chore(deps): bump the github-actions-dependencies group across 2 directories with 4 updates

.devcontainer/devcontainer-lock.json

@@ -1,9 +1,9 @@
 {
   "features": {
-    "ghcr.io/devcontainers/features/docker-in-docker:": {
-      "version": "2.17.0",
-      "resolved": "ghcr.io/devcontainers/features/docker-in-docker@sha256:25b9f05705ffba7dbe503230ac76081419306f8c8bc88e0ce78c4ecd99a0c78c",
-      "integrity": "sha256:25b9f05705ffba7dbe503230ac76081419306f8c8bc88e0ce78c4ecd99a0c78c"
+    "ghcr.io/devcontainers/features/docker-in-docker:3": {
+      "version": "3.0.1",
+      "resolved": "ghcr.io/devcontainers/features/docker-in-docker@sha256:ca2508495b01ba29eba93e8153772a2daa65eaa86471cc6863fe2a3d21933df9",
+      "integrity": "sha256:ca2508495b01ba29eba93e8153772a2daa65eaa86471cc6863fe2a3d21933df9"
     },
     "ghcr.io/devcontainers/features/github-cli:1": {
       "version": "1.1.0",

.devcontainer/devcontainer.json

@@ -3,7 +3,7 @@
   "image": "mcr.microsoft.com/devcontainers/base:debian",
   "features": {
     "ghcr.io/devcontainers/features/node:2": {},
-    "ghcr.io/devcontainers/features/docker-in-docker:": {
+    "ghcr.io/devcontainers/features/docker-in-docker:3": {
       "moby": false
     },
     "ghcr.io/devcontainers/features/github-cli:1": {

.github/linters/.jscpd.json

@@ -1,4 +1,8 @@
 {
   "threshold": 5,
-  "ignore": ["**/tests/npm/coverage/**", "**/node_modules/**"]
+  "ignore": [
+    "**/tests/npm/coverage/**",
+    "**/node_modules/**",
+    "**/.pnpm-store/**"
+  ]
 }

.github/workflows/__main-ci.yml

@@ -35,12 +35,21 @@ jobs:
   release:
     needs: ci
     if: github.event_name != 'schedule'
-    uses: hoverkraft-tech/ci-github-publish/.github/workflows/release-actions.yml@b27c38015a8265780329d229c841d057a18b8fae # 0.25.0
+    uses: hoverkraft-tech/ci-github-publish/.github/workflows/release-actions.yml@84d583ba7b357f9476707f54cf5419d630ae0145 # 0.26.2
     permissions:
       contents: read
     with:
       update-all: ${{ (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')) || github.event_name == 'workflow_dispatch' }}
       github-app-client-id: ${{ vars.CI_BOT_APP_CLIENT_ID }}
+      extra-badges: |
+        [
+          {
+            "label":"codecov",
+            "url":"https://codecov.io/gh/hoverkraft-tech/compose-action/graph/badge.svg?token=90JXB7EIMA",
+            "linkUrl":"https://codecov.io/gh/hoverkraft-tech/compose-action"
+          }
+        ]
+
     secrets:
       github-app-key: ${{ secrets.CI_BOT_APP_PRIVATE_KEY }}
 

.github/workflows/__test-action-dependencies-cache.yml

@@ -29,7 +29,7 @@ jobs:
       # jscpd:ignore-start
 
       - name: Arrange - Checkout sources
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Arrange - Setup Node.js runtime
         id: arrange-setup-node

.github/workflows/__test-action-get-package-manager.yml

@@ -43,7 +43,7 @@ jobs:
             run-script-command: yarn
     steps:
       - name: Arrange - Checkout sources
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Act - Run "get-package-manager" action
         id: act-get-package-manager

.github/workflows/__test-action-has-installed-dependencies.yml

@@ -31,7 +31,7 @@ jobs:
             lock-file: yarn.lock
     steps:
       - name: Arrange - Checkout sources
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Arrange - Setup Node.js runtime
         id: arrange-setup-node

.github/workflows/__test-action-package.yml

@@ -29,7 +29,7 @@ jobs:
             artifact-suffix: yarn
     steps:
       - name: Arrange - Checkout sources
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Act - Run "package" action
         id: act-package
@@ -92,7 +92,7 @@ jobs:
             package-tarball-artifact-id: ${{ needs.test.outputs['package-tarball-artifact-id-yarn'] }}
     steps:
       - name: Arrange - Checkout sources
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Arrange - Configure Node.js version
         run: echo "lts/*" > .nvmrc

.github/workflows/__test-action-setup-node.yml

@@ -27,7 +27,7 @@ jobs:
             run-script-command: yarn
     steps:
       - name: Arrange - Checkout sources
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Arrange - Configure Node.js version
         run: echo "lts/*" > .nvmrc

.github/workflows/__test-workflow-continuous-integration.yml

@@ -27,7 +27,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: act-without-container
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           artifact-ids: ${{ needs.act-without-container.outputs.build-artifact-id }}
@@ -62,7 +62,7 @@ jobs:
       issues: read
       packages: write
       pull-requests: read
-    uses: hoverkraft-tech/ci-github-container/.github/workflows/docker-build-images.yml@260358ba1fd405c57bc669823d89c625971a3431 # 0.34.2
+    uses: hoverkraft-tech/ci-github-container/.github/workflows/docker-build-images.yml@77f98ab8773b824eca7ed3f94e3e9c8b8af5875c # 0.36.1
     with:
       sign: false
       images: |
@@ -102,7 +102,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: act-with-container
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           artifact-ids: ${{ needs.act-with-container.outputs.build-artifact-id }}
@@ -149,7 +149,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: act-with-container-advanced
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           artifact-ids: ${{ needs.act-with-container-advanced.outputs.build-artifact-id }}

.github/workflows/__test-workflow-release.yml

@@ -15,7 +15,7 @@ jobs:
       package-tarball-artifact-id: ${{ steps.package.outputs.package-tarball-artifact-id }}
     steps:
       - name: Arrange - Checkout sources
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - id: package
         name: Arrange - Create package tarball

.github/workflows/continuous-integration.yml

@@ -294,10 +294,10 @@ jobs:
     runs-on: *ci-runner
     steps:
       - uses: hoverkraft-tech/ci-github-common/actions/checkout@b553a696531fbd36743ccbb0c76c717971b8acdb # 0.35.4
-      - uses: github/codeql-action/init@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5
+      - uses: github/codeql-action/init@87557b9c84dde89fdd9b10e88954ac2f4248e463 # v4.36.1
         with:
           languages: ${{ inputs.code-ql }}
-      - uses: github/codeql-action/analyze@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5
+      - uses: github/codeql-action/analyze@87557b9c84dde89fdd9b10e88954ac2f4248e463 # v4.36.1
 
   dependency-review:
     name: 🛡️ Dependency Review

actions/package/action.yml

@@ -53,7 +53,7 @@ outputs:
 runs:
   using: "composite"
   steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       with:
         persist-credentials: false
 

actions/setup-node/action.yml

@@ -30,6 +30,7 @@ outputs:
 runs:
   using: "composite"
   steps:
+    # jscpd:ignore-start
     - uses: hoverkraft-tech/ci-github-common/actions/local-actions@b553a696531fbd36743ccbb0c76c717971b8acdb # 0.35.4
       with:
         source-path: ${{ github.action_path }}/..
@@ -39,6 +40,7 @@ runs:
       with:
         working-directory: ${{ inputs.working-directory }}
         enforce-path-in-workspace: "false"
+    # jscpd:ignore-end
 
     - id: get-package-manager
       if: inputs.package-manager == ''