From edc8258562db6e28bdd4b12123064402bcb0a220 Mon Sep 17 00:00:00 2001
From: Xavier Guimard <yadd@debian.org>
Date: Wed, 1 Jul 2026 18:49:30 +0200
Subject: [PATCH] ci: update docker actions and trivy to current majors

- docker/setup-qemu-action:  v2 -> v4
- docker/setup-buildx-action: v2 -> v4
- docker/login-action:        v2 -> v4
- docker/metadata-action:     v4 -> v6
- docker/build-push-action:   v4 -> v7
- aquasecurity/trivy-action:  -> v0.36.0
---
 .github/actions/docker-common/action.yml | 12 ++++++------
 .github/workflows/trivy.yml              |  2 +-
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/actions/docker-common/action.yml b/.github/actions/docker-common/action.yml
index 546ca8b..b2039d8 100644
--- a/.github/actions/docker-common/action.yml
+++ b/.github/actions/docker-common/action.yml
@@ -38,11 +38,11 @@ runs:
         shell: bash
         run: echo "date=$(date +%Y-%m-%d)" >> $GITHUB_OUTPUT
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@v4
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v4
       - name: Login to Docker Hub
-        uses: docker/login-action@v2
+        uses: docker/login-action@v4
         with:
           username: ${{ inputs.DOCKER_USERNAME }}
           password: ${{ inputs.DOCKER_PASSWORD }}
@@ -68,7 +68,7 @@ runs:
           fi
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@v6
         with:
           images: ${{ inputs.DOCKER_IMAGE }}
       - name: Generate tags
@@ -112,7 +112,7 @@ runs:
             echo "tag=${{ steps.date.outputs.date }}${{ inputs.IMAGE_SUFFIX }}-lts" >> $GITHUB_OUTPUT
           fi
       - name: Build and push Docker image
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@v7
         with:
           context: ${{ inputs.DIRNAME }}
           build-args: |
@@ -133,7 +133,7 @@ runs:
           fi
       - name: Build and publish non-root image
         if: inputs.NON_ROOT == 'yes'
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@v7
         with:
           context: no-root
           build-args: |
diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml
index e793658..2481c38 100644
--- a/.github/workflows/trivy.yml
+++ b/.github/workflows/trivy.yml
@@ -36,7 +36,7 @@ jobs:
         run: |
           docker build -t docker.io/my-organization/my-app:${{ github.sha }} --build-arg=BASE=yadd/lemonldap-ng-base:latest-no-s6 ./portal
       - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@0.28.0
+        uses: aquasecurity/trivy-action@v0.36.0
         with:
           image-ref: 'docker.io/my-organization/my-app:${{ github.sha }}'
           format: 'template'