From a3fd2a5ff428688d99d135c8da9834313168b9b7 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 7 Sep 2026 05:18:32 +0000
Subject: [PATCH] ci(deps): bump the github-actions group across 1 directory
 with 3 updates

Bumps the github-actions group with 3 updates in the / directory: [anchore/sbom-action](https://github.com/anchore/sbom-action), [bridgecrewio/checkov-action](https://github.com/bridgecrewio/checkov-action) and [jdx/mise-action](https://github.com/jdx/mise-action).


Updates `anchore/sbom-action` from 0.24.0 to 0.24.2
- [Release notes](https://github.com/anchore/sbom-action/releases)
- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md)
- [Commits](https://github.com/anchore/sbom-action/compare/e22c389904149dbc22b58101806040fa8d37a610...3ad7283483fc7af8ff2b4ea19663c2d5ca935e26)

Updates `bridgecrewio/checkov-action` from 12.3119.0 to 12.3122.0
- [Release notes](https://github.com/bridgecrewio/checkov-action/releases)
- [Commits](https://github.com/bridgecrewio/checkov-action/compare/59b9d7edfcad5b87fbe3f473a9a134a721ad03f8...f967808197a8d784d3e72919f38c3ff0cda7884e)

Updates `jdx/mise-action` from 4.2.5 to 4.3.0
- [Release notes](https://github.com/jdx/mise-action/releases)
- [Changelog](https://github.com/jdx/mise-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/jdx/mise-action/compare/3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518...c2a87611a18de5b3828c5652fe268e992400cb5c)

---
updated-dependencies:
- dependency-name: anchore/sbom-action
  dependency-version: 0.24.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: bridgecrewio/checkov-action
  dependency-version: 12.3121.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: jdx/mise-action
  dependency-version: 4.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/docker-build.yml | 2 +-
 .github/workflows/publish.yml      | 4 ++--
 .github/workflows/security.yml     | 4 ++--
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml
index 10539b3..484ba72 100644
--- a/.github/workflows/docker-build.yml
+++ b/.github/workflows/docker-build.yml
@@ -114,7 +114,7 @@ jobs:
       # SBOM per image — attached to the registry alongside the signature.
       - name: Generate SBOM for CLI image
         if: github.event_name != 'pull_request' && steps.docker-creds.outputs.present == 'true' && steps.build-cli.outputs.digest != ''
-        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
+        uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
         with:
           image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build-cli.outputs.digest }}
           format: cyclonedx-json
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 336be88..9e5336c 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -426,7 +426,7 @@ jobs:
       - name: Generate SBOM (CycloneDX)
         # CycloneDX SBOM is required by EU CRA and US EO 14028 for shipped
         # software. Lets downstream consumers introspect the dep tree.
-        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
+        uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
         with:
           path: .
           config: .syft.yaml # names the root component (see the step above)
@@ -436,7 +436,7 @@ jobs:
 
       - name: Generate SBOM (SPDX)
         # Some consumers (e.g. RHEL, federal) require SPDX format.
-        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
+        uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
         with:
           path: .
           config: .syft.yaml # names the root component (see the step above)
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 6b87d58..ac57e84 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -188,7 +188,7 @@ jobs:
       - name: Checkov (terraform + kubernetes)
         # Baseline of pre-existing findings in .checkov.yaml skip-check.
         # Gating on net-new findings only — see .checkov.yaml header for context.
-        uses: bridgecrewio/checkov-action@59b9d7edfcad5b87fbe3f473a9a134a721ad03f8 # v12.3119.0
+        uses: bridgecrewio/checkov-action@f967808197a8d784d3e72919f38c3ff0cda7884e # v12.3122.0
         with:
           directory: .
           config_file: .checkov.yaml
@@ -331,7 +331,7 @@ jobs:
           node-version: "22"
           cache: "npm"
       - run: npm ci && npm run build
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
       - name: Provision declared tools via kit install (triage-gated)
         run: node dist/cli.js install
         continue-on-error: true # kit-self-audit: allow-continue-on-error