From 67213a44dcb8475e9990aa3e6dca9b7735b220f5 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 24 Nov 2025 11:43:26 +0000
Subject: [PATCH 1/3] Bump actions/checkout from 5 to 6

Bumps [actions/checkout](https://github.com/actions/checkout) from 5 to 6.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v5...v6)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/cd.yml            | 2 +-
 .github/workflows/ci.yml            | 2 +-
 .github/workflows/linter.yml        | 2 +-
 .github/workflows/version-check.yml | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index c32bb82..e3964c1 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -35,7 +35,7 @@ jobs:
     steps:
       - name: Checkout
         id: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           fetch-tags: true
           ref: main
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index dd922f9..378c0c4 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -29,7 +29,7 @@ jobs:
     steps:
       - name: Checkout
         id: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
 
       - name: Setup Docker BuildX
         id: setup-buildx
diff --git a/.github/workflows/linter.yml b/.github/workflows/linter.yml
index f7db77c..6d334e0 100644
--- a/.github/workflows/linter.yml
+++ b/.github/workflows/linter.yml
@@ -26,7 +26,7 @@ jobs:
     steps:
       - name: Checkout
         id: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/version-check.yml b/.github/workflows/version-check.yml
index 2267b3b..c9313a3 100644
--- a/.github/workflows/version-check.yml
+++ b/.github/workflows/version-check.yml
@@ -27,7 +27,7 @@ jobs:
     steps:
       - name: Checkout
         id: checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           fetch-tags: true
 

From c6338c4a08c3457d1190b588deaa4d5b72be73a7 Mon Sep 17 00:00:00 2001
From: Nick Alteen <ncalteen@github.com>
Date: Fri, 5 Dec 2025 11:28:46 -0500
Subject: [PATCH 2/3] Disable unused linters

---
 .github/workflows/linter.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/linter.yml b/.github/workflows/linter.yml
index 6d334e0..26fd4f7 100644
--- a/.github/workflows/linter.yml
+++ b/.github/workflows/linter.yml
@@ -38,4 +38,6 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           LINTER_RULES_PATH: ${{ github.workspace }}
           VALIDATE_ALL_CODEBASE: false
+          VALIDATE_BIOME_FORMAT: false
+          VALIDATE_BIOME_LINT: false
           VALIDATE_GITHUB_ACTIONS_ZIZMOR: false

From 278f37da105a96b3c2649cc3791836aaaa1b259a Mon Sep 17 00:00:00 2001
From: Nick Alteen <ncalteen@github.com>
Date: Fri, 5 Dec 2025 11:29:04 -0500
Subject: [PATCH 3/3] Add non-root user

---
 Dockerfile | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/Dockerfile b/Dockerfile
index e81584f..23c4ae4 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -7,5 +7,12 @@ WORKDIR /usr/src
 # Copy any source file(s) required for the action.
 COPY entrypoint.sh .
 
+# Create a non-root user and switch to it.
+RUN addgroup -S actiongroup && adduser -S actionuser -G actiongroup && \
+    chown -R actionuser:actiongroup /usr/src && \
+    chmod +x /usr/src/entrypoint.sh
+
+USER actionuser
+
 # Configure the container to be run as an executable.
 ENTRYPOINT ["/usr/src/entrypoint.sh"]