ci: bump docker/build-push-action from 6 to 7

[dependabot]

Bumps docker/build-push-action from 6 to 7.

Release notes

Sourced from docker/build-push-action's releases.

v7.0.0

• Node 24 as default runtime (requires Actions Runner v2.327.1 or later) by @​crazy-max in docker/build-push-action#1470
• Remove deprecated DOCKER_BUILD_NO_SUMMARY and DOCKER_BUILD_EXPORT_RETENTION_DAYS envs by @​crazy-max in docker/build-push-action#1473
• Remove legacy export-build tool support for build summary by @​crazy-max in docker/build-push-action#1474
• Switch to ESM and update config/test wiring by @​crazy-max in docker/build-push-action#1466
• Bump @​actions/core from 1.11.1 to 3.0.0 in docker/build-push-action#1454
• Bump @​docker/actions-toolkit from 0.62.1 to 0.79.0 in docker/build-push-action#1453 docker/build-push-action#1472 docker/build-push-action#1479
• Bump minimatch from 3.1.2 to 3.1.5 in docker/build-push-action#1463

Full Changelog: docker/build-push-action@v6.19.2...v7.0.0

v6.19.2

• Preserve port in GIT_AUTH_TOKEN host by @​crazy-max in docker/build-push-action#1458

Full Changelog: docker/build-push-action@v6.19.1...v6.19.2

v6.19.1

• Derive GIT_AUTH_TOKEN host from GitHub server URL by @​crazy-max in docker/build-push-action#1456

Full Changelog: docker/build-push-action@v6.19.0...v6.19.1

v6.19.0

• Scope default git auth token to github.com by @​crazy-max in docker/build-push-action#1451
• Bump brace-expansion from 1.1.11 to 1.1.12 in docker/build-push-action#1396
• Bump form-data from 2.5.1 to 2.5.5 in docker/build-push-action#1391
• Bump js-yaml from 3.14.1 to 3.14.2 in docker/build-push-action#1429
• Bump lodash from 4.17.21 to 4.17.23 in docker/build-push-action#1446
• Bump tmp from 0.2.3 to 0.2.4 in docker/build-push-action#1398
• Bump undici from 5.28.4 to 5.29.0 in docker/build-push-action#1397

Full Changelog: docker/build-push-action@v6.18.0...v6.19.0

v6.18.0

• Bump @​docker/actions-toolkit from 0.61.0 to 0.62.1 in docker/build-push-action#1381

[!NOTE] Build summary is now supported with Docker Build Cloud.

Full Changelog: docker/build-push-action@v6.17.0...v6.18.0

v6.17.0

• Bump @​docker/actions-toolkit from 0.59.0 to 0.61.0 by @​crazy-max in docker/build-push-action#1364

[!NOTE] Build record is now exported using the buildx history export command instead of the legacy export-build tool.

Full Changelog: docker/build-push-action@v6.16.0...v6.17.0

v6.16.0

• Handle no default attestations env var by @​crazy-max in docker/build-push-action#1343

... (truncated)

Commits

• d08e5c3 Merge pull request #1479 from docker/dependabot/npm_and_yarn/docker/actions-t...
• cbd2dff chore: update generated content
• f76f51f chore(deps): Bump @​docker/actions-toolkit from 0.78.0 to 0.79.0
• 7d03e66 Merge pull request #1473 from crazy-max/rm-deprecated-envs
• 98f853d chore: update generated content
• cadccf6 remove deprecated envs
• 03fe877 Merge pull request #1478 from docker/dependabot/github_actions/docker/setup-b...
• 827e366 chore(deps): Bump docker/setup-buildx-action from 3 to 4
• e25db87 Merge pull request #1474 from crazy-max/rm-export-build-tool
• 1ac2573 Merge pull request #1470 from crazy-max/node24
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: ci, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[claude]

PR Review: Bump docker/build-push-action from 6 to 7

This is a straightforward Dependabot dependency update with a minimal, single-line diff. Overall this looks fine to merge.

Summary of Changes

• Bumps docker/build-push-action from v6 to v7 in .github/workflows/docker.yml

Key Changes in v7

• Node 24 runtime: v7 requires Actions Runner v2.327.1 or later. GitHub-hosted runners (ubuntu-latest) should already meet this requirement, but worth confirming if you use self-hosted runners.
• Removed deprecated env vars (DOCKER_BUILD_NO_SUMMARY, DOCKER_BUILD_EXPORT_RETENTION_DAYS) — none of these are used in this workflow, so no impact.
• Removed legacy export-build tool support — not used here either.

Notes

• No configuration changes are needed; the workflow inputs/outputs remain compatible.
• The Dependabot compatibility score badge is present, indicating a low-risk upgrade.

Unrelated Observation (pre-existing)

The workflow currently uses actions/checkout@v6, which does not exist — the latest stable release is v4. This is a pre-existing issue unrelated to this PR, but worth fixing separately to avoid unexpected behavior.

Verdict

Looks good to merge. The change is minimal and low-risk for standard GitHub-hosted runners.

[claude]

PR Review: ci: bump docker/build-push-action from 6 to 7

This is a routine Dependabot major-version bump with a single-line change. Here's a quick assessment:

Summary of v7 Changes

• Node 24 runtime — requires Actions Runner v2.327.1 or later. GitHub-hosted runners (ubuntu-latest) should already meet this requirement.
• Removed deprecated env vars — DOCKER_BUILD_NO_SUMMARY and DOCKER_BUILD_EXPORT_RETENTION_DAYS are no longer supported, but neither is used in this workflow.
• Removed legacy export-build tool — no impact here; the workflow uses GHA cache (type=gha), which is unaffected.
• ESM migration and @actions/core 3.x — internal to the action; no API changes for users.

Workflow Review

The surrounding workflow (.github/workflows/docker.yml) looks healthy:

• Multi-arch build (linux/amd64,linux/arm64) is correctly configured.
• Push is correctly gated on github.event_name != 'pull_request', so no image is pushed from PRs.
• GHA layer caching (cache-from/cache-to) is in place.
• GHCR login is only performed when actually pushing.

Minor Observations (not blocking)

• Action version pinning: The workflow uses floating major-version tags (@v7, @v4, @v6) rather than full SHA pinning. SHA pinning is more supply-chain secure, but adopting it is a separate concern from this PR.
• docker/metadata-action@v6: Ensure this is the current stable release; it may be worth a separate Dependabot check if it's lagging.

Verdict

Safe to merge. The change is minimal, no deprecated features are in use, and the compatibility score from Dependabot is included. No code quality, security, or performance concerns specific to this PR.