chore(github-tag): update tag devsecninja/.github to v3

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
DevSecNinja/.github	workflow	major	v1.9.0 → v3.2.0
DevSecNinja/.github	action	major	v1.9.0 → v3.2.0

---

Release Notes

DevSecNinja/.github (DevSecNinja/.github)

v3.2.0

Compare Source

🚀 Features

• pages: add safe Cloudflare DNS cutover (72727fa)

v3.1.0

Compare Source

🚀 Features

• pages: add custom domain registration (#​342) (1b2ee6f)

v3.0.0

Compare Source

⚠ BREAKING CHANGES

• release-please: require GitHub App authentication (#​335)

🚀 Features

• release-please: require GitHub App authentication (#​335) (c278731)

🐛 Bug Fixes

• shell: apply configured indentation (#​337) (d1012e2)

v2.5.0

Compare Source

🚀 Features

• deps: update dependency apm-cli ( 0.26.0 ➔ 0.27.0 ) [automerge] (#​321) (d00cc26)
• deps: update dependency wrangler ( 4.118.0 ➔ 4.119.0 ) [automerge] (#​309) (044b9da)
• deps: update dependency wrangler ( 4.119.0 ➔ 4.123.0 ) [automerge] (#​318) (d88b8d9)
• github-release: update release jdx/mise ( v2026.7.14 ➔ v2026.8.0 ) [automerge] (#​319) (70fea47)
• mise: update tool uv ( 0.11.32 ➔ 0.12.1 ) [automerge] (#​320) (7db84d1)
• renovate: derive timestamp gating from one matcher (#​312) (be67213)

🐛 Bug Fixes

• github-release: update release jdx/mise ( v2026.7.12 ➔ v2026.7.13 ) [automerge] (#​307) (2dcda50)
• github-release: update release jdx/mise ( v2026.7.13 ➔ v2026.7.14 ) [automerge] (#​314) (2fb4955)
• mise: update tool pipx:checkov ( 3.3.8 ➔ 3.3.9 ) [automerge] (#​317) (42ccc79)
• renovate: recognize linuxserver version-v* tags (#​310) (d7115e6)
• renovate: scope linuxserver versioning by mirror and tag shape (#​313) (4dc939a)

v2.4.0

Compare Source

Features

• mise: update tool zizmor ( 1.27.0 ➔ 1.28.0 ) [automerge] (#​302) (aec0b6a)

Bug Fixes

• pages: scope Cloudflare concurrency per project (#​305) (5c5394a)

v2.3.0

Compare Source

Features

• deps: update dependency apm-cli ( 0.24.1 ➔ 0.25.0 ) [automerge] (#​264) (5ee03b1)
• deps: update dependency apm-cli ( 0.25.0 ➔ 0.26.0 ) [automerge] (#​274) (dca6f71)
• deps: update dependency wrangler ( 4.107.1 ➔ 4.110.0 ) [automerge] (#​265) (c17a963)
• deps: update dependency wrangler ( 4.110.0 ➔ 4.111.0 ) [automerge] (#​273) (0396f6e)
• deps: update dependency wrangler ( 4.111.0 ➔ 4.113.0 ) [automerge] (#​282) (fbc501b)
• deps: update dependency wrangler ( 4.113.0 ➔ 4.114.0 ) [automerge] (#​283) (1a236b2)
• deps: update dependency wrangler ( 4.114.0 ➔ 4.115.0 ) [automerge] (#​296) (77f2284)
• deps: update dependency wrangler ( 4.115.0 ➔ 4.116.0 ) [automerge] (#​297) (accf876)
• deps: update dependency wrangler ( 4.116.0 ➔ 4.118.0 ) [automerge] (#​301) (b953424)
• github-release: update release jdx/mise ( v2026.6.14 ➔ v2026.7.0 ) [automerge] (#​271) (c558dca)
• mise: update tool dprint ( 0.54.0 ➔ 0.55.0 ) [automerge] (#​262) (7aeefdf)
• mise: update tool trivy ( 0.71.2 ➔ 0.72.0 ) [automerge] (#​272) (46d7b4f)
• mise: update tool zizmor ( 1.26.1 ➔ 1.27.0 ) [automerge] (#​292) (d82cecd)
• pages: add optional go-version input (#​298) (53ed8b3)
• pages: deploy prebuilt artifacts via artifact-name (#​304) (0a2b9f0)
• renovate: PR-age cooldown for registries without trusted timestamps (#​286) (1465118)

Bug Fixes

• deps: update dependency apm-cli ( 0.24.0 ➔ 0.24.1 ) [automerge] (#​259) (9f63c58)
• deps: update dependency wrangler ( 4.107.0 ➔ 4.107.1 ) [automerge] (#​260) (96f8a37)
• github-release: update release jdx/mise ( v2026.6.11 ➔ v2026.6.14 ) [automerge] (#​251) (ee62ce3)
• github-release: update release jdx/mise ( v2026.7.0 ➔ v2026.7.5 ) [automerge] (#​277) (b41a91b)
• github-release: update release jdx/mise ( v2026.7.5 ➔ v2026.7.7 ) [automerge] (#​289) (045fd61)
• github-release: update release jdx/mise ( v2026.7.7 ➔ v2026.7.12 ) [automerge] (#​299) (920fcc6)
• mise: update tool dprint ( 0.55.0 ➔ 0.55.1 ) [automerge] (#​263) (de4fa66)
• mise: update tool dprint ( 0.55.1 ➔ 0.55.2 ) [automerge] (#​290) (5f0ca1a)
• mise: update tool lefthook ( 2.1.9 ➔ 2.1.10 ) [automerge] (#​278) (889aaba)
• mise: update tool pipx:checkov ( 3.3.1 ➔ 3.3.2 ) [automerge] (#​252) (276dd10)
• mise: update tool pipx:checkov ( 3.3.2 ➔ 3.3.6 ) [automerge] (#​268) (38f0253)
• mise: update tool pipx:checkov ( 3.3.6 ➔ 3.3.8 ) [automerge] (#​279) (17cd014)
• mise: update tool uv ( 0.11.23 ➔ 0.11.24 ) [automerge] (#​253) (0d40409)
• mise: update tool uv ( 0.11.24 ➔ 0.11.25 ) [automerge] (#​261) (ee9e92b)
• mise: update tool uv ( 0.11.25 ➔ 0.11.26 ) [automerge] (#​269) (cd723be)
• mise: update tool uv ( 0.11.26 ➔ 0.11.28 ) [automerge] (#​280) (15d7e11)
• mise: update tool uv ( 0.11.28 ➔ 0.11.29 ) [automerge] (#​291) (2df23c1)
• mise: update tool uv ( 0.11.29 ➔ 0.11.32 ) [automerge] (#​300) (1d48a4e)
• renovate: drop invalid minimumReleaseAge override on automerge rule (#​285) (37b3eb0)
• renovate: set internalChecksFilter to strict (#​284) (46c8d52)
• renovate: stop behind-base rebases resetting the pr-cooldown clock (#​287) (53f8930)

v2.2.0

Compare Source

Features

• deps: update dependency apm-cli ( 0.23.1 ➔ 0.24.0 ) [automerge] (#​247) (dcb8c94)
• deps: update dependency wrangler ( 4.105.0 ➔ 4.106.0 ) [automerge] (#​241) (8b65ff6)
• deps: update dependency wrangler ( 4.106.0 ➔ 4.107.0 ) [automerge] (#​248) (13630dd)
• github-tag: update tag devsecninja/ai-toolkit ( v0.7.0 ➔ v0.8.0 ) [automerge] (#​245) (0eb545a)
• lint: add upload-sarif input to skip GitHub code scanning upload (#​249) (30660c7)
• mise: update tool pipx:json5 ( 0.14.0 ➔ 0.15.0 ) [automerge] (#​244) (d2cdf62)
• mise: update tool zizmor ( 1.25.2 ➔ 1.26.1 ) [automerge] (#​246) (31bcb5f)

Bug Fixes

• mise: update tool uv ( 0.11.22 ➔ 0.11.23 ) [automerge] (#​242) (21344d2)

v2.1.0

Compare Source

Features

• deps: update dependency apm-cli ( 0.21.0 ➔ 0.22.0 ) [automerge] (#​214) (a9c7e67)
• deps: update dependency apm-cli ( 0.22.0 ➔ 0.23.1 ) [automerge] (#​236) (1c2c307)
• deps: update dependency wrangler ( 4.102.0 ➔ 4.105.0 ) [automerge] (#​213) (0ea0bbe)
• github-tag: update tag devsecninja/ai-toolkit ( v0.3.0 ➔ v0.6.2 ) [automerge] (#​215) (2cac081)
• github-tag: update tag devsecninja/ai-toolkit ( v0.6.2 ➔ v0.7.0 ) [automerge] (#​237) (46e0c28)
• mise: update tool pipx:checkov ( 3.2.533 ➔ 3.3.1 ) [automerge] (#​217) (7bbbe00)
• sync: distribute and consume labels-base.yaml via config-sync (#​223) (f219d42)

Bug Fixes

• ci: config-sync only fails when pipeline fails, not when changes detected (#​225) (1b46a68)
• fetch materialize branch in workflow (de33b8c)
• github-release: update release jdx/mise ( v2026.6.1 ➔ v2026.6.3 ) [automerge] (#​210) (88053b4)
• github-release: update release jdx/mise ( v2026.6.3 ➔ v2026.6.4 ) [automerge] (#​218) (c91478b)
• github-release: update release jdx/mise ( v2026.6.4 ➔ v2026.6.5 ) [automerge] (#​219) (f3539ca)
• github-release: update release jdx/mise ( v2026.6.5 ➔ v2026.6.6 ) [automerge] (#​220) (65b20fe)
• github-release: update release jdx/mise ( v2026.6.6 ➔ v2026.6.9 ) [automerge] (#​221) (df6f420)
• github-release: update release jdx/mise ( v2026.6.9 ➔ v2026.6.11 ) [automerge] (#​232) (63e120b)
• lint: install caller-pinned mise tools; friendly error when a tool isn't pinned (#​239) (56235e1)
• mise: update tool trivy ( 0.71.0 ➔ 0.71.2 ) [automerge] (#​233) (2636596)
• mise: update tool uv ( 0.11.21 ➔ 0.11.22 ) [automerge] (#​234) (f5fb5c7)

v2.0.0

Compare Source

⚠ BREAKING CHANGES

• pages: require artifact-path input (#​207)

Features

• pages: require artifact-path input (#​207) (6197650)

---

Configuration

📅 Schedule: (in timezone Europe/Amsterdam)

• Branch creation
  • "every weekend,on Friday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 44763d2c-2eac-4630-b08d-db9ff13f23d5

📥 Commits

Reviewing files that changed from the base of the PR and between 6de50cb and aa3d723.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: ccb851cd-60c5-43dc-8d0a-2966ae8397af

📥 Commits

Reviewing files that changed from the base of the PR and between 82ec3ae and 6de50cb.

📒 Files selected for processing (4)

• .github/workflows/apm-materialize.yml
• .github/workflows/config-sync.yml
• .github/workflows/lint.yml
• .github/workflows/release-please.yml

Included review availability: Your plan provides up to 10 included reviews per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The pull request updates DevSecNinja action pins and reusable workflow references from v1.9.0 to v3.2.0 across four GitHub Actions workflow files.

Changes

Workflow dependency updates

Layer / File(s)	Summary
Action pin updates .github/workflows/apm-materialize.yml	The harden-runner and open-pr action pins now use v3.2.0.
Reusable workflow updates .github/workflows/config-sync.yml, .github/workflows/lint.yml, .github/workflows/release-please.yml	The config-sync, lint, and release workflows now reference DevSecNinja v3.2.0 revisions.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Suggested reviewers: devsecninja

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the main change: updating DevSecNinja/.github workflow and action references to v3. The change matches the pull request contents, which update the references to v3.2.0.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}