleanup-action and dependabot/fetch-metadata.

Updates dataaxiom/ghcr-cleanup-action from 1.0.16 to 1.2.2

Release notes

Sourced from dataaxiom/ghcr-cleanup-action's releases.

v1.2.2

• feature: skip-regex-checks input bypasses regex length/ReDoS guards for intentionally large patterns (fix #128)

v1.2.1

• fix: tolerate every 404 on package version delete (was: fail on the second) (fix #121)
• fix: eliminate spurious "wasn't found" warnings from cosign signature dual-cascade race
• fix: per-image log buffer flushes audit trail even when a cascade errors mid-flight

v1.2.0

• feature: cross-run manifest cache; warm runs only fetch newly-published manifests (hit rate logged)
• perf: parallel API throughout — package pagination, manifest fetches, untag PUTs, child/referrer deletes
• perf: batched untagging — one reload per batch instead of one per tag
• perf: push token reuse across untag PUTs + 429/secondary rate-limit retries on registry auth
• fix: repository input is now informational; cleanup uses owner + package directly (supports unlinked / cross-account packages)
• log volume cap at 1000 lines per group (info); per-image log output buffered to avoid interleaving under concurrent deletes
• package version upgrades

v1.1.0

• fix: preserve OCI 1.1 subject-bearing referrers (cosign sigstore-bundles, attestations) during cleanup — were silently deleted as untagged #71
• fix: keep-n-tagged now gates untag operations; a matched tag is not stripped from an image that keep-n-tagged would protect (#99, #101)
• fix: shared multi-arch platform digests no longer cascade-deleted when one of multiple parent indexes is removed (#91)
• fix: delete-partial-images excludes fully ghost images #112
• fix: Octokit error output visible at all log levels (was suppressed when log-level was error or warn)
• fix: expand-packages rejects fine-grained PATs upfront with a clear message
• fix: setFailed message no longer overwritten by an empty Error in early-failure paths
• feat: ReDoS guard on user-supplied regex (delete-tags, exclude-tags, package) when use-regex: true
• feat: code refactor/split, removal of anys where possible using typed classes
• chore(deps): Node.js 24
• docs: README rewrite + Limitations section (5,000-download undeletable policy, nested-manifest non-support)

Commits

• d52806a Merge pull request #129 from rohanmars/main
• 7f28f9d feat: add skip-regex-checks input to opt out of regex safety guards
• f092b48 Merge pull request #122 from rohanmars/main
• fa3daf5 ci: hoist fork-PR approval gate to a single job (was per matrix entry)
• c1ba289 fix: synchronously claim digests before delete to prevent concurrent duplicat...
• f5e37e7 fix: tolerate all 404s on package version delete; always flush per-tree log b...
• 374e202 Merge pull request #120 from rohanmars/code-review
• e1e6176 perf: cap per-listing log volume at 1000 lines (truncate at INFO)
• 6516895 fix: drop the post-reload untag-ops invariant assertion (3.1.5 retraction)
• 5a020af feat: buffer deleteImage logs per top-level tree, flush atomically
• Additional commits viewable in compare view

Updates dependabot/fetch-metadata from 3.0.0 to 3.1.0

Release notes

Sourced from dependabot/fetch-metadata's releases.

v3.1.0

What's Changed

• Add permissions to all workflows by @​truggeri in dependabot/fetch-metadata#687
• build(deps-dev): bump globals from 16.0.0 to 17.4.0 by @​dependabot[bot] in dependabot/fetch-metadata#690
• build(deps-dev): bump esbuild from 0.27.4 to 0.28.0 by @​dependabot[bot] in dependabot/fetch-metadata#693
• build(deps-dev): bump @​hono/node-server from 1.19.10 to 1.19.13 by @​dependabot[bot] in dependabot/fetch-metadata#694
• build(deps-dev): bump hono from 4.12.7 to 4.12.12 by @​dependabot[bot] in dependabot/fetch-metadata#695
• Dynamically update the tracking tag in action by @​truggeri in dependabot/fetch-metadata#696
• fix: handle duplicate dependency names in parseMetadataLinks by @​devantler in dependabot/fetch-metadata#700
• fix: remove $ anchor from updateFragment regex to handle pip directory suffixes by @​devantler in dependabot/fetch-metadata#698
• Updates to README for permissions clarification by @​truggeri in dependabot/fetch-metadata#697
• fix: resolve update-type null for Python, Composer, and Terraform PRs by @​vitorsdcs in dependabot/fetch-metadata#704
• build(deps-dev): bump globals from 17.4.0 to 17.5.0 by @​dependabot[bot] in dependabot/fetch-metadata#703
• build(deps): bump actions/create-github-app-token from 3.0.0 to 3.1.1 by @​dependabot[bot] in dependabot/fetch-metadata#701
• build(deps): bump @​actions/github from 9.0.0 to 9.1.0 in the dependencies group across 1 directory by @​dependabot[bot] in dependabot/fetch-metadata#702
• build(deps-dev): bump hono from 4.12.12 to 4.12.14 by @​dependabot[bot] in dependabot/fetch-metadata#705
• v3.1.0 by @​fetch-metadata-action-automation[bot] in dependabot/fetch-metadata#692

New Contributors

• @​devantler made their first contribution in dependabot/fetch-metadata#700
• @​vitorsdcs made their first contribution in dependabot/fetch-metadata#704

Full Changelog: dependabot/fetch-metadata@v3...v3.1.0

Commits

• 25dd0e3 v3.1.0 (#692)
• e073f50 Merge pull request #705 from dependabot/dependabot/npm_and_yarn/hono-4.12.14
• 0670e16 build(deps-dev): bump hono from 4.12.12 to 4.12.14
• 7a7fe10 Merge pull request #702 from dependabot/dependabot/npm_and_yarn/dependencies-...
• 5168191 Updating dist build
• 23882e1 build(deps): bump @​actions/github in the dependencies group
• 1072469 Merge pull request #701 from dependabot/dependabot/github_actions/actions/cre...
• 43f8a00 build(deps): bump actions/create-github-app-token from 3.0.0 to 3.1.1
• b4d904a Merge pull request #703 from dependabot/dependabot/npm_and_yarn/globals-17.5.0
• c8046bb build(deps-dev): bump globals from 17.4.0 to 17.5.0
• Additional commits viewable in compare view