From 02c9b7bccc970485ea2dc29aa262ccad715f3b2b Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 3 Jun 2025 09:36:28 -0600
Subject: [PATCH] chore(deps): bump the github-actions group across 1 directory
 with 3 updates (#5641)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps the github-actions group with 3 updates in the / directory:
[docker/build-push-action](https://github.com/docker/build-push-action),
[mikefarah/yq](https://github.com/mikefarah/yq) and
[actions/setup-go](https://github.com/actions/setup-go).

Updates `docker/build-push-action` from 6.16.0 to 6.18.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/docker/build-push-action/releases">docker/build-push-action's
releases</a>.</em></p>
<blockquote>
<h2>v6.18.0</h2>
<ul>
<li>Bump <code>@​docker/actions-toolkit</code> from 0.61.0 to 0.62.1 in
<a
href="https://redirect.github.com/docker/build-push-action/pull/1381">docker/build-push-action#1381</a></li>
</ul>
<blockquote>
<p>[!NOTE]
<a
href="https://docs.docker.com/build/ci/github-actions/build-summary/">Build
summary</a> is now supported with <a
href="https://docs.docker.com/build-cloud/">Docker Build Cloud</a>.</p>
</blockquote>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/docker/build-push-action/compare/v6.17.0...v6.18.0">https://github.com/docker/build-push-action/compare/v6.17.0...v6.18.0</a></p>
<h2>v6.17.0</h2>
<ul>
<li>Bump <code>@​docker/actions-toolkit</code> from 0.59.0 to 0.61.0 by
<a href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in
<a
href="https://redirect.github.com/docker/build-push-action/pull/1364">docker/build-push-action#1364</a></li>
</ul>
<blockquote>
<p>[!NOTE]
Build record is now exported using the <a
href="https://docs.docker.com/reference/cli/docker/buildx/history/export/"><code>buildx
history export</code></a> command instead of the legacy export-build
tool.</p>
</blockquote>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/docker/build-push-action/compare/v6.16.0...v6.17.0">https://github.com/docker/build-push-action/compare/v6.16.0...v6.17.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/docker/build-push-action/commit/263435318d21b8e681c14492fe198d362a7d2c83"><code>2634353</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/build-push-action/issues/1381">#1381</a>
from docker/dependabot/npm_and_yarn/docker/actions-t...</li>
<li><a
href="https://github.com/docker/build-push-action/commit/c0432d2e016ab17a336cee48256683e74d5c4c9e"><code>c0432d2</code></a>
chore: update generated content</li>
<li><a
href="https://github.com/docker/build-push-action/commit/0bb1f27d6b9fc90993f41febd9b53ee89397d3f8"><code>0bb1f27</code></a>
set builder driver and endpoint attributes for dbc summary support</li>
<li><a
href="https://github.com/docker/build-push-action/commit/5f9dbf956c8481ecf630d0e53941d9d3afaa53bb"><code>5f9dbf9</code></a>
chore(deps): Bump <code>@​docker/actions-toolkit</code> from 0.61.0 to
0.62.1</li>
<li><a
href="https://github.com/docker/build-push-action/commit/0788c444d8b4d67580213712e34a148cae3a6c4e"><code>0788c44</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/build-push-action/issues/1375">#1375</a>
from crazy-max/remove-gcr</li>
<li><a
href="https://github.com/docker/build-push-action/commit/aa179ca4f405fed7a76dad90a23bd02d6f2a8d2d"><code>aa179ca</code></a>
e2e: remove GCR</li>
<li><a
href="https://github.com/docker/build-push-action/commit/1dc73863535b631f98b2378be8619f83b136f4a0"><code>1dc7386</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/build-push-action/issues/1364">#1364</a>
from crazy-max/history-export-cmd</li>
<li><a
href="https://github.com/docker/build-push-action/commit/9c9803f36437c54a2bf7b2c9a4a9011c2a812d71"><code>9c9803f</code></a>
chore: update generated content</li>
<li><a
href="https://github.com/docker/build-push-action/commit/db1f6c46e8d64f89ec10010e409681bcf7951c05"><code>db1f6c4</code></a>
DOCKER_BUILD_EXPORT_LEGACY env var to opt-in for legacy export</li>
<li><a
href="https://github.com/docker/build-push-action/commit/721e8c79de660781840d3a69a11e39e1e836ef8e"><code>721e8c7</code></a>
Bump <code>@​docker/actions-toolkit</code> from 0.59.0 to 0.61.0</li>
<li>See full diff in <a
href="https://github.com/docker/build-push-action/compare/14487ce63c7a62a4a324b0bfb37086795e31c6c1...263435318d21b8e681c14492fe198d362a7d2c83">compare
view</a></li>
</ul>
</details>
<br />

Updates `mikefarah/yq` from 4.45.1 to 4.45.4
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/mikefarah/yq/releases">mikefarah/yq's
releases</a>.</em></p>
<blockquote>
<h2>v4.45.4 - Fixing wrong map() behaviour on empty map</h2>
<ul>
<li>Fixing wrong map() behaviour on empty map <a
href="https://redirect.github.com/mikefarah/yq/issues/2359">#2359</a></li>
<li>Bumped dependencies</li>
</ul>
<h2>v4.45.3 - Fixes regression bug(s)</h2>
<ul>
<li>Fixing regression (<a
href="https://redirect.github.com/mikefarah/yq/issues/2353">#2353</a>,
<a
href="https://redirect.github.com/mikefarah/yq/issues/2359">#2359</a>,
<a
href="https://redirect.github.com/mikefarah/yq/issues/2325">#2325</a>)
introduced with in 4.45.2 with <a
href="https://redirect.github.com/mikefarah/yq/issues/2325">#2325</a>
fix</li>
<li>Bumped dependencies</li>
</ul>
<p>Sorry for the regression folks! 😓
fwiw I have since added automated tests to capture the scenarios
provided in the regression bug tickets</p>
<h2>v4.45.2</h2>
<ul>
<li>Added windows arm builds (Thanks <a
href="https://github.com/albertocavalcante"><code>@​albertocavalcante</code></a>,
<a
href="https://github.com/ShukantPal"><code>@​ShukantPal</code></a>)</li>
<li>Added s390x platform support (Thanks <a
href="https://github.com/ashokpariya0"><code>@​ashokpariya0</code></a>)</li>
<li>Additionally push docker images to ghcr.io (Thanks <a
href="https://github.com/reegnz"><code>@​reegnz</code></a>)</li>
<li>Fixing add when there is no node match <a
href="https://redirect.github.com/mikefarah/yq/issues/2325">#2325</a></li>
<li>sort_by works on maps</li>
<li>Bumped dependencies</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/mikefarah/yq/blob/master/release_notes.txt">mikefarah/yq's
changelog</a>.</em></p>
<blockquote>
<p>4.45.4:</p>
<ul>
<li>Fixing wrong map() behaviour on empty map <a
href="https://redirect.github.com/mikefarah/yq/issues/2359">#2359</a></li>
<li>Bumped dependencies</li>
</ul>
<p>4.45.3:</p>
<ul>
<li>Fixing regression introduced with in 4.45.2 with <a
href="https://redirect.github.com/mikefarah/yq/issues/2325">#2325</a>
fix :sweat: sorry folks!</li>
<li>Bumped dependencies</li>
</ul>
<p>4.45.2:</p>
<ul>
<li>Added windows arm builds (Thanks <a
href="https://github.com/albertocavalcante"><code>@​albertocavalcante</code></a>,
<a
href="https://github.com/ShukantPal"><code>@​ShukantPal</code></a>)</li>
<li>Added s390x platform support (Thanks <a
href="https://github.com/ashokpariya0"><code>@​ashokpariya0</code></a>)</li>
<li>Additionally push docker images to ghcr.io (Thanks <a
href="https://github.com/reegnz"><code>@​reegnz</code></a>)</li>
<li>Fixing add when there is no node match <a
href="https://redirect.github.com/mikefarah/yq/issues/2325">#2325</a></li>
<li>sort_by works on maps</li>
<li>Bumped dependencies</li>
</ul>
<p>4.45.1:</p>
<ul>
<li>Create parent directories when --split-exp is used, Thanks <a
href="https://github.com/rudo-thomas"><code>@​rudo-thomas</code></a></li>
<li>Bumped dependencies</li>
</ul>
<p>4.44.6:</p>
<ul>
<li>Fixed deleting items in array bug <a
href="https://redirect.github.com/mikefarah/yq/issues/2027">#2027</a>,
<a
href="https://redirect.github.com/mikefarah/yq/issues/2172">#2172</a>;
Thanks <a
href="https://github.com/jandubois"><code>@​jandubois</code></a></li>
<li>Docker image for armv7 / raspberry pi3, Thanks <a
href="https://github.com/brianegge"><code>@​brianegge</code></a></li>
<li>Fixed no-colors regression <a
href="https://redirect.github.com/mikefarah/yq/issues/2218">#2218</a></li>
<li>Fixed various panic scenarios <a
href="https://redirect.github.com/mikefarah/yq/issues/2211">#2211</a></li>
<li>Bumped dependencies</li>
</ul>
<p>4.44.5:</p>
<ul>
<li>Fixing release pipeline</li>
</ul>
<p>4.44.4:</p>
<ul>
<li>Format comments with a gray foreground (Thanks <a
href="https://github.com/gabe565"><code>@​gabe565</code></a>)</li>
<li>Fixed handling of nulls with sort_by expressions <a
href="https://redirect.github.com/mikefarah/yq/issues/2164">#2164</a></li>
<li>Force no color output when NO_COLOR env presents (Thanks <a
href="https://github.com/narqo"><code>@​narqo</code></a>)</li>
<li>Fixed array subtraction update bug <a
href="https://redirect.github.com/mikefarah/yq/issues/2159">#2159</a></li>
<li>Fixed index out of range error</li>
<li>Can traverse straight from parent operator (parent.blah)</li>
<li>Bumped dependencies</li>
</ul>
<p>4.44.3:</p>
<ul>
<li>Fixed upper-case file extension detection, Thanks <a
href="https://github.com/ryenus"><code>@​ryenus</code></a> (<a
href="https://redirect.github.com/mikefarah/yq/issues/2121">#2121</a>)</li>
<li>Log printing follow no-colors flag <a
href="https://redirect.github.com/mikefarah/yq/issues/2082">#2082</a></li>
<li>Skip and warn when interpolating strings and theres a unclosed
bracket <a
href="https://redirect.github.com/mikefarah/yq/issues/2083">#2083</a></li>
<li>Fixed CSV content starting with # issue <a
href="https://redirect.github.com/mikefarah/yq/issues/2076">#2076</a></li>
<li>Bumped dependencies</li>
</ul>
<p>4.44.2:</p>
<ul>
<li>Handle numbers with underscores <a
href="https://redirect.github.com/mikefarah/yq/issues/2039">#2039</a></li>
<li>Unique now works on maps and arrays <a
href="https://redirect.github.com/mikefarah/yq/issues/2068">#2068</a></li>
<li>Added support for short hand splat with env[] expression <a
href="https://redirect.github.com/mikefarah/yq/issues/2071">#2071</a>,</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/mikefarah/yq/commit/b534aa9ee5d38001fba3cd8fe254a037e4847b37"><code>b534aa9</code></a>
Bumping version</li>
<li><a
href="https://github.com/mikefarah/yq/commit/39a65b62d24d355fcf83b03db95139443dbab09b"><code>39a65b6</code></a>
Updating release notes</li>
<li><a
href="https://github.com/mikefarah/yq/commit/1e3006e951dad478f9731c1e9b3b5c2e98626962"><code>1e3006e</code></a>
Removing old issue template</li>
<li><a
href="https://github.com/mikefarah/yq/commit/22949df0fd0bd43ac62dc86845e247cb9cc4f896"><code>22949df</code></a>
Fixing running map against empty array bug <a
href="https://redirect.github.com/mikefarah/yq/issues/2359">#2359</a></li>
<li><a
href="https://github.com/mikefarah/yq/commit/734e2cd25402f10f51351c4034625043f07e7b06"><code>734e2cd</code></a>
Bumping version</li>
<li><a
href="https://github.com/mikefarah/yq/commit/082b76affabfa9470b4332473a9e53e128fdc4f3"><code>082b76a</code></a>
Preparing release notes</li>
<li><a
href="https://github.com/mikefarah/yq/commit/5bc2cd03da9139160db70901ffb8002bf6e242d5"><code>5bc2cd0</code></a>
Bumping golang version</li>
<li><a
href="https://github.com/mikefarah/yq/commit/20407a07a5d0a1b6d4b18f94c53caba536efcddc"><code>20407a0</code></a>
Adding more tests to prevent regression again :sweat</li>
<li><a
href="https://github.com/mikefarah/yq/commit/0a83da6b38cb638c8e5ab7194448bd69ad4f77ea"><code>0a83da6</code></a>
Bump github.com/pelletier/go-toml/v2 from 2.2.3 to 2.2.4</li>
<li><a
href="https://github.com/mikefarah/yq/commit/77da8b7d32020b138f9d86b4ca2a10c3a632b167"><code>77da8b7</code></a>
Bump golang from 1.24.2 to 1.24.3</li>
<li>Additional commits viewable in <a
href="https://github.com/mikefarah/yq/compare/8bf425b4d1344db7cd469a8d10a390876e0c77fd...b534aa9ee5d38001fba3cd8fe254a037e4847b37">compare
view</a></li>
</ul>
</details>
<br />

Updates `actions/setup-go` from 5.4.0 to 5.5.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/setup-go/releases">actions/setup-go's
releases</a>.</em></p>
<blockquote>
<h2>v5.5.0</h2>
<h2>What's Changed</h2>
<h3>Bug fixes:</h3>
<ul>
<li>Update self-hosted environment validation by <a
href="https://github.com/priyagupta108"><code>@​priyagupta108</code></a>
in <a
href="https://redirect.github.com/actions/setup-go/pull/556">actions/setup-go#556</a></li>
<li>Add manifest validation and improve error handling by <a
href="https://github.com/priyagupta108"><code>@​priyagupta108</code></a>
in <a
href="https://redirect.github.com/actions/setup-go/pull/586">actions/setup-go#586</a></li>
<li>Update template link by <a
href="https://github.com/jsoref"><code>@​jsoref</code></a> in <a
href="https://redirect.github.com/actions/setup-go/pull/527">actions/setup-go#527</a></li>
</ul>
<h3>Dependency  updates:</h3>
<ul>
<li>Upgrade <code>@​action/cache</code> from 4.0.2 to 4.0.3 by <a
href="https://github.com/aparnajyothi-y"><code>@​aparnajyothi-y</code></a>
in <a
href="https://redirect.github.com/actions/setup-go/pull/574">actions/setup-go#574</a></li>
<li>Upgrade <code>@​actions/glob</code> from 0.4.0 to 0.5.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-go/pull/573">actions/setup-go#573</a></li>
<li>Upgrade ts-jest from 29.1.2 to 29.3.2 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-go/pull/582">actions/setup-go#582</a></li>
<li>Upgrade eslint-plugin-jest from 27.9.0 to 28.11.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-go/pull/537">actions/setup-go#537</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/jsoref"><code>@​jsoref</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/setup-go/pull/527">actions/setup-go#527</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/setup-go/compare/v5...v5.5.0">https://github.com/actions/setup-go/compare/v5...v5.5.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/setup-go/commit/d35c59abb061a4a6fb18e82ac0862c26744d6ab5"><code>d35c59a</code></a>
chore: update discussions url (<a
href="https://redirect.github.com/actions/setup-go/issues/527">#527</a>)</li>
<li><a
href="https://github.com/actions/setup-go/commit/29694d72cd5e7ef3b09496b39f28a942af47737e"><code>29694d7</code></a>
Add manifest validation and improve error handling (<a
href="https://redirect.github.com/actions/setup-go/issues/586">#586</a>)</li>
<li><a
href="https://github.com/actions/setup-go/commit/78535dd5f299baffe8c7a20903d46f69f967f55b"><code>78535dd</code></a>
Bump eslint-plugin-jest from 27.9.0 to 28.11.0 (<a
href="https://redirect.github.com/actions/setup-go/issues/537">#537</a>)</li>
<li><a
href="https://github.com/actions/setup-go/commit/bb65d8857b81c74a671e81f935d3362a5d718e2f"><code>bb65d88</code></a>
Bump ts-jest from 29.1.2 to 29.3.2 (<a
href="https://redirect.github.com/actions/setup-go/issues/582">#582</a>)</li>
<li><a
href="https://github.com/actions/setup-go/commit/7f17e836c0800bfdfa49811f9ddaa7608881dffc"><code>7f17e83</code></a>
Bump <code>@​actions/glob</code> from 0.4.0 to 0.5.0 (<a
href="https://redirect.github.com/actions/setup-go/issues/573">#573</a>)</li>
<li><a
href="https://github.com/actions/setup-go/commit/dca8468d37b6d090cde2c7b97b738a37134f5ffb"><code>dca8468</code></a>
Update self-hosted environment validation and bump undici version (<a
href="https://redirect.github.com/actions/setup-go/issues/556">#556</a>)</li>
<li><a
href="https://github.com/actions/setup-go/commit/691cc3533f9e01982f216a98ecdd9fd81c27fd5b"><code>691cc35</code></a>
upgrade actions/cache to 4.0.3 (<a
href="https://redirect.github.com/actions/setup-go/issues/574">#574</a>)</li>
<li>See full diff in <a
href="https://github.com/actions/setup-go/compare/0aaccfd150d50ccaeb58ebd88d36e91967a5f35b...d35c59abb061a4a6fb18e82ac0862c26744d6ab5">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/docker-main.yaml             | 6 +++---
 .github/workflows/docker-version-branches.yaml | 2 +-
 .github/workflows/lint.yaml                    | 2 +-
 .github/workflows/release.yaml                 | 4 ++--
 .github/workflows/test.yaml                    | 8 ++++----
 5 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/docker-main.yaml b/.github/workflows/docker-main.yaml
index c68755e12..c83be2914 100644
--- a/.github/workflows/docker-main.yaml
+++ b/.github/workflows/docker-main.yaml
@@ -45,7 +45,7 @@ jobs:
           echo "sha-tag=${SHA_TAG}" >> $GITHUB_OUTPUT
 
