feat!: upgrade Docker actions and drop buildx_install input

[hisco]

Upgrades pinned GitHub Actions dependencies across workflows and the composite action.

Changes

• Bump actions/checkout v4 -> v7 in all workflow files.
• Replace codfish/semantic-release-action@v4 with cycjimmy/semantic-release-action@v6.0.0 (pinned to commit SHA). Replaced because codfish was disabled by GitHub after a supply-chain compromise so its tags no longer resolve; cycjimmy is the maintained standard replacement.
• Bump docker/build-push-action v6 -> v7.
• Bump docker/metadata-action v5 -> v6.
• Bump docker/setup-qemu-action v3 -> v4.
• Bump docker/setup-buildx-action v3 -> v4 (both steps).

setup-buildx v4 migration: install input removed

docker/setup-buildx-action@v4 removed the install input. To avoid a dangling unknown-input warning and silently dropped behavior, the composite's buildx_install plumbing was fully removed:

• Dropped the install: ${{ inputs.buildx_install || 'false' }} mapping in the setup-buildx step.
• Dropped the buildx_install input declaration from action.yml.
• Removed inputs.buildx_install from both setup-buildx if: guards.
• Removed the buildx_install row/mentions from README.md.
• Removed buildx_install: true from the test workflow.

https://claude.ai/code/session_011T9ASy4VmRoYrnuTsLd9oU

---

Note

Medium Risk
Major version bumps on Docker build/metadata/setup actions and a breaking public input removal can change CI/build behavior for consumers still using buildx_install.

Overview
Upgrades pinned GitHub Actions across workflows and the composite action, and adds weekly Dependabot grouping for github-actions updates.

Workflows move actions/checkout v4 → v7. Release replaces codfish/semantic-release-action with cycjimmy/semantic-release-action v6 (commit-pinned), using extra_plugins for semantic-release-github-actions-tags instead of additional-packages.

The composite bumps docker/setup-qemu-action v3 → v4, docker/setup-buildx-action v3 → v4, docker/metadata-action v5 → v6, and docker/build-push-action v6 → v7.

Breaking: buildx_install is removed end-to-end because setup-buildx-action@v4 dropped the install input—no mapping in action.yml, buildx_install dropped from setup-buildx if guards, README/docs/examples cleaned up, and the test workflow no longer passes buildx_install: true.

^{Reviewed by Cursor Bugbot for commit 9361878. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

🎉 This PR is included in version 2.0.0 🎉

The release is available on:

• GitHub release
• v2.0.0

Your semantic-release bot 📦🚀