Update GitHub Actions

[renovate-rancher]

This PR contains the following updates:

Package	Type	Update	Change	Pending
actions/upload-artifact	action	patch	v7.0.0 → v7.0.1
fossas/fossa-action	action	minor	v1.8.0 → v1.9.0
github/codeql-action	action	minor	v4.33.0 → v4.35.2	v4.36.0 (+3)
rancher/ecm-distro-tools	action	minor	v0.65.2 → v0.68.1	v0.70.0 (+5)

---

Release Notes

actions/upload-artifact (actions/upload-artifact)

v7.0.1

Compare Source

What's Changed

• Update the readme with direct upload details by @​danwkennedy in #​795
• Readme: bump all the example versions to v7 by @​danwkennedy in #​796
• Include changes in typespec/ts-http-runtime 0.3.5 by @​yacaovsnc in #​797

Full Changelog: actions/upload-artifact@v7...v7.0.1

fossas/fossa-action (fossas/fossa-action)

v1.9.0

Compare Source

What's Changed

• Bump actions/checkout from 5 to 6 by @​dependabot[bot] in #​245
• Bump @​actions/tool-cache from 3.0.1 to 4.0.0 by @​dependabot[bot] in #​267
• Bump undici from 6.23.0 to 6.24.1 by @​spatten in #​275
• Add CI workflow to auto-rebuild dist by @​spatten in #​276
• Bump actions/upload-artifact from 4 to 7 by @​dependabot[bot] in #​272
• Add CodeRabbit configuration by @​chad-fossa in #​271
• Bump @​types/node from 25.2.0 to 25.2.1 by @​dependabot[bot] in #​269

New Contributors

• @​chad-fossa made their first contribution in #​271

Full Changelog: fossas/fossa-action@v1.8.0...v1.9.0

github/codeql-action (github/codeql-action)

v4.35.2

Compare Source

• The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #​3795
• The Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. #​3789
• Python analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. #​3794
• Fixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. #​3807
• Update default CodeQL bundle version to 2.25.2. #​3823

v4.35.1

Compare Source

• Fix incorrect minimum required Git version for improved incremental analysis: it should have been 2.36.0, not 2.11.0. #​3781

v4.35.0

Compare Source

• Reduced the minimum Git version required for improved incremental analysis from 2.38.0 to 2.11.0. #​3767
• Update default CodeQL bundle version to 2.25.1. #​3773

v4.34.1

Compare Source

• Downgrade default CodeQL bundle version to 2.24.3 due to issues with a small percentage of Actions and JavaScript analyses. #​3762

v4.34.0

Compare Source

• Added an experimental change which disables TRAP caching when improved incremental analysis is enabled, since improved incremental analysis supersedes TRAP caching. This will improve performance and reduce Actions cache usage. We expect to roll this change out to everyone in March. #​3569
• We are rolling out improved incremental analysis to C/C++ analyses that use build mode none. We expect this rollout to be complete by the end of April 2026. #​3584
• Update default CodeQL bundle version to 2.25.0. #​3585

rancher/ecm-distro-tools (rancher/ecm-distro-tools)

v0.68.1

Compare Source

What's Changed

• Update SLSActl action version to v0.1.31 by @​tashima42 in #​904

Full Changelog: rancher/ecm-distro-tools@v0.68.0...v0.68.1

v0.68.0

Compare Source

Breaking change

• Creating tags on rancher, rancher-prime, ui and cli now use tags to auto get the latest pre-release and not the release

What's Changed

• Update module github.com/aws/aws-sdk-go-v2/config to v1.32.15 by @​renovate-rancher[bot] in #​894
• add renovate to yq by @​tashima42 in #​897
• Update dependency mikefarah/yq to v4.53.2 by @​renovate-rancher[bot] in #​896
• use tags for latest pre release check by @​tashima42 in #​903
• Update module github.com/google/go-github/v84 to v85 by @​renovate-rancher[bot] in #​902
• Update Update Kubernetes dependencies to v1.6.0 by @​renovate-rancher[bot] in #​901
• Update module github.com/aws/aws-sdk-go-v2/service/s3 to v1.99.1 by @​renovate-rancher[bot] in #​900

Full Changelog: rancher/ecm-distro-tools@v0.67.4...v0.68.0

v0.67.4

Compare Source

What's Changed

• Update module golang.org/x/mod to v0.35.0 by @​renovate-rancher[bot] in #​882
• Update module github.com/google/go-containerregistry to v0.21.5 by @​renovate-rancher[bot] in #​886
• Add -k3sN tag support to imagebuild sync/republish (#​1) by @​cwayne18 in #​890
• Add --alert flag for release notes generation cmd by @​rafaelbreno in #​891
• Update module github.com/go-git/go-git/v5 to v5.18.0 [SECURITY] by @​renovate-rancher[bot] in #​885
• Update sigstore/cosign-installer action to v4.1.1 by @​renovate-rancher[bot] in #​892
• Improve LatestRC func by @​rafaelbreno in #​893

