chore(deps): bump the ci group across 1 directory with 4 updates

[dependabot]

Bumps the ci group with 4 updates in the / directory: slackapi/slack-github-action, release-drafter/release-drafter, anchore/sbom-action and sigstore/cosign-installer.

Updates slackapi/slack-github-action from 2.1.1 to 3.0.1

Release notes

Sourced from slackapi/slack-github-action's releases.

Slack GitHub Action v3.0.1

What's Changed

Alongside the breaking changes of @v3.0.0 and a new technique to run Slack CLI commands, we tried the wrong name to publish to the GitHub Marketplace 🐙 This action is now noted as The Slack GitHub Action in listings 🎶 ✨

🎨 Maintenance

• chore: use a unique title for marketplace in slackapi/slack-github-action#576 - Thanks @​zimeg!
• chore(release): tag version 3.0.1 in slackapi/slack-github-action#577 - Thanks @​zimeg!

Full Changelog: slackapi/slack-github-action@v3.0.0...v3.0.1

Slack GitHub Action v3.0.0

The @v3.0.0 release had a hiccup on publish and we recommend using @​v3.0.1 or a more recent version when updating! Oops!

🎽 Running Slack CLI commands and the active Node runtime, both included in this release 👟 ✨

⚠️ Breaking change: Node.js 24 the runtime

This major version updates the GitHub Actions required runtime to Node.js 24. Most GitHub-hosted runners already include this, but self-hosted runners may need to be updated ahead of planned deprecations of Node 20 on GitHub Actions runners.

📺 Enhancement: Run Slack CLI commands

This release introduces a new technique for running Slack CLI commands directly in GitHub Actions workflows. Use this to install the latest version (or a specific one) of the CLI and execute commands like deploy for merges to main, manifest validate with tests, and other commands.

Gather a token using the following CLI command to store with repo secrets, then get started with an example below:

$ slack auth token

🧪 Validate an app manifest on pull requests

Check that your app manifest is valid before merging changes:

🔗 https://docs.slack.dev/tools/slack-github-action/sending-techniques/running-slack-cli-commands/validate-a-manifest

- name: Validate the manifest
  uses: slackapi/slack-github-action/cli@v3.0.0
  with:
    command: "manifest validate --app ${{ vars.SLACK_APP_ID }}"
    token: ${{ secrets.SLACK_SERVICE_TOKEN }}

🚀 Deploy your app on push to main

Automate deployments whenever changes land on your main branch:

🔗 https://docs.slack.dev/tools/slack-github-action/sending-techniques/running-slack-cli-commands/deploy-an-app

... (truncated)

Commits

• af78098 Release
• add1a00 chore(release): tag version 3.0.1 (#577)
• 2bc9e7a chore: use a unique title for marketplace (#576)
• c5d43da chore(release): tag version 3.0.0 (#575)
• 963b979 build(deps): bump @​slack/web-api from 7.14.1 to 7.15.0 (#574)
• 90b7328 build(deps): bump @​slack/logger from 4.0.0 to 4.0.1 (#573)
• e45cb89 feat: support slack cli commands with composite action inputs (#560)
• 0aed2c2 build(deps): bump https-proxy-agent from 7.0.6 to 8.0.0 (#572)
• 4795f96 build(deps-dev): bump sinon from 21.0.1 to 21.0.2 (#571)
• bd9e2ce build(deps): bump actions/setup-node from 6.2.0 to 6.3.0 (#569)
• Additional commits viewable in compare view

Updates release-drafter/release-drafter from 6.4.0 to 7.0.0

Release notes

Sourced from release-drafter/release-drafter's releases.

