ci(deps): bump docker/build-push-action from 7.2.0 to 7.3.0

[dependabot]

Bumps docker/build-push-action from 7.2.0 to 7.3.0.

Release notes

Sourced from docker/build-push-action's releases.

v7.3.0

• Preserve names in esbuild bundle by @​crazy-max in docker/build-push-action#1567
• Bump @​docker/actions-toolkit from 0.90.0 to 0.92.0 in docker/build-push-action#1545 docker/build-push-action#1572
• Bump @​sigstore/core from 3.1.0 to 3.2.1 in docker/build-push-action#1568
• Bump js-yaml from 4.1.1 to 4.3.0 in docker/build-push-action#1566
• Bump tmp from 0.2.5 to 0.2.7 in docker/build-push-action#1547
• Bump undici from 6.24.1 to 6.27.0 in docker/build-push-action#1564
• Bump vite from 7.3.2 to 7.3.6 in docker/build-push-action#1563

Full Changelog: docker/build-push-action@v7.2.0...v7.3.0

Commits

• 53b7df9 Merge pull request #1572 from docker/dependabot/npm_and_yarn/docker/actions-t...
• 154298c [dependabot skip] chore: update generated content
• cb1238b chore(deps): Bump @​docker/actions-toolkit from 0.91.0 to 0.92.0
• 24f845d Merge pull request #1566 from docker/dependabot/npm_and_yarn/js-yaml-4.2.0
• 9c69730 [dependabot skip] chore: update generated content
• bc3a3a5 Merge pull request #1574 from docker/dependabot/github_actions/aws-actions/co...
• a82c504 chore(deps): Bump js-yaml from 4.1.1 to 4.3.0
• 0285a75 Merge pull request #1573 from docker/dependabot/github_actions/actions/cache-...
• c6ad2a3 Merge pull request #1575 from docker/dependabot/github_actions/actions/checko...
• d37484f Merge pull request #1564 from docker/dependabot/npm_and_yarn/undici-6.27.0
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[helebest]

Step 1 — Code Review ✅

Change: .github/workflows/release.yml — bumps docker/build-push-action from 7.2.0 (f9f3042…) to 7.3.0 (53b7df9…), one line, still SHA-pinned with a trailing # v7.3.0 version comment.

Criterion	Assessment
Consistency	PR description (7.2.0 → 7.3.0) matches the diff exactly.
Correctness	New SHA 53b7df96c91f9c12dcc8a07bcb9ccacbed38856a is the HEAD commit of the upstream v7.3.0 release.
Conventions	Preserves the repo's convention of pinning actions by full commit SHA with a # vX.Y.Z comment.
Security	Immutable SHA pin (not a floating tag). v7.3.0 release notes are routine internal bumps — @docker/actions-toolkit 0.90→0.92, @sigstore/core, js-yaml, tmp, undici, vite, esbuild name preservation. No breaking changes and no security advisories affecting our usage.
Effectiveness	Achieves the stated dependency update.
Test coverage	CI-configuration-only change to the release workflow (runs on vX.Y.Z tags). No functional/library code changed, so no new test cases are warranted; the action step's inputs (context, file, tags, labels, platforms) are unchanged.

Verdict: low-risk, approved to proceed to CI monitoring.

---

Generated by Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[helebest]

Steps 2–4 — Verification, CI & Merge ✅

Step 2 — Regression: The change touches only .github/workflows/release.yml (the release-tag-gated image build), so no library/test code is affected. The full PR CI suite passed as the regression gate.

Step 3 — CI monitoring: All 9 checks green on head bd111a1:

• ci / lint-type-test (3.12) ✅
• ci / lint-type-test (3.13) ✅
• ci / Postgres contract tests ✅
• ci / Server e2e (serve-and-run) ✅
• ci / Wheel install smoke test ✅
• ci / Dockerfile DIKW_VERSION guard ✅
• Analyze Python (CodeQL) ✅ / CodeQL ✅
• codecov/patch ✅ (all modified lines covered)

mergeable_state: clean.

Step 4 — Merge: Squash-merged into main as 59855bf.

Decision: Approved and merged — low-risk, SHA-pinned CI action bump with a clean changelog and full green CI.

---

Generated by Claude Code

[helebest]

Steps 2–4 — Regression, CI & merge ✅

Step 2/3 — Regression & CI: All checks passed green on head bd111a1:

Check	Result
ci / lint-type-test (3.12)	✅ success
ci / lint-type-test (3.13)	✅ success
ci / Postgres contract tests	✅ success
ci / Server e2e (serve-and-run)	✅ success
ci / Wheel install smoke test	✅ success
ci / Dockerfile DIKW_VERSION guard	✅ success
Analyze Python (CodeQL)	✅ success
codecov/patch	✅ success

The lint-type-test jobs run the full ruff + mypy + pytest suite (Python 3.12 & 3.13), which is the regression gate for this repo. This is a CI-only change (.github/workflows/release.yml, a single SHA bump for docker/build-push-action) touching no library/product code, so the CI run is the complete regression verification.

Step 4 — Merge: Squash-merged into main as 59855bf6604addd00271ae33fac016db8ff449c1.

---

Generated by Claude Code

[helebest]

Automated Dependabot review

Step 1 — Code review

• Consistency: The single-line change matches the PR title — docker/build-push-action is bumped 7.2.0 → 7.3.0 in .github/workflows/release.yml, and the # v7.3.0 version comment is updated in step with the pinned SHA.
• Correctness: The new SHA 53b7df96c91f9c12dcc8a07bcb9ccacbed38856a corresponds to the v7.3.0 release tag per the upstream release notes/commit list. The action is used only in the release image-build step; its inputs (context, file, …) are unchanged, so no call-site adjustment is needed.
• Conventions: Follows the repo convention of pinning actions to a full commit SHA with a trailing # vX.Y.Z comment.
• Security: Minor version bump. The internal changes are forward transitive dependency bumps within the action itself (@docker/actions-toolkit, @sigstore/core, js-yaml, tmp, undici, vite) — several are security-relevant and move forward. No breaking changes or advisories affecting our usage.
• Effectiveness: Achieves the stated version bump.
• Test coverage: This is a CI action bump with no product-code change, so no unit tests apply; the action is exercised by the release image-build job.

Step 2 — Regression verification: Full CI suite is green on this PR — lint-type-test (3.12/3.13), Postgres contract tests, Server e2e, Wheel install smoke test, Dockerfile DIKW_VERSION guard.

Step 3 — CI monitoring: All checks pass green (Analyze Python, CodeQL, codecov/patch included); mergeable_state is clean.

Step 4 — Decision: Approved. Proceeding to squash merge.

---

Generated by Claude Code