From c90fffcdf0568c869a3aab756f22f6e2867834c6 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 24 Oct 2026 11:36:33 +0000
Subject: [PATCH] ci: bump the github-actions group across 1 directory with 2
 updates

Bumps the github-actions group with 2 updates in the / directory: [actions/create-github-app-token](https://github.com/actions/create-github-app-token) and [docker/bake-action](https://github.com/docker/bake-action).


Updates `actions/create-github-app-token` from 3.2.0 to 3.3.0
- [Release notes](https://github.com/actions/create-github-app-token/releases)
- [Changelog](https://github.com/actions/create-github-app-token/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/create-github-app-token/compare/bcd2ba49218906704ab6c1aa796996da409d3eb1...64ab729a6294000f5aa4a4bc0b73d1f32bc45510)

Updates `docker/bake-action` from 7.4.0 to 7.5.0
- [Release notes](https://github.com/docker/bake-action/releases)
- [Commits](https://github.com/docker/bake-action/compare/018cb6412ab401ebaa809aa5f85966b74628600f...59cb1203cd42bcefd40a1b6d73b589e48c86040e)

---
updated-dependencies:
- dependency-name: actions/create-github-app-token
  dependency-version: 3.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: docker/bake-action
  dependency-version: 7.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/dependabot.yaml | 2 +-
 .github/workflows/docker.yaml     | 2 +-
 .github/workflows/release.yaml    | 2 +-
 .github/workflows/static.yaml     | 8 ++++----
 4 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/dependabot.yaml b/.github/workflows/dependabot.yaml
index 034b2baae1..570d2627f2 100644
--- a/.github/workflows/dependabot.yaml
+++ b/.github/workflows/dependabot.yaml
@@ -12,7 +12,7 @@ jobs:
     steps:
       # The default GITHUB_TOKEN lacks the `workflows` scope and is refused on
       # PRs that touch .github/workflows; use the release app token instead.
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         id: app-token
         with:
           app-id: ${{ vars.RELEASE_APP_ID }}
diff --git a/.github/workflows/docker.yaml b/.github/workflows/docker.yaml
index 288c4c2c71..e51e6d3392 100644
--- a/.github/workflows/docker.yaml
+++ b/.github/workflows/docker.yaml
@@ -117,7 +117,7 @@ jobs:
           password: ${{ secrets.DOCKERHUB_TOKEN }} # zizmor: ignore[secrets-outside-env] TODO: drop once super-linter ships zizmor >=1.24.0, then the allowlist in zizmor.yaml takes over
       - name: Build
         id: build
-        uses: docker/bake-action@018cb6412ab401ebaa809aa5f85966b74628600f # v7.4.0
+        uses: docker/bake-action@59cb1203cd42bcefd40a1b6d73b589e48c86040e # v7.5.0
         with:
           pull: true
           load: ${{ !fromJson(needs.prepare.outputs.push) }}
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index f23fd55fe0..dd73349743 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -44,7 +44,7 @@ jobs:
             echo "::error::Invalid version: '${VERSION}' (must be SemVer, no v prefix)"
             exit 1
           fi
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         id: release-app-token
         with:
           app-id: ${{ vars.RELEASE_APP_ID }}
diff --git a/.github/workflows/static.yaml b/.github/workflows/static.yaml
index 5eb066a9f1..06c7e37111 100644
--- a/.github/workflows/static.yaml
+++ b/.github/workflows/static.yaml
@@ -131,7 +131,7 @@ jobs:
           REF: ${{ needs.prepare.outputs.ref }}
       - name: Build
         id: build
-        uses: docker/bake-action@018cb6412ab401ebaa809aa5f85966b74628600f # v7.4.0
+        uses: docker/bake-action@59cb1203cd42bcefd40a1b6d73b589e48c86040e # v7.5.0
         with:
           pull: true
           load: true
@@ -167,7 +167,7 @@ jobs:
       - name: Push the builder image
         id: push
         if: fromJson(needs.prepare.outputs.push) && !matrix.debug && !matrix.mimalloc
-        uses: docker/bake-action@018cb6412ab401ebaa809aa5f85966b74628600f # v7.4.0
+        uses: docker/bake-action@59cb1203cd42bcefd40a1b6d73b589e48c86040e # v7.5.0
         with:
           source: .
           targets: static-builder-musl
@@ -307,7 +307,7 @@ jobs:
           password: ${{ secrets.DOCKERHUB_TOKEN }} # zizmor: ignore[secrets-outside-env] TODO: drop once super-linter ships zizmor >=1.24.0, then the allowlist in zizmor.yaml takes over
       - name: Build
         id: build
-        uses: docker/bake-action@018cb6412ab401ebaa809aa5f85966b74628600f # v7.4.0
+        uses: docker/bake-action@59cb1203cd42bcefd40a1b6d73b589e48c86040e # v7.5.0
         with:
           pull: true
           load: true
@@ -339,7 +339,7 @@ jobs:
       - name: Push the builder image
         id: push
         if: fromJson(needs.prepare.outputs.push)
-        uses: docker/bake-action@018cb6412ab401ebaa809aa5f85966b74628600f # v7.4.0
+        uses: docker/bake-action@59cb1203cd42bcefd40a1b6d73b589e48c86040e # v7.5.0
         with:
           source: .
           targets: static-builder-gnu