Update all non-major dependencies (#6)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Joe Corall <[email protected]>

Author: renovate[bot]

.github/workflows/goreleaser.yml

@@ -20,7 +20,7 @@ jobs:
           fetch-depth: 0
       -
         name: Set up Go
-        uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5
       -
         name: Run GoReleaser
         uses: goreleaser/goreleaser-action@9c156ee8a17a598857849441385a2041ef570552 # v6

.github/workflows/lint-test-build-push.yml

@@ -12,14 +12,14 @@ jobs:
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
-      - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5
+      - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5
 
       - uses: hadolint/hadolint-action@54c9adbab1582c2ef04b2016b760714a4bfde3cf # v3.1.0
 
       - run: shellcheck *.sh
 
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@1481404843c368bc19ca9406f87d6e0fc97bdcfd # v7
+        uses: golangci/golangci-lint-action@9fae48acfc02a90574d7c304a1758ef9895495fa # v7
         with:
           version: latest
 
@@ -31,55 +31,8 @@ jobs:
 
   build-push:
     needs: [lint-test]
-    runs-on: ubuntu-24.04
-    timeout-minutes: 15
-    steps:
-      - uses: "actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683" # v4
-
-      - name: Extract branch or tag name as docker tag
-        shell: bash
-        run: |-
-          if [[ "${GITHUB_REF}" == refs/tags/* ]]; then
-            TAG=$(echo "${GITHUB_REF#refs/tags/}" | sed 's/[^a-zA-Z0-9._-]//g' | awk '{print substr($0, length($0)-120)}')
-          else
-            TAG=$(echo "${GITHUB_REF#refs/heads/}" | sed 's/[^a-zA-Z0-9._-]//g' | awk '{print substr($0, length($0)-120)}')
-          fi
-
-          echo "tag=$TAG" >> $GITHUB_OUTPUT
-        id: extract_tag
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3
-
-      - id: setup
-        name: Setup docker build
-        shell: bash
-        run: |-
-          # only cache main tag to GHCR
-          if [ "${{steps.extract_tag.outputs.tag}}" = "main" ]; then
-            echo "cache-to=type=registry,ref=ghcr.io/lehigh-university-libraries/isle-fcrepo-fs:cache,mode=max" >> $GITHUB_OUTPUT
-          else
-            echo "cache-to=" >> $GITHUB_OUTPUT
-          fi
-
-      - name: ghcr Login
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Build and push GHCR
-        uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6
-        with:
-          platforms: |
-            linux/amd64
-            linux/arm64
-          push: true
-          cache-from: type=registry,ref=ghcr.io/lehigh-university-libraries/isle-fcrepo-fs:cache
-          cache-to: ${{ steps.setup.outputs.cache-to }}
-          tags: |
-            ghcr.io/lehigh-university-libraries/isle-fcrepo-fs:${{steps.extract_tag.outputs.tag}}
+    uses: lehigh-university-libraries/gha/.github/workflows/build-push-ghcr.yaml@main
+    permissions:
+      contents: read
+      packages: write
+    secrets: inherit

Dockerfile

@@ -1,12 +1,12 @@
-FROM golang:1.24-alpine3.21@sha256:7772cb5322baa875edd74705556d08f0eeca7b9c4b5367754ce3f2f00041ccee
+FROM golang:1.24-alpine3.21@sha256:72ff633a5298088a576d505c51630257cf1f681fc64cecddfb5234837eb4a747
 
 WORKDIR /app
 
 SHELL ["/bin/ash", "-o", "pipefail", "-c"]
 
 ARG \
   # renovate: datasource=repology depName=alpine_3_21/ca-certificates
-  CA_CERTIFICATES_VERSION="20241121-r1" \
+  CA_CERTIFICATES_VERSION="20250619-r0" \
   # renovate: datasource=repology depName=alpine_3_21/dpkg
   DPKG_VERSION="1.22.11-r0" \
   # renovate: datasource=repology depName=alpine_3_21/gnupg
@@ -16,10 +16,10 @@ ARG \
   # renovate: datasource=repology depName=alpine_3_21/bash
   BASH_VERSION="5.2.37-r0" \
   # renovate: datasource=repology depName=alpine_3_21/openssl
-  OPENSSL_VERSION="3.3.3-r0"
+  OPENSSL_VERSION="3.3.4-r0" \
+  # renovate: datasource=github-releases depName=gosu packageName=tianon/gosu
+  GOSU_VERSION=1.17
 
-# renovate: datasource=github-releases depName=gosu packageName=tianon/gosu
-ENV GOSU_VERSION=1.17
 RUN apk add --no-cache --virtual .gosu-deps \
     ca-certificates=="${CA_CERTIFICATES_VERSION}" \
     dpkg=="${DPKG_VERSION}" \