chore(deps): update docker.io/library/node docker tag to v26

.gitea/workflows/auto-release.yaml

@@ -13,11 +13,12 @@ env:
 jobs:
   tag_on_change:
     permissions:
+      actions: write
       contents: write
 
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
 
@@ -54,7 +55,7 @@ jobs:
 
       - name: Trigger "Push tagged images" workflow
         if: steps.check_change.outputs.changed == 'true'
-        uses: actions/github-script@v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const workflowFileName = 'release.yaml';

.gitea/workflows/build.yaml

@@ -15,9 +15,11 @@ jobs:
   build-arm64:
     runs-on: ubuntu-latest-arm64
     steps:
-      - uses: actions/checkout@v6.0.2
-      - uses: docker/setup-qemu-action@v4.0.0
-      - uses: docker/setup-buildx-action@v4.0.0
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+        with:
+          image: harbor.cryptic.systems/docker/tonistiigi/binfmt:latest
+      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
 
       - name: Build image
         run: |
@@ -33,9 +35,11 @@ jobs:
   build-amd64:
     runs-on: ubuntu-latest-amd64
     steps:
-      - uses: actions/checkout@v6.0.2
-      - uses: docker/setup-qemu-action@v4.0.0
-      - uses: docker/setup-buildx-action@v4.0.0
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+        with:
+          image: harbor.cryptic.systems/docker/tonistiigi/binfmt:latest
+      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
 
       - name: Build image
         run: |

.gitea/workflows/markdown-linters.yaml

@@ -16,7 +16,7 @@ jobs:
     runs-on:
     - ubuntu-latest
     steps:
-    - uses: actions/checkout@v6.0.2
-    - uses: DavidAnson/markdownlint-cli2-action@v21.0.0
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+    - uses: DavidAnson/markdownlint-cli2-action@ded1f9488f68a970bc66ea5619e13e9b52e601cd # v23.2.0
       with:
         globs: '**/*.md'

.gitea/workflows/release.yaml

@@ -27,15 +27,17 @@ jobs:
           echo "version_raw=${VERSION}" >> $GITHUB_OUTPUT
           echo "version_cleaned=${VERSION/v/}" >> $GITHUB_OUTPUT
 
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-tags: true
           ref: "${{ steps.version_extraction.outputs.version_raw }}"
 
-      - uses: docker/setup-qemu-action@v4.0.0
-      - uses: docker/setup-buildx-action@v4.0.0
+      - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+        with:
+          image: harbor.cryptic.systems/docker/tonistiigi/binfmt:latest
+      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
 
-      - uses: docker/login-action@v4.1.0
+      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           registry: git.cryptic.systems
           username: ${{ github.repository_owner }}
@@ -67,15 +69,17 @@ jobs:
           echo "version_raw=${VERSION}" >> $GITHUB_OUTPUT
           echo "version_cleaned=${VERSION/v/}" >> $GITHUB_OUTPUT
 
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-tags: true
           ref: "${{ steps.version_extraction.outputs.version_raw }}"
 
-      - uses: docker/setup-qemu-action@v4.0.0
-      - uses: docker/setup-buildx-action@v4.0.0
+      - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+        with:
+          image: harbor.cryptic.systems/docker/tonistiigi/binfmt:latest
+      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
 
-      - uses: docker/login-action@v4.1.0
+      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           registry: git.cryptic.systems
           username: ${{ github.repository_owner }}
@@ -110,7 +114,7 @@ jobs:
           echo "version_raw=${VERSION}" >> $GITHUB_OUTPUT
           echo "version_cleaned=${VERSION/v/}" >> $GITHUB_OUTPUT
 
-      - uses: docker/login-action@v4.1.0
+      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           registry: git.cryptic.systems
           username: ${{ github.repository_owner }}

.gitea/workflows/update-docker-hub-description.yaml

@@ -13,8 +13,8 @@ jobs:
     runs-on:
     - ubuntu-latest
     steps:
-    - uses: actions/checkout@v6.0.2
-    - uses: peter-evans/dockerhub-description@v5.0.0
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+    - uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa # v5.0.0
       with:
         username: ${{ secrets.DOCKER_IO_USERNAME }}
         password: ${{ secrets.DOCKER_IO_PASSWORD }}

Dockerfile

@@ -1,4 +1,4 @@
-FROM docker.io/library/node:25.9.0-alpine AS build
+FROM docker.io/library/node:26.3.0-alpine AS build
 
 ARG MARKDOWNLINT_VERSION=master