Configure Renovate

[renovate-bot]

Welcome to Renovate! This is an onboarding PR to help you understand and configure settings before regular Pull Requests begin.

🚦 To activate Renovate, merge this Pull Request. To disable Renovate, simply close this Pull Request unmerged.

---

Detected Package Files

• Dockerfile (dockerfile)
• .github/workflows/test.yaml (github-actions)
• go.mod (gomod)

Configuration Summary

Based on the default config's presets, Renovate will:

• Start dependency updates only once this onboarding PR is merged
• Hopefully safe environment variables to allow users to configure.
• Show all Merge Confidence badges for pull requests.
• Enable Renovate Dependency Dashboard creation.
• Use semantic commit type fix for dependencies and chore for all others if semantic commits are in use.
• Ignore node_modules, bower_components, vendor and various test/tests (except for nuget) directories.
• Group known monorepo packages together.
• Use curated list of recommended non-monorepo package groupings.
• Show only the Age and Confidence Merge Confidence badges for pull requests.
• Apply crowd-sourced package replacement rules.
• Apply crowd-sourced workarounds for known problems with packages.
• Ensure that every dependency pinned by digest and sourced from GitHub.com contains a link to the commit-to-commit diff
• Correctly link to the source code for golang.org/x packages
• Link to pkg.go.dev/... for golang.org/x packages' title

🔡 Do you want to change how Renovate upgrades your dependencies? Add your custom config to renovate.json in this branch. Renovate will update the Pull Request description the next time it runs.

---

What to Expect

With your current configuration, Renovate will create 26 Pull Requests:

Update module google.golang.org/grpc to v1.56.3 [SECURITY]

• Branch name: renovate/go-google.golang.org-grpc-vulnerability
• Merge into: main
• Upgrade google.golang.org/grpc to v1.56.3

Update module github.com/sigstore/cosign/v2 to v2.2.4 [SECURITY]

• Branch name: renovate/go-github.com-sigstore-cosign-v2-vulnerability
• Merge into: main
• Upgrade github.com/sigstore/cosign/v2 to v2.2.4

Update module golang.org/x/net to v0.38.0 [SECURITY]

• Branch name: renovate/go-golang.org-x-net-vulnerability
• Merge into: main
• Upgrade golang.org/x/net to v0.38.0

Update module google.golang.org/protobuf to v1.33.0 [SECURITY]

• Branch name: renovate/go-google.golang.org-protobuf-vulnerability
• Merge into: main
• Upgrade google.golang.org/protobuf to v1.33.0

Update aquasecurity/trivy-action digest to 22438a4

• Schedule: ["at any time"]
• Branch name: renovate/aquasecurity-trivy-action-digest
• Merge into: main
• Upgrade aquasecurity/trivy-action to 22438a435773de8c97dc0958cc0b823c45b064ac

Update google.golang.org/genproto digest to 0a764e5

• Schedule: ["at any time"]
• Branch name: renovate/google.golang.org-genproto-digest
• Merge into: main
• Upgrade google.golang.org/genproto to 0a764e51fe1b

Update karancode/yamllint-github-action digest to 4052d36

• Schedule: ["at any time"]
• Branch name: renovate/karancode-yamllint-github-action-digest
• Merge into: main
• Upgrade karancode/yamllint-github-action to 4052d365f09b8d34eb552c363d1141fd60e2aeb2

Update codecov/codecov-action action to v3.1.6

• Schedule: ["at any time"]
• Branch name: renovate/codecov-codecov-action-3.x
• Merge into: main
• Upgrade codecov/codecov-action to ab904c41d6ece82784817410c45d8b8c02684457

Update actions/cache action to v3.5.0

• Schedule: ["at any time"]
• Branch name: renovate/actions-cache-3.x
• Merge into: main
• Upgrade actions/cache to 6f8efc29b200d32929f49075959781ed54ec270c

Update actions/checkout action to v3.6.0

• Schedule: ["at any time"]
• Branch name: renovate/actions-checkout-3.x
• Merge into: main
• Upgrade actions/checkout to f43a0e5ff2bd294095638e18286ca9a3d1956744

Update actions/setup-go action to v4.3.0

• Schedule: ["at any time"]
• Branch name: renovate/actions-setup-go-4.x
• Merge into: main
• Upgrade actions/setup-go to 7b8cf10d4e4a01d4992d18a89f4d7dc5a3e6d6f4

Update alpine Docker tag to v3.23.2

• Schedule: ["at any time"]
• Branch name: renovate/alpine-3.x
• Merge into: main
• Upgrade alpine to 3.23.2

Update golang Docker tag to v1.25.5

• Schedule: ["at any time"]
• Branch name: renovate/golang-1.x
• Merge into: main
• Upgrade golang to 1.25.5

Update module cloud.google.com/go/containeranalysis to v0.14.2

• Schedule: ["at any time"]
• Branch name: renovate/cloud.google.com-go-containeranalysis-0.x
• Merge into: main
• Upgrade cloud.google.com/go/containeranalysis to v0.14.2

Update module github.com/google/go-containerregistry to v0.20.7

• Schedule: ["at any time"]
• Branch name: renovate/github.com-google-go-containerregistry-0.x
• Merge into: main
• Upgrade github.com/google/go-containerregistry to v0.20.7

Update module github.com/rs/zerolog to v1.34.0

• Schedule: ["at any time"]
• Branch name: renovate/github.com-rs-zerolog-1.x
• Merge into: main
• Upgrade github.com/rs/zerolog to v1.34.0

Update module github.com/secure-systems-lab/go-securesystemslib to v0.10.0

• Schedule: ["at any time"]
• Branch name: renovate/github.com-secure-systems-lab-go-securesystemslib-0.x
• Merge into: main
• Upgrade github.com/secure-systems-lab/go-securesystemslib to v0.10.0

Update module github.com/stretchr/testify to v1.11.1

• Schedule: ["at any time"]
• Branch name: renovate/github.com-stretchr-testify-1.x
• Merge into: main
• Upgrade github.com/stretchr/testify to v1.11.1

Update module github.com/urfave/cli/v2 to v2.27.7

• Schedule: ["at any time"]
• Branch name: renovate/github.com-urfave-cli-v2-2.x
• Merge into: main
• Upgrade github.com/urfave/cli/v2 to v2.27.7

Update module google.golang.org/api to v0.259.0

• Schedule: ["at any time"]
• Branch name: renovate/google.golang.org-api-0.x
• Merge into: main
• Upgrade google.golang.org/api to v0.259.0

Update actions/cache action to v5

• Schedule: ["at any time"]
• Branch name: renovate/actions-cache-5.x
• Merge into: main
• Upgrade actions/cache to 9255dc7a253b0ccc959486e2bca901246202afeb

Update actions/checkout action to v6

• Schedule: ["at any time"]
• Branch name: renovate/actions-checkout-6.x
• Merge into: main
• Upgrade actions/checkout to 8e8c483db84b4bee98b60c0593521ed34d9990e8

Update actions/setup-go action to v6

• Schedule: ["at any time"]
• Branch name: renovate/actions-setup-go-6.x
• Merge into: main
• Upgrade actions/setup-go to 4dc6199c7b1a012772edbd06daecab0f50c9053c
• Upgrade actions/setup-go to v6

Update codecov/codecov-action action to v5

• Schedule: ["at any time"]
• Branch name: renovate/codecov-codecov-action-5.x
• Merge into: main
• Upgrade codecov/codecov-action to 671740ac38dd9b0130fbe1cec585b89eea48d3de

Update golangci/golangci-lint-action action to v9

• Schedule: ["at any time"]
• Branch name: renovate/golangci-golangci-lint-action-9.x
• Merge into: main
• Upgrade golangci/golangci-lint-action to v9

Update module github.com/urfave/cli/v2 to v3

• Schedule: ["at any time"]
• Branch name: renovate/github.com-urfave-cli-v2-3.x
• Merge into: main
• Upgrade github.com/urfave/cli/v2 to v3.6.1

🚸 Branch creation will be limited to maximum 2 per hour, so it doesn't swamp any CI resources or overwhelm the project. See docs for prhourlylimit for details.

---

Warning

Please correct - or verify that you can safely ignore - these dependency lookup failures before you merge this PR.

• Could not determine new digest for update (github-tags package andstor/file-existence-action)

Files affected: .github/workflows/test.yaml

---

❓ Got questions? Check out Renovate's Docs, particularly the Getting Started section.
If you need any further assistance then you can also request help here.

---

This PR was generated by Mend Renovate. View the repository job log.