chore: upgrade image toolchain dependencies

.github/workflows/buildah.yml

@@ -27,18 +27,18 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Install hadolint
         run: |
           mkdir -p "$HOME/.local/bin"
           curl -sSL -o "$HOME/.local/bin/hadolint" \
-            https://github.com/hadolint/hadolint/releases/download/v2.14.0/hadolint-Linux-x86_64
+            https://github.com/hadolint/hadolint/releases/download/v2.15.1/hadolint-linux-x86_64
           chmod +x "$HOME/.local/bin/hadolint"
           echo "$HOME/.local/bin" >> "$GITHUB_PATH"
 
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: '3.12'
 
@@ -53,7 +53,7 @@ jobs:
       images: ${{ steps.find.outputs.images }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 2
 
@@ -87,15 +87,15 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Install buildah and podman
         run: |
           sudo apt-get update
           sudo apt-get install -y buildah podman
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@v3
         with:
           context: ${{ matrix.image }}
           containerfiles: ${{ matrix.image }}/Containerfile
@@ -109,7 +109,7 @@ jobs:
         if: |
           (github.event_name == 'push' && github.ref == 'refs/heads/main') ||
           (github.event_name == 'workflow_dispatch' && inputs.mode == 'build & push')
-        uses: redhat-actions/push-to-registry@v2
+        uses: redhat-actions/push-to-registry@v3
         with:
           image: ${{ matrix.image }}
           tags: latest ${{ github.sha }}

.pre-commit-config.yaml

@@ -21,7 +21,7 @@ repos:
         entry: gitleaks dir --redact --verbose .
         pass_filenames: false
   - repo: https://github.com/hadolint/hadolint
-    rev: v2.14.0
+    rev: v2.15.1
     hooks:
       - id: hadolint
         args: [--failure-threshold=error]

AGENTS.md

@@ -35,7 +35,7 @@ Single workflow, three jobs, all on `ubuntu-latest`.
    - push/PR → only directories changed since the previous commit (`make changed-images`)
 3. **build** — after checks pass, fan out over the detected image matrix:
    - install buildah and podman
-   - `redhat-actions/buildah-build@v2` with `--squash`
+   - `redhat-actions/buildah-build@v3` with `--squash`
    - on `push` to `main`, or `workflow_dispatch` with `mode=build & push`, push to GHCR with tags `latest` and `${{ github.sha }}`
 
 PRs and `workflow_dispatch` with `mode=build` build but do not push.

README.md

@@ -6,8 +6,8 @@ Container image monorepo. Each subdirectory containing a `Containerfile` is buil
 
 | Directory | Base | Purpose |
 |---|---|---|
-| `tfroot-runner/` | `ghcr.io/actions/actions-runner` (Ubuntu) | gha-runner-scale-set runner with the OpenTofu IaC toolchain (kubectl, kustomize, sops, ansible, pre-commit, tflint, terraform-docs, infracost, checkov) |
-| `gh-cli/` | `alpine:3.21` | Minimal `gh` image for automation Jobs |
+| `tfroot-runner/` | `ghcr.io/actions/actions-runner:2.336.0` (Ubuntu) | gha-runner-scale-set runner with the OpenTofu IaC toolchain (kubectl, kustomize, sops, ansible, pre-commit, tflint, terraform-docs, infracost, checkov) |
+| `gh-cli/` | `alpine:3.24` | Minimal `gh` image for automation Jobs |
 
 ## How It Works
 

gh-cli/Containerfile

@@ -1,5 +1,5 @@
 # Minimal GitHub CLI image for automation tasks
-FROM alpine:3.21
+FROM alpine:3.24
 
 LABEL description="Minimal Alpine image with GitHub CLI for automation tasks"
 LABEL org.opencontainers.image.source="https://github.com/makeitworkcloud/images"

tfroot-runner/Containerfile

@@ -9,18 +9,20 @@
 ##############################
 # Pinned versions — update here
 ##############################
-ARG OPENTOFU_VERSION=1.12.3
-ARG SOPS_VERSION=3.13.1
+ARG OPENTOFU_VERSION=1.12.5
+ARG SOPS_VERSION=3.13.3
 ARG TERRAFORM_DOCS_VERSION=0.24.0
-ARG TFUPDATE_VERSION=0.9.4
+ARG TFUPDATE_VERSION=0.10.2
 ARG HCLEDIT_VERSION=0.2.18
-ARG TFLINT_VERSION=0.63.1
-ARG INFRACOST_VERSION=0.10.44
-ARG KUBECTL_VERSION=1.36.2
+ARG TFLINT_VERSION=0.64.0
+ARG INFRACOST_VERSION=0.10.45
+ARG KUBECTL_VERSION=1.36.3
 ARG KUSTOMIZE_VERSION=5.8.1
-ARG CHECKOV_VERSION=3.3.1
-ARG PRECOMMIT_VERSION=4.6.0
+ARG CHECKOV_VERSION=3.3.11
+ARG PRECOMMIT_VERSION=4.6.2
 ARG PYTHON_VERSION=3.14
+ARG YQ_VERSION=4.53.3
+ARG ACTIONS_RUNNER_VERSION=2.336.0
 
 ##############################
 # Stage 1: Build/download tools
@@ -103,9 +105,10 @@ RUN set -eux; \
 ##############################
 # Stage 2: Final runner image
 ##############################
-FROM --platform=linux/amd64 ghcr.io/actions/actions-runner:latest
+FROM --platform=linux/amd64 ghcr.io/actions/actions-runner:${ACTIONS_RUNNER_VERSION}
 
 ARG PYTHON_VERSION
+ARG YQ_VERSION
 
 LABEL org.opencontainers.image.title="tfroot-runner" \
       org.opencontainers.image.description="GitHub ARC runner with OpenTofu, kubectl, kustomize, sops, ansible, pre-commit, and friends." \
@@ -127,7 +130,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
         ansible-core openssh-client \
         jq genisoimage gnupg make shellcheck libatomic1 \
     && update-alternatives --install /usr/bin/python3 python3 /usr/bin/python${PYTHON_VERSION} 1 \
-    && curl -fsSL https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64 \
+    && curl -fsSL "https://github.com/mikefarah/yq/releases/download/v${YQ_VERSION}/yq_linux_amd64" \
         -o /usr/local/bin/yq && chmod +x /usr/local/bin/yq \
     && apt-get clean \
     && rm -rf /var/lib/apt/lists/* /usr/share/doc/* /usr/share/man/*

tfroot-runner/pre-commit-config.yaml

@@ -10,7 +10,7 @@ repos:
       - id: conventional-pre-commit
         stages: [commit-msg]
   - repo: https://github.com/antonbabenko/pre-commit-terraform
-    rev: v1.107.0
+    rev: v1.108.1
     hooks:
       - id: terraform_validate
         args: