chore(github-tag): update tag devsecninja/.github to v2

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
DevSecNinja/.github	workflow	major	v1.9.0 → v2.5.0	v3.2.0 (+2)

---

Release Notes

DevSecNinja/.github (DevSecNinja/.github)

v2.5.0

Compare Source

🚀 Features

• deps: update dependency apm-cli ( 0.26.0 ➔ 0.27.0 ) [automerge] (#​321) (d00cc26)
• deps: update dependency wrangler ( 4.118.0 ➔ 4.119.0 ) [automerge] (#​309) (044b9da)
• deps: update dependency wrangler ( 4.119.0 ➔ 4.123.0 ) [automerge] (#​318) (d88b8d9)
• github-release: update release jdx/mise ( v2026.7.14 ➔ v2026.8.0 ) [automerge] (#​319) (70fea47)
• mise: update tool uv ( 0.11.32 ➔ 0.12.1 ) [automerge] (#​320) (7db84d1)
• renovate: derive timestamp gating from one matcher (#​312) (be67213)

🐛 Bug Fixes

• github-release: update release jdx/mise ( v2026.7.12 ➔ v2026.7.13 ) [automerge] (#​307) (2dcda50)
• github-release: update release jdx/mise ( v2026.7.13 ➔ v2026.7.14 ) [automerge] (#​314) (2fb4955)
• mise: update tool pipx:checkov ( 3.3.8 ➔ 3.3.9 ) [automerge] (#​317) (42ccc79)
• renovate: recognize linuxserver version-v* tags (#​310) (d7115e6)
• renovate: scope linuxserver versioning by mirror and tag shape (#​313) (4dc939a)

v2.4.0

Compare Source

Features

• mise: update tool zizmor ( 1.27.0 ➔ 1.28.0 ) [automerge] (#​302) (aec0b6a)

Bug Fixes

• pages: scope Cloudflare concurrency per project (#​305) (5c5394a)

v2.3.0

Compare Source

Features

• deps: update dependency apm-cli ( 0.24.1 ➔ 0.25.0 ) [automerge] (#​264) (5ee03b1)
• deps: update dependency apm-cli ( 0.25.0 ➔ 0.26.0 ) [automerge] (#​274) (dca6f71)
• deps: update dependency wrangler ( 4.107.1 ➔ 4.110.0 ) [automerge] (#​265) (c17a963)
• deps: update dependency wrangler ( 4.110.0 ➔ 4.111.0 ) [automerge] (#​273) (0396f6e)
• deps: update dependency wrangler ( 4.111.0 ➔ 4.113.0 ) [automerge] (#​282) (fbc501b)
• deps: update dependency wrangler ( 4.113.0 ➔ 4.114.0 ) [automerge] (#​283) (1a236b2)
• deps: update dependency wrangler ( 4.114.0 ➔ 4.115.0 ) [automerge] (#​296) (77f2284)
• deps: update dependency wrangler ( 4.115.0 ➔ 4.116.0 ) [automerge] (#​297) (accf876)
• deps: update dependency wrangler ( 4.116.0 ➔ 4.118.0 ) [automerge] (#​301) (b953424)
• github-release: update release jdx/mise ( v2026.6.14 ➔ v2026.7.0 ) [automerge] (#​271) (c558dca)
• mise: update tool dprint ( 0.54.0 ➔ 0.55.0 ) [automerge] (#​262) (7aeefdf)
• mise: update tool trivy ( 0.71.2 ➔ 0.72.0 ) [automerge] (#​272) (46d7b4f)
• mise: update tool zizmor ( 1.26.1 ➔ 1.27.0 ) [automerge] (#​292) (d82cecd)
• pages: add optional go-version input (#​298) (53ed8b3)
• pages: deploy prebuilt artifacts via artifact-name (#​304) (0a2b9f0)
• renovate: PR-age cooldown for registries without trusted timestamps (#​286) (1465118)

Bug Fixes

• deps: update dependency apm-cli ( 0.24.0 ➔ 0.24.1 ) [automerge] (#​259) (9f63c58)
• deps: update dependency wrangler ( 4.107.0 ➔ 4.107.1 ) [automerge] (#​260) (96f8a37)
• github-release: update release jdx/mise ( v2026.6.11 ➔ v2026.6.14 ) [automerge] (#​251) (ee62ce3)
• github-release: update release jdx/mise ( v2026.7.0 ➔ v2026.7.5 ) [automerge] (#​277) (b41a91b)
• github-release: update release jdx/mise ( v2026.7.5 ➔ v2026.7.7 ) [automerge] (#​289) (045fd61)
• github-release: update release jdx/mise ( v2026.7.7 ➔ v2026.7.12 ) [automerge] (#​299) (920fcc6)
• mise: update tool dprint ( 0.55.0 ➔ 0.55.1 ) [automerge] (#​263) (de4fa66)
• mise: update tool dprint ( 0.55.1 ➔ 0.55.2 ) [automerge] (#​290) (5f0ca1a)
• mise: update tool lefthook ( 2.1.9 ➔ 2.1.10 ) [automerge] (#​278) (889aaba)
• mise: update tool pipx:checkov ( 3.3.1 ➔ 3.3.2 ) [automerge] (#​252) (276dd10)
• mise: update tool pipx:checkov ( 3.3.2 ➔ 3.3.6 ) [automerge] (#​268) (38f0253)
• mise: update tool pipx:checkov ( 3.3.6 ➔ 3.3.8 ) [automerge] (#​279) (17cd014)
• mise: update tool uv ( 0.11.23 ➔ 0.11.24 ) [automerge] (#​253) (0d40409)
• mise: update tool uv ( 0.11.24 ➔ 0.11.25 ) [automerge] (#​261) (ee9e92b)
• mise: update tool uv ( 0.11.25 ➔ 0.11.26 ) [automerge] (#​269) (cd723be)
• mise: update tool uv ( 0.11.26 ➔ 0.11.28 ) [automerge] (#​280) (15d7e11)
• mise: update tool uv ( 0.11.28 ➔ 0.11.29 ) [automerge] (#​291) (2df23c1)
• mise: update tool uv ( 0.11.29 ➔ 0.11.32 ) [automerge] (#​300) (1d48a4e)
• renovate: drop invalid minimumReleaseAge override on automerge rule (#​285) (37b3eb0)
• renovate: set internalChecksFilter to strict (#​284) (46c8d52)
• renovate: stop behind-base rebases resetting the pr-cooldown clock (#​287) (53f8930)

v2.2.0

Compare Source

Features

• deps: update dependency apm-cli ( 0.23.1 ➔ 0.24.0 ) [automerge] (#​247) (dcb8c94)
• deps: update dependency wrangler ( 4.105.0 ➔ 4.106.0 ) [automerge] (#​241) (8b65ff6)
• deps: update dependency wrangler ( 4.106.0 ➔ 4.107.0 ) [automerge] (#​248) (13630dd)
• github-tag: update tag devsecninja/ai-toolkit ( v0.7.0 ➔ v0.8.0 ) [automerge] (#​245) (0eb545a)
• lint: add upload-sarif input to skip GitHub code scanning upload (#​249) (30660c7)
• mise: update tool pipx:json5 ( 0.14.0 ➔ 0.15.0 ) [automerge] (#​244) (d2cdf62)
• mise: update tool zizmor ( 1.25.2 ➔ 1.26.1 ) [automerge] (#​246) (31bcb5f)

Bug Fixes

• mise: update tool uv ( 0.11.22 ➔ 0.11.23 ) [automerge] (#​242) (21344d2)

v2.1.0

Compare Source

Features

• deps: update dependency apm-cli ( 0.21.0 ➔ 0.22.0 ) [automerge] (#​214) (a9c7e67)
• deps: update dependency apm-cli ( 0.22.0 ➔ 0.23.1 ) [automerge] (#​236) (1c2c307)
• deps: update dependency wrangler ( 4.102.0 ➔ 4.105.0 ) [automerge] (#​213) (0ea0bbe)
• github-tag: update tag devsecninja/ai-toolkit ( v0.3.0 ➔ v0.6.2 ) [automerge] (#​215) (2cac081)
• github-tag: update tag devsecninja/ai-toolkit ( v0.6.2 ➔ v0.7.0 ) [automerge] (#​237) (46e0c28)
• mise: update tool pipx:checkov ( 3.2.533 ➔ 3.3.1 ) [automerge] (#​217) (7bbbe00)
• sync: distribute and consume labels-base.yaml via config-sync (#​223) (f219d42)

Bug Fixes

• ci: config-sync only fails when pipeline fails, not when changes detected (#​225) (1b46a68)
• fetch materialize branch in workflow (de33b8c)
• github-release: update release jdx/mise ( v2026.6.1 ➔ v2026.6.3 ) [automerge] (#​210) (88053b4)
• github-release: update release jdx/mise ( v2026.6.3 ➔ v2026.6.4 ) [automerge] (#​218) (c91478b)
• github-release: update release jdx/mise ( v2026.6.4 ➔ v2026.6.5 ) [automerge] (#​219) (f3539ca)
• github-release: update release jdx/mise ( v2026.6.5 ➔ v2026.6.6 ) [automerge] (#​220) (65b20fe)
• github-release: update release jdx/mise ( v2026.6.6 ➔ v2026.6.9 ) [automerge] (#​221) (df6f420)
• github-release: update release jdx/mise ( v2026.6.9 ➔ v2026.6.11 ) [automerge] (#​232) (63e120b)
• lint: install caller-pinned mise tools; friendly error when a tool isn't pinned (#​239) (56235e1)
• mise: update tool trivy ( 0.71.0 ➔ 0.71.2 ) [automerge] (#​233) (2636596)
• mise: update tool uv ( 0.11.21 ➔ 0.11.22 ) [automerge] (#​234) (f5fb5c7)

v2.0.0

Compare Source

⚠ BREAKING CHANGES

• pages: require artifact-path input (#​207)

Features

• pages: require artifact-path input (#​207) (6197650)

---

Configuration

📅 Schedule: (in timezone Europe/Amsterdam)

• Branch creation
  • "every weekend,on Friday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: eb39666c-13d3-4b43-9bb8-5516fe13ff89

📥 Commits

Reviewing files that changed from the base of the PR and between ed98225 and 3956018.

📒 Files selected for processing (2)

• .github/workflows/config-sync.yml
• .github/workflows/release-please.yml

Included review availability: Your plan provides up to 10 included reviews per hour; 4 remain after this review.

---

📝 Walkthrough

Walkthrough

The Config Sync and release-please workflows now reference the pinned shared workflow commit for version v2.5.0 instead of v1.9.0.

Changes

Workflow version update

Layer / File(s)	Summary
Shared workflow references .github/workflows/config-sync.yml, .github/workflows/release-please.yml	Both workflows now reference the pinned v2.5.0 shared workflow commit instead of v1.9.0.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~2 minutes

Change: Other

Suggested reviewers: devsecninja

Merge Risk: ⚪ Minimal · up to 39560

The workflow update remains mergeable: Config Sync can still create its pull request when it cannot apply the optional label.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: updating the DevSecNinja/.github workflow tag to version v2. The title is concise and relevant, although it does not specify the exact target version v2.5.…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch renovate/devsecninja-.github-2.x

---

_{Comment @coderabbitai help to get the list of available commands.}