chore(deps): update github-actions deps (#14265)

renovate[bot] · codeboten · web-flow · commit 97fcd3d13b4a · 2025-12-11T18:19:59.000Z
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/create-github-app-token](https://redirect.github.com/actions/create-github-app-token) | action | patch | `v2.2.0` -> `v2.2.1` | | [actions/stale](https://redirect.github.com/actions/stale) | action | patch | `v10.1.0` -> `v10.1.1` | | [anchore/sbom-action](https://redirect.github.com/anchore/sbom-action) | action | patch | `v0.20.10` -> `v0.20.11` | | [codecov/codecov-action](https://redirect.github.com/codecov/codecov-action) | action | patch | `5.5.1` -> `5.5.2` | | [github/codeql-action](https://redirect.github.com/github/codeql-action) | action | patch | `v4.31.6` -> `v4.31.7` | | [streetsidesoftware/cspell-action](https://redirect.github.com/streetsidesoftware/cspell-action) | action | minor | `v8.0.0` -> `v8.1.1` | --- > [!WARNING] > Some dependencies could not be looked up. Check the Dependency Dashboard for more information. --- ### Release Notes <details> <summary>actions/create-github-app-token (actions/create-github-app-token)</summary> ### [`v2.2.1`](https://redirect.github.com/actions/create-github-app-token/releases/tag/v2.2.1) [Compare Source](https://redirect.github.com/actions/create-github-app-token/compare/v2.2.0...v2.2.1) ##### Bug Fixes - **deps:** bump the production-dependencies group with 2 updates ([#&#8203;311](https://redirect.github.com/actions/create-github-app-token/issues/311)) ([b212e6a](https://redirect.github.com/actions/create-github-app-token/commit/b212e6a739dec02d8488610fbaf8f049f82ee999)) </details> <details> <summary>actions/stale (actions/stale)</summary> ### [`v10.1.1`](https://redirect.github.com/actions/stale/releases/tag/v10.1.1) [Compare Source](https://redirect.github.com/actions/stale/compare/v10.1.0...v10.1.1) #### What's Changed ##### Bug Fix - Add Missing Input Reading for `only-issue-types` by [@&#8203;Bibo-Joshi](https://redirect.github.com/Bibo-Joshi) in [#&#8203;1298](https://redirect.github.com/actions/stale/pull/1298) ##### Improvement - Improves error handling when rate limiting is disabled on GHES. by [@&#8203;chiranjib-swain](https://redirect.github.com/chiranjib-swain) in [#&#8203;1300](https://redirect.github.com/actions/stale/pull/1300) ##### Dependency Upgrades - Upgrade eslint-config-prettier from 8.10.0 to 10.1.8 by [@&#8203;dependabot](https://redirect.github.com/dependabot) in [#&#8203;1276](https://redirect.github.com/actions/stale/pull/1276) - Upgrade [@&#8203;types/node](https://redirect.github.com/types/node) from 20.10.3 to 24.2.0 and document breaking changes in v10 by [@&#8203;dependabot](https://redirect.github.com/dependabot) in [#&#8203;1280](https://redirect.github.com/actions/stale/pull/1280) - Upgrade actions/publish-action from 0.3.0 to 0.4.0 by [@&#8203;dependabot](https://redirect.github.com/dependabot) in [#&#8203;1291](https://redirect.github.com/actions/stale/pull/1291) - Upgrade actions/checkout from 4 to 6 by [@&#8203;dependabot](https://redirect.github.com/dependabot) in [#&#8203;1306](https://redirect.github.com/actions/stale/pull/1306) #### New Contributors - [@&#8203;chiranjib-swain](https://redirect.github.com/chiranjib-swain) made their first contribution in [#&#8203;1300](https://redirect.github.com/actions/stale/pull/1300) **Full Changelog**: <actions/stale@v10...v10.1.1> </details> <details> <summary>anchore/sbom-action (anchore/sbom-action)</summary> ### [`v0.20.11`](https://redirect.github.com/anchore/sbom-action/releases/tag/v0.20.11) [Compare Source](https://redirect.github.com/anchore/sbom-action/compare/v0.20.10...v0.20.11) #### Changes in v0.20.11 - update Syft to v1.38.2 ([#&#8203;557](https://redirect.github.com/anchore/sbom-action/pull/557)) - bump [@&#8203;octokit/plugin-paginate-rest](https://redirect.github.com/octokit/plugin-paginate-rest), [@&#8203;actions/artifact](https://redirect.github.com/actions/artifact) and [@&#8203;actions/github](https://redirect.github.com/actions/github) ([#&#8203;550](https://redirect.github.com/anchore/sbom-action/issues/550)) \[\[[dependabot\[bot\]](https://redirect.github.com/apps/dependabot)]\(<https://github.com/>[dependabot\[bot\]](https://redirect.github.com/apps/dependabot))] - bump js-yaml ([#&#8203;552](https://redirect.github.com/anchore/sbom-action/issues/552)) \[\[[dependabot\[bot\]](https://redirect.github.com/apps/dependabot)]\(<https://github.com/>[dependabot\[bot\]](https://redirect.github.com/apps/dependabot))] </details> <details> <summary>codecov/codecov-action (codecov/codecov-action)</summary> ### [`v5.5.2`](https://redirect.github.com/codecov/codecov-action/blob/HEAD/CHANGELOG.md#v552) [Compare Source](https://redirect.github.com/codecov/codecov-action/compare/v5.5.1...v5.5.2) ##### What's Changed **Full Changelog**: <https://github.com/codecov/codecov-action/compare/v5.5.1..v5.5.2> </details> <details> <summary>github/codeql-action (github/codeql-action)</summary> ### [`v4.31.7`](https://redirect.github.com/github/codeql-action/releases/tag/v4.31.7) [Compare Source](https://redirect.github.com/github/codeql-action/compare/v4.31.6...v4.31.7) ##### CodeQL Action Changelog See the [releases page](https://redirect.github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs. ##### 4.31.7 - 05 Dec 2025 - Update default CodeQL bundle version to 2.23.7. [#&#8203;3343](https://redirect.github.com/github/codeql-action/pull/3343) See the full [CHANGELOG.md](https://redirect.github.com/github/codeql-action/blob/v4.31.7/CHANGELOG.md) for more information. </details> <details> <summary>streetsidesoftware/cspell-action (streetsidesoftware/cspell-action)</summary> ### [`v8.1.1`](https://redirect.github.com/streetsidesoftware/cspell-action/releases/tag/v8.1.1) [Compare Source](https://redirect.github.com/streetsidesoftware/cspell-action/compare/v8.1.0...v8.1.1) ##### Updates and Bug Fixes - Fix publishing step ([18eb68e](https://redirect.github.com/streetsidesoftware/cspell-action/commit/18eb68ecec6022ff335d12e6f77167fe7eaa864d)) ### [`v8.1.0`](https://redirect.github.com/streetsidesoftware/cspell-action/releases/tag/v8.1.0) [Compare Source](https://redirect.github.com/streetsidesoftware/cspell-action/compare/v8.0.0...v8.1.0) ##### Documentation - Upgrade checkout and cspell-action versions ([#&#8203;2501](https://redirect.github.com/streetsidesoftware/cspell-action/issues/2501)) ([8d0a18b](https://redirect.github.com/streetsidesoftware/cspell-action/commit/8d0a18b2ef71a9fb9578843ac89efb47c067f6d9)) ##### Features - Add summary option ([#&#8203;2549](https://redirect.github.com/streetsidesoftware/cspell-action/issues/2549)) ([873ff5f](https://redirect.github.com/streetsidesoftware/cspell-action/commit/873ff5f29da239f4e704dd72bc2dd9c0517f4893)) - Update CSpell version (9.4.0) ([#&#8203;2544](https://redirect.github.com/streetsidesoftware/cspell-action/issues/2544)) ([2e8603d](https://redirect.github.com/streetsidesoftware/cspell-action/commit/2e8603d01d4b32558bb365b99f8c08a14a776b7e)) ##### Updates and Bug Fixes - Set esbuild target to node24 ([#&#8203;2510](https://redirect.github.com/streetsidesoftware/cspell-action/issues/2510)) ([14af53b](https://redirect.github.com/streetsidesoftware/cspell-action/commit/14af53ba0aa8a7d3ac534bfade96334454ae95ce)) - Update CSpell version (9.3.1) ([#&#8203;2508](https://redirect.github.com/streetsidesoftware/cspell-action/issues/2508)) ([a879e6e](https://redirect.github.com/streetsidesoftware/cspell-action/commit/a879e6e724cfd2968a7d8cdde46443e39dc75df5)) - Update CSpell version (9.3.2) ([#&#8203;2516](https://redirect.github.com/streetsidesoftware/cspell-action/issues/2516)) ([c176300](https://redirect.github.com/streetsidesoftware/cspell-action/commit/c1763001699fb6909cd77ed50c0e921469f7159b)) - Update Dictionaries and Dependencies ([#&#8203;2514](https://redirect.github.com/streetsidesoftware/cspell-action/issues/2514)) ([ccd54f7](https://redirect.github.com/streetsidesoftware/cspell-action/commit/ccd54f75f1b6666c147ab314041a8fe09fd79f1e)) - Update Dictionaries and Dependencies ([#&#8203;2522](https://redirect.github.com/streetsidesoftware/cspell-action/issues/2522)) ([d4e5a6d](https://redirect.github.com/streetsidesoftware/cspell-action/commit/d4e5a6dc6902a76c699e177238bcf84ac3a5d537)) - Update Dictionaries and Dependencies ([#&#8203;2527](https://redirect.github.com/streetsidesoftware/cspell-action/issues/2527)) ([aadf274](https://redirect.github.com/streetsidesoftware/cspell-action/commit/aadf2742bc05cf6e7c260f3efc92d36f0b3660bb)) - Update Dictionaries and Dependencies ([#&#8203;2535](https://redirect.github.com/streetsidesoftware/cspell-action/issues/2535)) ([50b7781](https://redirect.github.com/streetsidesoftware/cspell-action/commit/50b7781a2760418b620f75d38b0cd48c1110089b)) - Update Dictionaries and Dependencies ([#&#8203;2537](https://redirect.github.com/streetsidesoftware/cspell-action/issues/2537)) ([272b283](https://redirect.github.com/streetsidesoftware/cspell-action/commit/272b2830688e15c203a173e976661170287eb3cb)) - Workflow Bot -- Update ALL Dependencies (main) ([#&#8203;2509](https://redirect.github.com/streetsidesoftware/cspell-action/issues/2509)) ([0c3c972](https://redirect.github.com/streetsidesoftware/cspell-action/commit/0c3c9727372f99314cd329eb06d8186099424441)) - Workflow Bot -- Update ALL Dependencies (main) ([#&#8203;2511](https://redirect.github.com/streetsidesoftware/cspell-action/issues/2511)) ([98131f7](https://redirect.github.com/streetsidesoftware/cspell-action/commit/98131f74e9c9cdd1dd70e9f6fe1983f30c0fea3d)) - Workflow Bot -- Update ALL Dependencies (main) ([#&#8203;2534](https://redirect.github.com/streetsidesoftware/cspell-action/issues/2534)) ([17d6e4f](https://redirect.github.com/streetsidesoftware/cspell-action/commit/17d6e4f8d5d4d8db751165ee656a578f8abdc6b8)) - Workflow Bot -- Update ALL Dependencies (main) ([#&#8203;2539](https://redirect.github.com/streetsidesoftware/cspell-action/issues/2539)) ([e00d8fa](https://redirect.github.com/streetsidesoftware/cspell-action/commit/e00d8fa25d685c264b0587f71d9beb371c3a6e06)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - "on tuesday" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/open-telemetry/opentelemetry-collector).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Alex Boten <223565+codeboten@users.noreply.github.com>
diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml
@@ -222,7 +222,7 @@ jobs:
       - name: Run Unit Tests With Coverage
         run: make gotest-with-cover
       - name: Upload coverage report
-        uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # 5.5.1
+        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # 5.5.2
         env:
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
diff --git a/.github/workflows/builder-snapshot.yaml b/.github/workflows/builder-snapshot.yaml
@@ -36,7 +36,7 @@ jobs:
 
       - uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
 
-      - uses: anchore/sbom-action/download-syft@fbfd9c6c189226748411491745178e0c2017392d # v0.20.10
+      - uses: anchore/sbom-action/download-syft@43a17d6e7add2b5535efe4dcae9952337c479a93 # v0.20.11
 
       - uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
         with:
diff --git a/.github/workflows/check-codeowners.yaml b/.github/workflows/check-codeowners.yaml
@@ -48,7 +48,7 @@ jobs:
           repository: ${{github.event.pull_request.head.repo.full_name}}
           path: pr
 
-      - uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94 # v2.2.0
+      - uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
         id: otelbot-token
         with:
           app-id: ${{ vars.OTELBOT_APP_ID }}
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
@@ -39,12 +39,12 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@fe4161a26a8629af62121b670040955b330f9af2 # v4.31.6
+        uses: github/codeql-action/init@cf1bb45a277cb3c205638b2cd5c984db1c46a412 # v4.31.7
         with:
           languages: go
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@fe4161a26a8629af62121b670040955b330f9af2 # v4.31.6
+        uses: github/codeql-action/autobuild@cf1bb45a277cb3c205638b2cd5c984db1c46a412 # v4.31.7
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@fe4161a26a8629af62121b670040955b330f9af2 # v4.31.6
+        uses: github/codeql-action/analyze@cf1bb45a277cb3c205638b2cd5c984db1c46a412 # v4.31.7
diff --git a/.github/workflows/prepare-release.yml b/.github/workflows/prepare-release.yml
@@ -142,7 +142,7 @@ jobs:
             ~/go/pkg/mod
           key: go-cache-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('**/go.sum') }}
 
-      - uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94 # v2.2.0
+      - uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
         id: otelbot-token
         with:
           app-id: ${{ vars.OTELBOT_APP_ID }}
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
@@ -64,6 +64,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@fe4161a26a8629af62121b670040955b330f9af2 # v4.31.6
+        uses: github/codeql-action/upload-sarif@cf1bb45a277cb3c205638b2cd5c984db1c46a412 # v4.31.7
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/spell-check.yaml b/.github/workflows/spell-check.yaml
@@ -16,7 +16,7 @@ jobs:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: Run cSpell
-        uses: streetsidesoftware/cspell-action@3294df585d3d639e30f3bc019cb11940b9866e95 # v8.0.0
+        uses: streetsidesoftware/cspell-action@e5a858a18b7e0b56e0342b1dcad796308b7341a2 # v8.1.1
         with:
           incremental_files_only: false
           use_cspell_files: true
diff --git a/.github/workflows/stale-pr.yaml b/.github/workflows/stale-pr.yaml
@@ -12,7 +12,7 @@ jobs:
       pull-requests: write # for actions/stale to close stale PRs
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@5f858e3efba33a5ca4407a664cc011ad407f2008 # v10.1.0
+      - uses: actions/stale@997185467fa4f803885201cee163a9f38240193d # v10.1.1
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           stale-pr-message: "This PR was marked stale due to lack of activity. It will be closed in 14 days."
diff --git a/.github/workflows/survey-on-merged-pr.yml b/.github/workflows/survey-on-merged-pr.yml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event.pull_request.merged == true
     steps:
-      - uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94 # v2.2.0
+      - uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
         id: otelbot-token
         with:
           app-id: ${{ vars.OTELBOT_APP_ID }}
