chore(deps): update projectbluefin/actions digest to 8895d09

[mergeraptor]

This PR contains the following updates:

Package	Type	Update	Change
projectbluefin/actions (changelog)	workflow	digest	2564c7b → 8895d09
projectbluefin/actions (changelog)	action	digest	2564c7b → 8895d09

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[castrojo]

Approved via Bluefin review: update projectbluefin/actions digest to 5fc955e.

[hanthor]

2564c7b..4d3b97e is a wide range — 40+ commits, ~4,350 changed lines in projectbluefin/actions — so I checked what actually reaches finpilot rather than taking the digest on faith. Of the twelve things the five workflows here pin, only four changed at all, and every one of them is inert under finpilot's current configuration.

pinned path	changed in range?	reaches finpilot?
bootc-build/preflight	no	—
bootc-build/dnf-cache	no	—
bootc-build/detect-changes	no	—
bootc-build/generate-tags	no	—
bootc-build/push-image	no	—
bootc-build/ghcr-cleanup	no	—
reusable-sync-branches.yml	no	—
bootc-build/setup-runner	1 line	yes, harmless
bootc-build/validate-pr	5 lines	yes, a fix
bootc-build/sign-and-publish	15 lines	no — generate-sbom: false
bootc-build/chunka	14 lines	no — ENABLE_RECHUNKING: "false"
reusable-promote-squash.yml	83 lines	no — run_e2e: false

The two that do land:

• setup-runner bumps taiki-e/install-action 1938d65 → 3a2284f, still SHA-pinned.
• validate-pr replaces a # shellcheck disable=SC2086 word-split loop with read -ra + compgen -G, which fixes shellcheck globs containing spaces. pr-validation.yml passes shellcheck-glob: "build/*.sh" — no spaces — so this is a latent-bug fix, not a behaviour change here.

And the three that are gated off are worth naming explicitly, because they are the reason this is a safe bump today and would not be if any of those three flags flipped:

• reusable-promote-squash.yml now replaces "find a completed post-testing-e2e Actions run matching head_sha" with "read an e2e/post-testing commit status on the source commit, and only trust it if the poster is GitHub Actions itself." promote-main-to-stable.yml sets run_e2e: false with the documented rationale in #281, so the new gate short-circuits at RUN_E2E != 'true'. When #281 is fixed and run_e2e flips to true, finpilot will need a producer workflow that publishes that commit status — the old "just find a successful run" behaviour will no longer be there to fall back on.
• sign-and-publish sets SYFT_RELATIONSHIPS_PACKAGE_FILE_OWNERSHIP: "false" and skips the GitHub attestation (with a ::warning::, job still green) when the SBOM exceeds 16 MB. Inert here because generate-sbom: false.
• chunka — see below.

One thing to carry elsewhere, not a blocker here. The chunka change (4f64578, moving the chunkah config from an env var to a mounted file to avoid E2BIG) looks wrong in its BuildStream branch. In the buildah branch the flag is correctly passed to chunkah:

--build-arg "CHUNKAH_ARGS=--config /run/src/config.json --max-layers ..."

but in the BST branch it lands among the podman run options, before the image reference:

sudo podman run --rm \
  -v "${CHUNKAH_CONFIG_FILE}:/chunkah-config.json:ro" \
  --config /chunkah-config.json \
  "${CHUNKAH_REF}" build \
    --max-layers "${MAX_LAYERS}" ...

--config is not a podman run option; it is a root-level persistent flag podman keeps for Docker compatibility and ignores. So either podman rejects the flag and the step fails, or — more likely, since cobra lets persistent flags be given at subcommand level — it is silently swallowed and chunkah never receives the config at all, losing the OCI labels (containers.bootc=1 among them) that the file was created to preserve. I could not run podman here to settle which, so treat that as "one of two bad outcomes" rather than a confirmed error message.

finpilot is not exposed (ENABLE_RECHUNKING: "false", and no xattr-manifest input, so it would take the buildah branch anyway). The repos that pass xattr-manifest — the BuildStream images — are the ones to check before they take this digest.

mergeable_state: blocked (two-approval ruleset), so this still needs a second reviewer. Renovate has automerge disabled on this one by config, so it wants a manual merge.

---

Generated by Claude Code

[hanthor]

Narrowing my own note above so it doesn't send anyone hunting: I went and checked, and no repo in the org currently passes xattr-manifest to bootc-build/chunka. The only reference to that input anywhere is its own declaration in bootc-build/chunka/action.yml:18 and its use at :46. reusable-build.yml (which bluefin, bluefin-lts and utah all call) invokes chunka with source-image and max-layers only, so every live caller takes the buildah branch.

So the --config placement problem is latent, not active — nothing is losing OCI labels today. It matters whenever the BST path is first switched on, which is exactly the moment it would be hardest to diagnose. Worth fixing in projectbluefin/actions while it costs nothing; I don't have write access to that repo to open the issue there myself.

Doesn't change the verdict on this PR.

---

Generated by Claude Code

[kubestellar-hive]

Reviewed — no findings from this perspective.

— hive: agent=reviewer backend=copilot model=claude-fable-5 copilot=1.0.78