[renovate]

Description

Renovate proposes this dependency update under the family preset. The table below lists each package and its version change, and the release notes follow.

Pre-Merge Verification Checklist

The bot ticks nothing; CI runs the repository's required gate on this pull request; items no check decides (3D tests among them) still need a reviewer's look.

• Local verification passed: make verify-all
• No new HISS / NASA Power-of-10 infractions (all new/modified functions
  $\le 60$ LOC)
• 3D Tests included (Positive, Negative, Boundary) for public APIs
• Agent contexts in sync: standardsctl compile-context --verify
• Commit messages adhere to Conventional Commits format

This PR contains the following updates:

Package	Type	Update	Change
docker/login-action	action	minor	v4.7.0 → v4.8.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

docker/login-action

v4.8.0

Compare Source

• Set Docker Hub OIDC token lifetime default to 1 hour by @​crazy-max in #​1070
• Bump @​aws-sdk/client-ecr and @​aws-sdk/client-ecr-public to 3.1161.0 in #​1103
• Bump @​docker/actions-toolkit from 0.107.0 to 0.109.0 in #​1105
• Bump vite from 7.3.6 to 7.3.7 in #​1101

Full Changelog: docker/login-action@v4.7.0...v4.8.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

Summary by CodeRabbit

• Chores
  • Updated the sign-in step in the automated container image publishing workflow. The workflow’s build, publishing, verification, attestation, and tag-promotion behavior remains unchanged. This maintenance update does not change application features or user-facing behavior.

[sourcery-ai]

Sorry @renovate[bot], this account has used its review budget of 2,500,000 diff characters for the last 7 days.

You can request another review in 3 hours and 8 minutes by commenting @sourcery-ai review.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

• Last reviewed commit: b40fa21
• Latest commit, not reviewed: fb296ec

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• Resume reviews
• Trigger review

No actionable comments were generated in the recent review.

Walkthrough

The devcontainer image workflow now uses docker/login-action v4.8.0 instead of v4.7.0 for registry login. The other workflow steps and triggers are unchanged.

Changes: Publish workflow

Layer / File(s)	Summary
Update GHCR login action .github/workflows/devcontainer-image.yml	The publish job now uses docker/login-action v4.8.0 instead of v4.7.0.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Possibly related issues

• VMAFx/pelorus Issue 3 tracks Renovate-detected dependency updates, including GitHub Actions. This PR updates docker/login-action.

Merge Risk: Minimal · previous review b40fa

The GHCR login action update has no identified merge-blocking risk. The publish-job result was not supplied.

Architecture risk: Low · up to b40fa

The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.

Changed systems: None identified.

Architecture concerns
No architecture-level concerns identified.

Review details

Before / after behavior

• observed — Modified behavior in .github/workflows/devcontainer-image.yml: The registry login step updates docker/login-action from v4.7.0 to v4.8.0.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely identifies the dependency update from the changeset.
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Finishing Touches

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Recent review info

Run configuration

• Source mode: Auto
• Repository: VMAFx/pelorus
• Branch: master
• File: .coderabbit.yaml
• Commit: c8ef3d0
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: ce9ead68-3747-4198-9193-9bb210110bea

Commits

Reviewing files that changed from the base of the PR and between 3118415 and b40fa21.

Files selected for processing: 1

• .github/workflows/devcontainer-image.yml

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 7 remain after this review.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

✅ No blocking issues noticed

No blocking findings were identified. The acceptance criteria appear addressed by the stated dependency update, with no agent-reported regressions or quality issues.

Test suggestions

• Verify the workflow uses docker/login-action v4.8.0.
• Verify the publish job still authenticates to GHCR with the repository actor and GitHub token.

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Verify the workflow uses docker/login-action v4.8.0.
2. Verify the publish job still authenticates to GHCR with the repository actor and GitHub token.

_{TIP How was this review? Give us feedback}

[sourcery-ai]

Reviewer's Guide

Configuration

Update the devcontainer image workflow to use docker/login-action v4.8.0 for its ghcr.io login step.

• .github/workflows/devcontainer-image.yml L140

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.