deps: Update dependencies for github

[renovate-bot]

This PR contains the following updates:

Package	Type	Update	Change
actions/setup-go	action	minor	v5.3.0 -> v5.4.0
actions/upload-artifact	action	patch	v4.6.0 -> v4.6.2
github/codeql-action	action	patch	v3.28.9 -> v3.28.12
golangci/golangci-lint-action	action	patch	v6.5.0 -> v6.5.2
ossf/scorecard-action	action	patch	v2.4.0 -> v2.4.1

---

Release Notes

actions/setup-go (actions/setup-go)

v5.4.0

Compare Source

actions/upload-artifact (actions/upload-artifact)

v4.6.2

Compare Source

What's Changed

• Update to use artifact 2.3.2 package & prepare for new upload-artifact release by @​salmanmkc in https://github.com/actions/upload-artifact/pull/685

New Contributors

• @​salmanmkc made their first contribution in https://github.com/actions/upload-artifact/pull/685

Full Changelog: actions/upload-artifact@v4...v4.6.2

v4.6.1

Compare Source

What's Changed

• Update to use artifact 2.2.2 package by @​yacaovsnc in https://github.com/actions/upload-artifact/pull/673

Full Changelog: actions/upload-artifact@v4...v4.6.1

github/codeql-action (github/codeql-action)

v3.28.12

Compare Source

v3.28.11

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.11 - 07 Mar 2025

• Update default CodeQL bundle version to 2.20.6. #​2793

See the full CHANGELOG.md for more information.

v3.28.10

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.10 - 21 Feb 2025

• Update default CodeQL bundle version to 2.20.5. #​2772
• Address an issue where the CodeQL Bundle would occasionally fail to decompress on macOS. #​2768

See the full CHANGELOG.md for more information.

golangci/golangci-lint-action (golangci/golangci-lint-action)

v6.5.2

Compare Source

v6.5.1

Compare Source

What's Changed

Changes

• fix: octokit retry by @​ldez in https://github.com/golangci/golangci-lint-action/pull/1193
• feat: restrict action v6 on golangci-lint v1 by @​ldez in https://github.com/golangci/golangci-lint-action/pull/1194

Documentation

• docs: add notes for annotation config by @​dveeden in https://github.com/golangci/golangci-lint-action/pull/1173
• docs: improve verify option explanation by @​ldez in https://github.com/golangci/golangci-lint-action/pull/1175

Dependencies

• build(deps-dev): bump the dev-dependencies group with 3 updates by @​dependabot in https://github.com/golangci/golangci-lint-action/pull/1177
• build(deps): bump the dependencies group with 2 updates by @​dependabot in https://github.com/golangci/golangci-lint-action/pull/1178
• build(deps): bump @​octokit/request from 8.4.0 to 8.4.1 by @​dependabot in https://github.com/golangci/golangci-lint-action/pull/1181
• build(deps-dev): bump the dev-dependencies group with 3 updates by @​dependabot in https://github.com/golangci/golangci-lint-action/pull/1185
• build(deps): bump @​types/node from 22.13.4 to 22.13.5 in the dependencies group by @​dependabot in https://github.com/golangci/golangci-lint-action/pull/1186
• build(deps): bump @​octokit/plugin-paginate-rest from 9.2.1 to 9.2.2 by @​dependabot in https://github.com/golangci/golangci-lint-action/pull/1187
• build(deps): bump the dependencies group with 2 updates by @​dependabot in https://github.com/golangci/golangci-lint-action/pull/1189
• build(deps-dev): bump the dev-dependencies group across 1 directory with 5 updates by @​dependabot in https://github.com/golangci/golangci-lint-action/pull/1190
• build(deps-dev): bump eslint-config-prettier from 10.0.2 to 10.1.1 in the dev-dependencies group by @​dependabot in https://github.com/golangci/golangci-lint-action/pull/1191
• build(deps): bump @​types/node from 22.13.8 to 22.13.10 in the dependencies group by @​dependabot in https://github.com/golangci/golangci-lint-action/pull/1192

New Contributors

• @​dveeden made their first contribution in https://github.com/golangci/golangci-lint-action/pull/1173

Full Changelog: golangci/golangci-lint-action@v6.5.0...v6.5.1

ossf/scorecard-action (ossf/scorecard-action)

v2.4.1

Compare Source

What's Changed

• This update bumps the Scorecard version to the v5.1.1 release. For a complete list of changes, please refer to the v5.1.0 and v5.1.1 release notes.
• Publishing results now uses half the API quota as before. The exact savings depends on the repository in question.
  • use Scorecard library entrypoint instead of Cobra hooking by @​spencerschrock in https://github.com/ossf/scorecard-action/pull/1423
• Some errors were made into annotations to make them more visible
  • Make default branch error more prominent by @​jsoref in https://github.com/ossf/scorecard-action/pull/1459
• There is now an optional file_mode input which controls how repository files are fetched from GitHub. The default is archive, but git produces the most accurate results for repositories with .gitattributes files at the cost of analysis speed.
  • add input for specifying --file-mode by @​spencerschrock in https://github.com/ossf/scorecard-action/pull/1509
• The underlying container for the action is now hosted on GitHub Container Registry. There should be no functional changes.
  • 🌱 publish docker images to GitHub Container Registry by @​spencerschrock in https://github.com/ossf/scorecard-action/pull/1453

Docs

• Installation docs update by @​JeremiahAHoward in https://github.com/ossf/scorecard-action/pull/1416

New Contributors

• @​JeremiahAHoward made their first contribution in https://github.com/ossf/scorecard-action/pull/1416
• @​jsoref made their first contribution in https://github.com/ossf/scorecard-action/pull/1459
  Full Changelog: ossf/scorecard-action@v2.4.0...v2.4.1

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.