chore(deps): update jorisjonkers-dev/github-workflows action to v0.17.0

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
JorisJonkers-dev/github-workflows	workflow	minor	v0.8.1 → v0.17.0	v0.18.0
JorisJonkers-dev/github-workflows	workflow	minor	v0.16.1 → v0.17.0	v0.18.0
JorisJonkers-dev/github-workflows	workflow	minor	v0.14.1 → v0.17.0	v0.18.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

JorisJonkers-dev/github-workflows (JorisJonkers-dev/github-workflows)

v0.17.0

Compare Source

Features

• add-to-project: add a manual recovery hatch (#​111) (744261c)
• add-to-project: add an org-wide backfill scope (#​124) (592d6df), closes #​122
• hygiene: add an advisory org-wide repository hygiene sweep (#​125) (345d473), closes #​123

Bug Fixes

• leak-scan: exclude the action's own checkout from the deny-list scan (#​109) (5dfb39d)
• leak-scan: repair four rules that could never fire (#​127) (300e8af)
• renovate: drop the deprecated match keys that break config validation (#​112) (d9027a8)

v0.16.1

Compare Source

Bug Fixes

• deploy-check: write an explicit boolean for provenance in the contract (#​104) (10b9b90)

v0.16.0

Compare Source

Features

• deploy-check: let a workload with no HTTP surface opt out of health (#​100) (2733754)

v0.15.2

Compare Source

Bug Fixes

• reusable: pin the self-checkout to a literal instead of an empty context (#​98) (7d19693)

v0.15.1

Compare Source

Bug Fixes

• deploy-check: resolve the context to a file instead of a package root (#​95) (c15011b)

v0.15.0

Compare Source

Features

• deploy-check: replace the duplicated render script with one tested package (#​94) (7fbbe54)

Bug Fixes

• deploy-artifact: report an unsupported raw-manifests guard honestly (#​92) (e59679c)

v0.14.2

Compare Source

Bug Fixes

• deploy-preview: render each fragment to a file so previews stop failing (#​90) (1a8c957)

v0.14.1

Compare Source

Bug Fixes

• ci: bound every reusable workflow job with a timeout (#​88) (119f6fd)

v0.14.0

Compare Source

Features

• deploy-artifact: emit an applyable bundle so Flux can consume the artifact (#​86) (aa05b95)

v0.13.0

Compare Source

Features

• tofu-ci: add a reusable OpenTofu workflow (#​83) (30e21ce)

Bug Fixes

• leak-scan: scan the diff in pr-diff mode, not whole files (#​82) (7dd71fb)

v0.12.9

Compare Source

Bug Fixes

• leak-scan: stop the ipv6 pattern matching Actions annotations (#​80) (5d42ac7)

v0.12.8

Compare Source

Bug Fixes

• leak-scan: stop the ipv6 pattern matching timestamps (#​78) (d759a6c)

v0.12.7

Compare Source

Bug Fixes

• leak-scan: replace --files-at-commit with gitleaks git --log-opts for pr-diff mode (#​75) (4be901c)

v0.12.6

Compare Source

Bug Fixes

• deploy-artifact: anchor kind=Secret grep to prevent SecretStore over-match (#​73) (8e57f62)

v0.12.5

Compare Source

Bug Fixes

• leak-scan: replace --all with --log-opts=--all for gitleaks v8.x (#​67) (d993ef7)

v0.12.4

Compare Source

Bug Fixes

• leak-scan: install gitleaks+trufflehog with SHA pins; fail-closed all-refs mode (#​63) (1ddf81e)

v0.12.3

Compare Source

Bug Fixes

• deploy-preview: fail loud on render failures and anchor the raw-secret match (#​62) (36710bd)

v0.12.2

Compare Source

Bug Fixes

• deploy-preview: scorecard gate misjudges not_applicable, no_raw_secrets, and npm_signatures_verified (#​60) (77c8d5c)

v0.12.1

Compare Source

Bug Fixes

• deploy-artifact: handle npm audit no-deps skip for GHPR scoped packages (5039ff0)

v0.12.0

Compare Source

Features

• leak-scan: add exclude-paths input for pr-diff mode (c8c23b5)

v0.11.11

Compare Source

Bug Fixes

• remove tag from attest subject-name (#​53) (597a48f)

v0.11.10

Compare Source

Bug Fixes

• add subject-name to attest-build-provenance step (#​51) (07eff62)

v0.11.9

Compare Source

Bug Fixes

• use deploy- tag prefix and fix oras resolve for artifact digest (#​49) (ca4ace3)

v0.11.8

Compare Source

Bug Fixes

• add GHCR auth and fix idempotency check in deploy-artifact publish (#​47) (1dcc8d0)

v0.11.7

Compare Source

Bug Fixes

• remove kubeconform and kustomize validation for fragment output (#​45) (99dfaf6)

v0.11.6

Compare Source

Bug Fixes

• pass per-fragment file path to --output in render loop (#​43) (a212a6e)

v0.11.5

Compare Source

Bug Fixes

• skip deploy-config-schema validate for ClusterContext file (#​41) (97d6e32)

v0.11.4

Compare Source

Bug Fixes

• skip npm audit signatures for packages from private registry (GHPR not supported) (#​39) (1ead5ca)

v0.11.3

Compare Source

Bug Fixes

• read schema version from package.json instead of non-existent --version flag (#​37) (0cc8c8a)

v0.11.2

Compare Source

Bug Fixes

• correct invalid action SHA pins (#​35) (351fd23)

v0.11.1

Compare Source

Bug Fixes

• align deploy actions with the real deploy-config-schema 0.16.0 CLI (#​33) (c77dd90)

v0.11.0

Compare Source

Features

• deploy-artifact, leak-scan and deploy-validate reusable workflows (#​31) (2cbc78f)

v0.10.2

Compare Source

Bug Fixes

• node-ci: exclude vendored tree via config, not deletion (#​26) (bde2ec0)

v0.10.1

Compare Source

Bug Fixes

• node-ci: remove vendored actions tree before quality checks (#​24) (15e0845)

v0.10.0

Compare Source

Features

• enforce zero-warning reusable CI (#​22) (c8ac6ff)

v0.9.0

Compare Source

Features

• add deploy automation reusables (#​17) (e6b6073)
• ci: migrate reusable workflows to JorisJonkers-dev coordinates (#​3) (7d1b8f3)
• clients: add shared publish-api-clients reusable workflow + api-client-publish action (#​9) (96a2b65)

Bug Fixes

• clients: declare sourcesJar/javadocJar dependency on generate (#​13) (f67200c)
• clients: link npm package to its repo for public visibility (#​15) (8bccf4d)
• clients: use plain setup-node (no install in empty dir) (#​11) (bd9c029)
• make reusable publishes idempotent (#​19) (2189fbe)
• reusable: check out github-workflows at github.job_workflow_sha (#​7) (78a598a)

---

Configuration

📅 Schedule: (in timezone Etc/UTC)

• Branch creation
  • "after 02:00 and before 06:00 every weekday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Deploy Preview — agents-ui

Environments: production
Context ref: ghcr.io/jorisjonkers-dev/cluster-deploy-context-public@sha256:95dc39fc695694c8fb4b0c538d7fe13038d407c7302c3725c98f0496c6a83499
Workloads: 1 | Routes: 1 | Gatus endpoints: 1

Image refs

• agents-ui: ghcr.io/jorisjonkers-dev/agents-ui@sha256:0000000000000000000000000000000000000000000000000000000000000000

SC-11 Readiness Scorecard

	Check	Status	Detail
✅	schema_pinned	pass
✅	context_pinned	pass
✅	no_latest_images	pass
✅	health_declared	pass
✅	route_owner_authmode_declared	pass
✅	rollback_retention_acknowledged	pass
✅	no_raw_secrets	pass
➖	stateful_policy_declared	not_applicable	deployment declares no stateful workloads
➖	raw_manifests_guarded	not_applicable	no workload enables rawManifests
➖	npm_signatures_verified	not_applicable	provenance is only evaluated when publishing an artifact

pass = ready · fail = blocks deployment · not_applicable = check does not apply

➖ 3 check(s) not applicable: stateful_policy_declared, raw_manifests_guarded, npm_signatures_verified

---

Updated by deploy-check on push to this PR.