ci(github-action): update action devsecninja/.github to v1.7.0 [automerge]

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
DevSecNinja/.github	action	minor	v1.4.0 → v1.7.0
DevSecNinja/.github	action	minor	v1.6.1 → v1.7.0

---

Release Notes

DevSecNinja/.github (DevSecNinja/.github)

v1.7.0

Compare Source

Features

• deps: update dependency wrangler ( 4.95.0 ➔ 4.97.0 ) [automerge] (#​158) (3d14dd6)
• deps: update dependency wrangler ( 4.97.0 ➔ 4.98.0 ) [automerge] (#​162) (c04ee2c)
• deps: update dependency wrangler ( 4.98.0 ➔ 4.100.0 ) [automerge] (#​174) (416eecb)
• renovate: add digest-pinned container image custom manager (#​172) (aa43930)
• renovate: branch-automerge dotfiles devcontainer digest updates without tests (#​161) (5657813)
• renovate: merge dotfiles devcontainer digests anytime and fix dprint failure (#​164) (a0618e2)

Bug Fixes

• github-release: update mise ( v2026.5.11 ➔ v2026.5.14 ) [automerge] (#​153) (56550d3)
• github-release: update mise ( v2026.5.14 ➔ v2026.5.15 ) [automerge] (#​159) (334758a)
• github-release: update mise ( v2026.5.15 ➔ v2026.5.16 ) [automerge] (#​167) (7b793ad)
• make go-lint version optional since we don't always lint go (61a23c2)
• mise: update tool lefthook ( 2.1.6 ➔ 2.1.8 ) [automerge] (#​154) (947b145)
• mise: update tool lefthook ( 2.1.8 ➔ 2.1.9 ) [automerge] (#​169) (566ce48)
• mise: update tool pipx:checkov ( 3.2.529 ➔ 3.2.530 ) [automerge] (#​168) (11841c5)
• prevent shellcheck/shfmt failure when no shell scripts exist (42655d5)
• renovate: add minimumReleaseAge 0 to autoMerge configuration (40ac871)
• renovate: expand CODEOWNERS bot-bump exceptions to cover manifests (df89220)
• renovate: strip leading v from mise node version pins (#​176) (ec1a62a)
• temp update base.json5 to allow unsafe executions (652fcb3)

v1.6.1

Compare Source

Bug Fixes

• workflows: restore persisted creds on caller checkout for open-pr (#​147) (2ffca5f)

v1.6.0

Compare Source

Features

• config sync nested codeowners (#​146) (f296be4)
• config-sync: support nested paths and centrally manage CODEOWNERS (#​144) (4683261)

v1.5.0

Compare Source

Features

• deps: Update dependency wrangler ( 3.114.17 ➔ 4.92.0 ) (#​132) (459b7b5)
• deps: update dependency wrangler ( 4.92.0 ➔ 4.95.0 ) (#​135) (92f7b7a)
• mise: update tool zizmor ( 1.24.1 ➔ 1.25.0 ) (#​122) (89b97e8)
• pages: support Cloudflare production deploys (a8f6fb5)
• renovate: append [automerge] suffix to auto-merge PR titles (#​129) (c23a538)
• renovate: auto-merge non-major updates after soak and enforce custom-manager governance (20c696b)
• renovate: prevent lockfile refreshes not working due to minimum release age (70e9026)

Bug Fixes

• ci: disable setup-node caching by default in Pages workflow (#​139) (40674e1)
• ci: scope release-please App token to least privilege (#​137) (f992e18)
• github-release: update release golangci/golangci-lint ( v2.12.1 ➔ v2.12.2 ) (#​110) (7af578a)
• github-release: update release jdx/mise ( v2026.5.0 ➔ v2026.5.2 ) (#​112) (429d8e2)
• github-release: update release jdx/mise ( v2026.5.10 ➔ v2026.5.11 ) [automerge] (#​143) (b184c9d)
• github-release: update release jdx/mise ( v2026.5.2 ➔ v2026.5.3 ) (#​114) (21453b2)
• github-release: update release jdx/mise ( v2026.5.3 ➔ v2026.5.4 ) (#​115) (8e503a5)
• github-release: update release jdx/mise ( v2026.5.4 ➔ v2026.5.5 ) (#​116) (d4a7feb)
• github-release: update release jdx/mise ( v2026.5.5 ➔ v2026.5.9 ) (#​119) (ef9510d)
• github-release: update release jdx/mise ( v2026.5.9 ➔ v2026.5.10 ) [automerge] (#​134) (7900749)
• mise: update tool pipx:checkov ( 3.2.526 ➔ 3.2.527 ) (#​113) (276901b)
• mise: update tool pipx:checkov ( 3.2.527 ➔ 3.2.528 ) (#​117) (644da14)
• mise: update tool pipx:checkov ( 3.2.528 ➔ 3.2.529 ) (#​120) (1fe6ea3)
• mise: update tool zizmor ( 1.25.0 ➔ 1.25.2 ) [automerge] (#​127) (f786192)
• move automerge label closer to the automerge setting (9d9d9d5)
• pages: require Cloudflare credentials for production (827f771)
• renovate: automerge github action pin prs (897927e)
• renovate: expand custom-managed dependencies to full version (#​141) (1c0531e)
• renovate: support non-github-releases datasources in workflow custom manager (#​131) (82e0381)
• Update wrangler version to 4.92.0 (bf64a09)

Reverts

• renovate: reverse ineffective custom.regex pin rule from #​141 (#​142) (40aa05b)

---

Configuration

📅 Schedule: (in timezone Europe/Amsterdam)

• Branch creation
  • "every weekend,on Friday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.