Update GH workflows to latest

Author: macropin

.github/workflows/build-push.yml

@@ -1,4 +1,6 @@
-# Panubo build and push to Quay.io and ECR Public
+# Source: https://github.com/panubo/reference-github-actions/blob/main/docker-images/build-push.yml
+#
+# Description: Panubo build and push to Quay.io and ECR Public
 # This GH Action is intended for public docker images that package upstream applications/services (ie not for projects of Panubo's).
 # For repos that build multiple repos use the multi-build-push.yml workflow.
 #
@@ -9,6 +11,8 @@
 # Automated testing is triggered by `make _ci_test`, if no test is required the Makefile target should just run `true`.
 # Before tests are run a Docker build is performed, the resulting image has a tag of "test"
 # BATS is installed since it is commonly required by the tests.
+#
+# LICENSE: MIT License, Copyright (c) 2021-2025 Volt Grid Pty Ltd t/a Panubo
 
 name: build and push on main and tags
 
@@ -33,7 +37,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v5
 
       - name: Get repo name
         id: image_name
@@ -42,7 +46,7 @@ jobs:
 
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@v5
         with:
           # list of Docker images to use as base name for tags
           images: |
@@ -59,28 +63,28 @@ jobs:
             # type=sha
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@v3
 
       - name: Set up Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
 
       # The values provided to these two AWS steps are always the same for Panubo owned repos
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v1-node16
+        uses: aws-actions/configure-aws-credentials@v4
         with:
           role-to-assume: ${{ env.GITHUB_ROLE_ARN }}
           aws-region: us-east-1
 
       - name: Login to ECR
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           registry: public.ecr.aws
 
       - name: Login to Quay.io
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           registry: quay.io
           username: ${{ secrets.PANUBUILD_QUAYIO_USERNAME }}
@@ -92,7 +96,7 @@ jobs:
           bats-version: 1.7.0
 
       - name: Build and export to Docker
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@v6
         with:
           builder: ${{ steps.buildx.outputs.name }}
           cache-from: type=gha
@@ -104,7 +108,7 @@ jobs:
           make _ci_test
 
       - name: Build and Push
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@v6
         with:
           builder: ${{ steps.buildx.outputs.name }}
           push: ${{ github.event_name != 'pull_request' }}

.github/workflows/release.yml

@@ -1,32 +1,33 @@
-# Source: https://github.com/panubo/reference-github-actions/blob/master/github-release.yml
+# Source: https://github.com/panubo/reference-github-actions/blob/main/github-release.yml
+# Description: Create a GitHub release
+# LICENSE: MIT License, Copyright (c) 2021-2025 Volt Grid Pty Ltd t/a Panubo
+
+name: GitHub Release
 
 on:
   push:
     tags:
-      - '*'
+      - "v*"
+  workflow_call:
 
-name: GitHub Release
+permissions:
+  contents: write
 
 jobs:
   build:
     name: Create GitHub Release
     runs-on: ubuntu-latest
     steps:
-
       - name: Checkout code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v5
         with:
-          fetch-depth: 0
+          fetch-depth: 0 # Required for git log to work
 
       - name: Get Release Notes
         id: get_release_notes
         run: |
-          NOTES=$(git log --pretty=format:%s $(git tag --sort=-refname | head -1)...$(git tag --sort=-refname | head -2 | tail -1) | awk '{ print "-", $0  }')
-          NOTES="${NOTES//'%'/'%25'}"
-          NOTES="${NOTES//$'\n'/'%0A'}"
-          NOTES="${NOTES//$'\r'/'%0D'}"
-          echo "NOTES: ${NOTES}"
-          echo "::set-output name=notes::${NOTES}"
+          NOTES=$(git log --pretty=format:%s $(git tag --sort=-v:refname | head -1)...$(git tag --sort=-v:refname | head -2 | tail -1) | awk '{ print "-", $0  }')
+          printf "notes<<EOF\\n%s\\nEOF\\n" "${NOTES}" >> "$GITHUB_OUTPUT"
 
       - name: Create Release
         id: create_release
@@ -41,5 +42,5 @@ jobs:
 
             ${{ steps.get_release_notes.outputs.notes }}
 
-          draft: true
+          draft: false
           prerelease: false

.github/workflows/test.yml

@@ -10,7 +10,7 @@ jobs:
     steps:
 
       - name: Checkout code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0