chore(deps): update github actions

Author: renovate[bot]

.github/workflows/check-fips-compliance-reqs.yaml

@@ -25,7 +25,7 @@ jobs:
   check-boringssl-commit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
       - name: Read FIPS spec
         id: fips-spec
@@ -38,7 +38,7 @@ jobs:
           echo "FIPS spec: Go ~${GO_VERSION}, BoringSSL ${BORINGSSL_COMMIT}"
 
       - name: Setup Go (matching fips/spec.yaml)
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version: "~${{ steps.fips-spec.outputs.go_version }}"
           check-latest: true
@@ -56,7 +56,7 @@ jobs:
 
       - name: Restore BoringSSL commit cache
         id: cache-boringssl
-        uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+        uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5
         with:
           path: .boringssl-cache
           key: boringssl-commit-go${{ steps.go-version.outputs.version }}
@@ -101,7 +101,7 @@ jobs:
           echo "sha=${BORINGSSL_SHA}" >> $GITHUB_OUTPUT
 
       - name: Save BoringSSL commit cache
-        uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+        uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5
         if: steps.cache-boringssl.outputs.cache-hit != 'true'
         with:
           path: .boringssl-cache

.github/workflows/check-links.yaml

@@ -16,13 +16,13 @@ jobs:
   check-links:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           fetch-depth: 0
 
       - name: Restore lychee cache
         id: restore-cache
-        uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+        uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5
         with:
           path: .lycheecache
           key: cache-lychee
@@ -57,7 +57,7 @@ jobs:
           cat .lycheecache
 
       - name: Save lychee cache
-        uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+        uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5
         if: always() && hashFiles('.lycheecache') != ''
         with:
           path: .lycheecache

.github/workflows/ci-base.yaml

@@ -59,14 +59,14 @@ jobs:
       docker_manifest_sha_name: ${{ steps.set-outputs.outputs.docker_manifest_sha_name }}
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           fetch-depth: 0 # required for tag metadata
 
       - run: ./scripts/free-disk-space.sh
 
       - name: Setup Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version: "~1.26"
           cache: ${{ env.caching_enabled == 'true' }}
@@ -79,7 +79,7 @@ jobs:
         run: make check
 
       - name: Validate GoReleaser license
-        uses: goreleaser/goreleaser-action@1a80836c5c9d9e5755a25cb59ec6f45a3b5f41a8 # v7
+        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7
         env:
           GORELEASER_KEY: ${{ secrets.goreleaser_key }}
         with:
@@ -101,7 +101,7 @@ jobs:
 
       - name: Cache sources
         id: cache-sources
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
         if: env.caching_enabled == 'true'
         with:
           path: |
@@ -122,20 +122,20 @@ jobs:
 
       - name: Configure AWS Credentials
         if: ${{ inputs.publish }}
-        uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6
+        uses: aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b # v6
         with:
           role-to-assume: ${{ secrets.aws_oidc_role_arn }}
           aws-region: us-east-1
 
       - name: Login to ECR
         if: ${{ inputs.publish }}
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4
         with:
           registry: ${{ env.registry }}/${{ inputs.distribution }}
 
-      - uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4
+      - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4
 
-      - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
+      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
 
       - name: Install cross-compilation toolchain
         if: inputs.fips
@@ -169,7 +169,7 @@ jobs:
 
       - name: Configure AWS Credentials
         if: ${{ inputs.publish }}
-        uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6
+        uses: aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b # v6
         with:
           role-to-assume: ${{ secrets.aws_oidc_role_arn }}
           aws-region: us-east-1
@@ -208,7 +208,7 @@ jobs:
       - name: Cache goreleaser build
         id: cache-goreleaser
         if: env.caching_enabled == 'true'
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
         with:
           path: |
             distributions/${{ inputs.distribution }}/dist
@@ -235,7 +235,7 @@ jobs:
       - name: Build binaries & packages with GoReleaser
         if: inputs.publish || steps.cache-goreleaser.outputs.cache-hit != 'true'
         id: goreleaser
-        uses: goreleaser/goreleaser-action@1a80836c5c9d9e5755a25cb59ec6f45a3b5f41a8 # v7
+        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7
         env:
           NFPM_PASSPHRASE: ${{ secrets.gpg_passphrase }}
           GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
@@ -299,7 +299,7 @@ jobs:
           echo "binary_tmp=${BINARY_TMP}" >> $GITHUB_OUTPUT
 
