chore(deps): update github-actions pinned digests

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/attest-build-provenance	action	minor	v4.1.1 → v4.2.2
actions/checkout	action	pin	v6 → v6.1.0
actions/checkout	action	pin	v7 → v7.0.1
actions/checkout	action	minor	v4.2.2 → v4.4.0
actions/create-github-app-token	action	pin	v3 → v3.2.0
actions/download-artifact	action	pin	v8 → v8.0.1
actions/setup-java	action	pin	v5 → v5.7.0
actions/setup-node	action	pin	v6 → v6.5.0
actions/setup-node	action	pin	v4 → v4.4.0
actions/setup-node	action	pin	v7 → v7.0.0
actions/setup-python	action	pin	v6 → v6.3.0
actions/upload-artifact	action	pinDigest	→ 043fb46
cachix/install-nix-action	action	pin	v31 → v31.11.1
docker/build-push-action	action	pin	v7 → v7.4.0
docker/login-action	action	pin	v4 → v4.6.0
docker/setup-buildx-action	action	pin	v4 → v4.4.1
docker/setup-qemu-action	action	pin	v4 → v4.4.0
googleapis/release-please-action	action	pin	v5 → v5.0.0
gradle/actions	action	pin	v6 → v6.4.0
pnpm/action-setup	action	pin	v6 → v6.1.0
re-actors/alls-green	action	pinDigest	→ b5b5b37
sigstore/cosign	uses-with	patch	v2.6.1 → v2.6.5

---

Release Notes

actions/attest-build-provenance (actions/attest-build-provenance)

v4.2.2

Compare Source

[!NOTE]
As of version 4, actions/attest-build-provenance is simply a wrapper on top of actions/attest.

Existing applications may continue to use the attest-build-provenance action, but new implementations should use actions/attest instead.

What's Changed

• Bump actions/attest from 4.2.0 to 4.2.1 in the actions-minor group by @​dependabot[bot] in #​862

Full Changelog: actions/attest-build-provenance@v4.1.1...v4.2.2

actions/checkout (actions/checkout)

v4.4.0

Compare Source

v4.3.1

Compare Source

• Port v6 cleanup to v4 by @​ericsciple in #​2305

v4.3.0

Compare Source

• docs: update README.md by @​motss in #​1971
• Add internal repos for checking out multiple repositories by @​mouismail in #​1977
• Documentation update - add recommended permissions to Readme by @​benwells in #​2043
• Adjust positioning of user email note and permissions heading by @​joshmgross in #​2044
• Update README.md by @​nebuk89 in #​2194
• Update CODEOWNERS for actions by @​TingluoHuang in #​2224
• Update package dependencies by @​salmanmkc in #​2236

sigstore/cosign (sigstore/cosign)

v2.6.5

Compare Source

Changelog

This release backports GHSA-fx35-mq7g-6g98 (Verification bypass via public key in legacy bundle) to Cosign v2.6.x.

We strongly encourage folks to continue their migration to the bundle format. The Cosign v3.1.x releases support both formats; the primary change being that the default for signing is the bundle format (although you can specify --new-bundle-format=false to sign with the old format). The verification commands in Cosign v3.1.x support both formats, and will try to detect the format for you for maximum compatibility.

Thanks to all contributors!

v2.6.4

Compare Source

This release is a backport of OCI manifest fixes, and better support for cosign attestation download when you are using a mix of old Cosign signatures with the more recent bundle format.

We strongly encourage folks to continue their migration to the bundle format. The Cosign v3.1.x releases support both formats; the primary change being that the default for signing is the bundle format (although you can specify --new-bundle-format=false to sign with the old format). The verification commands in Cosign v3.1.x support both formats, and will try to detect the format for you for maximum compatibility.

Changelog

• 26261f0 Allow attestation download to handle both bundle types (#​4996) (#​5017)
• d49a0c1 fix: include artifactType in OCI 1.1 signature referrer manifest (cherry-pick PR-4997 to release-2.6) (#​5002)

Thanks to all contributors!

v2.6.3

Compare Source

Changelog

v2.6.3 resolves GHSA-w6c6-c85g-mmv6.

• fecddd3 Fix DSSE predicate check (#​4802)
• 564c5b1 Backport bundle detection to sign and attest (#​4727)

Thanks to all contributors!

v2.6.2

Compare Source

v2.6.2 resolves GHSA-whqx-f9j3-ch6m.

Changes

• Fix bundle verify path for old bundle/trusted root (GHSA-whqx-f9j3-ch6m) (#​4624)
• bump sigstore deps to resolve build errors (#​4619)

---

Configuration

📅 Schedule: (in timezone Etc/UTC)

• Branch creation
  • "before 9am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.