chore(deps): update docker/login-action action to v4.4.0

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
docker/login-action	action	minor	v4.1.0 → v4.4.0	v4.5.0

---

Release Notes

docker/login-action (docker/login-action)

v4.4.0

Compare Source

v4.3.0

Compare Source

• Preserve names in esbuild bundle by @​crazy-max in #​1022
• Bump @​aws-sdk/client-ecr and @​aws-sdk/client-ecr-public to 3.1076.0 #​999 #​1030
• Bump @​docker/actions-toolkit from 0.90.0 to 0.92.0 in #​1004 #​1027
• Bump @​sigstore/core from 3.1.0 to 3.2.1 in #​1023
• Bump @​sigstore/verify from 3.1.0 to 3.1.1 in #​1029
• Bump http-proxy-agent and https-proxy-agent to 9.1.0 in #​1017
• Bump js-yaml from 4.1.1 to 5.2.0 in #​1028
• Bump sigstore from 4.1.0 to 4.1.1 in #​1031
• Bump tmp from 0.2.5 to 0.2.7 in #​1002
• Bump undici from 6.24.1 to 6.27.0 in #​1020
• Bump vite from 7.3.3 to 7.3.6 in #​1019

Full Changelog: docker/login-action@v4.2.0...v4.3.0

v4.2.0

Compare Source

• Bump @​actions/core from 3.0.0 to 3.0.1 in #​976
• Bump @​aws-sdk/client-ecr and @​aws-sdk/client-ecr-public to 3.1050.0 in #​960
• Bump @​docker/actions-toolkit from 0.86.0 to 0.90.0 in #​970
• Bump brace-expansion from 2.0.1 to 5.0.6 in #​993
• Bump fast-xml-builder from 1.1.4 to 1.2.0 in #​985
• Bump fast-xml-parser from 5.3.6 to 5.8.0 in #​963
• Bump http-proxy-agent and https-proxy-agent to 9.0.0 in #​961
• Bump postcss from 8.5.6 to 8.5.10 in #​979
• Bump tar from 6.2.1 to 7.5.15 in #​991
• Bump vite from 7.3.1 to 7.3.3 in #​986

Full Changelog: docker/login-action@v4.1.0...v4.2.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (* 0-4,22-23 * * 1-5)
  • Only on Sunday and Saturday (* * * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Renovate PR Review Results

⚖️ Safety Assessment: ✅ Safe

🔍 Release Content Analysis

Version Progression: v4.1.0 → v4.2.0 → v4.3.0 → v4.4.0

v4.2.0 (May 22, 2026):

• Purely dependency maintenance release
• Updated @actions/core (3.0.0 → 3.0.1)
• Updated @aws-sdk packages (client-ecr, client-ecr-public → 3.1050.0)
• Updated @docker/actions-toolkit (0.86.0 → 0.90.0)
• Updated network utilities (http-proxy-agent, https-proxy-agent → 9.0.0)
• Updated build tools (brace-expansion, fast-xml-builder, fast-xml-parser, postcss, tar, vite)
• No breaking changes or API modifications

v4.3.0 (July 2, 2024):

• Preserved names in esbuild bundle (improved debugging/readability)
• Updated @aws-sdk packages (→ 3.1076.0)
• Updated @docker/actions-toolkit (0.90.0 → 0.92.0)
• Updated Sigstore libraries (@sigstore/core → 3.2.1, @sigstore/verify → 3.1.1)
• Updated proxy agents (→ 9.1.0), js-yaml (→ 5.2.0), undici, vite, tmp, sigstore
• No breaking changes or new features

v4.4.0 (July 3, 2026):

• Bug fix: Skip empty registry-auth secret mask (improved handling of authentication secrets)
• Updated @aws-sdk packages (→ 3.1077.0)
• No breaking changes

Key Findings:

• All releases are minor version bumps focused on dependency updates and bug fixes
• No breaking changes across all three intermediate versions
• No new inputs/outputs added - action.yml interface remains stable
• No security advisories published for any version in this range
• Bug fix in v4.4.0 improves secret handling behavior without requiring code changes

🎯 Impact Scope Investigation

Usage Location:

• Single usage found in .github/workflows/release-please.yml:58
• Used for authenticating to GitHub Container Registry (ghcr.io) during Docker image publishing

Current Configuration:

- uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
  with:
    registry: ghcr.io
    username: ${{ github.actor }}
    password: ${{ github.token }}

Action Interface Comparison:

• v4.1.0 and v4.4.0 have identical action.yml inputs/outputs
• All inputs remain optional with same defaults
• Runtime changed from node24 to node24 (no change)
• Main entry point unchanged (dist/index.cjs)

Impact Assessment:

• ✅ No changes to action inputs/outputs required
• ✅ Current configuration uses standard inputs (registry, username, password) - fully compatible
• ✅ No impact on other dependencies
• ✅ No configuration file changes needed
• ✅ Behavior improvements are backward-compatible (empty registry-auth handling)

💡 Recommended Actions

Immediate Actions:

1. Merge this PR - The update is safe and backward-compatible
2. No code modifications required
3. No configuration changes needed

Post-Merge Validation:

1. Monitor the next release workflow execution to confirm Docker login succeeds
2. Verify GitHub Container Registry authentication works as expected
3. No additional testing required beyond normal CI/CD validation

Benefits of This Update:

• Improved AWS SDK support (ECR integrations)
• Enhanced dependency security through updates
• Bug fix for empty registry-auth secret masking
• Updated Sigstore libraries for better supply chain security
• No migration burden or code changes required

🔗 Reference Links

• v4.4.0 Release Notes
• v4.3.0 Release Notes
• v4.2.0 Release Notes
• Full Changelog v4.1.0...v4.4.0
• docker/login-action Repository
• Security Advisories (none published)

Generated by koki-develop/claude-renovate-review