       - name: Build and load Docker image
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
         if: steps.cache-goreleaser.outputs.cache-hit == 'true'
         with:
           context: ${{ steps.copy-binary.outputs.binary_tmp }}
@@ -350,7 +350,7 @@ jobs:
         run: |
           kind load docker-image "${{ env.registry }}/${{ inputs.distribution }}:${{ env.image_tag }}" --name ${{ inputs.test_cluster_name }}
 
-      - uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0
+      - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
 
       - name: Derive NR backend URL from region
         run: |

.github/workflows/ci-bump-component-versions.yaml

@@ -16,7 +16,7 @@ jobs:
         runs-on: ubuntu-latest
         steps:
         - name: Checkout
-          uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+          uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
           with:
             fetch-depth: 0 # required for tag metadata
             token: ${{ secrets.RELEASE_TOKEN }}
@@ -35,7 +35,7 @@ jobs:
             git config --global user.email 'github-actions[bot]@users.noreply.github.com'
     
         - name: Setup Go
-          uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+          uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
           with:
             go-version: "~1.26"
             check-latest: true

.github/workflows/ci-host-config-drift.yaml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           fetch-depth: 0
 

.github/workflows/ci-nightly.yaml

@@ -27,7 +27,7 @@ jobs:
       workflow-run-id: ${{ steps.get-commit.outputs.workflow-run-id }}  
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           sparse-checkout: |
             .github/actions
@@ -50,7 +50,7 @@ jobs:
         fips: [false, true]
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           sparse-checkout: |
             .github/actions

.github/workflows/ci-snapshot-cli.yaml

@@ -17,13 +17,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           fetch-depth: 0 # required for tag metadata
           sparse-checkout: cmd/nrdot-collector-builder
 
       - name: Setup Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version: "~1.26"
           check-latest: true
@@ -39,20 +39,20 @@ jobs:
         working-directory: cmd/nrdot-collector-builder
 
       - name: Login to Docker
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4
         if: ${{ env.ACT }}
         with:
           registry: docker.io
           username: ${{ vars.OTELCOMM_DOCKER_HUB_USERNAME }}
           password: ${{ secrets.OTELCOMM_DOCKER_HUB_PASSWORD }}
 
-      - uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4
+      - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4
 
-      - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
+      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
 
       - name: Publish alpha with GoReleaser
         id: goreleaser
-        uses: goreleaser/goreleaser-action@1a80836c5c9d9e5755a25cb59ec6f45a3b5f41a8 # v7
+        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7
         with:
           distribution: goreleaser-pro
           version: "~> v2"
@@ -63,7 +63,7 @@ jobs:
           GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
 
       - name: Login to GitHub Container Registry for manifests
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4
         if: ${{ !env.ACT }}
         with:
           registry: ghcr.io

.github/workflows/ci.yaml

@@ -28,7 +28,7 @@ jobs:
       distributions: ${{ steps.discover.outputs.distributions }}
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           sparse-checkout: |
             .github/actions

.github/workflows/deploy-and-e2e.yaml

@@ -66,7 +66,7 @@ jobs:
       windows-e2e: ${{ steps.check-platform-specs.outputs.windows_e2e }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           fetch-depth: 0
 
@@ -180,11 +180,11 @@ jobs:
       TF_VAR_commit_sha_short: ${{ needs.setup.outputs.commit-sha-short }}
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
       - name: Configure AWS Credentials
         id: configure-aws-credentials-for-eks
-        uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6
+        uses: aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b # v6
         with:
           role-to-assume: ${{ secrets.aws_oidc_role_arn }}
           aws-region: us-east-1
@@ -238,11 +238,11 @@ jobs:
       TF_VAR_commit_sha_short: ${{ needs.setup.outputs.commit-sha-short }}
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
       - name: Configure AWS Credentials
         id: configure-aws-credentials
-        uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6
+        uses: aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b # v6
         with:
           role-to-assume: ${{ secrets.aws_oidc_role_arn }}
           aws-region: us-east-1
@@ -311,11 +311,11 @@ jobs:
       TF_VAR_commit_sha_short: ${{ needs.setup.outputs.commit-sha-short }}
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
       - name: Configure AWS Credentials
         id: configure-aws-credentials
-        uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6
+        uses: aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b # v6
         with:
           role-to-assume: ${{ secrets.aws_oidc_role_arn }}
           aws-region: us-east-1

.github/workflows/lint-renovate-config.yaml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
       - name: Install Renovate config validator
         run: npm install --global renovate