build(deps): bump the github-actions group with 10 updates

[dependabot]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

---

Note

Low Risk
Routine Dependabot pin updates to CI only; no application or runtime code changes, though CI behavior could shift slightly with newer action versions.

Overview
Bumps pinned third-party and Chainguard GitHub Actions across CI workflows with no workflow logic changes.

Chainguard actions (boilerplate, donotsubmit, setup-kind, kind-diag, gofmt, goimports, trailing-space, eof-newline) move from commit f0be699… to 4d37df0… in boilerplate, donotsubmit, kind-e2e, and style workflows.

Other bumps: golang/govulncheck-action v1.0.4 → v1.1.0 in build.yaml, and actions/stale v10.3.0 → v10.4.0 in stale.yaml.

^{Reviewed by Cursor Bugbot for commit b0b979d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit b0b979d. Configure here.}

[cursor]

Invalid govulncheck action pin

High Severity · Logic Bug

The build.yaml workflow pins golang/govulncheck-action to 032d455... (labeled v1.1.0). This commit/tag does not exist upstream, which causes the Build job to fail when resolving the action and blocks PR CI.

 

^{Reviewed by Cursor Bugbot for commit b0b979d. Configure here.}

[cursor]

Invalid Chainguard actions pin

High Severity · Logic Bug

Eight workflow steps pin chainguard-dev/actions/* to commit 4d37df0…, but that commit does not appear to exist upstream. The previous pin f0be699… still resolves. KinD e2e, style, boilerplate, and donotsubmit jobs would fail when GitHub Actions tries to fetch those actions.

Additional Locations (2)

• .github/workflows/boilerplate.yaml#L35-L36
• .github/workflows/style.yaml#L27-L28

 

^{Reviewed by Cursor Bugbot for commit b0b979d. Configure here.}