Update oras-project/setup-oras action to v2

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
oras-project/setup-oras	action	major	v1.2.4 → v2.0.0

---

Release Notes

oras-project/setup-oras (oras-project/setup-oras)

v2.0.0

Compare Source

Highlights

• Support ORAS CLI v1.3.1
• Migrate action runtime from node20 to node24 (#​153)
• Pin undici to >=6.24.1 to address 5 CVEs: GHSA-f269-vfmq-vjvj, GHSA-2mjp-6q6p-2qxm, GHSA-vrm6-8vpv-qv8q, GHSA-v9p9-hfj2-hcw8, GHSA-4992-7rv2-5pvq
• Bump @actions/core from ^2.x to ^3.0.0 (ESM-only)
• Bump @actions/tool-cache from ^3.x to ^4.0.0 (ESM-only)
• Replace @vercel/ncc with esbuild as the build bundler

What's Changed

• Add version 1.3.1 with checksums (#​150)
• feat: migrate action runtime from node20 to node24 (#​153)
• fix: pin undici to >=6.24.1 to address CVEs (#​157)
• chore(deps): bump @​actions/core to 3.x and @​actions/tool-cache to 4.x (#​159)
• chore(deps): Bump @​actions/core from 1.11.1 to 2.0.1 (#​130)
• chore(deps): Bump typescript from 5.9.2 to 6.0.2 (#​151)
• chore(deps): Bump actions/checkout from 5 to 6 (#​128)
• chore(deps): Bump actions/setup-node from 5 to 6 (#​123)
• chore(deps): Bump @​types/node from 24.12.0 to 25.5.2 (multiple PRs)

Full Changelog: oras-project/setup-oras@v1.2.4...v2.0.0

v2.0

Compare Source

v2

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.