       - name: Docker Publish - Main
-        uses: docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83
         with:
           context: .
           file: ./Dockerfile
@@ -58,7 +58,7 @@ jobs:
             org.opencontainers.image.revision=${{ github.sha }}
 
       - name: Docker Publish - Debug
-        uses: docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83
         with:
           context: .
           file: ./Dockerfile.debug
@@ -81,7 +81,7 @@ jobs:
           token: ${{ secrets.APPARITOR_GITHUB_TOKEN }}
 
       - name: Bump psql environment
-        uses: mikefarah/yq@8bf425b4d1344db7cd469a8d10a390876e0c77fd
+        uses: mikefarah/yq@b534aa9ee5d38001fba3cd8fe254a037e4847b37
         with:
           cmd:
             yq eval '.pomerium.image.tag = "${{ needs.publish.outputs.sha-tag }}"' -i
diff --git a/.github/workflows/docker-version-branches.yaml b/.github/workflows/docker-version-branches.yaml
index 39c671e80..9055fad43 100644
--- a/.github/workflows/docker-version-branches.yaml
+++ b/.github/workflows/docker-version-branches.yaml
@@ -39,7 +39,7 @@ jobs:
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Docker Publish - Version Branches
-        uses: docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83
         with:
           context: .
           file: ./Dockerfile
diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
index c0fd8ce0d..2fdeb1825 100644
--- a/.github/workflows/lint.yaml
+++ b/.github/workflows/lint.yaml
@@ -13,7 +13,7 @@ jobs:
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
 
-      - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b
+      - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5
         with:
           go-version: 1.24.x
           cache: false
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 71e575b50..456d71139 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -31,7 +31,7 @@ jobs:
           node-version: 22.x
 
       - name: Set up Go
-        uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5
         with:
           go-version: 1.24.x
           cache: false
@@ -127,7 +127,7 @@ jobs:
           token: ${{ secrets.APPARITOR_GITHUB_TOKEN }}
 
       - name: Bump test environment
-        uses: mikefarah/yq@8bf425b4d1344db7cd469a8d10a390876e0c77fd
+        uses: mikefarah/yq@b534aa9ee5d38001fba3cd8fe254a037e4847b37
         with:
           cmd: yq eval '.pomerium.image.tag = "${{ needs.goreleaser.outputs.tag }}"' -i projects/pomerium-demo/pomerium-demo/values.yaml
 
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index 955beb0c6..06630dc58 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -20,7 +20,7 @@ jobs:
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
 
-      - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b
+      - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5
         with:
           go-version: 1.24.x
           cache: false
@@ -59,7 +59,7 @@ jobs:
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
 
-      - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b
+      - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5
         with:
           go-version: 1.24.x
 
@@ -107,7 +107,7 @@ jobs:
         uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2
 
       - name: Docker Build
-        uses: docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83
         with:
           context: .
           file: ./Dockerfile
@@ -123,7 +123,7 @@ jobs:
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b
+      - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5
         with:
           go-version: 1.24.x
           cache: false