chore(deps): update workflows

[renovate-bot]

This PR contains the following updates:

Package	Type	Update	Change
actions/download-artifact	action	patch	v4.1.8 -> v4.1.9
codecov/codecov-action	action	minor	v5.3.1 -> v5.4.0
docker/setup-buildx-action	action	digest	f7ce87c -> b5ca514
docker/setup-qemu-action	action	digest	4574d27 -> 2910929
slsa-framework/slsa-github-generator	action	minor	v2.0.0 -> v2.1.0

---

Release Notes

actions/download-artifact (actions/download-artifact)

v4.1.9

Compare Source

What's Changed

• Add workflow file for publishing releases to immutable action package by @​Jcambass in https://github.com/actions/download-artifact/pull/354
• docs: small migration fix by @​froblesmartin in https://github.com/actions/download-artifact/pull/370
• Update MIGRATION.md by @​andyfeller in https://github.com/actions/download-artifact/pull/372
• Update artifact package to 2.2.2 by @​yacaovsnc in https://github.com/actions/download-artifact/pull/380

New Contributors

• @​Jcambass made their first contribution in https://github.com/actions/download-artifact/pull/354
• @​froblesmartin made their first contribution in https://github.com/actions/download-artifact/pull/370
• @​andyfeller made their first contribution in https://github.com/actions/download-artifact/pull/372
• @​yacaovsnc made their first contribution in https://github.com/actions/download-artifact/pull/380

Full Changelog: actions/download-artifact@v4...v4.1.9

codecov/codecov-action (codecov/codecov-action)

v5.4.0

Compare Source

What's Changed

• update wrapper submodule to 0.2.0, add recurse_submodules arg by @​matt-codecov in https://github.com/codecov/codecov-action/pull/1780
• build(deps): bump actions/upload-artifact from 4.6.0 to 4.6.1 by @​app/dependabot in https://github.com/codecov/codecov-action/pull/1775
• build(deps): bump ossf/scorecard-action from 2.4.0 to 2.4.1 by @​app/dependabot in https://github.com/codecov/codecov-action/pull/1776
• build(deps): bump github/codeql-action from 3.28.9 to 3.28.10 by @​app/dependabot in https://github.com/codecov/codecov-action/pull/1777
• Clarify in README that use_pypi bypasses integrity checks too by @​webknjaz in https://github.com/codecov/codecov-action/pull/1773
• Fix use of safe.directory inside containers by @​Flamefire in https://github.com/codecov/codecov-action/pull/1768
• Fix description for report_type input by @​craigscott-crascit in https://github.com/codecov/codecov-action/pull/1770
• build(deps): bump github/codeql-action from 3.28.8 to 3.28.9 by @​app/dependabot in https://github.com/codecov/codecov-action/pull/1765
• Fix a typo in the example by @​miranska in https://github.com/codecov/codecov-action/pull/1758
• build(deps): bump github/codeql-action from 3.28.5 to 3.28.8 by @​app/dependabot in https://github.com/codecov/codecov-action/pull/1757
• build(deps): bump github/codeql-action from 3.28.1 to 3.28.5 by @​app/dependabot in https://github.com/codecov/codecov-action/pull/1753

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.3.1..v5.4.0

slsa-framework/slsa-github-generator (slsa-framework/slsa-github-generator)

v2.1.0

Compare Source

v2.1.0: Sigstore Bundles for Generic Generator and Go Builder

The workflows generator_generic_slsa3.yml and builder_go_slsa3.yml
have been updated to produce signed Sigstore Bundles, just like all the other builders
that use the BYOB framework.

The workflow logs will now print a LogIndex, rather than a LogUUID. Both are equally searchanble on
https://search.sigstore.dev/.

v2.1.0: Vars context recorded in provenance

• Updated: GitHub vars context is now recorded in provenance for the generic and
  container generators. The vars context cannot affect the build in the Go
  builder so it is not recorded.

---

Configuration

📅 Schedule: Branch creation - "before 6am on monday" in timezone Australia/Sydney, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.