Bump the github-actions group across 1 directory with 7 updates

Bumps the github-actions group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [docker/metadata-action](https://github.com/docker/metadata-action) | `5.6.1` | `5.7.0` |
| [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) | `3.3.0` | `3.6.0` |
| [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `3.8.0` | `3.10.0` |
| [docker/build-push-action](https://github.com/docker/build-push-action) | `6.13.0` | `6.15.0` |
| [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) | `2.2.0` | `2.2.2` |
| [actions/create-github-app-token](https://github.com/actions/create-github-app-token) | `1.11.2` | `1.11.6` |
| [ncipollo/release-action](https://github.com/ncipollo/release-action) | `1.15.0` | `1.16.0` |



Updates `docker/metadata-action` from 5.6.1 to 5.7.0
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Commits](docker/metadata-action@369eb59...902fa8e)

Updates `docker/setup-qemu-action` from 3.3.0 to 3.6.0
- [Release notes](https://github.com/docker/setup-qemu-action/releases)
- [Commits](docker/setup-qemu-action@53851d1...2910929)

Updates `docker/setup-buildx-action` from 3.8.0 to 3.10.0
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](docker/setup-buildx-action@6524bf6...b5ca514)

Updates `docker/build-push-action` from 6.13.0 to 6.15.0
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](docker/build-push-action@ca877d9...471d1dc)

Updates `actions/attest-build-provenance` from 2.2.0 to 2.2.2
- [Release notes](https://github.com/actions/attest-build-provenance/releases)
- [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md)
- [Commits](actions/attest-build-provenance@v2.2.0...v2.2.2)

Updates `actions/create-github-app-token` from 1.11.2 to 1.11.6
- [Release notes](https://github.com/actions/create-github-app-token/releases)
- [Commits](actions/create-github-app-token@136412a...21cfef2)

Updates `ncipollo/release-action` from 1.15.0 to 1.16.0
- [Release notes](https://github.com/ncipollo/release-action/releases)
- [Commits](ncipollo/release-action@cdcc88a...440c8c1)

---
updated-dependencies:
- dependency-name: docker/metadata-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: docker/setup-qemu-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: docker/setup-buildx-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: docker/build-push-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: actions/attest-build-provenance
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: actions/create-github-app-token
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: ncipollo/release-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <[email protected]>

Author: dependabot[bot]

.github/workflows/docker.yml

@@ -40,7 +40,7 @@ jobs:
 
       - name: extract image metadata
         id: meta
-        uses: docker/metadata-action@369eb591f429131d6889c46b94e711f089e6ca96 # pin@v5.6.1
+        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # pin@v5.7.0
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |
@@ -50,10 +50,10 @@ jobs:
             type=sha
 
       - name: set up QEMU
-        uses: docker/setup-qemu-action@53851d14592bedcffcf25ea515637cff71ef929a # pin@v3
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # pin@v3
 
       - name: set up docker buildx
-        uses: docker/setup-buildx-action@6524bf65af31da8d45b59e8c27de4bd072b392f5 # pin@v3.8.0
+        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # pin@v3.10.0
 
       - name: login to ghcr
         if: github.event_name != 'pull_request'
@@ -65,7 +65,7 @@ jobs:
 
       - name: build and push
         id: push
-        uses: docker/build-push-action@ca877d9245402d1537745e0e356eab47c3520991 # pin@v6.13.0
+        uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # pin@v6.15.0
         with:
           context: .
           push: ${{ github.event_name != 'pull_request' }}

.github/workflows/release.yml

@@ -45,7 +45,7 @@ jobs:
           mv ./bin/runway ./releases/runway-linux-x86_64
 
       - name: generate artifact attestation
-        uses: actions/[email protected].0
+        uses: actions/[email protected].2
         with:
           subject-path: 'releases/runway-*'
 
@@ -54,15 +54,15 @@ jobs:
           name: runway-binaries
           path: releases/
 
-      - uses: actions/create-github-app-token@136412a57a7081aa63c935a2cc2918f76c34f514 # [email protected].2
+      - uses: actions/create-github-app-token@21cfef2b496dd8ef5b904c159339626a10ad380e # [email protected].6
         id: app-token
         with:
           app-id: ${{ vars.APP_ID }}
           private-key: ${{ secrets.PRIVATE_KEY }}
 
       - name: Push a Release
         id: release
-        uses: ncipollo/release-action@cdcc88a9acf3ca41c16c37bb7d21b9ad48560d87 # pin@v1.15.0
+        uses: ncipollo/release-action@440c8c1cb0ed28b9f43e4d1d670870f059653174 # pin@v1.16.0
         with:
           artifacts: "./releases/*"
           tag: ${{ env.VERSION }}