Skip to content

ci(github-action): update action actions/attest-build-provenance (v2.0.0 βž” v2.4.0) - #24

Merged
renovate[bot] merged 1 commit into
mainfrom
renovate/actions-attest-build-provenance-2.x
Jul 21, 2026
Merged

ci(github-action): update action actions/attest-build-provenance (v2.0.0 βž” v2.4.0)#24
renovate[bot] merged 1 commit into
mainfrom
renovate/actions-attest-build-provenance-2.x

Conversation

@renovate

@renovate renovate Bot commented Jun 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change
actions/attest-build-provenance action minor v2 β†’ v2.4.0

Release Notes

actions/attest-build-provenance (actions/attest-build-provenance)

v2.4.0

Compare Source

What's Changed

Full Changelog: actions/attest-build-provenance@v2.3.0...v2.4.0

v2.3.0

Compare Source

What's Changed

Full Changelog: actions/attest-build-provenance@v2.2.3...v2.3.0

v2.2.3

Compare Source

What's Changed

Full Changelog: actions/attest-build-provenance@v2.2.2...v2.2.3

v2.2.2

Compare Source

What's Changed

Full Changelog: actions/attest-build-provenance@v2.2.1...v2.2.2

v2.2.1

Compare Source

What's Changed

Full Changelog: actions/attest-build-provenance@v2.2.0...v2.2.1

v2.2.0

Compare Source

What's Changed
  • Bump actions/attest from v2.1.0 to v2.2.0 by @​bdehamer in #​449
    • Includes support for now subject-checksums input parameter

Full Changelog: actions/attest-build-provenance@v2.1.0...v2.2.0

v2.1.0

Compare Source

What's Changed

Full Changelog: actions/attest-build-provenance@v2.0.1...v2.1.0

v2.0.1

Compare Source

What's Changed
  • Bump actions/attest from 2.0.0 to 2.0.1 by @​bdehamer in #​406
    • Deduplicate subjects before adding to in-toto statement

Full Changelog: actions/attest-build-provenance@v2.0.0...v2.0.1

Configuration

πŸ“… Schedule: (in timezone Europe/London)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

β™» Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

πŸ”• Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the dependencies Pull requests that update a dependency file label Jun 14, 2026
@github-actions

github-actions Bot commented Jun 14, 2026

Copy link
Copy Markdown
Contributor

Super-linter summary

Language Validation result
GITHUB_ACTIONS Fail ❌
GITHUB_ACTIONS_ZIZMOR Fail ❌
GIT_MERGE_CONFLICT_MARKERS Pass βœ…
PRE_COMMIT Pass βœ…
SPELL_CODESPELL Pass βœ…
YAML Pass βœ…
YAML_PRETTIER Pass βœ…

Super-linter detected linting errors

For more information, see the GitHub Actions workflow run

Powered by Super-linter

GITHUB_ACTIONS 
.github/workflows/build-and-push.yaml:38:9: shellcheck reported issue in this script: SC2086:info:2:30: Double quote to prevent globbing and word splitting [shellcheck]
   |
38 |         run: |
   |         ^~~~
.github/workflows/build-and-push.yaml:38:9: shellcheck reported issue in this script: SC2086:info:3:20: Double quote to prevent globbing and word splitting [shellcheck]
   |
38 |         run: |
   |         ^~~~
.github/workflows/build-and-push.yaml:38:9: shellcheck reported issue in this script: SC2086:info:3:48: Double quote to prevent globbing and word splitting [shellcheck]
   |
38 |         run: |
   |         ^~~~
.github/workflows/build-and-push.yaml:38:9: shellcheck reported issue in this script: SC2086:info:4:20: Double quote to prevent globbing and word splitting [shellcheck]
   |
38 |         run: |
   |         ^~~~
.github/workflows/build-and-push.yaml:38:9: shellcheck reported issue in this script: SC2086:info:4:50: Double quote to prevent globbing and word splitting [shellcheck]
   |
38 |         run: |
   |         ^~~~
.github/workflows/build-and-push.yaml:38:9: shellcheck reported issue in this script: SC2129:style:2:1: Consider using { cmd1; cmd2; } >> file instead of individual redirects [shellcheck]
   |
38 |         run: |
   |         ^~~~
.github/workflows/build-and-push.yaml:104:9: shellcheck reported issue in this script: SC2086:info:10:52: Double quote to prevent globbing and word splitting [shellcheck]
    |
104 |         run: |
    |         ^~~~
.github/workflows/build-and-push.yaml:104:9: shellcheck reported issue in this script: SC2086:info:12:48: Double quote to prevent globbing and word splitting [shellcheck]
    |
104 |         run: |
    |         ^~~~
.github/workflows/build-and-push.yaml:104:9: shellcheck reported issue in this script: SC2086:info:14:18: Double quote to prevent globbing and word splitting [shellcheck]
    |
104 |         run: |
    |         ^~~~
.github/workflows/build-and-push.yaml:104:9: shellcheck reported issue in this script: SC2086:info:1:29: Double quote to prevent globbing and word splitting [shellcheck]
    |
104 |         run: |
    |         ^~~~
.github/workflows/build-and-push.yaml:104:9: shellcheck reported issue in this script: SC2086:info:2:12: Double quote to prevent globbing and word splitting [shellcheck]
    |
104 |         run: |
    |         ^~~~
.github/workflows/build-and-push.yaml:104:9: shellcheck reported issue in this script: SC2086:info:3:68: Double quote to prevent globbing and word splitting [shellcheck]
    |
104 |         run: |
    |         ^~~~
.github/workflows/build-and-push.yaml:104:9: shellcheck reported issue in this script: SC2086:info:4:65: Double quote to prevent globbing and word splitting [shellcheck]
    |
104 |         run: |
    |         ^~~~
.github/workflows/build-and-push.yaml:104:9: shellcheck reported issue in this script: SC2086:info:5:61: Double quote to prevent globbing and word splitting [shellcheck]
    |
104 |         run: |
    |         ^~~~
.github/workflows/build-and-push.yaml:104:9: shellcheck reported issue in this script: SC2086:info:6:12: Double quote to prevent globbing and word splitting [shellcheck]
    |
104 |         run: |
    |         ^~~~
.github/workflows/build-and-push.yaml:104:9: shellcheck reported issue in this script: SC2086:info:7:20: Double quote to prevent globbing and word splitting [shellcheck]
    |
104 |         run: |
    |         ^~~~
.github/workflows/build-and-push.yaml:104:9: shellcheck reported issue in this script: SC2086:info:8:18: Double quote to prevent globbing and word splitting [shellcheck]
    |
104 |         run: |
    |         ^~~~
.github/workflows/build-and-push.yaml:104:9: shellcheck reported issue in this script: SC2129:style:1:1: Consider using { cmd1; cmd2; } >> file instead of individual redirects [shellcheck]
    |
104 |         run: |
    |         ^~~~
GITHUB_ACTIONS_ZIZMOR 
οΏ½[1mοΏ½[33mwarning[artipacked]οΏ½[0mοΏ½[1m: credential persistence through GitHub Actions artifactsοΏ½[0m
  οΏ½[1mοΏ½[94m--> οΏ½[0m/github/workspace/.github/workflows/build-and-push.yaml:33:9
   οΏ½[1mοΏ½[94m|οΏ½[0m
οΏ½[1mοΏ½[94m33οΏ½[0m οΏ½[1mοΏ½[94m|οΏ½[0m         - name: Checkout
   οΏ½[1mοΏ½[94m|οΏ½[0m οΏ½[1mοΏ½[33m _________^οΏ½[0m
οΏ½[1mοΏ½[94m34οΏ½[0m οΏ½[1mοΏ½[94m|οΏ½[0m οΏ½[1mοΏ½[33m|οΏ½[0m         uses: actions/checkout@v4
   οΏ½[1mοΏ½[94m|οΏ½[0m οΏ½[1mοΏ½[33m|_________________________________^οΏ½[0m οΏ½[1mοΏ½[33mdoes not set persist-credentials: falseοΏ½[0m
   οΏ½[1mοΏ½[94m|οΏ½[0m
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: audit confidence β†’ Low
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: this finding has an auto-fix
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mhelpοΏ½[0m: audit documentation β†’ οΏ½[32mhttps://docs.zizmor.sh/audits/#artipackedοΏ½[39m

οΏ½[1mοΏ½[96mhelp[template-injection]οΏ½[0mοΏ½[1m: code injection via template expansionοΏ½[0m
   οΏ½[1mοΏ½[94m--> οΏ½[0m/github/workspace/.github/workflows/build-and-push.yaml:107:54
    οΏ½[1mοΏ½[94m|οΏ½[0m
οΏ½[1mοΏ½[94m104οΏ½[0m οΏ½[1mοΏ½[94m|οΏ½[0m         run: |
    οΏ½[1mοΏ½[94m|οΏ½[0m         οΏ½[1mοΏ½[94m---οΏ½[0m οΏ½[1mοΏ½[94mthis run blockοΏ½[0m
οΏ½[1mοΏ½[94m...οΏ½[0m
οΏ½[1mοΏ½[94m107οΏ½[0m οΏ½[1mοΏ½[94m|οΏ½[0m           echo "**Image**: \`${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}\`" >> $GITHUB_STEP_SUMMARY
    οΏ½[1mοΏ½[94m|οΏ½[0m                                                      οΏ½[1mοΏ½[96m^^^^^^^^^^^^^^οΏ½[0m οΏ½[1mοΏ½[96mmay expand into attacker-controllable codeοΏ½[0m
    οΏ½[1mοΏ½[94m|οΏ½[0m
    οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: audit confidence β†’ High
    οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: this finding has an auto-fix
    οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mhelpοΏ½[0m: audit documentation β†’ οΏ½[32mhttps://docs.zizmor.sh/audits/#template-injectionοΏ½[39m

οΏ½[1mοΏ½[94minfo[template-injection]οΏ½[0mοΏ½[1m: code injection via template expansionοΏ½[0m
   οΏ½[1mοΏ½[94m--> οΏ½[0m/github/workspace/.github/workflows/build-and-push.yaml:108:36
    οΏ½[1mοΏ½[94m|οΏ½[0m
οΏ½[1mοΏ½[94m104οΏ½[0m οΏ½[1mοΏ½[94m|οΏ½[0m         run: |
    οΏ½[1mοΏ½[94m|οΏ½[0m         οΏ½[1mοΏ½[94m---οΏ½[0m οΏ½[1mοΏ½[94mthis run blockοΏ½[0m
οΏ½[1mοΏ½[94m...οΏ½[0m
οΏ½[1mοΏ½[94m108οΏ½[0m οΏ½[1mοΏ½[94m|οΏ½[0m           echo "**Version**: \`${{ steps.version.outputs.version }}\`" >> $GITHUB_STEP_SUMMARY
    οΏ½[1mοΏ½[94m|οΏ½[0m                                    οΏ½[1mοΏ½[94m^^^^^^^^^^^^^^^^^^^^^^^^^^^^^οΏ½[0m οΏ½[1mοΏ½[94mmay expand into attacker-controllable codeοΏ½[0m
    οΏ½[1mοΏ½[94m|οΏ½[0m
    οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: audit confidence β†’ Low
    οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: this finding has an auto-fix
    οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mhelpοΏ½[0m: audit documentation β†’ οΏ½[32mhttps://docs.zizmor.sh/audits/#template-injectionοΏ½[39m

οΏ½[1mοΏ½[94minfo[template-injection]οΏ½[0mοΏ½[1m: code injection via template expansionοΏ½[0m
   οΏ½[1mοΏ½[94m--> οΏ½[0m/github/workspace/.github/workflows/build-and-push.yaml:109:35
    οΏ½[1mοΏ½[94m|οΏ½[0m
οΏ½[1mοΏ½[94m104οΏ½[0m οΏ½[1mοΏ½[94m|οΏ½[0m         run: |
    οΏ½[1mοΏ½[94m|οΏ½[0m         οΏ½[1mοΏ½[94m---οΏ½[0m οΏ½[1mοΏ½[94mthis run blockοΏ½[0m
οΏ½[1mοΏ½[94m...οΏ½[0m
οΏ½[1mοΏ½[94m109οΏ½[0m οΏ½[1mοΏ½[94m|οΏ½[0m           echo "**Digest**: \`${{ steps.build.outputs.digest }}\`" >> $GITHUB_STEP_SUMMARY
    οΏ½[1mοΏ½[94m|οΏ½[0m                                   οΏ½[1mοΏ½[94m^^^^^^^^^^^^^^^^^^^^^^^^^^οΏ½[0m οΏ½[1mοΏ½[94mmay expand into attacker-controllable codeοΏ½[0m
    οΏ½[1mοΏ½[94m|οΏ½[0m
    οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: audit confidence β†’ Low
    οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: this finding has an auto-fix
    οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mhelpοΏ½[0m: audit documentation β†’ οΏ½[32mhttps://docs.zizmor.sh/audits/#template-injectionοΏ½[39m

οΏ½[1mοΏ½[94minfo[template-injection]οΏ½[0mοΏ½[1m: code injection via template expansionοΏ½[0m
   οΏ½[1mοΏ½[94m--> οΏ½[0m/github/workspace/.github/workflows/build-and-push.yaml:114:23
    οΏ½[1mοΏ½[94m|οΏ½[0m
οΏ½[1mοΏ½[94m104οΏ½[0m οΏ½[1mοΏ½[94m|οΏ½[0m         run: |
    οΏ½[1mοΏ½[94m|οΏ½[0m         οΏ½[1mοΏ½[94m---οΏ½[0m οΏ½[1mοΏ½[94mthis run blockοΏ½[0m
οΏ½[1mοΏ½[94m...οΏ½[0m
οΏ½[1mοΏ½[94m114οΏ½[0m οΏ½[1mοΏ½[94m|οΏ½[0m             echo "${{ steps.meta-release.outputs.tags }}" >> $GITHUB_STEP_SUMMARY
    οΏ½[1mοΏ½[94m|οΏ½[0m                       οΏ½[1mοΏ½[94m^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^οΏ½[0m οΏ½[1mοΏ½[94mmay expand into attacker-controllable codeοΏ½[0m
    οΏ½[1mοΏ½[94m|οΏ½[0m
    οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: audit confidence β†’ Low
    οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: this finding has an auto-fix
    οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mhelpοΏ½[0m: audit documentation β†’ οΏ½[32mhttps://docs.zizmor.sh/audits/#template-injectionοΏ½[39m

οΏ½[1mοΏ½[94minfo[template-injection]οΏ½[0mοΏ½[1m: code injection via template expansionοΏ½[0m
   οΏ½[1mοΏ½[94m--> οΏ½[0m/github/workspace/.github/workflows/build-and-push.yaml:116:23
    οΏ½[1mοΏ½[94m|οΏ½[0m
οΏ½[1mοΏ½[94m104οΏ½[0m οΏ½[1mοΏ½[94m|οΏ½[0m         run: |
    οΏ½[1mοΏ½[94m|οΏ½[0m         οΏ½[1mοΏ½[94m---οΏ½[0m οΏ½[1mοΏ½[94mthis run blockοΏ½[0m
οΏ½[1mοΏ½[94m...οΏ½[0m
οΏ½[1mοΏ½[94m116οΏ½[0m οΏ½[1mοΏ½[94m|οΏ½[0m             echo "${{ steps.meta-dev.outputs.tags }}" >> $GITHUB_STEP_SUMMARY
    οΏ½[1mοΏ½[94m|οΏ½[0m                       οΏ½[1mοΏ½[94m^^^^^^^^^^^^^^^^^^^^^^^^^^^οΏ½[0m οΏ½[1mοΏ½[94mmay expand into attacker-controllable codeοΏ½[0m
    οΏ½[1mοΏ½[94m|οΏ½[0m
    οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: audit confidence β†’ Low
    οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: this finding has an auto-fix
    οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mhelpοΏ½[0m: audit documentation β†’ οΏ½[32mhttps://docs.zizmor.sh/audits/#template-injectionοΏ½[39m

οΏ½[1mοΏ½[91merror[unpinned-uses]οΏ½[0mοΏ½[1m: unpinned action referenceοΏ½[0m
  οΏ½[1mοΏ½[94m--> οΏ½[0m/github/workspace/.github/workflows/build-and-push.yaml:34:15
   οΏ½[1mοΏ½[94m|οΏ½[0m
οΏ½[1mοΏ½[94m34οΏ½[0m οΏ½[1mοΏ½[94m|οΏ½[0m         uses: actions/checkout@v4
   οΏ½[1mοΏ½[94m|οΏ½[0m               οΏ½[1mοΏ½[91m^^^^^^^^^^^^^^^^^^^οΏ½[0m οΏ½[1mοΏ½[91maction is not pinned to a hash (required by blanket policy)οΏ½[0m
   οΏ½[1mοΏ½[94m|οΏ½[0m
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: audit confidence β†’ High
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: this finding has an auto-fix
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mhelpοΏ½[0m: audit documentation β†’ οΏ½[32mhttps://docs.zizmor.sh/audits/#unpinned-usesοΏ½[39m

οΏ½[1mοΏ½[91merror[unpinned-uses]οΏ½[0mοΏ½[1m: unpinned action referenceοΏ½[0m
  οΏ½[1mοΏ½[94m--> οΏ½[0m/github/workspace/.github/workflows/build-and-push.yaml:45:15
   οΏ½[1mοΏ½[94m|οΏ½[0m
οΏ½[1mοΏ½[94m45οΏ½[0m οΏ½[1mοΏ½[94m|οΏ½[0m         uses: docker/setup-qemu-action@v3
   οΏ½[1mοΏ½[94m|οΏ½[0m               οΏ½[1mοΏ½[91m^^^^^^^^^^^^^^^^^^^^^^^^^^^οΏ½[0m οΏ½[1mοΏ½[91maction is not pinned to a hash (required by blanket policy)οΏ½[0m
   οΏ½[1mοΏ½[94m|οΏ½[0m
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: audit confidence β†’ High
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: this finding has an auto-fix
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mhelpοΏ½[0m: audit documentation β†’ οΏ½[32mhttps://docs.zizmor.sh/audits/#unpinned-usesοΏ½[39m

οΏ½[1mοΏ½[91merror[unpinned-uses]οΏ½[0mοΏ½[1m: unpinned action referenceοΏ½[0m
  οΏ½[1mοΏ½[94m--> οΏ½[0m/github/workspace/.github/workflows/build-and-push.yaml:48:15
   οΏ½[1mοΏ½[94m|οΏ½[0m
οΏ½[1mοΏ½[94m48οΏ½[0m οΏ½[1mοΏ½[94m|οΏ½[0m         uses: docker/setup-buildx-action@v3
   οΏ½[1mοΏ½[94m|οΏ½[0m               οΏ½[1mοΏ½[91m^^^^^^^^^^^^^^^^^^^^^^^^^^^^^οΏ½[0m οΏ½[1mοΏ½[91maction is not pinned to a hash (required by blanket policy)οΏ½[0m
   οΏ½[1mοΏ½[94m|οΏ½[0m
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: audit confidence β†’ High
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: this finding has an auto-fix
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mhelpοΏ½[0m: audit documentation β†’ οΏ½[32mhttps://docs.zizmor.sh/audits/#unpinned-usesοΏ½[39m

οΏ½[1mοΏ½[91merror[unpinned-uses]οΏ½[0mοΏ½[1m: unpinned action referenceοΏ½[0m
  οΏ½[1mοΏ½[94m--> οΏ½[0m/github/workspace/.github/workflows/build-and-push.yaml:51:15
   οΏ½[1mοΏ½[94m|οΏ½[0m
οΏ½[1mοΏ½[94m51οΏ½[0m οΏ½[1mοΏ½[94m|οΏ½[0m         uses: docker/login-action@v3
   οΏ½[1mοΏ½[94m|οΏ½[0m               οΏ½[1mοΏ½[91m^^^^^^^^^^^^^^^^^^^^^^οΏ½[0m οΏ½[1mοΏ½[91maction is not pinned to a hash (required by blanket policy)οΏ½[0m
   οΏ½[1mοΏ½[94m|οΏ½[0m
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: audit confidence β†’ High
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: this finding has an auto-fix
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mhelpοΏ½[0m: audit documentation β†’ οΏ½[32mhttps://docs.zizmor.sh/audits/#unpinned-usesοΏ½[39m

οΏ½[1mοΏ½[91merror[unpinned-uses]οΏ½[0mοΏ½[1m: unpinned action referenceοΏ½[0m
  οΏ½[1mοΏ½[94m--> οΏ½[0m/github/workspace/.github/workflows/build-and-push.yaml:60:15
   οΏ½[1mοΏ½[94m|οΏ½[0m
οΏ½[1mοΏ½[94m60οΏ½[0m οΏ½[1mοΏ½[94m|οΏ½[0m         uses: docker/metadata-action@v5
   οΏ½[1mοΏ½[94m|οΏ½[0m               οΏ½[1mοΏ½[91m^^^^^^^^^^^^^^^^^^^^^^^^^οΏ½[0m οΏ½[1mοΏ½[91maction is not pinned to a hash (required by blanket policy)οΏ½[0m
   οΏ½[1mοΏ½[94m|οΏ½[0m
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: audit confidence β†’ High
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: this finding has an auto-fix
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mhelpοΏ½[0m: audit documentation β†’ οΏ½[32mhttps://docs.zizmor.sh/audits/#unpinned-usesοΏ½[39m

οΏ½[1mοΏ½[91merror[unpinned-uses]οΏ½[0mοΏ½[1m: unpinned action referenceοΏ½[0m
  οΏ½[1mοΏ½[94m--> οΏ½[0m/github/workspace/.github/workflows/build-and-push.yaml:72:15
   οΏ½[1mοΏ½[94m|οΏ½[0m
οΏ½[1mοΏ½[94m72οΏ½[0m οΏ½[1mοΏ½[94m|οΏ½[0m         uses: docker/metadata-action@v5
   οΏ½[1mοΏ½[94m|οΏ½[0m               οΏ½[1mοΏ½[91m^^^^^^^^^^^^^^^^^^^^^^^^^οΏ½[0m οΏ½[1mοΏ½[91maction is not pinned to a hash (required by blanket policy)οΏ½[0m
   οΏ½[1mοΏ½[94m|οΏ½[0m
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: audit confidence β†’ High
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: this finding has an auto-fix
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mhelpοΏ½[0m: audit documentation β†’ οΏ½[32mhttps://docs.zizmor.sh/audits/#unpinned-usesοΏ½[39m

οΏ½[1mοΏ½[91merror[unpinned-uses]οΏ½[0mοΏ½[1m: unpinned action referenceοΏ½[0m
  οΏ½[1mοΏ½[94m--> οΏ½[0m/github/workspace/.github/workflows/build-and-push.yaml:85:15
   οΏ½[1mοΏ½[94m|οΏ½[0m
οΏ½[1mοΏ½[94m85οΏ½[0m οΏ½[1mοΏ½[94m|οΏ½[0m         uses: docker/build-push-action@v6
   οΏ½[1mοΏ½[94m|οΏ½[0m               οΏ½[1mοΏ½[91m^^^^^^^^^^^^^^^^^^^^^^^^^^^οΏ½[0m οΏ½[1mοΏ½[91maction is not pinned to a hash (required by blanket policy)οΏ½[0m
   οΏ½[1mοΏ½[94m|οΏ½[0m
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: audit confidence β†’ High
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: this finding has an auto-fix
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mhelpοΏ½[0m: audit documentation β†’ οΏ½[32mhttps://docs.zizmor.sh/audits/#unpinned-usesοΏ½[39m

�[32m18�[39m findings (�[1m�[93m5�[39m suppressed, �[92m13�[39m fixable�[0m): �[35m4�[39m informational, �[36m1�[39m low, �[33m1�[39m medium, �[31m7�[39m high🌈 zizmor v1.23.1
�[32m INFO�[0m �[1maudit�[0m�[2m:�[0m �[2mzizmor�[0m�[2m:�[0m 🌈 completed /github/workspace/.github/workflows/build-and-push.yaml

@renovate
renovate Bot force-pushed the renovate/actions-attest-build-provenance-2.x branch from 39745eb to 4efa624 Compare June 18, 2026 18:41
@github-actions

github-actions Bot commented Jun 18, 2026

Copy link
Copy Markdown
Contributor

Super-linter summary

Language Validation result
GITHUB_ACTIONS Fail ❌
GITHUB_ACTIONS_ZIZMOR Fail ❌
GIT_MERGE_CONFLICT_MARKERS Pass βœ…
PRE_COMMIT Pass βœ…
SPELL_CODESPELL Pass βœ…
YAML Pass βœ…
YAML_PRETTIER Pass βœ…

Super-linter detected linting errors

For more information, see the GitHub Actions workflow run

Powered by Super-linter

GITHUB_ACTIONS 
.github/workflows/build-and-push.yaml:38:9: shellcheck reported issue in this script: SC2086:info:2:30: Double quote to prevent globbing and word splitting [shellcheck]
   |
38 |         run: |
   |         ^~~~
.github/workflows/build-and-push.yaml:38:9: shellcheck reported issue in this script: SC2086:info:3:20: Double quote to prevent globbing and word splitting [shellcheck]
   |
38 |         run: |
   |         ^~~~
.github/workflows/build-and-push.yaml:38:9: shellcheck reported issue in this script: SC2086:info:3:48: Double quote to prevent globbing and word splitting [shellcheck]
   |
38 |         run: |
   |         ^~~~
.github/workflows/build-and-push.yaml:38:9: shellcheck reported issue in this script: SC2086:info:4:20: Double quote to prevent globbing and word splitting [shellcheck]
   |
38 |         run: |
   |         ^~~~
.github/workflows/build-and-push.yaml:38:9: shellcheck reported issue in this script: SC2086:info:4:50: Double quote to prevent globbing and word splitting [shellcheck]
   |
38 |         run: |
   |         ^~~~
.github/workflows/build-and-push.yaml:38:9: shellcheck reported issue in this script: SC2129:style:2:1: Consider using { cmd1; cmd2; } >> file instead of individual redirects [shellcheck]
   |
38 |         run: |
   |         ^~~~
.github/workflows/build-and-push.yaml:104:9: shellcheck reported issue in this script: SC2086:info:10:52: Double quote to prevent globbing and word splitting [shellcheck]
    |
104 |         run: |
    |         ^~~~
.github/workflows/build-and-push.yaml:104:9: shellcheck reported issue in this script: SC2086:info:12:48: Double quote to prevent globbing and word splitting [shellcheck]
    |
104 |         run: |
    |         ^~~~
.github/workflows/build-and-push.yaml:104:9: shellcheck reported issue in this script: SC2086:info:14:18: Double quote to prevent globbing and word splitting [shellcheck]
    |
104 |         run: |
    |         ^~~~
.github/workflows/build-and-push.yaml:104:9: shellcheck reported issue in this script: SC2086:info:1:29: Double quote to prevent globbing and word splitting [shellcheck]
    |
104 |         run: |
    |         ^~~~
.github/workflows/build-and-push.yaml:104:9: shellcheck reported issue in this script: SC2086:info:2:12: Double quote to prevent globbing and word splitting [shellcheck]
    |
104 |         run: |
    |         ^~~~
.github/workflows/build-and-push.yaml:104:9: shellcheck reported issue in this script: SC2086:info:3:68: Double quote to prevent globbing and word splitting [shellcheck]
    |
104 |         run: |
    |         ^~~~
.github/workflows/build-and-push.yaml:104:9: shellcheck reported issue in this script: SC2086:info:4:65: Double quote to prevent globbing and word splitting [shellcheck]
    |
104 |         run: |
    |         ^~~~
.github/workflows/build-and-push.yaml:104:9: shellcheck reported issue in this script: SC2086:info:5:61: Double quote to prevent globbing and word splitting [shellcheck]
    |
104 |         run: |
    |         ^~~~
.github/workflows/build-and-push.yaml:104:9: shellcheck reported issue in this script: SC2086:info:6:12: Double quote to prevent globbing and word splitting [shellcheck]
    |
104 |         run: |
    |         ^~~~
.github/workflows/build-and-push.yaml:104:9: shellcheck reported issue in this script: SC2086:info:7:20: Double quote to prevent globbing and word splitting [shellcheck]
    |
104 |         run: |
    |         ^~~~
.github/workflows/build-and-push.yaml:104:9: shellcheck reported issue in this script: SC2086:info:8:18: Double quote to prevent globbing and word splitting [shellcheck]
    |
104 |         run: |
    |         ^~~~
.github/workflows/build-and-push.yaml:104:9: shellcheck reported issue in this script: SC2129:style:1:1: Consider using { cmd1; cmd2; } >> file instead of individual redirects [shellcheck]
    |
104 |         run: |
    |         ^~~~
GITHUB_ACTIONS_ZIZMOR 
οΏ½[1mοΏ½[33mwarning[artipacked]οΏ½[0mοΏ½[1m: credential persistence through GitHub Actions artifactsοΏ½[0m
  οΏ½[1mοΏ½[94m--> οΏ½[0m/github/workspace/.github/workflows/build-and-push.yaml:33:9
   οΏ½[1mοΏ½[94m|οΏ½[0m
οΏ½[1mοΏ½[94m33οΏ½[0m οΏ½[1mοΏ½[94m|οΏ½[0m         - name: Checkout
   οΏ½[1mοΏ½[94m|οΏ½[0m οΏ½[1mοΏ½[33m _________^οΏ½[0m
οΏ½[1mοΏ½[94m34οΏ½[0m οΏ½[1mοΏ½[94m|οΏ½[0m οΏ½[1mοΏ½[33m|οΏ½[0m         uses: actions/checkout@v4
   οΏ½[1mοΏ½[94m|οΏ½[0m οΏ½[1mοΏ½[33m|_________________________________^οΏ½[0m οΏ½[1mοΏ½[33mdoes not set persist-credentials: falseοΏ½[0m
   οΏ½[1mοΏ½[94m|οΏ½[0m
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: audit confidence β†’ Low
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: this finding has an auto-fix
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mhelpοΏ½[0m: audit documentation β†’ οΏ½[32mhttps://docs.zizmor.sh/audits/#artipackedοΏ½[39m

οΏ½[1mοΏ½[96mhelp[template-injection]οΏ½[0mοΏ½[1m: code injection via template expansionοΏ½[0m
   οΏ½[1mοΏ½[94m--> οΏ½[0m/github/workspace/.github/workflows/build-and-push.yaml:107:54
    οΏ½[1mοΏ½[94m|οΏ½[0m
οΏ½[1mοΏ½[94m104οΏ½[0m οΏ½[1mοΏ½[94m|οΏ½[0m         run: |
    οΏ½[1mοΏ½[94m|οΏ½[0m         οΏ½[1mοΏ½[94m---οΏ½[0m οΏ½[1mοΏ½[94mthis run blockοΏ½[0m
οΏ½[1mοΏ½[94m...οΏ½[0m
οΏ½[1mοΏ½[94m107οΏ½[0m οΏ½[1mοΏ½[94m|οΏ½[0m           echo "**Image**: \`${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}\`" >> $GITHUB_STEP_SUMMARY
    οΏ½[1mοΏ½[94m|οΏ½[0m                                                      οΏ½[1mοΏ½[96m^^^^^^^^^^^^^^οΏ½[0m οΏ½[1mοΏ½[96mmay expand into attacker-controllable codeοΏ½[0m
    οΏ½[1mοΏ½[94m|οΏ½[0m
    οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: audit confidence β†’ High
    οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: this finding has an auto-fix
    οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mhelpοΏ½[0m: audit documentation β†’ οΏ½[32mhttps://docs.zizmor.sh/audits/#template-injectionοΏ½[39m

οΏ½[1mοΏ½[94minfo[template-injection]οΏ½[0mοΏ½[1m: code injection via template expansionοΏ½[0m
   οΏ½[1mοΏ½[94m--> οΏ½[0m/github/workspace/.github/workflows/build-and-push.yaml:108:36
    οΏ½[1mοΏ½[94m|οΏ½[0m
οΏ½[1mοΏ½[94m104οΏ½[0m οΏ½[1mοΏ½[94m|οΏ½[0m         run: |
    οΏ½[1mοΏ½[94m|οΏ½[0m         οΏ½[1mοΏ½[94m---οΏ½[0m οΏ½[1mοΏ½[94mthis run blockοΏ½[0m
οΏ½[1mοΏ½[94m...οΏ½[0m
οΏ½[1mοΏ½[94m108οΏ½[0m οΏ½[1mοΏ½[94m|οΏ½[0m           echo "**Version**: \`${{ steps.version.outputs.version }}\`" >> $GITHUB_STEP_SUMMARY
    οΏ½[1mοΏ½[94m|οΏ½[0m                                    οΏ½[1mοΏ½[94m^^^^^^^^^^^^^^^^^^^^^^^^^^^^^οΏ½[0m οΏ½[1mοΏ½[94mmay expand into attacker-controllable codeοΏ½[0m
    οΏ½[1mοΏ½[94m|οΏ½[0m
    οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: audit confidence β†’ Low
    οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: this finding has an auto-fix
    οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mhelpοΏ½[0m: audit documentation β†’ οΏ½[32mhttps://docs.zizmor.sh/audits/#template-injectionοΏ½[39m

οΏ½[1mοΏ½[94minfo[template-injection]οΏ½[0mοΏ½[1m: code injection via template expansionοΏ½[0m
   οΏ½[1mοΏ½[94m--> οΏ½[0m/github/workspace/.github/workflows/build-and-push.yaml:109:35
    οΏ½[1mοΏ½[94m|οΏ½[0m
οΏ½[1mοΏ½[94m104οΏ½[0m οΏ½[1mοΏ½[94m|οΏ½[0m         run: |
    οΏ½[1mοΏ½[94m|οΏ½[0m         οΏ½[1mοΏ½[94m---οΏ½[0m οΏ½[1mοΏ½[94mthis run blockοΏ½[0m
οΏ½[1mοΏ½[94m...οΏ½[0m
οΏ½[1mοΏ½[94m109οΏ½[0m οΏ½[1mοΏ½[94m|οΏ½[0m           echo "**Digest**: \`${{ steps.build.outputs.digest }}\`" >> $GITHUB_STEP_SUMMARY
    οΏ½[1mοΏ½[94m|οΏ½[0m                                   οΏ½[1mοΏ½[94m^^^^^^^^^^^^^^^^^^^^^^^^^^οΏ½[0m οΏ½[1mοΏ½[94mmay expand into attacker-controllable codeοΏ½[0m
    οΏ½[1mοΏ½[94m|οΏ½[0m
    οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: audit confidence β†’ Low
    οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: this finding has an auto-fix
    οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mhelpοΏ½[0m: audit documentation β†’ οΏ½[32mhttps://docs.zizmor.sh/audits/#template-injectionοΏ½[39m

οΏ½[1mοΏ½[94minfo[template-injection]οΏ½[0mοΏ½[1m: code injection via template expansionοΏ½[0m
   οΏ½[1mοΏ½[94m--> οΏ½[0m/github/workspace/.github/workflows/build-and-push.yaml:114:23
    οΏ½[1mοΏ½[94m|οΏ½[0m
οΏ½[1mοΏ½[94m104οΏ½[0m οΏ½[1mοΏ½[94m|οΏ½[0m         run: |
    οΏ½[1mοΏ½[94m|οΏ½[0m         οΏ½[1mοΏ½[94m---οΏ½[0m οΏ½[1mοΏ½[94mthis run blockοΏ½[0m
οΏ½[1mοΏ½[94m...οΏ½[0m
οΏ½[1mοΏ½[94m114οΏ½[0m οΏ½[1mοΏ½[94m|οΏ½[0m             echo "${{ steps.meta-release.outputs.tags }}" >> $GITHUB_STEP_SUMMARY
    οΏ½[1mοΏ½[94m|οΏ½[0m                       οΏ½[1mοΏ½[94m^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^οΏ½[0m οΏ½[1mοΏ½[94mmay expand into attacker-controllable codeοΏ½[0m
    οΏ½[1mοΏ½[94m|οΏ½[0m
    οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: audit confidence β†’ Low
    οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: this finding has an auto-fix
    οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mhelpοΏ½[0m: audit documentation β†’ οΏ½[32mhttps://docs.zizmor.sh/audits/#template-injectionοΏ½[39m

