chore(deps): update projectbluefin/actions digest to d8f871c

.github/workflows/reusable-build.yml

@@ -112,7 +112,7 @@ jobs:
           submodules: recursive
 
       - name: Setup runner
-        uses: projectbluefin/actions/bootc-build/setup-runner@5989a5b8fe1bdf008cf30f4f9d7a7e407da4b2e7 # v1
+        uses: projectbluefin/actions/bootc-build/setup-runner@d8f871c0ca7a868339d3c175200a7319492473c7 # v1
         with:
           storage-backend: btrfs
           update-podman: "true"
@@ -160,7 +160,7 @@ jobs:
 
       - name: Restore DNF package cache
         id: dnf-cache-restore
-        uses: projectbluefin/actions/bootc-build/dnf-cache@7827453a52eaddb45cb432bd14d9651bc27669ba # v1
+        uses: projectbluefin/actions/bootc-build/dnf-cache@d8f871c0ca7a868339d3c175200a7319492473c7 # v1
         with:
           action: restore
           cache-name: ${{ steps.setup-cache.outputs.cache_name }}
@@ -215,7 +215,7 @@ jobs:
 
       - name: Save DNF package cache
         if: always() && !cancelled()
-        uses: projectbluefin/actions/bootc-build/dnf-cache@7827453a52eaddb45cb432bd14d9651bc27669ba # v1
+        uses: projectbluefin/actions/bootc-build/dnf-cache@d8f871c0ca7a868339d3c175200a7319492473c7 # v1
         with:
           action: save
           cache-name: ${{ steps.setup-cache.outputs.cache_name }}
@@ -275,7 +275,7 @@ jobs:
         # files/pkg-intervals.tsv is maintained by the pkg-cadence workflow.
         # Skip on PRs and testing stream — rechunk is also skipped there.
         if: github.event_name != 'pull_request' && inputs.stream_name != 'testing'
-        uses: projectbluefin/actions/bootc-build/apply-pkg-intervals@7827453a52eaddb45cb432bd14d9651bc27669ba # v1
+        uses: projectbluefin/actions/bootc-build/apply-pkg-intervals@d8f871c0ca7a868339d3c175200a7319492473c7 # v1
         with:
           source-image: localhost/${{ env.IMAGE_NAME }}:${{ env.DEFAULT_TAG }}
           intervals-file: files/pkg-intervals.tsv
@@ -289,7 +289,7 @@ jobs:
       - name: Rechunk Image
         if: github.event_name != 'pull_request' && inputs.stream_name != 'testing'
         id: rechunk-image
-        uses: projectbluefin/actions/bootc-build/chunka@7827453a52eaddb45cb432bd14d9651bc27669ba # v1
+        uses: projectbluefin/actions/bootc-build/chunka@d8f871c0ca7a868339d3c175200a7319492473c7 # v1
         with:
           source-image: localhost/${{ env.IMAGE_NAME }}:${{ env.DEFAULT_TAG }}
           max-layers: ${{ inputs.max_layers }}
@@ -407,7 +407,7 @@ jobs:
 
       - name: Scan image for vulnerabilities
         continue-on-error: true  # Trivy DB issues (e.g. new OS families) must never block builds
-        uses: projectbluefin/actions/bootc-build/scan-image@7827453a52eaddb45cb432bd14d9651bc27669ba # v1
+        uses: projectbluefin/actions/bootc-build/scan-image@d8f871c0ca7a868339d3c175200a7319492473c7 # v1
         with:
           image: localhost/${{ env.IMAGE_NAME }}:${{ env.DEFAULT_TAG }}
           input: /tmp/scan-image.tar
@@ -419,7 +419,7 @@ jobs:
       - name: Push to GHCR
         id: push
         if: github.event_name != 'pull_request'
-        uses: projectbluefin/actions/bootc-build/push-image@7827453a52eaddb45cb432bd14d9651bc27669ba # v1
+        uses: projectbluefin/actions/bootc-build/push-image@d8f871c0ca7a868339d3c175200a7319492473c7 # v1
         with:
           image-name: ${{ env.IMAGE_NAME }}
           tags: ${{ steps.compute-push-tags.outputs.push_tags }}
@@ -532,7 +532,7 @@ jobs:
       - name: Sign, publish SBOM, and attest
         if: github.event_name != 'pull_request'
         continue-on-error: true  # Never block image publishing — signing/SBOM failures are non-fatal
-        uses: projectbluefin/actions/bootc-build/sign-and-publish@7827453a52eaddb45cb432bd14d9651bc27669ba # v1
+        uses: projectbluefin/actions/bootc-build/sign-and-publish@d8f871c0ca7a868339d3c175200a7319492473c7 # v1
         with:
           image: ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}
           digest: ${{ steps.push.outputs.digest }}

.github/workflows/reusable-execute-release.yml

@@ -325,7 +325,7 @@ jobs:
 
       - name: Notify Discord releases channel
         if: success() && inputs.tag_name != ''
-        uses: projectbluefin/actions/.github/actions/discord-release-notify@v1
+        uses: projectbluefin/actions/.github/actions/discord-release-notify@d8f871c0ca7a868339d3c175200a7319492473c7 # v1
         with:
           webhook_url: ${{ secrets.DISCORD_RELEASES_WEBHOOK }}
           tag_name: ${{ inputs.tag_name }}

.github/workflows/reusable-promote-squash.yml

@@ -273,7 +273,7 @@ jobs:
       - name: Render promotion PR body
         if: steps.compare.outputs.sync_needed == 'true' && steps.rebuild.outputs.promoted != 'false'
         id: render
-        uses: projectbluefin/actions/.github/actions/render-pr-body@v1
+        uses: projectbluefin/actions/.github/actions/render-pr-body@d8f871c0ca7a868339d3c175200a7319492473c7 # v1
         with:
           variants:          ${{ inputs.variants }}
           repo:              ${{ github.repository }}
@@ -442,7 +442,7 @@ jobs:
       issues: write
       packages: read
       pull-requests: write
-    uses: projectbluefin/actions/.github/workflows/reusable-release-gate.yml@7827453a52eaddb45cb432bd14d9651bc27669ba # v1
+    uses: projectbluefin/actions/.github/workflows/reusable-release-gate.yml@d8f871c0ca7a868339d3c175200a7319492473c7 # v1
     with:
       repo: ${{ github.repository }}
       pr_number: ${{ needs.promote.outputs.pr_number }}

.github/workflows/reusable-release-gate.yml

@@ -376,7 +376,7 @@ jobs:
 
       - name: Update PR body gate section
         if: inputs.pr_number != ''
-        uses: projectbluefin/actions/.github/actions/render-gate-section@v1
+        uses: projectbluefin/actions/.github/actions/render-gate-section@d8f871c0ca7a868339d3c175200a7319492473c7 # v1
         with:
           gh_token:        ${{ github.token }}
           repo:            ${{ inputs.repo }}

.github/workflows/reusable-release.yml

@@ -359,7 +359,7 @@ jobs:
           echo "WARNING: Using placeholder SBOM — artifact '${{ inputs.sbom_artifact }}' missing from run ${{ steps.build_run.outputs.run_id }}"
 
       - name: Create release
-        uses: projectbluefin/actions/bootc-build/create-release@v1
+        uses: projectbluefin/actions/bootc-build/create-release@d8f871c0ca7a868339d3c175200a7319492473c7 # v1
         with:
           sbom-path: sbom-current/${{ steps.image_name.outputs.image_name }}.sbom.json
           tag: ${{ steps.meta.outputs.tag }}
@@ -394,7 +394,7 @@ jobs:
 
       - name: Generate release notes
         id: release-notes
-        uses: projectbluefin/actions/bootc-build/generate-release-notes@7827453a52eaddb45cb432bd14d9651bc27669ba # v1
+        uses: projectbluefin/actions/bootc-build/generate-release-notes@d8f871c0ca7a868339d3c175200a7319492473c7 # v1
         with:
           tag: ${{ inputs.tag }}
           output-file: CHANGELOG.md