ci: bump deprecated GitHub Actions (checkout v7, codeql v3, setup-helm v5)

[guimard]

Bumps deprecated actions flagged by GitHub Actions run annotations.

Action	Before	After
actions/checkout	v4	v7
github/codeql-action/upload-sarif	v2 / v3	v3
azure/setup-helm	v4	v5

actions/upload-artifact@v4 isn't referenced directly — it's pulled in by
github/codeql-action; moving to the current v3 (the v2 usage was itself
deprecated) picks up a current bundled upload-artifact, clearing that warning.

Versions checked against each action's latest release on 2026-07-01. No behavioural
change (plain checkout, same helm version input).

Summary by CodeRabbit

• Chores
  • Updated several GitHub Actions workflows to newer action versions for checkout, Helm setup, and SARIF upload.
  • Improved build, publish, security scan, and pull request pipeline reliability with updated workflow dependencies.

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR upgrades GitHub Actions dependency versions across four CI workflow files: docker-publish.yml, hadolint.yml, pr.yml, and trivy.yml. Changes include bumping actions/checkout from v4 to v7 throughout, azure/setup-helm from v4 to v5, and github/codeql-action/upload-sarif from v2 to v3.

Changes

CI Action Version Upgrades

Layer / File(s)	Summary
docker-publish.yml checkout and helm action bumps .github/workflows/docker-publish.yml	All jobs (test, build-and-push-* including -no-s6 variants, and publish-helm) upgrade actions/checkout from v4 to v7; publish-helm additionally upgrades azure/setup-helm from v4 to v5.
hadolint.yml, pr.yml, trivy.yml action bumps .github/workflows/hadolint.yml, .github/workflows/pr.yml, .github/workflows/trivy.yml	hadolint.yml upgrades actions/checkout to v7 and github/codeql-action/upload-sarif from v2 to v3; pr.yml and trivy.yml upgrade actions/checkout to v7.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Estimated code review effort: 1 (Trivial) | ~5 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the CI workflow dependency bumps reflected in the PR.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/bump-actions

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

.github/workflows/docker-publish.yml (1)

19-20: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Consider adding persist-credentials: false to checkout steps.

Static analysis flags every checkout step in this file for the artipacked pattern — credentials persisted in .git/config can leak via subsequent steps or artifacts. This predates the version bump but is cheap to fix now that these lines are being touched anyway. Applies identically in hadolint.yml, pr.yml, and trivy.yml.

🛡️ Example fix (repeat for each checkout step)

       - name: Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false

Also applies to: 30-31, 46-47, 61-62, 76-77, 92-93, 107-108, 122-123, 137-138, 152-153, 167-168, 182-183, 197-198, 213-214, 229-230, 247-248, 264-265, 281-282, 298-299, 315-316, 332-333, 368-370

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/docker-publish.yml around lines 19 - 20, Add
persist-credentials: false to every actions/checkout invocation in the affected
workflow files to prevent git credentials from being written to .git/config.
Update each Checkout code step in docker-publish.yml, and apply the same change
to the checkout steps in hadolint.yml, pr.yml, and trivy.yml by editing the
existing actions/checkout entries.

Source: Linters/SAST tools

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/workflows/docker-publish.yml:
- Around line 19-20: Add persist-credentials: false to every actions/checkout
invocation in the affected workflow files to prevent git credentials from being
written to .git/config. Update each Checkout code step in docker-publish.yml,
and apply the same change to the checkout steps in hadolint.yml, pr.yml, and
trivy.yml by editing the existing actions/checkout entries.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 82daec4f-bcce-417b-8d5e-870417348c3a

📥 Commits

Reviewing files that changed from the base of the PR and between 255234a and b4e2fd4.

📒 Files selected for processing (4)

• .github/workflows/docker-publish.yml
• .github/workflows/hadolint.yml
• .github/workflows/pr.yml
• .github/workflows/trivy.yml