Update GitHub Actions

[tmt-renovate-bot]

This PR contains the following updates:

Package	Type	Update	Change
actions/attest-build-provenance	action	minor	v4.1.1 → v4.2.2
github/codeql-action	action	patch	v4.37.4 → v4.37.6
renovatebot/github-action	action	patch	v46.2.0 → v46.2.1

---

Release Notes

actions/attest-build-provenance (actions/attest-build-provenance)

v4.2.2

Compare Source

[!NOTE]
As of version 4, actions/attest-build-provenance is simply a wrapper on top of actions/attest.

Existing applications may continue to use the attest-build-provenance action, but new implementations should use actions/attest instead.

What's Changed

• Bump actions/attest from 4.2.0 to 4.2.1 in the actions-minor group by @​dependabot[bot] in #​862

Full Changelog: actions/attest-build-provenance@v4.1.1...v4.2.2

github/codeql-action (github/codeql-action)

v4.37.6

Compare Source

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #​4070

v4.37.5

Compare Source

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #​4061

renovatebot/github-action (renovatebot/github-action)

v46.2.1

Compare Source

Documentation

• update references to renovatebot/github-action to v46.2.0 (b48aa6c)

Miscellaneous Chores

• deps: update dependency globals to v17.8.0 (3e46bd7)
• deps: update dependency lint-staged to v17.2.0 (9c685f2)
• deps: update node.js to v24.18.1 (f525256)

Build System

• deps: lock file maintenance (3d8211a)

Continuous Integration

• deps: update ghcr.io/renovatebot/renovate docker tag to v44.0.1 (d471d52)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.2.1 (5cb64df)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.2.2 (a6b5808)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.2.3 (ab4d1eb)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.3.0 (a427843)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.3.3 (2ac8329)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.4.0 (7665449)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.4.2 (0166c9f)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.4.3 (8662b55)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.4.5 (1e71262)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.4.6 (7bec40c)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.5.0 (d146e8b)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.5.1 (ddd5dca)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.5.2 (0731dab)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.5.3 (700f3b5)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.6.0 (7edb80e)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.7.0 (127e8ef)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.7.1 (f7532d1)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.7.2 (0fcd35b)
• deps: update ghcr.io/zizmorcore/zizmor docker tag to v1.29.0 (#​1068) (581f6ac)
• deps: update zizmorcore/zizmor-action action to v0.6.2 (e36e81c)

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.