chore(deps): update image python to v3.14.1 (#391)

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

.github/actions/setup-test-environment/action.yml

@@ -17,7 +17,7 @@ runs:
   using: composite
   steps:
     - name: Install uv
-      uses: astral-sh/setup-uv@1e862dfacbd1d6d858c55d9b792c756523627244 # v7.1.4
+      uses: astral-sh/setup-uv@ed21f2f24f8dd64503750218de024bcf64c7250a # v7.1.5
       with:
         enable-cache: true
 
@@ -31,7 +31,7 @@ runs:
       run: uv sync --frozen
 
     - name: Setup Node.js
-      uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
+      uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
       with:
         node-version: '24'
         cache: npm

.github/workflows/action-security.yml

@@ -48,7 +48,7 @@ jobs:
 
       - name: Notify on Critical Issues
         if: failure() && steps.security-scan.outputs.critical_issues != '0'
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         with:
           script: |-
             const { repo, owner } = context.repo;

.github/workflows/build-testing-image.yml

@@ -49,7 +49,7 @@ jobs:
 
       - name: Extract metadata
         id: meta
-        uses: docker/metadata-action@318604b99e75e41977312d83839a89be02ca4893 # v5.9.0
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
         with:
           images: ghcr.io/${{ github.repository_owner }}/actions
           tags: |

.github/workflows/issue-stats.yml

@@ -30,7 +30,7 @@ jobs:
           echo "last_month=$first_day..$last_day" >> "$GITHUB_ENV"
 
       - name: Run issue-metrics tool
-        uses: github/issue-metrics@78b1d469a1b1c94945b15bd71dedcb1928667f49 # v3.25.3
+        uses: github/issue-metrics@55bb0b704982057a101ab7515fb72b2293927c8a # v3.25.4
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SEARCH_QUERY: 'repo:ivuorinen/actions is:issue created:${{ env.last_month }} -reason:"not planned"'

.github/workflows/pr-lint.yml

@@ -74,14 +74,14 @@ jobs:
 
       - name: Upload SARIF Report
         if: always() && hashFiles('megalinter-reports/sarif/*.sarif')
-        uses: github/codeql-action/upload-sarif@fdbfb4d2750291e159f0156def62b853c2798ca2 # v4.31.5
+        uses: github/codeql-action/upload-sarif@cf1bb45a277cb3c205638b2cd5c984db1c46a412 # v4.31.7
         with:
           sarif_file: megalinter-reports/sarif
           category: megalinter
 
       - name: Check Results
         if: always()
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         with:
           script: |
             const status = '${{ steps.pr-lint.outputs.validation_status }}';

.github/workflows/release.yml

@@ -17,6 +17,6 @@ jobs:
       contents: write
     steps:
       - uses: actions/checkout@71cf2267d89c5cb81562390fa70a37fa40b1305e # v6-beta
-      - uses: softprops/action-gh-release@5be0e66d93ac7ed76da52eca8bb058f665c3a5fe # v2.4.2
+      - uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0
         with:
           generate_release_notes: true

.github/workflows/stale.yml

@@ -25,7 +25,7 @@ jobs:
 
     steps:
       - name: 🚀 Run stale
-        uses: actions/stale@5f858e3efba33a5ca4407a664cc011ad407f2008 # v10.1.0
+        uses: actions/stale@997185467fa4f803885201cee163a9f38240193d # v10.1.1
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           days-before-stale: 30

.github/workflows/test-actions.yml

@@ -73,7 +73,7 @@ jobs:
         if: always()
 
       - name: Upload SARIF file
-        uses: github/codeql-action/upload-sarif@fdbfb4d2750291e159f0156def62b853c2798ca2 # v4.31.5
+        uses: github/codeql-action/upload-sarif@cf1bb45a277cb3c205638b2cd5c984db1c46a412 # v4.31.7
         if: always() && hashFiles('_tests/reports/test-results.sarif') != ''
         with:
           sarif_file: _tests/reports/test-results.sarif

.github/workflows/version-maintenance.yml

@@ -49,7 +49,7 @@ jobs:
 
       - name: Create Pull Request
         if: steps.action-versioning.outputs.updated == 'true'
-        uses: peter-evans/create-pull-request@84ae59a2cdc2258d6fa0732dd66352dddae2a412 # v7.0.9
+        uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7.0.11
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           commit-message: 'chore: update action references to ${{ steps.version.outputs.major }}'
@@ -76,7 +76,7 @@ jobs:
 
       - name: Check for Annual Bump
         if: steps.action-versioning.outputs.needs-annual-bump == 'true'
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         with:
           script: |
             const currentYear = new Date().getFullYear();

.pre-commit-config.yaml

@@ -14,7 +14,7 @@ repos:
         types: [markdown, python, yaml]
         files: ^(docs/.*|README\.md|CONTRIBUTING\.md|CHANGELOG\.md|.*\.py|.*\.ya?ml)$
   - repo: https://github.com/astral-sh/uv-pre-commit
-    rev: 0.9.11
+    rev: 0.9.16
     hooks:
       - id: uv-lock
       - id: uv-sync
@@ -44,7 +44,7 @@ repos:
         args: [--autofix, --no-sort-keys]
 
   - repo: https://github.com/DavidAnson/markdownlint-cli2
-    rev: v0.19.1
+    rev: v0.20.0
     hooks:
       - id: markdownlint-cli2
         args: [--fix]
@@ -55,7 +55,7 @@ repos:
       - id: yamllint
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.14.6
+    rev: v0.14.8
     hooks:
       # Run the linter with auto-fix
       - id: ruff-check
@@ -83,11 +83,6 @@ repos:
       - id: actionlint
         args: ['-shellcheck=']
 
-  - repo: https://github.com/renovatebot/pre-commit-hooks
-    rev: 42.19.3
-    hooks:
-      - id: renovate-config-validator
-
   - repo: https://github.com/bridgecrewio/checkov.git
     rev: '3.2.495'
     hooks:
@@ -96,6 +91,6 @@ repos:
           - '--quiet'
 
   - repo: https://github.com/gitleaks/gitleaks
-    rev: v8.29.1
+    rev: v8.30.0
     hooks:
       - id: gitleaks

.python-version

@@ -1 +1 @@
-3.14.0
+3.14.1

ansible-lint-fix/action.yml

@@ -77,7 +77,7 @@ runs:
       if: steps.check-files.outputs.files_found == 'true'
       uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
       with:
-        python-version: '3.11'
+        python-version: '3.14'
         cache: 'pip'
 
     - name: Install ansible-lint
@@ -130,6 +130,6 @@ runs:
 
     - name: Upload SARIF Report
       if: steps.check-files.outputs.files_found == 'true'
-      uses: github/codeql-action/upload-sarif@fdbfb4d2750291e159f0156def62b853c2798ca2 # v4.31.5
+      uses: github/codeql-action/upload-sarif@cf1bb45a277cb3c205638b2cd5c984db1c46a412 # v4.31.7
       with:
         sarif_file: ansible-lint.sarif

biome-lint/action.yml

@@ -181,9 +181,9 @@ runs:
         echo "Detected package manager: $package_manager"
 
     - name: Setup Node.js
-      uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
+      uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
       with:
-        node-version: '22'
+        node-version: '24'
 
     - name: Enable Corepack
       shell: sh
@@ -331,7 +331,7 @@ runs:
 
     - name: Upload SARIF Report
       if: inputs.mode == 'check' && always()
-      uses: github/codeql-action/upload-sarif@fdbfb4d2750291e159f0156def62b853c2798ca2 # v4.31.5
+      uses: github/codeql-action/upload-sarif@cf1bb45a277cb3c205638b2cd5c984db1c46a412 # v4.31.7
       with:
         sarif_file: biome-report.sarif
 

codeql-analysis/action.yml

@@ -186,7 +186,7 @@ runs:
         echo "Using build mode: $build_mode"
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@fdbfb4d2750291e159f0156def62b853c2798ca2 # v4.31.5
+      uses: github/codeql-action/init@cf1bb45a277cb3c205638b2cd5c984db1c46a412 # v4.31.7
       with:
         languages: ${{ inputs.language }}
         queries: ${{ inputs.queries }}
@@ -199,12 +199,12 @@ runs:
         threads: ${{ inputs.threads }}
 
     - name: Autobuild
-      uses: github/codeql-action/autobuild@fdbfb4d2750291e159f0156def62b853c2798ca2 # v4.31.5
+      uses: github/codeql-action/autobuild@cf1bb45a277cb3c205638b2cd5c984db1c46a412 # v4.31.7
       if: ${{ steps.set-build-mode.outputs.build-mode == 'autobuild' }}
 
     - name: Perform CodeQL Analysis
       id: analysis
-      uses: github/codeql-action/analyze@fdbfb4d2750291e159f0156def62b853c2798ca2 # v4.31.5
+      uses: github/codeql-action/analyze@cf1bb45a277cb3c205638b2cd5c984db1c46a412 # v4.31.7
       with:
         category: ${{ steps.set-category.outputs.category }}
         upload: ${{ inputs.upload-results }}

compress-images/action.yml

@@ -163,7 +163,7 @@ runs:
 
     - name: Create New Pull Request If Needed
       if: steps.calibre.outputs.markdown != ''
-      uses: peter-evans/create-pull-request@84ae59a2cdc2258d6fa0732dd66352dddae2a412 # v7.0.9
+      uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7.0.11
       with:
         token: ${{ inputs.token }}
         title: 'chore: compress images'

csharp-lint-check/action.yml

@@ -206,6 +206,6 @@ runs:
         fi
 
     - name: Upload SARIF Report
-      uses: github/codeql-action/upload-sarif@fdbfb4d2750291e159f0156def62b853c2798ca2 # v4.31.5
+      uses: github/codeql-action/upload-sarif@cf1bb45a277cb3c205638b2cd5c984db1c46a412 # v4.31.7
       with:
         sarif_file: dotnet-format.sarif

eslint-lint/action.yml

@@ -288,9 +288,9 @@ runs:
         echo "Detected package manager: $package_manager"
 
     - name: Setup Node.js
-      uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
+      uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
       with:
-        node-version: '22'
+        node-version: '24'
 
     - name: Enable Corepack
       shell: sh
@@ -457,7 +457,7 @@ runs:
 
     - name: Upload SARIF Report
       if: inputs.mode == 'check' && inputs.report-format == 'sarif' && always()
-      uses: github/codeql-action/upload-sarif@fdbfb4d2750291e159f0156def62b853c2798ca2 # v4.31.5
+      uses: github/codeql-action/upload-sarif@cf1bb45a277cb3c205638b2cd5c984db1c46a412 # v4.31.7
       with:
         sarif_file: ${{ inputs.working-directory }}/eslint-results.sarif
 

go-lint/action.yml

@@ -414,7 +414,7 @@ runs:
 
     - name: Upload Lint Results
       if: always() && inputs.report-format == 'sarif'
-      uses: github/codeql-action/upload-sarif@fdbfb4d2750291e159f0156def62b853c2798ca2 # v4.31.5
+      uses: github/codeql-action/upload-sarif@cf1bb45a277cb3c205638b2cd5c984db1c46a412 # v4.31.7
       with:
         sarif_file: ${{ inputs.working-directory }}/reports/golangci-lint.sarif
         category: golangci-lint

npm-publish/action.yml

@@ -121,9 +121,9 @@ runs:
         echo "Detected package manager: $package_manager"
 
     - name: Setup Node.js
-      uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
+      uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
       with:
-        node-version: '22'
+        node-version: '24'
 
     - name: Enable Corepack
       shell: sh

php-tests/action.yml

@@ -319,7 +319,7 @@ runs:
 
