ci(github-action): update action docker/setup-buildx-action (594f3bf → f87e599)

[its-miso]

This PR contains the following updates:

Package	Type	Update	Change
docker/setup-buildx-action (changelog)	action	digest	594f3bf → f87e599

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Configuration

📅 Schedule: (in timezone America/Edmonton)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[its-saffron]

AI Automated Review

Full PR review.

Analysis engine: MiniMax-M3@https://litellm.jory.dev/v1 (anthropic) — escalated (fast_low_confidence)

Recommendation

Approve. This is a routine Renovate-generated digest bump for docker/setup-buildx-action (v4) in two workflow files. The change is minimal, the new digest is pinned, both workflows already use pinned-by-digest references for other actions (consistent with the project's supply-chain hardening visible in repo history), and CI is green for the relevant checks (review, test, docker).

Change-by-change findings

• .github/workflows/ci.yaml (line 34): docker/setup-buildx-action digest bumped from 594f3bf… to f87e599…, still annotated # v4. Same major version, same positional usage (Build (no push) job), no inputs added/removed in the diff. ✅
• .github/workflows/ci.yaml (line 36): docker/build-push-action@c3c9e263… is untouched — no version skew introduced. ✅
• .github/workflows/release.yaml (line 19): Identical digest bump on the release job; docker/login-action@dbcb8138… and docker/build-push-action@c3c9e263… unchanged, so the three docker actions in this job remain mutually compatible (all stay on their previously pinned versions). ✅
• .github/workflows/release.yaml (line 87): Downstream docker/build-push-action@c3c9e263… reference unchanged. ✅

Sources

• PR body describes a digest bump of docker/setup-buildx-action only; Renovate-generated (renovate-bot author, branch renovate/docker-setup-buildx-action-digest). No other dependencies declared in this PR.
• GitHub releases enrichment confirms the action's v4 line is alive and current (latest v4.4.1 on 2026-09-16). The new digest f87e599… is on the v4 line, consistent with the existing # v4 comment pin.
• Compare-view metadata for the exact digest pair could not be fetched (Could not fetch compare metadata), so the contents of the digest change cannot be inspected from the corpus. This is a normal limitation for digest-only (non-tag) bumps and is not itself a defect; the change is still a point-update on v4 with no schema/inputs change evident in the workflow files.

Standards Compliance

• The repository's AGENTS.md governs how issues are filed for the autonomous dispatch → foreman loop (imperative ask + concrete file paths). This PR is a Renovate dependency update, not a task driven by an agent-issued issue, so the ask-scoping rails do not apply here. No conformance drift identified.
• Pinning actions by SHA digest (rather than mutable tags) is consistent with the repo's pattern: every other action reference in ci.yaml, release.yaml, ai-pr-review.yaml, branch-lifecycle-check.yaml, and release-please.yaml is digest-pinned with a # vX human-readable comment. This PR extends that pattern, it does not violate it.

Unknowns or Needs Verification

• The release notes / diff for the 594f3bf… → f87e599… digest move on docker/setup-buildx-action v4 were not retrievable from the corpus (GitHub HTML skipped, structured compare metadata fetch failed). The new digest is verified to be on the v4 line via the releases enrichment and the retained # v4 comment, but I cannot enumerate the individual commits/changes between the two digests from the provided evidence. This is acceptable for a routine v4 patch-point bump that adds no new inputs in the diff, but a maintainer who wants a CVE-by-CVE audit of setup-buildx-action between those two digests would need to inspect upstream directly.

Risk calibration

• pr_kind: app_code (deterministic) — accurate: it modifies workflow YAML.
• risk_flags: none — accurate. The change touches pinned GitHub Actions (supply chain), but the diff is a same-major-version digest bump that preserves every other action's pin, and no credentials, network exposure, paths, secrets, or migrations are touched.
• must_check: empty list — nothing additional to verify.

No findings to report.