οΏ½[1mοΏ½[94minfo[template-injection]οΏ½[0mοΏ½[1m: code injection via template expansionοΏ½[0m
   οΏ½[1mοΏ½[94m--> οΏ½[0m/github/workspace/.github/workflows/build-and-push.yaml:116:23
    οΏ½[1mοΏ½[94m|οΏ½[0m
οΏ½[1mοΏ½[94m104οΏ½[0m οΏ½[1mοΏ½[94m|οΏ½[0m         run: |
    οΏ½[1mοΏ½[94m|οΏ½[0m         οΏ½[1mοΏ½[94m---οΏ½[0m οΏ½[1mοΏ½[94mthis run blockοΏ½[0m
οΏ½[1mοΏ½[94m...οΏ½[0m
οΏ½[1mοΏ½[94m116οΏ½[0m οΏ½[1mοΏ½[94m|οΏ½[0m             echo "${{ steps.meta-dev.outputs.tags }}" >> $GITHUB_STEP_SUMMARY
    οΏ½[1mοΏ½[94m|οΏ½[0m                       οΏ½[1mοΏ½[94m^^^^^^^^^^^^^^^^^^^^^^^^^^^οΏ½[0m οΏ½[1mοΏ½[94mmay expand into attacker-controllable codeοΏ½[0m
    οΏ½[1mοΏ½[94m|οΏ½[0m
    οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: audit confidence β†’ Low
    οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: this finding has an auto-fix
    οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mhelpοΏ½[0m: audit documentation β†’ οΏ½[32mhttps://docs.zizmor.sh/audits/#template-injectionοΏ½[39m

οΏ½[1mοΏ½[91merror[unpinned-uses]οΏ½[0mοΏ½[1m: unpinned action referenceοΏ½[0m
  οΏ½[1mοΏ½[94m--> οΏ½[0m/github/workspace/.github/workflows/build-and-push.yaml:34:15
   οΏ½[1mοΏ½[94m|οΏ½[0m
οΏ½[1mοΏ½[94m34οΏ½[0m οΏ½[1mοΏ½[94m|οΏ½[0m         uses: actions/checkout@v4
   οΏ½[1mοΏ½[94m|οΏ½[0m               οΏ½[1mοΏ½[91m^^^^^^^^^^^^^^^^^^^οΏ½[0m οΏ½[1mοΏ½[91maction is not pinned to a hash (required by blanket policy)οΏ½[0m
   οΏ½[1mοΏ½[94m|οΏ½[0m
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: audit confidence β†’ High
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: this finding has an auto-fix
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mhelpοΏ½[0m: audit documentation β†’ οΏ½[32mhttps://docs.zizmor.sh/audits/#unpinned-usesοΏ½[39m

οΏ½[1mοΏ½[91merror[unpinned-uses]οΏ½[0mοΏ½[1m: unpinned action referenceοΏ½[0m
  οΏ½[1mοΏ½[94m--> οΏ½[0m/github/workspace/.github/workflows/build-and-push.yaml:45:15
   οΏ½[1mοΏ½[94m|οΏ½[0m
οΏ½[1mοΏ½[94m45οΏ½[0m οΏ½[1mοΏ½[94m|οΏ½[0m         uses: docker/setup-qemu-action@v3
   οΏ½[1mοΏ½[94m|οΏ½[0m               οΏ½[1mοΏ½[91m^^^^^^^^^^^^^^^^^^^^^^^^^^^οΏ½[0m οΏ½[1mοΏ½[91maction is not pinned to a hash (required by blanket policy)οΏ½[0m
   οΏ½[1mοΏ½[94m|οΏ½[0m
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: audit confidence β†’ High
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: this finding has an auto-fix
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mhelpοΏ½[0m: audit documentation β†’ οΏ½[32mhttps://docs.zizmor.sh/audits/#unpinned-usesοΏ½[39m

οΏ½[1mοΏ½[91merror[unpinned-uses]οΏ½[0mοΏ½[1m: unpinned action referenceοΏ½[0m
  οΏ½[1mοΏ½[94m--> οΏ½[0m/github/workspace/.github/workflows/build-and-push.yaml:48:15
   οΏ½[1mοΏ½[94m|οΏ½[0m
οΏ½[1mοΏ½[94m48οΏ½[0m οΏ½[1mοΏ½[94m|οΏ½[0m         uses: docker/setup-buildx-action@v3
   οΏ½[1mοΏ½[94m|οΏ½[0m               οΏ½[1mοΏ½[91m^^^^^^^^^^^^^^^^^^^^^^^^^^^^^οΏ½[0m οΏ½[1mοΏ½[91maction is not pinned to a hash (required by blanket policy)οΏ½[0m
   οΏ½[1mοΏ½[94m|οΏ½[0m
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: audit confidence β†’ High
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: this finding has an auto-fix
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mhelpοΏ½[0m: audit documentation β†’ οΏ½[32mhttps://docs.zizmor.sh/audits/#unpinned-usesοΏ½[39m

οΏ½[1mοΏ½[91merror[unpinned-uses]οΏ½[0mοΏ½[1m: unpinned action referenceοΏ½[0m
  οΏ½[1mοΏ½[94m--> οΏ½[0m/github/workspace/.github/workflows/build-and-push.yaml:51:15
   οΏ½[1mοΏ½[94m|οΏ½[0m
οΏ½[1mοΏ½[94m51οΏ½[0m οΏ½[1mοΏ½[94m|οΏ½[0m         uses: docker/login-action@v3
   οΏ½[1mοΏ½[94m|οΏ½[0m               οΏ½[1mοΏ½[91m^^^^^^^^^^^^^^^^^^^^^^οΏ½[0m οΏ½[1mοΏ½[91maction is not pinned to a hash (required by blanket policy)οΏ½[0m
   οΏ½[1mοΏ½[94m|οΏ½[0m
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: audit confidence β†’ High
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: this finding has an auto-fix
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mhelpοΏ½[0m: audit documentation β†’ οΏ½[32mhttps://docs.zizmor.sh/audits/#unpinned-usesοΏ½[39m

οΏ½[1mοΏ½[91merror[unpinned-uses]οΏ½[0mοΏ½[1m: unpinned action referenceοΏ½[0m
  οΏ½[1mοΏ½[94m--> οΏ½[0m/github/workspace/.github/workflows/build-and-push.yaml:60:15
   οΏ½[1mοΏ½[94m|οΏ½[0m
οΏ½[1mοΏ½[94m60οΏ½[0m οΏ½[1mοΏ½[94m|οΏ½[0m         uses: docker/metadata-action@v5
   οΏ½[1mοΏ½[94m|οΏ½[0m               οΏ½[1mοΏ½[91m^^^^^^^^^^^^^^^^^^^^^^^^^οΏ½[0m οΏ½[1mοΏ½[91maction is not pinned to a hash (required by blanket policy)οΏ½[0m
   οΏ½[1mοΏ½[94m|οΏ½[0m
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: audit confidence β†’ High
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: this finding has an auto-fix
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mhelpοΏ½[0m: audit documentation β†’ οΏ½[32mhttps://docs.zizmor.sh/audits/#unpinned-usesοΏ½[39m

οΏ½[1mοΏ½[91merror[unpinned-uses]οΏ½[0mοΏ½[1m: unpinned action referenceοΏ½[0m
  οΏ½[1mοΏ½[94m--> οΏ½[0m/github/workspace/.github/workflows/build-and-push.yaml:72:15
   οΏ½[1mοΏ½[94m|οΏ½[0m
οΏ½[1mοΏ½[94m72οΏ½[0m οΏ½[1mοΏ½[94m|οΏ½[0m         uses: docker/metadata-action@v5
   οΏ½[1mοΏ½[94m|οΏ½[0m               οΏ½[1mοΏ½[91m^^^^^^^^^^^^^^^^^^^^^^^^^οΏ½[0m οΏ½[1mοΏ½[91maction is not pinned to a hash (required by blanket policy)οΏ½[0m
   οΏ½[1mοΏ½[94m|οΏ½[0m
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: audit confidence β†’ High
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: this finding has an auto-fix
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mhelpοΏ½[0m: audit documentation β†’ οΏ½[32mhttps://docs.zizmor.sh/audits/#unpinned-usesοΏ½[39m

οΏ½[1mοΏ½[91merror[unpinned-uses]οΏ½[0mοΏ½[1m: unpinned action referenceοΏ½[0m
  οΏ½[1mοΏ½[94m--> οΏ½[0m/github/workspace/.github/workflows/build-and-push.yaml:85:15
   οΏ½[1mοΏ½[94m|οΏ½[0m
οΏ½[1mοΏ½[94m85οΏ½[0m οΏ½[1mοΏ½[94m|οΏ½[0m         uses: docker/build-push-action@v6
   οΏ½[1mοΏ½[94m|οΏ½[0m               οΏ½[1mοΏ½[91m^^^^^^^^^^^^^^^^^^^^^^^^^^^οΏ½[0m οΏ½[1mοΏ½[91maction is not pinned to a hash (required by blanket policy)οΏ½[0m
   οΏ½[1mοΏ½[94m|οΏ½[0m
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: audit confidence β†’ High
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: this finding has an auto-fix
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mhelpοΏ½[0m: audit documentation β†’ οΏ½[32mhttps://docs.zizmor.sh/audits/#unpinned-usesοΏ½[39m

�[32m18�[39m findings (�[1m�[93m5�[39m suppressed, �[92m13�[39m fixable�[0m): �[35m4�[39m informational, �[36m1�[39m low, �[33m1�[39m medium, �[31m7�[39m high🌈 zizmor v1.23.1
�[32m INFO�[0m �[1maudit�[0m�[2m:�[0m �[2mzizmor�[0m�[2m:�[0m 🌈 completed /github/workspace/.github/workflows/build-and-push.yaml

@renovate
renovate Bot force-pushed the renovate/actions-attest-build-provenance-2.x branch from 4efa624 to 7dfaff3 Compare July 12, 2026 13:44
@github-actions

github-actions Bot commented Jul 12, 2026

Copy link
Copy Markdown
Contributor

Super-linter summary

Language Validation result
GITHUB_ACTIONS Fail ❌
GITHUB_ACTIONS_ZIZMOR Fail ❌
GIT_MERGE_CONFLICT_MARKERS Pass βœ…
PRE_COMMIT Pass βœ…
SPELL_CODESPELL Pass βœ…
YAML Pass βœ…
YAML_PRETTIER Pass βœ…

Super-linter detected linting errors

For more information, see the GitHub Actions workflow run

Powered by Super-linter

GITHUB_ACTIONS 
.github/workflows/build-and-push.yaml:38:9: shellcheck reported issue in this script: SC2086:info:2:30: Double quote to prevent globbing and word splitting [shellcheck]
   |
38 |         run: |
   |         ^~~~
.github/workflows/build-and-push.yaml:38:9: shellcheck reported issue in this script: SC2086:info:3:20: Double quote to prevent globbing and word splitting [shellcheck]
   |
38 |         run: |
   |         ^~~~
.github/workflows/build-and-push.yaml:38:9: shellcheck reported issue in this script: SC2086:info:3:48: Double quote to prevent globbing and word splitting [shellcheck]
   |
38 |         run: |
   |         ^~~~
.github/workflows/build-and-push.yaml:38:9: shellcheck reported issue in this script: SC2086:info:4:20: Double quote to prevent globbing and word splitting [shellcheck]
   |
38 |         run: |
   |         ^~~~
.github/workflows/build-and-push.yaml:38:9: shellcheck reported issue in this script: SC2086:info:4:50: Double quote to prevent globbing and word splitting [shellcheck]
   |
38 |         run: |
   |         ^~~~
.github/workflows/build-and-push.yaml:38:9: shellcheck reported issue in this script: SC2129:style:2:1: Consider using { cmd1; cmd2; } >> file instead of individual redirects [shellcheck]
   |
38 |         run: |
   |         ^~~~
.github/workflows/build-and-push.yaml:104:9: shellcheck reported issue in this script: SC2086:info:10:52: Double quote to prevent globbing and word splitting [shellcheck]
    |
104 |         run: |
    |         ^~~~
.github/workflows/build-and-push.yaml:104:9: shellcheck reported issue in this script: SC2086:info:12:48: Double quote to prevent globbing and word splitting [shellcheck]
    |
104 |         run: |
    |         ^~~~
.github/workflows/build-and-push.yaml:104:9: shellcheck reported issue in this script: SC2086:info:14:18: Double quote to prevent globbing and word splitting [shellcheck]
    |
104 |         run: |
    |         ^~~~
.github/workflows/build-and-push.yaml:104:9: shellcheck reported issue in this script: SC2086:info:1:29: Double quote to prevent globbing and word splitting [shellcheck]
    |
104 |         run: |
    |         ^~~~
.github/workflows/build-and-push.yaml:104:9: shellcheck reported issue in this script: SC2086:info:2:12: Double quote to prevent globbing and word splitting [shellcheck]
    |
104 |         run: |
    |         ^~~~
.github/workflows/build-and-push.yaml:104:9: shellcheck reported issue in this script: SC2086:info:3:68: Double quote to prevent globbing and word splitting [shellcheck]
    |
104 |         run: |
    |         ^~~~
.github/workflows/build-and-push.yaml:104:9: shellcheck reported issue in this script: SC2086:info:4:65: Double quote to prevent globbing and word splitting [shellcheck]
    |
104 |         run: |
    |         ^~~~
.github/workflows/build-and-push.yaml:104:9: shellcheck reported issue in this script: SC2086:info:5:61: Double quote to prevent globbing and word splitting [shellcheck]
    |
104 |         run: |
    |         ^~~~
.github/workflows/build-and-push.yaml:104:9: shellcheck reported issue in this script: SC2086:info:6:12: Double quote to prevent globbing and word splitting [shellcheck]
    |
104 |         run: |
    |         ^~~~
.github/workflows/build-and-push.yaml:104:9: shellcheck reported issue in this script: SC2086:info:7:20: Double quote to prevent globbing and word splitting [shellcheck]
    |
104 |         run: |
    |         ^~~~
.github/workflows/build-and-push.yaml:104:9: shellcheck reported issue in this script: SC2086:info:8:18: Double quote to prevent globbing and word splitting [shellcheck]
    |
104 |         run: |
    |         ^~~~
.github/workflows/build-and-push.yaml:104:9: shellcheck reported issue in this script: SC2129:style:1:1: Consider using { cmd1; cmd2; } >> file instead of individual redirects [shellcheck]
    |
104 |         run: |
    |         ^~~~
GITHUB_ACTIONS_ZIZMOR 
οΏ½[1mοΏ½[33mwarning[artipacked]οΏ½[0mοΏ½[1m: credential persistence through GitHub Actions artifactsοΏ½[0m
  οΏ½[1mοΏ½[94m--> οΏ½[0m/github/workspace/.github/workflows/build-and-push.yaml:33:9
   οΏ½[1mοΏ½[94m|οΏ½[0m
οΏ½[1mοΏ½[94m33οΏ½[0m οΏ½[1mοΏ½[94m|οΏ½[0m         - name: Checkout
   οΏ½[1mοΏ½[94m|οΏ½[0m οΏ½[1mοΏ½[33m _________^οΏ½[0m
οΏ½[1mοΏ½[94m34οΏ½[0m οΏ½[1mοΏ½[94m|οΏ½[0m οΏ½[1mοΏ½[33m|οΏ½[0m         uses: actions/checkout@v4
   οΏ½[1mοΏ½[94m|οΏ½[0m οΏ½[1mοΏ½[33m|_________________________________^οΏ½[0m οΏ½[1mοΏ½[33mdoes not set persist-credentials: falseοΏ½[0m
   οΏ½[1mοΏ½[94m|οΏ½[0m
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: audit confidence β†’ Low
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: this finding has an auto-fix
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mhelpοΏ½[0m: audit documentation β†’ οΏ½[32mhttps://docs.zizmor.sh/audits/#artipackedοΏ½[39m

οΏ½[1mοΏ½[96mhelp[template-injection]οΏ½[0mοΏ½[1m: code injection via template expansionοΏ½[0m
   οΏ½[1mοΏ½[94m--> οΏ½[0m/github/workspace/.github/workflows/build-and-push.yaml:107:54
    οΏ½[1mοΏ½[94m|οΏ½[0m
οΏ½[1mοΏ½[94m104οΏ½[0m οΏ½[1mοΏ½[94m|οΏ½[0m         run: |
    οΏ½[1mοΏ½[94m|οΏ½[0m         οΏ½[1mοΏ½[94m---οΏ½[0m οΏ½[1mοΏ½[94mthis run blockοΏ½[0m
οΏ½[1mοΏ½[94m...οΏ½[0m
οΏ½[1mοΏ½[94m107οΏ½[0m οΏ½[1mοΏ½[94m|οΏ½[0m           echo "**Image**: \`${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}\`" >> $GITHUB_STEP_SUMMARY
    οΏ½[1mοΏ½[94m|οΏ½[0m                                                      οΏ½[1mοΏ½[96m^^^^^^^^^^^^^^οΏ½[0m οΏ½[1mοΏ½[96mmay expand into attacker-controllable codeοΏ½[0m
    οΏ½[1mοΏ½[94m|οΏ½[0m
    οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: audit confidence β†’ High
    οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: this finding has an auto-fix
    οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mhelpοΏ½[0m: audit documentation β†’ οΏ½[32mhttps://docs.zizmor.sh/audits/#template-injectionοΏ½[39m

οΏ½[1mοΏ½[94minfo[template-injection]οΏ½[0mοΏ½[1m: code injection via template expansionοΏ½[0m
   οΏ½[1mοΏ½[94m--> οΏ½[0m/github/workspace/.github/workflows/build-and-push.yaml:108:36
    οΏ½[1mοΏ½[94m|οΏ½[0m
οΏ½[1mοΏ½[94m104οΏ½[0m οΏ½[1mοΏ½[94m|οΏ½[0m         run: |
    οΏ½[1mοΏ½[94m|οΏ½[0m         οΏ½[1mοΏ½[94m---οΏ½[0m οΏ½[1mοΏ½[94mthis run blockοΏ½[0m
οΏ½[1mοΏ½[94m...οΏ½[0m
οΏ½[1mοΏ½[94m108οΏ½[0m οΏ½[1mοΏ½[94m|οΏ½[0m           echo "**Version**: \`${{ steps.version.outputs.version }}\`" >> $GITHUB_STEP_SUMMARY
    οΏ½[1mοΏ½[94m|οΏ½[0m                                    οΏ½[1mοΏ½[94m^^^^^^^^^^^^^^^^^^^^^^^^^^^^^οΏ½[0m οΏ½[1mοΏ½[94mmay expand into attacker-controllable codeοΏ½[0m
    οΏ½[1mοΏ½[94m|οΏ½[0m
    οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: audit confidence β†’ Low
    οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: this finding has an auto-fix
    οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mhelpοΏ½[0m: audit documentation β†’ οΏ½[32mhttps://docs.zizmor.sh/audits/#template-injectionοΏ½[39m

οΏ½[1mοΏ½[94minfo[template-injection]οΏ½[0mοΏ½[1m: code injection via template expansionοΏ½[0m
   οΏ½[1mοΏ½[94m--> οΏ½[0m/github/workspace/.github/workflows/build-and-push.yaml:109:35
    οΏ½[1mοΏ½[94m|οΏ½[0m
οΏ½[1mοΏ½[94m104οΏ½[0m οΏ½[1mοΏ½[94m|οΏ½[0m         run: |
    οΏ½[1mοΏ½[94m|οΏ½[0m         οΏ½[1mοΏ½[94m---οΏ½[0m οΏ½[1mοΏ½[94mthis run blockοΏ½[0m
οΏ½[1mοΏ½[94m...οΏ½[0m
οΏ½[1mοΏ½[94m109οΏ½[0m οΏ½[1mοΏ½[94m|οΏ½[0m           echo "**Digest**: \`${{ steps.build.outputs.digest }}\`" >> $GITHUB_STEP_SUMMARY
    οΏ½[1mοΏ½[94m|οΏ½[0m                                   οΏ½[1mοΏ½[94m^^^^^^^^^^^^^^^^^^^^^^^^^^οΏ½[0m οΏ½[1mοΏ½[94mmay expand into attacker-controllable codeοΏ½[0m
    οΏ½[1mοΏ½[94m|οΏ½[0m
    οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: audit confidence β†’ Low
    οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: this finding has an auto-fix
    οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mhelpοΏ½[0m: audit documentation β†’ οΏ½[32mhttps://docs.zizmor.sh/audits/#template-injectionοΏ½[39m

οΏ½[1mοΏ½[94minfo[template-injection]οΏ½[0mοΏ½[1m: code injection via template expansionοΏ½[0m
   οΏ½[1mοΏ½[94m--> οΏ½[0m/github/workspace/.github/workflows/build-and-push.yaml:114:23
    οΏ½[1mοΏ½[94m|οΏ½[0m
οΏ½[1mοΏ½[94m104οΏ½[0m οΏ½[1mοΏ½[94m|οΏ½[0m         run: |
    οΏ½[1mοΏ½[94m|οΏ½[0m         οΏ½[1mοΏ½[94m---οΏ½[0m οΏ½[1mοΏ½[94mthis run blockοΏ½[0m
οΏ½[1mοΏ½[94m...οΏ½[0m
οΏ½[1mοΏ½[94m114οΏ½[0m οΏ½[1mοΏ½[94m|οΏ½[0m             echo "${{ steps.meta-release.outputs.tags }}" >> $GITHUB_STEP_SUMMARY
    οΏ½[1mοΏ½[94m|οΏ½[0m                       οΏ½[1mοΏ½[94m^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^οΏ½[0m οΏ½[1mοΏ½[94mmay expand into attacker-controllable codeοΏ½[0m
    οΏ½[1mοΏ½[94m|οΏ½[0m
    οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: audit confidence β†’ Low
    οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: this finding has an auto-fix
    οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mhelpοΏ½[0m: audit documentation β†’ οΏ½[32mhttps://docs.zizmor.sh/audits/#template-injectionοΏ½[39m

οΏ½[1mοΏ½[94minfo[template-injection]οΏ½[0mοΏ½[1m: code injection via template expansionοΏ½[0m
   οΏ½[1mοΏ½[94m--> οΏ½[0m/github/workspace/.github/workflows/build-and-push.yaml:116:23
    οΏ½[1mοΏ½[94m|οΏ½[0m
οΏ½[1mοΏ½[94m104οΏ½[0m οΏ½[1mοΏ½[94m|οΏ½[0m         run: |
    οΏ½[1mοΏ½[94m|οΏ½[0m         οΏ½[1mοΏ½[94m---οΏ½[0m οΏ½[1mοΏ½[94mthis run blockοΏ½[0m
οΏ½[1mοΏ½[94m...οΏ½[0m
οΏ½[1mοΏ½[94m116οΏ½[0m οΏ½[1mοΏ½[94m|οΏ½[0m             echo "${{ steps.meta-dev.outputs.tags }}" >> $GITHUB_STEP_SUMMARY
    οΏ½[1mοΏ½[94m|οΏ½[0m                       οΏ½[1mοΏ½[94m^^^^^^^^^^^^^^^^^^^^^^^^^^^οΏ½[0m οΏ½[1mοΏ½[94mmay expand into attacker-controllable codeοΏ½[0m
    οΏ½[1mοΏ½[94m|οΏ½[0m
    οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: audit confidence β†’ Low
    οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: this finding has an auto-fix
    οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mhelpοΏ½[0m: audit documentation β†’ οΏ½[32mhttps://docs.zizmor.sh/audits/#template-injectionοΏ½[39m

οΏ½[1mοΏ½[91merror[unpinned-uses]οΏ½[0mοΏ½[1m: unpinned action referenceοΏ½[0m
  οΏ½[1mοΏ½[94m--> οΏ½[0m/github/workspace/.github/workflows/build-and-push.yaml:34:15
   οΏ½[1mοΏ½[94m|οΏ½[0m
οΏ½[1mοΏ½[94m34οΏ½[0m οΏ½[1mοΏ½[94m|οΏ½[0m         uses: actions/checkout@v4
   οΏ½[1mοΏ½[94m|οΏ½[0m               οΏ½[1mοΏ½[91m^^^^^^^^^^^^^^^^^^^οΏ½[0m οΏ½[1mοΏ½[91maction is not pinned to a hash (required by blanket policy)οΏ½[0m
   οΏ½[1mοΏ½[94m|οΏ½[0m
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: audit confidence β†’ High
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: this finding has an auto-fix
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mhelpοΏ½[0m: audit documentation β†’ οΏ½[32mhttps://docs.zizmor.sh/audits/#unpinned-usesοΏ½[39m

οΏ½[1mοΏ½[91merror[unpinned-uses]οΏ½[0mοΏ½[1m: unpinned action referenceοΏ½[0m
  οΏ½[1mοΏ½[94m--> οΏ½[0m/github/workspace/.github/workflows/build-and-push.yaml:45:15
   οΏ½[1mοΏ½[94m|οΏ½[0m
οΏ½[1mοΏ½[94m45οΏ½[0m οΏ½[1mοΏ½[94m|οΏ½[0m         uses: docker/setup-qemu-action@v3
   οΏ½[1mοΏ½[94m|οΏ½[0m               οΏ½[1mοΏ½[91m^^^^^^^^^^^^^^^^^^^^^^^^^^^οΏ½[0m οΏ½[1mοΏ½[91maction is not pinned to a hash (required by blanket policy)οΏ½[0m
   οΏ½[1mοΏ½[94m|οΏ½[0m
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: audit confidence β†’ High
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: this finding has an auto-fix
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mhelpοΏ½[0m: audit documentation β†’ οΏ½[32mhttps://docs.zizmor.sh/audits/#unpinned-usesοΏ½[39m

οΏ½[1mοΏ½[91merror[unpinned-uses]οΏ½[0mοΏ½[1m: unpinned action referenceοΏ½[0m
  οΏ½[1mοΏ½[94m--> οΏ½[0m/github/workspace/.github/workflows/build-and-push.yaml:48:15
   οΏ½[1mοΏ½[94m|οΏ½[0m
οΏ½[1mοΏ½[94m48οΏ½[0m οΏ½[1mοΏ½[94m|οΏ½[0m         uses: docker/setup-buildx-action@v3
   οΏ½[1mοΏ½[94m|οΏ½[0m               οΏ½[1mοΏ½[91m^^^^^^^^^^^^^^^^^^^^^^^^^^^^^οΏ½[0m οΏ½[1mοΏ½[91maction is not pinned to a hash (required by blanket policy)οΏ½[0m
   οΏ½[1mοΏ½[94m|οΏ½[0m
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: audit confidence β†’ High
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: this finding has an auto-fix
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mhelpοΏ½[0m: audit documentation β†’ οΏ½[32mhttps://docs.zizmor.sh/audits/#unpinned-usesοΏ½[39m

οΏ½[1mοΏ½[91merror[unpinned-uses]οΏ½[0mοΏ½[1m: unpinned action referenceοΏ½[0m
  οΏ½[1mοΏ½[94m--> οΏ½[0m/github/workspace/.github/workflows/build-and-push.yaml:51:15
   οΏ½[1mοΏ½[94m|οΏ½[0m
οΏ½[1mοΏ½[94m51οΏ½[0m οΏ½[1mοΏ½[94m|οΏ½[0m         uses: docker/login-action@v3
   οΏ½[1mοΏ½[94m|οΏ½[0m               οΏ½[1mοΏ½[91m^^^^^^^^^^^^^^^^^^^^^^οΏ½[0m οΏ½[1mοΏ½[91maction is not pinned to a hash (required by blanket policy)οΏ½[0m
   οΏ½[1mοΏ½[94m|οΏ½[0m
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: audit confidence β†’ High
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: this finding has an auto-fix
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mhelpοΏ½[0m: audit documentation β†’ οΏ½[32mhttps://docs.zizmor.sh/audits/#unpinned-usesοΏ½[39m

οΏ½[1mοΏ½[91merror[unpinned-uses]οΏ½[0mοΏ½[1m: unpinned action referenceοΏ½[0m
  οΏ½[1mοΏ½[94m--> οΏ½[0m/github/workspace/.github/workflows/build-and-push.yaml:60:15
   οΏ½[1mοΏ½[94m|οΏ½[0m
οΏ½[1mοΏ½[94m60οΏ½[0m οΏ½[1mοΏ½[94m|οΏ½[0m         uses: docker/metadata-action@v5
   οΏ½[1mοΏ½[94m|οΏ½[0m               οΏ½[1mοΏ½[91m^^^^^^^^^^^^^^^^^^^^^^^^^οΏ½[0m οΏ½[1mοΏ½[91maction is not pinned to a hash (required by blanket policy)οΏ½[0m
   οΏ½[1mοΏ½[94m|οΏ½[0m
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: audit confidence β†’ High
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: this finding has an auto-fix
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mhelpοΏ½[0m: audit documentation β†’ οΏ½[32mhttps://docs.zizmor.sh/audits/#unpinned-usesοΏ½[39m

οΏ½[1mοΏ½[91merror[unpinned-uses]οΏ½[0mοΏ½[1m: unpinned action referenceοΏ½[0m
  οΏ½[1mοΏ½[94m--> οΏ½[0m/github/workspace/.github/workflows/build-and-push.yaml:72:15
   οΏ½[1mοΏ½[94m|οΏ½[0m
οΏ½[1mοΏ½[94m72οΏ½[0m οΏ½[1mοΏ½[94m|οΏ½[0m         uses: docker/metadata-action@v5
   οΏ½[1mοΏ½[94m|οΏ½[0m               οΏ½[1mοΏ½[91m^^^^^^^^^^^^^^^^^^^^^^^^^οΏ½[0m οΏ½[1mοΏ½[91maction is not pinned to a hash (required by blanket policy)οΏ½[0m
   οΏ½[1mοΏ½[94m|οΏ½[0m
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: audit confidence β†’ High
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: this finding has an auto-fix
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mhelpοΏ½[0m: audit documentation β†’ οΏ½[32mhttps://docs.zizmor.sh/audits/#unpinned-usesοΏ½[39m

οΏ½[1mοΏ½[91merror[unpinned-uses]οΏ½[0mοΏ½[1m: unpinned action referenceοΏ½[0m
  οΏ½[1mοΏ½[94m--> οΏ½[0m/github/workspace/.github/workflows/build-and-push.yaml:85:15
   οΏ½[1mοΏ½[94m|οΏ½[0m
οΏ½[1mοΏ½[94m85οΏ½[0m οΏ½[1mοΏ½[94m|οΏ½[0m         uses: docker/build-push-action@v6
   οΏ½[1mοΏ½[94m|οΏ½[0m               οΏ½[1mοΏ½[91m^^^^^^^^^^^^^^^^^^^^^^^^^^^οΏ½[0m οΏ½[1mοΏ½[91maction is not pinned to a hash (required by blanket policy)οΏ½[0m
   οΏ½[1mοΏ½[94m|οΏ½[0m
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: audit confidence β†’ High
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mnoteοΏ½[0m: this finding has an auto-fix
   οΏ½[1mοΏ½[94m= οΏ½[0mοΏ½[1mhelpοΏ½[0m: audit documentation β†’ οΏ½[32mhttps://docs.zizmor.sh/audits/#unpinned-usesοΏ½[39m

�[32m18�[39m findings (�[1m�[93m5�[39m suppressed, �[92m13�[39m fixable�[0m): �[35m4�[39m informational, �[36m1�[39m low, �[33m1�[39m medium, �[31m7�[39m high🌈 zizmor v1.23.1
�[32m INFO�[0m �[1maudit�[0m�[2m:�[0m �[2mzizmor�[0m�[2m:�[0m 🌈 completed /github/workspace/.github/workflows/build-and-push.yaml

@renovate
renovate Bot merged commit 848ae88 into main Jul 21, 2026
9 of 12 checks passed
@renovate
renovate Bot deleted the renovate/actions-attest-build-provenance-2.x branch July 21, 2026 18:41
LukeEvansTech pushed a commit that referenced this pull request Oct 30, 2026
@renovate
ci(github-action): update action actions/attest-build-provenance (v2.…
985bd83 
…0.0 βž” v2.4.0) (#24)

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[actions/attest-build-provenance](https://redirect.github.com/actions/attest-build-provenance)
| action | minor | `v2` β†’ `v2.4.0` |

---

### Release Notes

<details>
<summary>actions/attest-build-provenance
(actions/attest-build-provenance)</summary>

###
[`v2.4.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.4.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.3.0...v2.4.0)

##### What's Changed

- Bump undici from 5.28.5 to 5.29.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;633](https://redirect.github.com/actions/attest-build-provenance/pull/633)
- Bump actions/attest from 2.3.0 to
[2.4.0](https://redirect.github.com/actions/attest/releases/tag/v2.4.0)
by [@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;654](https://redirect.github.com/actions/attest-build-provenance/pull/654)
- Includes support for the new well-known summary file which will
accumulate paths to all attestations generated in a given workflow run

**Full Changelog**:
<actions/attest-build-provenance@v2.3.0...v2.4.0>

###
[`v2.3.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.3.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.3...v2.3.0)

##### What's Changed

- Bump `actions/attest` from 2.2.1 to 2.3.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;615](https://redirect.github.com/actions/attest-build-provenance/pull/615)
  - Updates `@sigstore/oci` from 0.4.0 to 0.5.0

**Full Changelog**:
<actions/attest-build-provenance@v2.2.3...v2.3.0>

###
[`v2.2.3`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.3)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.2...v2.2.3)

##### What's Changed

- Pin actions/attest reference by commit SHA by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;493](https://redirect.github.com/actions/attest-build-provenance/pull/493)

**Full Changelog**:
<actions/attest-build-provenance@v2.2.2...v2.2.3>

###
[`v2.2.2`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.2)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.1...v2.2.2)

##### What's Changed

- Bump predicate action from 1.1.4 to 1.1.5 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;485](https://redirect.github.com/actions/attest-build-provenance/pull/485)
- Bump
[@&#8203;actions/attest](https://redirect.github.com/actions/attest)
from 1.5.0 to 1.6.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;484](https://redirect.github.com/actions/attest-build-provenance/pull/484)
- Update buildSLSAProvenancePredicate to populate `workflow.ref` field
from the `ref` claim in the OIDC token
([actions/toolkit#1969](https://redirect.github.com/actions/toolkit/pull/1969))

**Full Changelog**:
<actions/attest-build-provenance@v2.2.1...v2.2.2>

###
[`v2.2.1`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.1)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.0...v2.2.1)

##### What's Changed

- Bump undici from 5.28.4 to 5.28.5 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;457](https://redirect.github.com/actions/attest-build-provenance/pull/457)
- Bump
[@&#8203;octokit/request-error](https://redirect.github.com/octokit/request-error)
from 5.0.1 to 5.1.1 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;469](https://redirect.github.com/actions/attest-build-provenance/pull/469)
- Bump
[@&#8203;octokit/request](https://redirect.github.com/octokit/request)
from 8.2.0 to 8.4.1 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;478](https://redirect.github.com/actions/attest-build-provenance/pull/478)
- Bump actions/attest from 2.2.0 to 2.2.1 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;481](https://redirect.github.com/actions/attest-build-provenance/pull/481)
- Includes `@actions/attest`
[v1.6.0](https://redirect.github.com/actions/toolkit/blob/main/packages/attest/RELEASES.md#160)

**Full Changelog**:
<actions/attest-build-provenance@v2.2.0...v2.2.1>

###
[`v2.2.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.1.0...v2.2.0)

##### What's Changed

- Bump actions/attest from v2.1.0 to v2.2.0 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;449](https://redirect.github.com/actions/attest-build-provenance/pull/449)
  - Includes support for now `subject-checksums` input parameter

**Full Changelog**:
<actions/attest-build-provenance@v2.1.0...v2.2.0>

###
[`v2.1.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.1.0)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.0.1...v2.1.0)

##### What's Changed

- Update README w/ note about GH plans supporting attestations by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;414](https://redirect.github.com/actions/attest-build-provenance/pull/414)
- Add `attestation-id` and `attestation-url` outputs by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;415](https://redirect.github.com/actions/attest-build-provenance/pull/415)

**Full Changelog**:
<actions/attest-build-provenance@v2.0.1...v2.1.0>

###
[`v2.0.1`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.0.1)

[Compare
Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2...v2.0.1)

##### What's Changed

- Bump actions/attest from 2.0.0 to 2.0.1 by
[@&#8203;bdehamer](https://redirect.github.com/bdehamer) in
[#&#8203;406](https://redirect.github.com/actions/attest-build-provenance/pull/406)
  - Deduplicate subjects before adding to in-toto statement

**Full Changelog**:
<actions/attest-build-provenance@v2.0.0...v2.0.1>

</details>

---

### Configuration

πŸ“… **Schedule**: (in timezone Europe/London)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

β™» **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

πŸ”• **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/LukeEvansTech/acinfinity-exporter).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMTkuMCIsInVwZGF0ZWRJblZlciI6IjQzLjI3Mi40IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants