chore(deps): update github-actions (major)

.github/workflows/build-docs.yaml

@@ -12,7 +12,7 @@ permissions: read-all
 
 jobs:
   deploy:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     permissions:
       contents: write
       pages: write

.github/workflows/build.yaml

@@ -27,7 +27,7 @@ jobs:
     permissions:
       contents: read
       packages: write
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     outputs:
       image: ${{ env.IMAGE_NAME }}
       digest: ${{ steps.build.outputs.digest }}
@@ -57,7 +57,7 @@ jobs:
 
       - name: Build image
         id: build
-        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5.4.0
+        uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75 # v6.9.0
         with:
           cache-from: type=registry,ref=${{ env.IMAGE_NAME }}:buildcache
           cache-to: type=inline
@@ -70,7 +70,7 @@ jobs:
             MODULE_NAME=${{ inputs.module-name }}
 
       - name: Run unit tests
-        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5.4.0
+        uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75 # v6.9.0
         with:
           cache-from: type=gha
           cache-to: type=gha,mode=max
@@ -80,6 +80,11 @@ jobs:
           build-args: |
             MODULE_NAME=${{ inputs.module-name }}
 
+      - name: Trivy Cache
+        uses: yogeshlonkar/trivy-cache-action@5e3c2d406dd3a13d95a3eabc520e0ac19ab729b5 # v0.1.8
+        with:
+          gh-token: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Run Trivy vulnerability scanner
         uses: aquasecurity/trivy-action@6e7b7d1fd3e4fef0c5fa8cce1229c54b2c9bd0d8 # 0.24.0
         with:
@@ -140,7 +145,7 @@ jobs:
 
   sign:
     name: sign image
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     if: ${{ github.event_name != 'pull_request' }}
     needs:
       - build

.github/workflows/chaos-test.yaml

@@ -8,7 +8,7 @@ permissions: read-all
 jobs:
   run-chaos-tests:
     name: run chaos tests
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout
         uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
@@ -17,7 +17,7 @@ jobs:
         uses: docker/setup-buildx-action@4fd812986e6c8c2a69e18311145f9371337f27d4 # v3.4.0
 
       - name: Build image
-        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5.4.0
+        uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75 # v6.9.0
         with:
           push: false
           load: true

.github/workflows/check-links.yaml

@@ -10,15 +10,15 @@ permissions: read-all
 
 jobs:
   check-links:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     permissions:
       issues: write
     steps:
       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
 
       - name: Link Checker
         id: lychee
-        uses: lycheeverse/lychee-action@2b973e86fc7b1f6b36a93795fe2c9c6ae1118621 # v1.10.0
+        uses: lycheeverse/lychee-action@7cd0af4c74a61395d455af97419279d86aafaede # v2.0.2
         with:
           args: "--config=.lychee.toml ."
         env:

.github/workflows/ci.yaml

@@ -37,7 +37,7 @@ jobs:
       context: ${{ matrix.context }}
 
   test:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     needs:
       - build
     strategy:

.github/workflows/codeql.yaml

@@ -25,7 +25,7 @@ on:
 jobs:
   analyze:
     name: Analyze
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     permissions:
       actions: read
       contents: read

.github/workflows/helm-lint.yaml

@@ -9,7 +9,7 @@ permissions: read-all
 
 jobs:
   lint:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     container: ghcr.io/chgl/kube-powertools:v2.3.12@sha256:026468ae2827c50261b1245b0a2a6204f7e2793e086202aad433e6baa720204a
     steps:
       - name: Add workspace as safe directory

.github/workflows/lint-pr-title.yaml

@@ -12,7 +12,7 @@ permissions: read-all
 jobs:
   lint:
     name: Validate PR title
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     steps:
       - uses: amannn/action-semantic-pull-request@0723387faaf9b38adef4775cd42cfd5155ed6017 # v5.5.3
         env:

.github/workflows/mega-linter.yml

@@ -23,7 +23,7 @@ concurrency:
 jobs:
   build:
     name: MegaLinter
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     permissions:
       contents: read
       pull-requests: write
@@ -40,7 +40,7 @@ jobs:
         id: ml
         # You can override MegaLinter flavor used to have faster performances
         # More info at https://oxsecurity.github.io/megalinter/flavors/
-        uses: oxsecurity/megalinter@bacb5f8674e3730b904ca4d20c8bd477bc51b1a7 # v7.13.0
+        uses: oxsecurity/megalinter@b38cdf1f0cbe056fad4112cb7cd99c2b574c9617 # v8.1.0
         env:
           # All available variables are described in documentation
           # https://oxsecurity.github.io/megalinter/configuration/

.github/workflows/release-please.yaml

@@ -9,37 +9,11 @@ permissions: read-all
 
 jobs:
   release-please:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     permissions:
       contents: write
       pull-requests: write
     steps:
-      - uses: google-github-actions/release-please-action@db8f2c60ee802b3748b512940dde88eabd7b7e01 # v3.7.13
+      - uses: googleapis/release-please-action@7987652d64b4581673a76e33ad5e98e3dd56832f # v4.1.3
         with:
           token: ${{ secrets.MIRACUM_BOT_SEMANTIC_RELEASE_TOKEN }}
-          release-type: simple
-          pull-request-title-pattern: "chore: release ${version}"
-          extra-files: |
-            charts/recruit/Chart.yaml
-            charts/recruit/values.yaml
-            src/list/Dockerfile
-            src/buildSrc/src/main/groovy/org.miracum.recruit.java-common-conventions.gradle
-            src/notify/src/main/resources/application.yml
-            src/query/src/main/resources/application.yml
-            docker-compose/docker-compose.yaml
-            docs/configuration/security.md
-            docs/_snippets/k8s/query-argo-workflow.yaml
-          changelog-types: |
-            [
-              { "type": "feat", "section": "Features" },
-              { "type": "fix", "section": "Bug Fixes" },
-              { "type": "perf", "section": "Performance Improvements" },
-              { "type": "docs", "section": "Documentation", "hidden": false },
-              {
-                "type": "chore",
-                "section": "Miscellaneous Chores",
-                "hidden": false
-              },
-              { "type": "build", "section": "Build", "hidden": false },
-              { "type": "ci", "section": "CI/CD", "hidden": false }
-            ]

.github/workflows/release.yaml

@@ -12,7 +12,7 @@ permissions: {}
 jobs:
   publish-helm-chart:
     name: publish helm chart
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     permissions:
       contents: read
       packages: write
@@ -62,7 +62,7 @@ jobs:
 
   sync-helm-chart-to-central-chart-repo:
     name: sync helm chart to central chart repo
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     permissions:
       contents: read
     steps:
@@ -89,7 +89,7 @@ jobs:
           CHART_VERSION=$(yq .version recruit/charts/recruit/Chart.yaml)
           echo "version=${CHART_VERSION}" >> "$GITHUB_OUTPUT"
 
-      - uses: peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c # v6.1.0
+      - uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f # v7.0.5
         with:
           token: ${{ secrets.token }}
           path: miracum-charts
@@ -100,7 +100,7 @@ jobs:
   # experimental
   publish-kyverno-policies:
     name: publish kyverno policies
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     container: ghcr.io/chgl/kube-powertools:v2.3.12@sha256:026468ae2827c50261b1245b0a2a6204f7e2793e086202aad433e6baa720204a
     continue-on-error: true
     steps:
@@ -117,7 +117,7 @@ jobs:
 
   prepare-artifacts:
     name: prepare artifacts
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     needs:
       - publish-helm-chart
     outputs:

.github/workflows/reset-chart-changelog-annotations.yaml

@@ -15,7 +15,7 @@ permissions: read-all
 jobs:
   reset-commit-and-push:
     name: reset changelog annotations, commit, and push
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     container: ghcr.io/chgl/kube-powertools:v2.3.12@sha256:026468ae2827c50261b1245b0a2a6204f7e2793e086202aad433e6baa720204a
     permissions:
       contents: write

.github/workflows/test-compose-installation.yaml

@@ -11,7 +11,7 @@ permissions: read-all
 
 jobs:
   test:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     env:
       RECRUIT_IMAGE_BASE_NAME: ghcr.io/${{ github.repository }}
       RECRUIT_IMAGE_TAG: ${{ inputs.image-tag }}

.github/workflows/test-k8s-installation.yaml

@@ -12,15 +12,15 @@ on:
 
 jobs:
   test:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@4fd812986e6c8c2a69e18311145f9371337f27d4 # v3.4.0
 
       - name: Build tester image
-        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5.4.0
+        uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75 # v6.9.0
         with:
           push: false
           load: true

.github/workflows/validate-fhir-resources.yaml

@@ -11,7 +11,7 @@ permissions: read-all
 jobs:
   validate-fhir-resource:
     name: Validate FHIR resources
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     container: ghcr.io/miracum/ig-build-tools:v2.1.3@sha256:bf7bea1460447c06f8dbef5ccca1bab2fe9b31b0ccabba6b342859022f5cbd97
     steps:
       - name: Checkout code

.github/workflows/validate-gradle-wrapper.yaml

@@ -12,7 +12,7 @@ permissions: read-all
 jobs:
   validation:
     name: "Validation"
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
-      - uses: gradle/actions/wrapper-validation@d9c87d481d55275bb5441eef3fe0e46805f9ef70 # v3.5.0
+      - uses: gradle/actions/wrapper-validation@d156388eb19639ec20ade50009f3d199ce1e2808 # v4.1.0

.github/workflows/yamllint.yaml

@@ -16,7 +16,7 @@ permissions: read-all
 
 jobs:
   yamllint:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     # contains yamllint
     container: ghcr.io/chgl/kube-powertools:v2.3.12@sha256:026468ae2827c50261b1245b0a2a6204f7e2793e086202aad433e6baa720204a
     steps:

release-please-config.json

@@ -1,17 +1,13 @@
 {
   "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
-  "release-type": "simple",
-  "include-component-in-tag": false,
+  "bump-minor-pre-major": true,
+  "bump-patch-for-minor-pre-major": true,
+  "include-v-in-tag": true,
+  "separate-pull-requests": true,
   "extra-label": "release-please",
+  "release-type": "simple",
   "packages": {
     ".": {
-      "component": "recruit",
-      "changelog-path": "CHANGELOG.md",
-      "release-type": "simple",
-      "bump-minor-pre-major": false,
-      "bump-patch-for-minor-pre-major": false,
-      "draft": false,
-      "prerelease": false,
       "extra-files": [
         "charts/recruit/Chart.yaml",
         "charts/recruit/values.yaml",