v7.0.0

What's Changed

Breaking

• feat: new major version (#1475) @​cchanche

Bug Fixes

• fix: JSON schema too strict with required fields (#1535) @​jetersen

Maintenance

• chore(deps): update vitest to 4.1.0 (#1544) @renovate[bot]
• chore(deps): update linters (#1549) @renovate[bot]
• chore(deps): update dependency nock to 14.0.11 (#1548) @renovate[bot]
• chore(deps): update dependency @​graphql-codegen/near-operation-file-preset to 5.0.0 (#1545) @renovate[bot]
• chore(deps): update dependency @​types/node to 24.12.0 (#1543) @renovate[bot]
• chore(deps): update dependency @​graphql-codegen/cli to 6.2.1 (#1542) @renovate[bot]
• chore(deps): update vite (#1541) @renovate[bot]
• chore(deps): update linters (#1540) @renovate[bot]
• build(deps): bump actions/stale from 9 to 10 (#1527) @dependabot[bot]

Documentation

• docs: fix v7 docs (#1532) @​cchanche

Other changes

• chore: migrate from ESLint + Prettier to Biome (#1552) @​jetersen
• ci: fix licensed (#1533) @​cchanche

Dependency Updates

• fix(deps): update dependency compare-versions to 6.1.1 (#1547) @renovate[bot]
• fix(deps): update dependency zod to 4.3.6 (#1551) @renovate[bot]
• fix(deps): update dependency semver to 7.7.4 (#1550) @renovate[bot]

Full Changelog: release-drafter/release-drafter@v6.4.0...v7.0.0

Commits

• 3a7fb5c chore: release v7.0.0
• 1bba8e8 docs: broken link in contributing guide
• 90c8b30 docs(copilot): update instructions for Biome
• ea57e4c ci: replace shell scripts with cross-platform TypeScript and simplify workflows
• 5ed1f8c chore: update editor and devcontainer config for Biome
• 68e853e chore: reformat codebase with Biome and fix code smells
• 720e969 chore: migrate from ESLint + Prettier to Biome
• ee6226d fix(deps): update dependency compare-versions to 6.1.1 (#1547)
• 9a48bb9 chore(deps): update vitest to 4.1.0 (#1544)
• f62bd72 chore(build): rebuild artifacts
• Additional commits viewable in compare view

Updates anchore/sbom-action from 0.23.0 to 0.23.1

Release notes

Sourced from anchore/sbom-action's releases.

v0.23.1

⬆️ Dependencies

• chore(deps): update Syft to v1.42.2 (#607) [@anchore-actions-token-generator[bot]]
• chore(deps): bump fast-xml-parser and all other deps (#604) [@dependabot[bot]]

Commits

• 57aae52 chore(deps): update Syft to v1.42.2 (#607)
• c29e913 chore(deps): bump fast-xml-parser and other deps (#604)
• See full diff in compare view

Updates sigstore/cosign-installer from 4.0.0 to 4.1.0

Release notes

Sourced from sigstore/cosign-installer's releases.

v4.1.0

What's Changed

We recommend updating as soon as possible as this includes bug fixes for Cosign. We also recommend removing with: cosign-release and strongly discourage using cosign-release unless you have a specific reason to use an older version of Cosign.

• Bump cosign to 3.0.5 in sigstore/cosign-installer#220
• fix: add retry to curl downloads for transient network failures in sigstore/cosign-installer#210

Full Changelog: sigstore/cosign-installer@v4.0.0...v4.1.0

Commits

• ba7bc0a fix: add retry to curl downloads for transient network failures (#210)
• 5a292e1 Bump cosign to 3.0.5 (#220)
• 351ea76 Bump actions/checkout from 6.0.1 to 6.0.2 (#217)
• c17565f test with go 1.26 too (#221)
• a6fdd19 Bump actions/setup-go from 6.1.0 to 6.3.0 (#218)
• 430b6a7 docs: fix registry from gcr.io to ghcr.io (#213)
• 4d14d7f feat: update to v3.0.3 (#212)
• f148005 fix: use env vars for template expansions; show curl errors (#207)
• c3f2d79 Bump actions/checkout from 6.0.0 to 6.0.1 (#208)
• b9a9af4 drop tests with go1.24 as it cant build (#211)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions