Update github-actions

[gardener-ci-robot]

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	patch	v7.0.0 → v7.0.1
ghcr.io/zizmorcore/zizmor	uses-with	minor	1.26.1 → 1.28.0
zizmorcore/zizmor-action	action	minor	v0.5.7 → v0.6.1

---

Release Notes

actions/checkout (actions/checkout)

v7.0.1

Compare Source

• Skip running unsafe pr check if input is default by @​aiqiaoy in #​2518
• Trim only ascii whitespace for branch by @​aiqiaoy in #​2521
• Escape values passed to --unset by @​aiqiaoy in #​2530
• Various dependency updates

zizmorcore/zizmor (ghcr.io/zizmorcore/zizmor)

v1.28.0

Compare Source

Security 🔒🔗

• v1.27.0 contained a logging defect that would print any configured GitHub credentials as part of zizmor's cleartext logging. No versions other than v1.27.0 were affected. See GHSA-f42p-wjw5-97qh for full information.

  Many thanks to @​shaanmajid for finding and reporting this vulnerability.

Enhancements 🌱🔗

• The JSON (v1) output format now includes metadata for each finding's fixes, if the finding has fixes (#​2186)

• The dependabot-cooldown audit is now aware of GitHub's new three-day default cooldown (#​2193)

• sbt is now recognized as a package-ecosystem in dependabot.yml (#​2211)

Bug Fixes 🐛🔗

• Fixed a bug where the template-injection audit would incorrectly flag steps.*.outcome and steps.*.conclusion as injection risks in the default persona (#​2199)

• Fixed a bug where the github-env audit would incorrectly flag some printf calls as exploitable (#​2201)

• Fixed a bug where zizmor would produce a misleading and confusing error message when asked to audit an ambiguous remote input (#​2205)

v1.27.0

Compare Source

New Features 🌈🔗

• zizmor now has experimental support for workflows that specify parallel steps. See Usage - Parallel steps for more information (#​2153)
  Enhancements 🌱🔗

• zizmor's handling of paths is now more consistent, particularly when run on Windows (#​2163)

• zizmor now emits a helpful warning when being run in implicit offline mode (#​2180)

Bug Fixes 🐛🔗

• Fixed a bug where the secrets-outside-env audit would not honor ignore comments within the same job scope (#​2157)

• Fixed a bug where the ref-version-mismatch audit would not honor ignore comments within the same steps scope (#​2177)

• Fixed a bug where --collect=[MODE] was not correctly handled when auditing remote inputs (#​2185)

zizmorcore/zizmor-action (zizmorcore/zizmor-action)

v0.6.1

Compare Source

zizmor 1.28.0 is now the default version used by the action.

v0.6.0

Compare Source

zizmor 1.27.0 is now the default version used by the action.

What's Changed

• Fold Docker image pull output into a collapsed Actions log group by @​woodruffw with @​Copilot in #​132
• Readme: document missing inputs by @​staabm in #​130
• ci: block version sync workflow on forks by @​shaanmajid in #​129
• Sync zizmor versions by @​github-actions[bot] in #​137
• Add collect input by @​woodruffw in #​139

New Contributors

• @​woodruffw with @​Copilot made their first contribution in #​132
• @​staabm made their first contribution in #​130
• @​shaanmajid made their first contribution in #​129

Full Changelog: zizmorcore/zizmor-action@v0.5.7...v0.6.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[gardener-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign petersutter for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

GitHub Actions workflows now use actions/checkout v7.0.1 pins. The Zizmor workflow also updates its action pin to v0.6.1 and configures Zizmor version 1.28.0.

Changes

GitHub Actions updates

Layer / File(s)	Summary
Refresh GitHub Actions pins .github/workflows/build.yaml, .github/workflows/prepare-hotfix-branch.yaml, .github/workflows/reuse-tool-lint.yaml, .github/workflows/zizmor.yaml	Updates actions/checkout pins to v7.0.1; the Zizmor workflow also updates its action pin to v0.6.1 and tool version to 1.28.0.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• gardener/dashboard#2873: Updates the Zizmor version in the same workflow.
• gardener/dashboard#2944: Introduces and pins Zizmor in the same workflow.
• gardener/dashboard#3029: Updates actions/checkout pins in the same workflows.

Suggested labels: area/security

Suggested reviewers: grolu, holgerkoser, klocke-io

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (1 warning, 1 inconclusive)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description has update details and release notes, but it misses most required template sections and formatting.	Fill out the template with /area, /kind, what/why, fixed issue, reviewer notes, and a properly formatted release note block.
Title check	❓ Inconclusive	The title is related to GitHub Actions updates, but it is too generic to identify the main change clearly.	Use a more specific title like "Update GitHub Actions dependencies and zizmor versions".

✅ Passed checks (3 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch renovate/github-actions

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}