ci(github-action): update action docker/build-push-action (53b7df9 → c3c9e26)

[its-miso]

This PR contains the following updates:

Package	Type	Update	Change
docker/build-push-action (changelog)	action	digest	53b7df9 → c3c9e26

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Configuration

📅 Schedule: (in timezone America/Edmonton)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[its-saffron]

AI Automated Review

Full PR review.

Analysis engine: MiniMax-M3@https://litellm.jory.dev/v1 (anthropic) — escalated (fast_low_confidence)

Recommendation: approve

This is a routine, dependency-only Renovate digest bump of docker/build-push-action from 53b7df96c91f9c12dcc8a07bcb9ccacbed38856a to c3c9e263c25d99ce0380d002d59b67737d91b0dc in two CI/release workflow files. Both pins keep the trailing # v7 comment, and the action remains pinned to a full commit SHA (not a mutable tag) in both .github/workflows/ci.yaml and .github/workflows/release.yaml. The diff is the minimum-risk shape for a Renovate-generated action digest update.

Change-by-change findings

• .github/workflows/ci.yaml (line 36) — bumps the Build (no push) step's docker/build-push-action SHA from 53b7df9… to c3c9e26…. No with: block is changed, so the context: . / push: false inputs are preserved verbatim. Correct.
• .github/workflows/release.yaml (line 36) — bumps the pre-scan build step (per the surrounding comment block: "release's packages against a provably clean build. A tarball has no resolution logic to get wrong. If a critical/high CVE is found we never push."). Same SHA update, push: false retained. Correct.
• .github/workflows/release.yaml (line 87) — bumps the post-scan re-tag/push step (per comment: "Re-tag and push now that both Trivy scans have passed."). Same SHA update, push: true retained, so the rebuilds reproducibly carry buildx metadata/labels/provenance. Correct.

All three references updated consistently; no orphan 53b7df9… pins remain in the diff. Verified by git grep for 53b7df9 — no hits in the repo after this change. Verified by git grep for action — every docker/build-push-action reference now resolves to c3c9e263c25d99ce0380d002d59b67737d91b0dc, matching the PR title.

Standards Compliance

The repository's documented guidance (AGENTS.md) is about how agents must file issues so the autonomous review loop can vet the ask: state the ask in one imperative sentence and name concrete file paths the fix is expected to touch. That guidance governs issue intake, not the contents of a Renovate PR. Nothing in AGENTS.md speaks to CI action pinning policy, so there is no documented repo-level convention that this PR violates.

Sources

• Renovate-generated body, current digest enrichment, and the PR diff all agree the bump is 53b7df9… → c3c9e26… on docker/build-push-action, comment # v7 retained.
• The full GitHub compare-metadata fetch for docker/build-push-action@53b7df9…c3c9e26… could not be retrieved, so I cannot enumerate which commits sit between the two digests. This is a routine non-blocker for a Renovate SHA bump that is gated by its own CI runs, including a real docker job, before automerge.
• Release-history enrichment for docker/build-push-action shows active v7.x releases; both referenced digests fall inside the v7 line.

Unknowns or Needs Verification

• Could not fetch the GitHub compare view for the exact digest pair, so the per-commit changelog between 53b7df9… and c3c9e26… is not in the corpus. Not blocking — Renovate's stability-days gate plus the docker and test CI checks passing (see below) cover the typical regression surface, and any behavioral regression in build-push-action v7 would surface in the workflow run.
• renovate/stability-days is reported pending at the time of CI capture. This is the Renovate-side stability delay; it does not gate merge on its own (automerge is enabled on this PR's Renovate config), and the native review, test, and docker GitHub checks have all succeeded.