chore(deps): update dependencies (patch & digest)

Author: renovate[bot]

.github/workflows/codegen.yaml

@@ -16,12 +16,12 @@ jobs:
         with:
           persist-credentials: false
       - id: go-version
-        uses: opendefensecloud/dev-kit/.github/actions/get-go-version@41370fd52f6889401ef79388e54e7e38bfbf112e # v1.0.11
+        uses: opendefensecloud/dev-kit/.github/actions/get-go-version@0f029600dddec8c33a712f6ad5ef77fb97a5eac1 # v1.0.12
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
           go-version: ${{ steps.go-version.outputs.version }}
       - name: Run codegen
         run: |
           make codegen
       - name: Check for changes
-        uses: opendefensecloud/dev-kit/.github/actions/diff-check@41370fd52f6889401ef79388e54e7e38bfbf112e # v1.0.11
+        uses: opendefensecloud/dev-kit/.github/actions/diff-check@0f029600dddec8c33a712f6ad5ef77fb97a5eac1 # v1.0.12

.github/workflows/docker.yaml

@@ -93,7 +93,7 @@ jobs:
           driver-opts: ${{ env.ACT == 'true' && 'network=host' || '' }}
       - name: Login to GHCR
         if: ${{ env.ACT != 'true' }}
-        uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c # v4
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -152,7 +152,7 @@ jobs:
           push-to-registry: true
       - name: Attest provenance
         if: ${{ env.ACT != 'true' }}
-        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4
         with:
           subject-name: ghcr.io/${{ github.repository_owner }}/${{ matrix.image.name }}
           subject-digest: ${{ steps.image.outputs.digest }}

.github/workflows/golang.yaml

@@ -39,7 +39,7 @@ jobs:
         with:
           persist-credentials: false
       - id: go-version
-        uses: opendefensecloud/dev-kit/.github/actions/get-go-version@41370fd52f6889401ef79388e54e7e38bfbf112e # v1.0.11
+        uses: opendefensecloud/dev-kit/.github/actions/get-go-version@0f029600dddec8c33a712f6ad5ef77fb97a5eac1 # v1.0.12
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
           go-version: ${{ steps.go-version.outputs.version }}
@@ -67,7 +67,7 @@ jobs:
         with:
           infile: arc.coverprofile
       - name: Coveralls GitHub Action
-        uses: coverallsapp/github-action@5cbfd81b66ca5d10c19b062c04de0199c215fb6e # v2.3.7
+        uses: coverallsapp/github-action@8d6379e14d29928660c4ba802d8e85393440b329 # v2.3.8
         with:
           github-token: ${{ secrets.github_token }}
           path-to-lcov: coverage.lcov

.github/workflows/helm-publish.yaml

@@ -50,7 +50,7 @@ jobs:
         uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
 
       - name: Login to GHCR # required for cosign
-        uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c # v4
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}

.github/workflows/release.yaml

@@ -57,7 +57,7 @@ jobs:
           find bin -type f ! -name checksums.txt | sort | xargs sha256sum > bin/checksums.txt
 
       - name: Attest build provenance
-        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4
         with:
           subject-path: 'bin/arc-*-*' # binaries only; runs before signing so the .sigstore.json bundles are not yet present
 

.github/workflows/scorecard.yaml

@@ -78,7 +78,7 @@ jobs:
       # Upload the results to GitHub's code scanning dashboard (optional).
       # Commenting out will disable upload of results to your repo's Code Scanning dashboard
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
         with:
           sarif_file: results.sarif
 

.github/workflows/test-e2e.yaml

@@ -25,7 +25,7 @@ jobs:
         with:
           persist-credentials: false
       - id: go-version
-        uses: opendefensecloud/dev-kit/.github/actions/get-go-version@41370fd52f6889401ef79388e54e7e38bfbf112e # v1.0.11
+        uses: opendefensecloud/dev-kit/.github/actions/get-go-version@0f029600dddec8c33a712f6ad5ef77fb97a5eac1 # v1.0.12
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
           go-version: ${{ steps.go-version.outputs.version }}

Makefile

@@ -1,5 +1,5 @@
 # Include ODC common make targets
-DEV_KIT_VERSION := v1.0.11
+DEV_KIT_VERSION := v1.0.12
 -include common.mk
 common.mk:
 	@[ -f .common.mk-download ] || \
@@ -33,7 +33,7 @@ KIND_NODE_IMAGE ?= kindest/node:v$(patsubst v%,%,$(ENVTEST_K8S_VERSION))
 KIND_NODE_VERSION := $(lastword $(subst :, ,$(KIND_NODE_IMAGE)))
 
 export ARGO_WORKFLOWS_VERSION := $(shell awk '/^[ \t]+github.com\/argoproj\/argo-workflows/ {print $$2}' go.mod)
-export CERTMANAGER_VERSION := v1.21.0
+export CERTMANAGER_VERSION := v1.21.1
 export TRUSTMANAGER_VERSION := v0.24.0
 
 LICENSE := apache

examples/blob/cluster-workflow-template.yaml

@@ -76,7 +76,7 @@ spec:
         limit: "2"
 
       script:
-        image: amazon/aws-cli:2.36.8
+        image: amazon/aws-cli:2.36.18
         command: [sh, -c]
         volumeMounts:
           - &dstSecretMount
@@ -129,7 +129,7 @@ spec:
 
     - name: determine-size-s3
       script:
-        image: amazon/aws-cli:2.36.8
+        image: amazon/aws-cli:2.36.18
         command: [sh, -c]
         volumeMounts:
           - &srcSecretMount
@@ -211,7 +211,7 @@ spec:
           persistentVolumeClaim:
             claimName: "{{ workflow.name }}"
       script:
-        image: amazon/aws-cli:2.36.8
+        image: amazon/aws-cli:2.36.18
         command: [sh, -c]
         volumeMounts:
           - &workDirMount
@@ -255,7 +255,7 @@ spec:
       volumes:
         - *workDir
       script:
-        image: clamav/clamav-debian:1.5.2-37
+        image: clamav/clamav-debian:1.5.3
         command: ["/bin/bash", "-c"]
         volumeMounts:
           - *workDirMount
@@ -268,7 +268,7 @@ spec:
       volumes:
         - *workDir
       script:
-        image: amazon/aws-cli:2.36.8
+        image: amazon/aws-cli:2.36.18
         command: [sh, -c]
         volumeMounts:
           - *workDirMount