Full Changelog: rancher/ecm-distro-tools@v0.67.3...v0.67.4

v0.67.3

Compare Source

What's Changed

• remove qa folder and files by @​mdrahman-suse in #​877
• remove devcontainer by @​tashima42 in #​876
• remove test-pad, add qa folder without qa-captain script by @​mdrahman-suse in #​878
• Update module github.com/google/go-containerregistry to v0.21.4 by @​renovate-rancher[bot] in #​879
• Update module github.com/aws/aws-sdk-go-v2/service/s3 to v1.99.0 by @​renovate-rancher[bot] in #​880
• Update rancher/ecm-distro-tools action to v0.65.2 by @​renovate-rancher[bot] in #​884
• Update module golang.org/x/text to v0.36.0 by @​renovate-rancher[bot] in #​883
• Update module golang.org/x/crypto to v0.50.0 by @​renovate-rancher[bot] in #​881
• Update release tag rke2|k3s commands to support Tag instead of Release by @​rafaelbreno in #​887
• Update rancher/ecm-distro-tools action to v0.66.0 by @​renovate-rancher[bot] in #​888

New Contributors

• @​mdrahman-suse made their first contribution in #​877

Full Changelog: rancher/ecm-distro-tools@v0.67.2...v0.67.3

v0.67.2

Compare Source

What's Changed

• Update module github.com/aws/aws-sdk-go-v2/config to v1.32.14 by @​renovate-rancher[bot] in #​874
• Update dependency etcd-io/etcd to v3.6.10 by @​renovate-rancher[bot] in #​875
• Small improvements in kdm generation and update nginx env name by @​rafaelbreno in #​873

Full Changelog: rancher/ecm-distro-tools@v0.67.1...v0.67.2

v0.67.1

Compare Source

What's Changed

• add clean images step by @​tashima42 in #​871
• verify checksums and use target arch to build by @​tashima42 in #​872

Full Changelog: rancher/ecm-distro-tools@v0.67.0...v0.67.1

v0.67.0

Compare Source

What's Changed

• Update module github.com/aws/aws-sdk-go-v2 to v1.41.5 by @​renovate-rancher[bot] in #​860
• Update module github.com/aws/aws-sdk-go-v2/service/s3 to v1.97.3 by @​renovate-rancher[bot] in #​862
• Update module github.com/aws/aws-sdk-go-v2/config to v1.32.13 by @​renovate-rancher[bot] in #​861
• Update rancher/ecm-distro-tools action to v0.64.0 by @​renovate-rancher[bot] in #​864
• Update module github.com/aws/aws-sdk-go-v2/service/s3 to v1.98.0 by @​renovate-rancher[bot] in #​868
• Update module github.com/go-git/go-git/v5 to v5.17.2 by @​renovate-rancher[bot] in #​867
• Update module go.opentelemetry.io/otel/sdk to v1.43.0 [SECURITY] by @​renovate-rancher[bot] in #​869
• add images list from flag by @​tashima42 in #​870

Full Changelog: rancher/ecm-distro-tools@v0.66.3...v0.67.0

v0.66.3

Compare Source

What's Changed

• Change permissions from read to write for contents by @​tashima42 in #​855
• Update example to pin GHAs to by @​macedogm in #​856
• Update actions/setup-go digest to 4a36011 by @​renovate-rancher[bot] in #​857
• Update module github.com/aws/aws-sdk-go-v2/service/s3 to v1.97.2 by @​renovate-rancher[bot] in #​858
• Update module github.com/go-git/go-git/v5 to v5.17.1 [SECURITY] by @​renovate-rancher[bot] in #​859
• Add imageEnvVersion function that will extract a Env value from a file by @​rafaelbreno in #​863

Full Changelog: rancher/ecm-distro-tools@v0.66.2...v0.66.3

v0.66.2

Compare Source

What's Changed

• Enhance README with immutable releases guidance by @​tashima42 in #​853
• Add GH_TOKEN to release publishing step by @​tashima42 in #​854

Full Changelog: rancher/ecm-distro-tools@v0.66.1...v0.66.2

v0.66.1

Compare Source

What's Changed

• Update GitHub Actions by @​renovate-rancher[bot] in #​842
• prepare release workflow for immutable releases by @​tashima42 in #​852

Full Changelog: rancher/ecm-distro-tools@v0.66.0...v0.66.1

v0.66.0

Compare Source

Breaking changes:

• Create tags instead of releases for rancher and rancher-prime and fix warnings by @​tashima42 in #​846

What's Changed

• chore(deps): update module github.com/google/go-containerregistry to v0.21.3 by @​renovate-rancher[bot] in #​840
• Pin GH Actions to commit sha by @​tashima42 in #​843
• chore(deps): update rancherlabs/slsactl action to v0.1.24 by @​renovate-rancher[bot] in #​841
• Harden workflows and actions by @​tashima42 in #​844

Full Changelog: rancher/ecm-distro-tools@v0.65.2...v0.66.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.