GH Actions: Bump the action-runners group with 2 updates

[dependabot]

Bumps the action-runners group with 2 updates: actions/attest and lumaxis/shellcheck-problem-matchers.

Updates actions/attest from 4.2.1 to 4.2.2

Release notes

Sourced from actions/attest's releases.

v4.2.2

What's Changed

• Bump @​sigstore/oci from 0.7.1 to 0.7.2 by @​bdehamer in actions/attest#469
• Bump brace-expansion by @​dependabot[bot] in actions/attest#468
• Bump ip-address from 10.2.0 to 10.4.0 by @​dependabot[bot] in actions/attest#467

Full Changelog: actions/attest@v4.2.1...v4.2.2

Commits

• 1e69f48 Bump ip-address from 10.2.0 to 10.4.0 (#467)
• 02787ce Bump brace-expansion (#468)
• 98ac037 bump @​sigstore/oci from 0.7.1 to 0.7.2 (#469)
• See full diff in compare view

Updates lumaxis/shellcheck-problem-matchers from 2.1.0 to 2.3.1

Release notes

Sourced from lumaxis/shellcheck-problem-matchers's releases.

v2.3.1

What's Changed

Patch release. No functional change — index.js, action.yml and all matcher behaviour are identical to v2.3.0. No workflow changes are required.

Regenerates package-lock.json against https://registry.npmjs.org/. The v2.3.0 lockfile was generated on a machine configured against a Microsoft package-feed proxy, so 71 of its resolved URLs pointed at ms-feed-*.pkgs.visualstudio.com instead of the public npm registry. Those feeds are publicly readable so installs still worked, but a public project's lockfile shouldn't route contributors' installs through a third-party mirror.

This affects contributors only. The action has no runtime dependencies — action.yml runs index.js directly — so users of the action were never impacted.

The dependency graph is unchanged: same 71 packages, same versions.

Runner requirement (unchanged)

node24 requires Actions runner v2.327.1 or newer.

Full Changelog: lumaxis/shellcheck-problem-matchers@v2.3.0...v2.3.1

v2.3.0

What's Changed

Internal cleanup release. No workflow changes are required — the format input and all matcher behaviour are unchanged.

The action is now dependency-free

@actions/core was the only runtime dependency, and it was used for exactly two calls (getInput and setFailed). Both are now inlined with plain Node, leaving path (a builtin) as the only require.

That let us delete the dist/ bundle entirely — the action runs index.js directly from the repository root. This also fixes a long-standing problem: the bundler (@zeit/ncc) had been broken since Node 17 (ERR_OSSL_EVP_UNSUPPORTED), so dist/ had not been rebuilt since March 2023 and dependency updates never actually reached users.

Security

npm audit goes from 8 vulnerabilities to 0, and all open Dependabot alerts are cleared. Dependency count dropped from 103 packages to 72.

Also in this release

• Migrated to ESLint 10 with flat config
• CI now runs actions/checkout@v7 and actions/setup-node@v7 pinned to Node 24

... (truncated)

Commits

• bf6e086 Regenerate package-lock.json against the public npm registry (#148)
• 76712f8 Migrate to ESLint 9+ flat config and upgrade to ESLint 10 (#147)
• 492adb6 Drop @​actions/core and remove the dist/ bundle (#145)
• e29d580 Modernize CI action versions and fix README badge (#144)
• 0a0e558 Fix typo in test fixture filename (#143)
• 321c8e1 Merge pull request #138 from jrfnl/feature/update-to-node-24
• 1a8d8cc Merge pull request #137 from lumaxis/dependabot/github_actions/actions-0bd136...
• 6952dba Update from Node 16 to Node 24
• b8b24a0 Bump actions/checkout in the actions group across 1 directory
• 54048fb Merge pull request #131 from lumaxis/dependabot/npm_and_yarn/dev-dependencies...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions