chore(deps): update workflows (major)

[renovate-bot]

This PR contains the following updates:

Package	Type	Update	Change
golangci/golangci-lint-action	action	major	v5.3.0 -> v6.0.1
slsa-framework/slsa-github-generator	action	major	v1.10.0 -> v2.0.0

---

Release Notes

golangci/golangci-lint-action (golangci/golangci-lint-action)

v6.0.1

Compare Source

v6.0.0

Compare Source

What's Changed

This version removes annotations option (because it was useless), and removes the default output format (github-actions).
The annotations are still produced but with another approach.

Changes

• feat: rewrite format handling by @​ldez in https://github.com/golangci/golangci-lint-action/pull/1038

Dependencies

• build(deps-dev): bump @​typescript-eslint/eslint-plugin from 7.7.1 to 7.8.0 by @​dependabot in https://github.com/golangci/golangci-lint-action/pull/1034
• build(deps): bump @​types/node from 20.12.7 to 20.12.8 by @​dependabot in https://github.com/golangci/golangci-lint-action/pull/1036
• build(deps-dev): bump @​typescript-eslint/parser from 7.7.1 to 7.8.0 by @​dependabot in https://github.com/golangci/golangci-lint-action/pull/1035

Full Changelog: golangci/golangci-lint-action@v5.3.0...v6.0.0

slsa-framework/slsa-github-generator (slsa-framework/slsa-github-generator)

v2.0.0

Compare Source

v2.0.0: Breaking Change: upload-artifact and download-artifact

• Our workflows now use the new @v4s of actions/upload-artifact and actions/download-artifact, which are incompatiblle with the prior @v3. See Our docs on the generic generator for more information and how to upgrade.

v2.0.0: Breaking Change: attestation-name Workflow Input and Output

• attestation-name as a workflow input to .github/workflows/generator_generic_slsa3.yml is now removed. Use provenance-name instead.

v2.0.0: DSSE Rekor Type

• When uploading signed provenance to the log, the entry created in the log is now
  a DSSE Rekor type. This fixes a bug where the current intoto type does not
  persist provenance signatures. The attestation will no longer be persisted
  in Rekor (#​3299)

---

Configuration

📅 Schedule: Branch creation - "before 6am on monday" in timezone Australia/Sydney, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.

[codecov-commenter]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 63.72%. Comparing base (f86f846) to head (efcfabc).

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #897      +/-   ##
==========================================
- Coverage   64.27%   63.72%   -0.56%     
==========================================
  Files         146      146              
  Lines        9294    11958    +2664     
==========================================
+ Hits         5974     7620    +1646     
- Misses       2853     3874    +1021     
+ Partials      467      464       -3     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[G-Rath]

Note that Codecov requires some other changes before it can be landed, and it sounds like slsa-framework/slsa-github-generator might need them too, so these should probably be done in dedicated PRs

[another-rex]

We don't use any of the options in the breaking changes of either workflow.