chore(deps): update github actions to v4.4.1, v4.2.3, v0.3.1, v1.7.0, v0.12.0, v0.7.0, v1.2.1

.github/workflows/analysis.yml

@@ -142,6 +142,6 @@ jobs:
     if: always() && (! github.event.pull_request.draft)
     runs-on: ubuntu-slim
     steps:
-      - uses: bcgov/actions/workflow-results@79aefe3a7abb2d0d00b1b3ea4cfbf12727a10638 # v0.9.0
+      - uses: bcgov/actions/workflow-results@122a9b1c6c082b1b1f18c300020fbdc417b6b0b2 # v0.10.0
         with:
           needs: ${{ toJson(needs) }}

.github/workflows/merge.yml

@@ -27,7 +27,7 @@ jobs:
       # Find the PR number associated with this squash-merged commit on main,
       # so we can deploy the same image tag that the PR was running.
       - id: pr
-        uses: bcgov/action-get-pr@3931962bf13b3f4702d0013ec7c836f752ff1a3b # v0.3.0
+        uses: bcgov/action-get-pr@28b0adf8e4d40720d41f9c87356ce24b0a4bd6af # v0.3.1
 
   deploy-test:
     name: TEST Deploys (${{ needs.init.outputs.pr }})

.github/workflows/pr-close.yml

@@ -14,7 +14,7 @@ permissions: {}
 jobs:
   cleanup:
     name: Cleanup and Image Promotion
-    uses: bcgov/quickstart-openshift-helpers/.github/workflows/.pr-close.yml@ca6579bdadf383a2513397081f963889b92823a4 # v1.1.0
+    uses: bcgov/quickstart-openshift-helpers/.github/workflows/.pr-close.yml@a11ad3d1b9288fb40757c4314a62eb86ff227931 # v1.2.1
     permissions:
       packages: write
     secrets:
@@ -52,7 +52,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Delete per-PR NetworkPolicies
-        uses: bcgov/action-oc-runner@09b5eeae15bdbc7f7a21b406ee2c66a1d5819f8c # v1.6.1
+        uses: bcgov/action-oc-runner@111868d1fc50db0a40417ba321d865ef5c931bbd # v1.7.0
         with:
           oc_namespace: ${{ secrets.oc_namespace }}
           oc_token: ${{ secrets.oc_token }}

.github/workflows/pr-open.yml

@@ -50,7 +50,7 @@ jobs:
         package: [backend, frontend]
     timeout-minutes: 10
     steps:
-      - uses: bcgov/action-builder-ghcr@de3d575cf158e16f5dc2789630f6d587483b911c # v4.4.0
+      - uses: bcgov/action-builder-ghcr@cb2629351c87dd1c2130073e4ebb7233a9653a63 # v4.4.1
         with:
           package: ${{ matrix.package }}
           tags: ${{ github.event.number }}
@@ -111,6 +111,6 @@ jobs:
     if: always()
     runs-on: ubuntu-slim
     steps:
-      - uses: bcgov/actions/workflow-results@79aefe3a7abb2d0d00b1b3ea4cfbf12727a10638 # v0.9.0
+      - uses: bcgov/actions/workflow-results@122a9b1c6c082b1b1f18c300020fbdc417b6b0b2 # v0.10.0
         with:
           needs: ${{ toJson(needs) }}

.github/workflows/pr-validate.yml

@@ -16,7 +16,7 @@ jobs:
     if: (! github.event.pull_request.draft)
     permissions:
       pull-requests: write
-    uses: bcgov/quickstart-openshift-helpers/.github/workflows/.pr-validate.yml@ca6579bdadf383a2513397081f963889b92823a4 # v1.1.0
+    uses: bcgov/quickstart-openshift-helpers/.github/workflows/.pr-validate.yml@a11ad3d1b9288fb40757c4314a62eb86ff227931 # v1.2.1
     with:
       markdown_links: |
         - [Frontend](https://nr-fsp-${{ github.event.number }}.apps.silver.devops.gov.bc.ca)
@@ -28,6 +28,6 @@ jobs:
     needs: [validate]
     runs-on: ubuntu-slim
     steps:
-      - uses: bcgov/actions/workflow-results@79aefe3a7abb2d0d00b1b3ea4cfbf12727a10638 # v0.9.0
+      - uses: bcgov/actions/workflow-results@122a9b1c6c082b1b1f18c300020fbdc417b6b0b2 # v0.10.0
         with:
           needs: ${{ toJson(needs) }}

.github/workflows/release.yml

@@ -29,7 +29,7 @@ jobs:
 
       - name: Resolve image digest
         id: resolve
-        uses: bcgov/actions/image-tracker@4026bfd276b8a5839029106099b13edfb594b2c3 # v0.8.0
+        uses: bcgov/actions/image-tracker@122a9b1c6c082b1b1f18c300020fbdc417b6b0b2 # v0.10.0
         with:
           package: ${{ matrix.package }}
           revision: ${{ github.sha }}
@@ -88,7 +88,7 @@ jobs:
       # v0.5.0 is the first release carrying sysdig-monitor, and it
       # keeps the __APP__ template substitution that monitoring/alerts/*.json
       # depend on — don't downgrade this pin.
-      - uses: bcgov/actions-openshift/sysdig-monitor@4dbe4f6d25d14cbdb01e525a302e61e31f96c3ed # v0.5.0
+      - uses: bcgov/actions-openshift/sysdig-monitor@46f2614322f7ba1a5ad88a7e4e1b98569c80dcf7 # v0.6.0
         with:
           sysdig_api_token: ${{ secrets.SYSDIG_API_TOKEN }}
           oc_namespace: ${{ secrets.oc_namespace }}

.github/workflows/reusable-deploy.yml

@@ -172,7 +172,7 @@ jobs:
           KC_SA_CLIENT_SECRET: ${{ secrets.keycloak_sa_client_secret }}
         run: ./.github/scripts/ensure-keycloak-service-account.sh
 
-      - uses: bcgov/action-deployer-openshift@bb9d143f4f03187239580c17c4b77da04cdb6e66 # v4.2.2
+      - uses: bcgov/action-deployer-openshift@e2d60eb9cacceb89c3b97d8dcf0a2c460eea5eab # v4.2.3
         id: deploy
         # The user-lookup client secret is a step OUTPUT (from keycloak_sa), so
         # it can't sit in the job-level env; set it here and reference
@@ -249,7 +249,7 @@ jobs:
     env:
       VANITY_HOST: ${{ vars.VANITY_HOST }}
     steps:
-      - uses: bcgov/action-deployer-openshift@bb9d143f4f03187239580c17c4b77da04cdb6e66 # v4.2.2
+      - uses: bcgov/action-deployer-openshift@e2d60eb9cacceb89c3b97d8dcf0a2c460eea5eab # v4.2.3
         id: deploy
         with:
           file: frontend/openshift.deploy.yml
@@ -287,7 +287,7 @@ jobs:
       # can't skip an object per environment.
       - name: Default Route (non-PROD)
         if: ${{ inputs.target != 'prod' }}
-        uses: bcgov/action-deployer-openshift@bb9d143f4f03187239580c17c4b77da04cdb6e66 # v4.2.2
+        uses: bcgov/action-deployer-openshift@e2d60eb9cacceb89c3b97d8dcf0a2c460eea5eab # v4.2.3
         with:
           file: frontend/openshift.route.yml
           oc_namespace: ${{ secrets.oc_namespace }}
@@ -310,7 +310,7 @@ jobs:
       # DATABASE_PASSWORD in the backend job.
       - name: Vanity Route (PROD)
         if: ${{ inputs.target == 'prod' && env.VANITY_HOST != '' }}
-        uses: bcgov/action-deployer-openshift@bb9d143f4f03187239580c17c4b77da04cdb6e66 # v4.2.2
+        uses: bcgov/action-deployer-openshift@e2d60eb9cacceb89c3b97d8dcf0a2c460eea5eab # v4.2.3
         env:
           VANITY_TLS_CERTIFICATE: ${{ secrets.vanity_tls_certificate }}
           VANITY_TLS_KEY: ${{ secrets.vanity_tls_key }}

.github/workflows/scheduled.yml

@@ -43,7 +43,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Clean up PR Deployments
-        uses: bcgov/action-oc-runner@09b5eeae15bdbc7f7a21b406ee2c66a1d5819f8c # v1.6.1
+        uses: bcgov/action-oc-runner@111868d1fc50db0a40417ba321d865ef5c931bbd # v1.7.0
         with:
           oc_namespace: ${{ secrets.oc_namespace }}
           oc_token: ${{ secrets.oc_token }}
@@ -94,7 +94,7 @@ jobs:
     permissions:
       contents: write
       pages: write
-    uses: bcgov/quickstart-openshift-helpers/.github/workflows/.schema-spy.yml@ca6579bdadf383a2513397081f963889b92823a4 # v1.1.0
+    uses: bcgov/quickstart-openshift-helpers/.github/workflows/.schema-spy.yml@a11ad3d1b9288fb40757c4314a62eb86ff227931 # v1.2.1
 
   # Run sequentially to reduce chances of rate limiting
   zap: