chore(deps): update github actions

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
github/issue-labeler	action	minor	v3.4 → v3.5
step-security/harden-runner	action	minor	v2.20.0 → v2.21.1
tombi-toml/setup-tombi	action	minor	v1.2.4 → v1.5.0

---

Release Notes

github/issue-labeler (github/issue-labeler)

v3.5

Compare Source

Compatibility

This release updates the action runtime from Node.js 20 to Node.js 24. Self-hosted runners should use Actions Runner v2.328.0 or later. Node.js 24 is incompatible with macOS 13.4 and earlier and does not support ARM32. See GitHub's Node 20 deprecation notice.

What's Changed

• Fix broken link by @​stephanmiehe in #​93
• Add package-lock.json by @​boomanaiden154 in #​100
• bump nodejs 20 -> 24 by @​BBBmau in #​107

New Contributors

• @​boomanaiden154 made their first contribution in #​100
• @​BBBmau made their first contribution in #​107

Full Changelog: github/issue-labeler@v3.4...v3.5

step-security/harden-runner (step-security/harden-runner)

v2.21.1

Compare Source

v2.21.0

Compare Source

What's Changed

• Support for denied endpoints in block mode. This is included in the enterprise tier. Customers can deny outbound calls, for example, to public package registries.
• Improved Support for AWS CodeBuild GitHub Actions Runners.
• Bug fixes.

Full Changelog: step-security/harden-runner@v2.20.1...v2.21.0

v2.20.1

Compare Source

What's Changed

• AWS CodeBuild-hosted runner support
• Implicitly allow single-labeled (internal) domains in block-mode

Full Changelog: step-security/harden-runner@v2.20.0...v2.20.1

tombi-toml/setup-tombi (tombi-toml/setup-tombi)

v1.5.0

Compare Source

This setup-tombi release matches tombi v1.5.0.

Full Changelog: tombi-toml/setup-tombi@v1.4.1...v1.5.0

v1.4.1

Compare Source

This setup-tombi release matches tombi v1.4.1.

Full Changelog: tombi-toml/setup-tombi@v1.4.0...v1.4.1

v1.4.0

Compare Source

This setup-tombi release matches tombi v1.4.0.

Full Changelog: tombi-toml/setup-tombi@v1.3.5...v1.4.0

v1.3.5

Compare Source

This setup-tombi release matches tombi v1.3.5.

Full Changelog: tombi-toml/setup-tombi@v1.3.4...v1.3.5

v1.3.4

Compare Source

This setup-tombi release matches tombi v1.3.4.

Full Changelog: tombi-toml/setup-tombi@v1.3.3...v1.3.4

v1.3.3

Compare Source

This setup-tombi release matches tombi v1.3.3.

Full Changelog: tombi-toml/setup-tombi@v1.3.2...v1.3.3

v1.3.2

Compare Source

This setup-tombi release matches tombi v1.3.2.

Full Changelog: tombi-toml/setup-tombi@v1.2.10...v1.3.2

v1.3

Compare Source

v1.2.10

Compare Source

This setup-tombi release matches tombi v1.2.10.

Full Changelog: tombi-toml/setup-tombi@v1...v1.2.10

v1.2.9

Compare Source

This setup-tombi release matches tombi v1.2.9.

Full Changelog: tombi-toml/setup-tombi@v1...v1.2.9

v1.2.8

Compare Source

This setup-tombi release matches tombi v1.2.8.

Full Changelog: tombi-toml/setup-tombi@v1...v1.2.8

v1.2.7

Compare Source

This setup-tombi release matches tombi v1.2.7.

What's Changed

• Address Dependabot vulnerabilities by @​ya7010 in #​46

Full Changelog: tombi-toml/setup-tombi@v1...v1.2.7

v1.2.6

Compare Source

This setup-tombi release matches tombi v1.2.6.

Full Changelog: tombi-toml/setup-tombi@v1...v1.2.6

v1.2.5

Compare Source

This setup-tombi release matches tombi v1.2.5.

Full Changelog: tombi-toml/setup-tombi@v1...v1.2.5

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

⚠️ JUnit XML file not found

The CLI was unable to find any JUnit XML files to upload.
For more help, visit our troubleshooting guide.

[gabemontero]

approve for the fullsend piece

[durandom]

Overlap note vs #4489

This PR's fullsend.yaml hunk only retargets the existing shim pin (v0.32.0 → v0.37.0 SHA). That is not a fullsend scaffold upgrade: it keeps the old workflow template and does not add prioritize.yml, the v0.37 shim fields, or the ADR 0064 .fullsend/customized/ cleanup.

Please merge #4489 for the fullsend bump. After that, rebase this Renovate PR — the fullsend.yaml hunk should drop, and the remaining GitHub Action updates (issue-labeler, harden-runner, tombi, etc.) can land on their own.

Do not merge this PR as a substitute for #4489.

[nickboldt]

Kim said "Go for it.  Changelog indicates they are QOL improvements.  Let's see"

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud