fix(ci): bump projectbluefin/actions SHA to 2a09e72e9be1 (#166) (#792)

actions@3025b5d31f34 excluded dakota from sign-and-publish
certificate-identity-regexp, causing 65% publish failure rate.
actions#166 fixes the regexp and makes scan-image non-blocking.

Assisted-by: Claude Sonnet 4.5 via pi

Author: castrojo

.github/workflows/build.yml

@@ -132,7 +132,7 @@ jobs:
       # Note: setup-runner btrfs does not pass loopback-free; watch for disk
       # pressure and upstream the option if needed.
       - name: Setup runner
-        uses: projectbluefin/actions/bootc-build/setup-runner@3025b5d31f34ce44c19eab41a7fa5d4d5c5b688e # v1.1.0
+        uses: projectbluefin/actions/bootc-build/setup-runner@2a09e72e9be15b137392dde15f8587f35587e8eb # v1.1.0
         with:
           storage-backend: btrfs
           update-podman: true
@@ -210,7 +210,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Setup runner
-        uses: projectbluefin/actions/bootc-build/setup-runner@3025b5d31f34ce44c19eab41a7fa5d4d5c5b688e # v1.1.0
+        uses: projectbluefin/actions/bootc-build/setup-runner@2a09e72e9be15b137392dde15f8587f35587e8eb # v1.1.0
         with:
           storage-backend: btrfs
           update-podman: true

.github/workflows/clean.yml

@@ -14,7 +14,7 @@ jobs:
       packages: write
     steps:
       - name: Delete Images Older Than 90 Days
-        uses: projectbluefin/actions/bootc-build/ghcr-cleanup@3025b5d31f34ce44c19eab41a7fa5d4d5c5b688e # feat/ghcr-cleanup-orphaned-images
+        uses: projectbluefin/actions/bootc-build/ghcr-cleanup@2a09e72e9be15b137392dde15f8587f35587e8eb # feat/ghcr-cleanup-orphaned-images
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           packages: dakota,dakota-nvidia

.github/workflows/ghcr-cleanup.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Prune old GHCR images
-        uses: projectbluefin/actions/bootc-build/ghcr-cleanup@3025b5d31f34ce44c19eab41a7fa5d4d5c5b688e # v1.1.0
+        uses: projectbluefin/actions/bootc-build/ghcr-cleanup@2a09e72e9be15b137392dde15f8587f35587e8eb # v1.1.0
         with:
           packages: dakota,dakota-nvidia
           older-than: 90 days

.github/workflows/publish.yml

@@ -128,7 +128,7 @@ jobs:
       # Note: setup-runner btrfs does not expose loopback-free; watch for disk
       # pressure and upstream the option if needed.
       - name: Setup runner
-        uses: projectbluefin/actions/bootc-build/setup-runner@3025b5d31f34ce44c19eab41a7fa5d4d5c5b688e # v1.1.0
+        uses: projectbluefin/actions/bootc-build/setup-runner@2a09e72e9be15b137392dde15f8587f35587e8eb # v1.1.0
         with:
           storage-backend: btrfs
           update-podman: true
@@ -160,7 +160,7 @@ jobs:
         # xattr-manifest (fakecap-manifest.tsv) is pre-committed (Cargo.lock pattern)
         # and regenerated by the update-filemap workflow when elements change.
         # Merge order: projectbluefin/actions#<PR> must land before this workflow runs.
-        uses: projectbluefin/actions/bootc-build/chunka@3025b5d31f34ce44c19eab41a7fa5d4d5c5b688e # v1
+        uses: projectbluefin/actions/bootc-build/chunka@2a09e72e9be15b137392dde15f8587f35587e8eb # v1
         with:
           source-image: localhost/${{ env.IMAGE_NAME }}${{ matrix.image_suffix }}:latest
           max-layers: "120"
@@ -223,7 +223,7 @@ jobs:
         # generate-sbom: false — dakota uses just sbom (BST-native provenance via
         # bst artifact list). Syft post-build scan is less accurate for BST builds.
         # SBOM attachment and SBOM signing are handled in the steps below.
-        uses: projectbluefin/actions/bootc-build/sign-and-publish@3025b5d31f34ce44c19eab41a7fa5d4d5c5b688e # v1.1.0
+        uses: projectbluefin/actions/bootc-build/sign-and-publish@2a09e72e9be15b137392dde15f8587f35587e8eb # v1.1.0
         with:
           image: ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}${{ matrix.image_suffix }}
           digest: ${{ steps.push.outputs.digest }}

.github/workflows/renovate-automerge.yml

@@ -12,6 +12,6 @@ permissions:
 jobs:
   automerge:
     if: github.event.workflow_run.conclusion == 'success'
-    uses: projectbluefin/actions/.github/workflows/reusable-renovate-automerge.yml@3025b5d31f34ce44c19eab41a7fa5d4d5c5b688e # v1
+    uses: projectbluefin/actions/.github/workflows/reusable-renovate-automerge.yml@2a09e72e9be15b137392dde15f8587f35587e8eb # v1
     with:
       head_sha: ${{ github.event.workflow_run.head_sha }}

.github/workflows/skill-drift.yml

@@ -10,7 +10,7 @@ permissions:
 
 jobs:
   skill-drift:
-    uses: projectbluefin/actions/.github/workflows/skill-drift-check.yml@3025b5d31f34ce44c19eab41a7fa5d4d5c5b688e # v1
+    uses: projectbluefin/actions/.github/workflows/skill-drift-check.yml@2a09e72e9be15b137392dde15f8587f35587e8eb # v1
     with:
       code-paths: '[".github/workflows/**", "build_files/**", "Justfile", "elements/**"]'
       skill-paths: '["docs/skills/**", "docs/*.md", "AGENTS.md"]'