     - name: Setup PHP
       id: setup-php
-      uses: shivammathur/setup-php@bf6b4fbd49ca58e4608c9c89fba0b8d90bd2a39f # 2.35.5
+      uses: shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1 # 2.36.0
       with:
         php-version: ${{ steps.detect-php-version.outputs.detected-version }}
         extensions: ${{ inputs.extensions }}

pr-lint/action.yml

@@ -57,10 +57,6 @@ runs:
         ref: ${{ github.event.pull_request.head.sha || github.sha }}
         persist-credentials: false
 
-        # If you use VALIDATE_ALL_CODEBASE = true, you can remove this line to
-        # improve performance
-        fetch-depth: 0
-
     #   ╭──────────────────────────────────────────────────────────╮
     #   │               Install packages for linting               │
     #   ╰──────────────────────────────────────────────────────────╯
@@ -74,6 +70,29 @@ runs:
 
         if [ -f package.json ]; then
           printf '%s\n' "found=true" >> "$GITHUB_OUTPUT"
+
+          # Check if packageManager field is set (for corepack)
+          if command -v jq >/dev/null 2>&1; then
+            has_package_manager=$(jq -r '.packageManager // empty' package.json 2>/dev/null || printf '')
+            if [ -n "$has_package_manager" ]; then
+              printf '%s\n' "has-package-manager=true" >> "$GITHUB_OUTPUT"
+              printf 'Found packageManager field: %s\n' "$has_package_manager"
+            else
+              printf '%s\n' "has-package-manager=false" >> "$GITHUB_OUTPUT"
+            fi
+          else
+            # Fallback: check with grep if jq not available
+            # Use robust pattern to verify non-empty value
+            if grep -q '"packageManager"[[:space:]]*:[[:space:]]*"[^"]\+"' package.json 2>/dev/null; then
+              printf '%s\n' "has-package-manager=true" >> "$GITHUB_OUTPUT"
+              printf '%s\n' "Found packageManager field in package.json"
+            else
+              printf '%s\n' "has-package-manager=false" >> "$GITHUB_OUTPUT"
+            fi
+          fi
+        else
+          # Explicitly set has-package-manager to false when package.json doesn't exist
+          printf '%s\n' "has-package-manager=false" >> "$GITHUB_OUTPUT"
         fi
 
     - name: Detect Package Manager
@@ -99,30 +118,35 @@ runs:
 
     - name: Setup Node.js
       if: steps.detect-node.outputs.found == 'true'
-      uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
+      uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
       with:
-        node-version: '22'
+        node-version: '24'
 
     - name: Enable Corepack
-      if: steps.detect-node.outputs.found == 'true'
+      if: steps.detect-node.outputs.found == 'true' && steps.detect-node.outputs.has-package-manager == 'true'
       shell: sh
       run: |
         set -eu
         corepack enable
+        printf '%s\n' "Corepack enabled - package manager will be installed automatically from package.json"
 
-    - name: Install Package Manager
-      if: steps.detect-node.outputs.found == 'true'
+    - name: Install Package Manager (Fallback)
+      if: steps.detect-node.outputs.found == 'true' && steps.detect-node.outputs.has-package-manager == 'false'
       shell: sh
       env:
         PACKAGE_MANAGER: ${{ steps.detect-pm.outputs.package-manager }}
       run: |
         set -eu
 
+        printf 'No packageManager field found, using detected package manager: %s\n' "$PACKAGE_MANAGER"
+
         case "$PACKAGE_MANAGER" in
           pnpm)
+            corepack enable
             corepack prepare pnpm@latest --activate
             ;;
           yarn)
+            corepack enable
             corepack prepare yarn@stable --activate
             ;;
           bun|npm)
@@ -161,9 +185,14 @@ runs:
             pnpm install --frozen-lockfile
             ;;
           "yarn")
-            if [ -f ".yarnrc.yml" ]; then
+            # Detect Yarn version by checking actual version output
+            # Yarn 2+ (Berry) uses --immutable, Yarn 1.x (Classic) uses --frozen-lockfile
+            yarn_version=$(yarn --version 2>/dev/null || printf '1.0.0')
+            if printf '%s' "$yarn_version" | grep -q '^[2-9]'; then
+              # Yarn 2+ (Berry) - use --immutable
               yarn install --immutable
             else
+              # Yarn 1.x (Classic) - use --frozen-lockfile
               yarn install --frozen-lockfile
             fi
             ;;
@@ -306,7 +335,7 @@ runs:
 
     - name: Setup PHP
       if: steps.detect-php.outputs.found == 'true'
-      uses: shivammathur/setup-php@bf6b4fbd49ca58e4608c9c89fba0b8d90bd2a39f # 2.35.5
+      uses: shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1 # 2.36.0
       with:
         php-version: ${{ steps.php-version.outputs.detected-version }}
         tools: composer
@@ -323,7 +352,7 @@ runs:
         set -eu
 
         matcher_path=$(printf '%s' "$RUNNER_TOOL_CACHE/php.json" | tr -d '\n\r')
-        echo "::add-matcher::$matcher_path"
+        printf '%s\n' "::add-matcher::$matcher_path"
 
     - name: Install PHP dependencies
       if: steps.detect-php.outputs.found == 'true'
@@ -349,7 +378,7 @@ runs:
       id: python-version
       shell: sh
       env:
-        DEFAULT_VERSION: '3.11'
+        DEFAULT_VERSION: '3.14'
       run: |
         set -eu
 
@@ -486,7 +515,7 @@ runs:
       id: go-version
       shell: sh
       env:
-        DEFAULT_VERSION: '1.24'
+        DEFAULT_VERSION: '1.25'
       run: |
         set -eu
 
@@ -603,7 +632,7 @@ runs:
     - name: MegaLinter
       # You can override MegaLinter flavor used to have faster performances
       # More info at https://megalinter.io/latest/flavors/
-      uses: oxsecurity/megalinter/flavors/cupcake@62c799d895af9bcbca5eacfebca29d527f125a57 # v9.1.0
+      uses: oxsecurity/megalinter/flavors/cupcake@55a59b24a441e0e1943080d4a512d827710d4a9d # v9.2.0
       id: ml
 
       # All available variables are described in documentation
@@ -621,11 +650,7 @@ runs:
         #     github.event_name == 'push' &&
         #     contains(fromJSON('["refs/heads/main", "refs/heads/master"]'), github.ref)
         #   }}
-        VALIDATE_ALL_CODEBASE: >-
-          ${{
-            github.event_name == 'push' &&
-            contains(fromJSON('["refs/heads/main", "refs/heads/master"]'), github.ref)
-          }}
+        VALIDATE_ALL_CODEBASE: false
 
         GITHUB_TOKEN: ${{ inputs.token || github.token }}
 
@@ -649,13 +674,6 @@ runs:
         # Uncomment to disable copy-paste and spell checks
         DISABLE: COPYPASTE,SPELL
 
-    # Export env vars to make them available for subsequent expressions
-    - name: Export Apply Fixes Variables
-      shell: sh
-      run: |
-        echo "APPLY_FIXES_EVENT=pull_request" >> "$GITHUB_ENV"
-        echo "APPLY_FIXES_MODE=commit" >> "$GITHUB_ENV"
-
     # Upload MegaLinter artifacts
     - name: Archive production artifacts
       if: success() || failure()
@@ -666,112 +684,3 @@ runs:
         path: |
           megalinter-reports
           mega-linter.log
-
-    # Set APPLY_FIXES_IF var for use in future steps
-    - name: Set APPLY_FIXES_IF var
-      shell: sh
-      env:
-        APPLY_FIXES_CONDITION: >-
-          ${{
-            steps.ml.outputs.has_updated_sources == 1 &&
-            (env.APPLY_FIXES_EVENT == 'all' || env.APPLY_FIXES_EVENT == github.event_name) &&
-            (github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository)
-          }}
-      run: |
-        set -eu
-
-        # Sanitize by removing newlines to prevent env var injection
-        sanitized_condition="$(echo "$APPLY_FIXES_CONDITION" | tr -d '\n\r')"
-        printf 'APPLY_FIXES_IF=%s\n' "$sanitized_condition" >> "${GITHUB_ENV}"
-
-    # Set APPLY_FIXES_IF_* vars for use in future steps
-    - name: Set APPLY_FIXES_IF_* vars
-      shell: sh
-      env:
-        APPLY_FIXES_IF_PR_CONDITION: ${{ env.APPLY_FIXES_IF == 'true' && env.APPLY_FIXES_MODE == 'pull_request' }}
-        APPLY_FIXES_IF_COMMIT_CONDITION: ${{ env.APPLY_FIXES_IF == 'true' && env.APPLY_FIXES_MODE == 'commit' && (!contains(fromJSON('["refs/heads/main", "refs/heads/master"]'), github.ref)) }}
-      run: |
-        set -eu
-
-        # Sanitize by removing newlines to prevent env var injection
-        sanitized_pr="$(echo "$APPLY_FIXES_IF_PR_CONDITION" | tr -d '\n\r')"
-        sanitized_commit="$(echo "$APPLY_FIXES_IF_COMMIT_CONDITION" | tr -d '\n\r')"
-
-        printf 'APPLY_FIXES_IF_PR=%s\n' "$sanitized_pr" >> "${GITHUB_ENV}"
-        printf 'APPLY_FIXES_IF_COMMIT=%s\n' "$sanitized_commit" >> "${GITHUB_ENV}"
-
-    # Create pull request if applicable
-    # (for now works only on PR from same repository, not from forks)
-    - name: Create Pull Request with applied fixes
-      uses: peter-evans/create-pull-request@84ae59a2cdc2258d6fa0732dd66352dddae2a412 # v7.0.9
-      id: cpr
-      if: env.APPLY_FIXES_IF_PR == 'true'
-      with:
-        token: ${{ inputs.token || github.token }}
-        commit-message: 'style: apply linter fixes'
-        title: 'style: apply linter fixes'
-        labels: bot
-
-    - name: Create PR output
-      if: env.APPLY_FIXES_IF_PR == 'true'
-      shell: sh
-      env:
-        PR_NUMBER: ${{ steps.cpr.outputs.pull-request-number }}
-        PR_URL: ${{ steps.cpr.outputs.pull-request-url }}
-      run: |
-        set -eu
-
-        printf 'PR Number - %s\n' "$PR_NUMBER"
-        printf 'PR URL - %s\n' "$PR_URL"
-
-    # Push new commit if applicable
-    # (for now works only on PR from same repository, not from forks)
-    - name: Prepare commit
-      if: env.APPLY_FIXES_IF_COMMIT == 'true'
-      shell: sh
-      run: |
-        set -eu
-
-        # Fix .git directory ownership after MegaLinter container execution
-        current_uid=$(id -u)
-        sudo chown -Rc "$current_uid" .git/
-
-        # Ensure we're on the correct branch (not in detached HEAD state)
-        # This is necessary because MegaLinter may leave the repo in a detached HEAD state
-        current_branch=$(git rev-parse --abbrev-ref HEAD)
-        if [ "$current_branch" = "HEAD" ]; then
-          printf '%s\n' "Repository is in detached HEAD state"
-
-          # Get the branch name from git refs (safer than trusting event data)
-          # This finds the branch that points to the current commit
-          branch_ref=$(git for-each-ref --format='%(refname:short)' --points-at=HEAD 'refs/remotes/origin/*' | head -1 | sed 's|^origin/||')
-
-          if [ -z "$branch_ref" ]; then
-            echo "::error::Could not determine branch name from git refs"
-            exit 1
-          fi
-
-          # Validate branch reference to prevent command injection
-          if ! git check-ref-format --branch "$branch_ref"; then
-            echo "::error::Invalid branch reference format: $branch_ref"
-            exit 1
-          fi
-
-          echo "Checking out branch: $branch_ref"
-          git checkout "$branch_ref"
-
-          # Export for next step
-          echo "VALIDATED_BRANCH=$branch_ref" >> "$GITHUB_ENV"
-        else
-          echo "Repository is on branch: $current_branch"
-          echo "VALIDATED_BRANCH=$current_branch" >> "$GITHUB_ENV"
-        fi
-
-    - name: Commit and push applied linter fixes
-      uses: stefanzweifel/git-auto-commit-action@28e16e81777b558cc906c8750092100bbb34c5e3 # v7.0.0
-      if: env.APPLY_FIXES_IF_COMMIT == 'true'
-      with:
-        branch: ${{ env.VALIDATED_BRANCH }}
-        commit_message: 'style: apply linter fixes'
-        commit_user_name: ${{ inputs.username }}
-        commit_user_email: ${{ inputs.email }}

prettier-lint/action.yml

@@ -274,9 +274,9 @@ runs:
         echo "Detected package manager: $package_manager"
 
     - name: Setup Node.js
-      uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
+      uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
       with:
-        node-version: '22'
+        node-version: '24'
 
     - name: Enable Corepack
       shell: sh

python-lint-fix/action.yml

@@ -370,7 +370,7 @@ runs:
 
     - name: Upload SARIF Report
       if: steps.check-files.outputs.result == 'found'
-      uses: github/codeql-action/upload-sarif@fdbfb4d2750291e159f0156def62b853c2798ca2 # v4.31.5
+      uses: github/codeql-action/upload-sarif@cf1bb45a277cb3c205638b2cd5c984db1c46a412 # v4.31.7
       with:
         sarif_file: ${{ inputs.working-directory }}/reports/flake8.sarif
         category: 'python-lint'

security-scan/action.yml

@@ -161,14 +161,14 @@ runs:
 
     - name: Upload Trivy results
       if: steps.verify-sarif.outputs.has_trivy == 'true'
-      uses: github/codeql-action/upload-sarif@fdbfb4d2750291e159f0156def62b853c2798ca2 # v4.31.5
+      uses: github/codeql-action/upload-sarif@cf1bb45a277cb3c205638b2cd5c984db1c46a412 # v4.31.7
       with:
         sarif_file: 'trivy-results.sarif'
         category: 'trivy'
 
     - name: Upload Gitleaks results
       if: steps.verify-sarif.outputs.has_gitleaks == 'true'
-      uses: github/codeql-action/upload-sarif@fdbfb4d2750291e159f0156def62b853c2798ca2 # v4.31.5
+      uses: github/codeql-action/upload-sarif@cf1bb45a277cb3c205638b2cd5c984db1c46a412 # v4.31.7
       with:
         sarif_file: 'gitleaks-report.sarif'
         category: 'gitleaks'

stale/action.yml

@@ -52,7 +52,7 @@ runs:
 
     - name: 🚀 Run stale
       id: stale
-      uses: actions/stale@5f858e3efba33a5ca4407a664cc011ad407f2008 # v10.1.0
+      uses: actions/stale@997185467fa4f803885201cee163a9f38240193d # v10.1.1
       with:
         repo-token: ${{ inputs.token || github.token }}
         days-before-stale: ${{ inputs.days-before-stale }}

terraform-lint-fix/action.yml

@@ -256,7 +256,7 @@ runs:
 
     - name: Upload SARIF Report
       if: steps.check-files.outputs.found == 'true' && inputs.format == 'sarif'
-      uses: github/codeql-action/upload-sarif@fdbfb4d2750291e159f0156def62b853c2798ca2 # v4.31.5
+      uses: github/codeql-action/upload-sarif@cf1bb45a277cb3c205638b2cd5c984db1c46a412 # v4.31.7
       with:
         sarif_file: ${{ env.VALIDATED_WORKING_DIR }}/reports/tflint.sarif
         category: terraform-lint