[actions] Update GitHub Actions versions - 2026-08-29

[github-actions]

Summary

Bumped anchore/sbom-action from v0.24.0 to v0.24.2 in the release workflow and its corresponding SHA-pinned dataset entries. Also removed the now-obsolete github/codeql-action/upload-sarif@v4.37.8 pin, since it was superseded by v4.37.9 already present in the same file, from both action-pin data files.

Change Classification

• Type: dependency-update
• Scope: .github/workflows/release.md, pkg/actionpins/data/action_pins.json, pkg/workflow/data/action_pins.json
• Breaking: No

Key Changes

File	Change	Impact
.github/workflows/release.md	Bumped both SBOM generation steps (SPDX and CycloneDX) from anchore/sbom-action@v0.24.0 to @v0.24.2	Medium
pkg/actionpins/data/action_pins.json	Updated pinned anchore/sbom-action entry to v0.24.2 with new SHA; removed stale github/codeql-action/upload-sarif@v4.37.8 pin	Medium
pkg/workflow/data/action_pins.json	Mirrored the same anchore/sbom-action bump and removal of the obsolete upload-sarif@v4.37.8 pin	Medium

Impact Assessment

• The release workflow now runs SBOM generation (SPDX and CycloneDX formats) using the updated anchore/sbom-action@v0.24.2, pulling in upstream fixes/improvements from that action.
• Downstream consumers of the pinned action-pin datasets (pkg/actionpins and pkg/workflow) will resolve anchore/sbom-action to the new version/SHA; any code path referencing the removed upload-sarif@v4.37.8 entry must now use v4.37.9, which was already present.
• No changes to workflow logic, inputs, or outputs; this is a routine dependency pin refresh.

Commits

f1d4ccd8a Recompile workflows with updated action pins
a57b00bf6 Restore anchore action update
f51697827 Restore generated action pin datasets
899bbb35f Track PR refresh status
99f8b88b8 Keep action update scoped to source lock
4e7b9d97c Track dependency refresh progress
ec875fd58 Update GitHub Actions versions in actions-lock.json

Generated by PR Description Updater for #56859 · copilot · auto · 48.7 AIC · ⌖ 5.4 AIC · ⊞ 7.7K · ◷

[gh-aw-bot]

@copilot Please refresh this dependency update PR for forward progress. Re-run the pr-finisher skill, update the branch if needed, and hand back once checks are ready for maintainer review.

Generated by 👨🍳 PR Sous Chef
_{Comment /souschef to run again}

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 24.1 AIC · ⌖ 8.63 AIC · ⊞ 8.8K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot Please refresh this dependency update PR for forward progress. Re-run the pr-finisher skill, update the branch if needed, and hand back once checks are ready for maintainer review.

Gener...

Refreshed the PR in 99f8b88. The cumulative diff is scoped to .github/aw/actions-lock.json; formatting, lint, recompilation, integration tests, and the final impacted validation gate pass. CI runs are awaiting approval before jobs can start.

[gh-aw-bot]

@copilot Please refresh this PR for forward progress. Re-run the pr-finisher skill, address any remaining review feedback, and update the branch if needed.

Run: https://github.com/github/gh-aw/actions/runs/33246602890

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 10.4 AIC · ⌖ 8.7 AIC · ⊞ 8.8K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot Please refresh this PR for forward progress. Re-run the pr-finisher skill, address any remaining review feedback, and update the branch if needed.

Run: https://github.com/github/gh-aw/acti...

Refreshed in a57b00b (with scope cleanup in f516978). The branch is current with main, has no unresolved review threads, and the cumulative diff is limited to .github/aw/actions-lock.json. Formatting, lint, full Go tests, compilation of all 297 workflows, and the final validation gate pass; CI still requires maintainer approval/re-trigger.

[gh-aw-bot]

@copilot Please refresh this PR for forward progress. Re-run the pr-finisher skill, update the branch if needed, and hand back once checks are ready for maintainer review.

Run: https://github.com/github/gh-aw/actions/runs/33251251524

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 41.3 AIC · ⌖ 8.7 AIC · ⊞ 8.8K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot Please refresh this PR for forward progress. Re-run the pr-finisher skill, update the branch if needed, and hand back once checks are ready for maintainer review.

Run: https://github.com/g...

Re-ran pr-finisher on a57b00b. The branch is current with main, has no unresolved review threads, and remains scoped to .github/aw/actions-lock.json. Formatting, lint, unit/full Go tests, all 297 workflow compilations, and the final validation gate pass. Run 33251251524 succeeded; its single blocked github.com request caused no job failure. Maintainer review/check approval remains.

[pelikhan]

@copilot recompile

[gh-aw-bot]

@copilot Please refresh the branch if needed, rerun the pr-finisher skill, and hand back once maintainer-ready.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 5.1 AIC · ⌖ 8.65 AIC · ⊞ 6.4K · ◷
_{Comment /souschef to run again}

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.87.10