chore(deps): update ferrlabs/.github digest to 6a248c7

[ferrlabs-renovate]

This PR contains the following updates:

Package	Type	Update	Change
FerrLabs/.github (changelog)	workflow	digest	39502a0 → 6a248c7

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[ferrfleet]

Digest-only bump of FerrLabs/.github (39502a0 → e056bc5) across the four reusable workflow refs in ci.yml, pr-title.yml, release.yml, security-scan.yml.

There is exactly one commit between the two SHAs (FerrLabs/.github#361, "resolve ferrlabs-* crates from crates.io instead of Kellnr"), and it only touches default.json and snippets/deny.toml — the Renovate preset and a cargo-deny snippet. None of the four reusable workflow files this repo pins (reusable-ci-go.yml, reusable-pr-title.yml, reusable-ferrflow-release.yml, reusable-security-scan.yml) changed content at all between the old and new digest. So there's nothing for this repo's CI to actually pick up from the bump.

Note this repo's renovate.json extends github>FerrLabs/.github unpinned, so the crates.io-vs-Kellnr resolution change already applies to FerrVault's own Renovate runs regardless of this PR — it's not gated by this digest bump.

Checks running at review time are green where completed, nothing failed.

[ferrfleet]

Re-review: Renovate moved the target digest since my last approval (was 39502a0→e056bc5, now 39502a0→b6a08e6), so this is a fresh diff, not a no-op rebase.

Of the four reusable workflows this repo pins, two (reusable-pr-title.yml, reusable-security-scan.yml) are byte-identical between old and new digest. The other two have real content changes, both benign for this repo:

• reusable-ci-go.yml: added continue-on-error: true to the two coverage-artifact upload steps (with a comment explaining a flaky upload shouldn't fail the gate). Only loosens a failure mode, doesn't affect ci.yml's build-paths/enable-sonar usage.
• reusable-ferrflow-release.yml: bumps the pinned FerrLabs/FerrFlow action v7.21.7 → v7.25.0 and adds an optional tag-signing feature (new TAG_SIGNING_KEY secret, tag_signing_key/name/email inputs). release.yml:15-19 only passes FERRLABS_DISPATCH_TOKEN and sets no TAG_SIGNING_NAME/TAG_SIGNING_EMAIL vars, so signing stays disabled here — no-op for this repo.

Checks completed so far (gitleaks, osv-scanner, PR title, snyk, zizmor) are all green; CI Test/Lint/Security, opengrep and the kind smoke test were still running at review time with nothing failed.

[ferrfleet]

Re-review: Renovate moved the target digest again since my last approval (was 39502a0→b6a08e6, now 39502a0→42a0645), so this is a new diff.

Of the four reusable workflows this repo pins, three (reusable-ci-go.yml, reusable-pr-title.yml, reusable-security-scan.yml) are byte-identical to the versions I already reviewed at b6a08e6. Only reusable-ferrflow-release.yml changed further:

• Adds an opt-in crates-io-trusted-publishing input plus a rust-lang/crates-io-auth-action step, and switches CARGO_REGISTRY_TOKEN from the static secrets.CARGO_FERRLABS_REGISTRY_TOKEN to that step's OIDC-minted output (only populated when the new input is true).
• release.yml:15-18 in this repo doesn't set crates-io-trusted-publishing and doesn't pass secrets: inherit or CARGO_FERRLABS_REGISTRY_TOKEN, so CARGO_REGISTRY_TOKEN was empty before this change and stays empty after — no-op here. This repo's .ferrflow also sets deferPublish: true, and crates.io publish actually happens through this repo's own .github/workflows/publish.yml, not through the reusable release workflow's token at all.

Checks on the head commit were still in progress at review time (CI, Secrets+CVE scans, kind smoke test); nothing has failed so far.

[ferrfleet]

Re-review: target digest moved again since my last approval (was 39502a0→42a0645, now 39502a0→1a21d234c).

Only one commit separates the two: FerrLabs/.github#382, "build fuzz targets for the toolchain host, not cargo-fuzz's own triple," which touches only reusable-fuzz-rust.yml. None of the four reusable workflows this repo pins (reusable-ci-go.yml, reusable-pr-title.yml, reusable-ferrflow-release.yml, reusable-security-scan.yml) changed. No-op for this repo.

All completed checks on the head commit are green (CI Security, gitleaks, osv-scanner, snyk, zizmor, PR title); CI Test/Lint, opengrep and the kind smoke test were still running at review time with nothing failed.

[ferrfleet]

Re-review: target digest moved again since my last approval (was 39502a0→1a21d23, now 39502a0→6b7ce7f).

One commit separates the two: FerrLabs/.github#383, "chore(renovate): resolve @FerrLabs packages from npmjs". It touches default.json plus reusable-ci-node.yml and reusable-ci-astro.yml. All four reusable workflows this repo pins (reusable-ci-go.yml, reusable-pr-title.yml, reusable-ferrflow-release.yml, reusable-security-scan.yml) are byte-identical between the two digests, as is .github/actions/. No-op for FerrVault's CI.

As before, this repo's renovate.json extends github>FerrLabs/.github unpinned, so the npmjs preset change already applies to FerrVault's Renovate runs independently of this digest bump.

Completed checks on the head commit are green (gitleaks, osv-scanner, snyk, PR title, CI Detect Go module); CI Test/Lint/Security, opengrep, zizmor and the kind smoke test were still running at review time with nothing failed.

[ferrfleet]

Re-review: target digest moved again since my last approval (was 39502a0→6b7ce7f, now 39502a0→30bd2ef).

Two commits separate them, both touching only default.json:

• FerrLabs/.github#385, widens the Renovate Dockerfile schedule from before 6am on monday to on monday.
• FerrLabs/.github#386, rewords that rule's description only.

None of the four reusable workflows this repo pins (reusable-ci-go.yml, reusable-pr-title.yml, reusable-ferrflow-release.yml, reusable-security-scan.yml) changed, nor did .github/actions/. No-op for FerrVault's CI. As before, this repo's renovate.json extends github>FerrLabs/.github unpinned, so the schedule change already applies to FerrVault's Renovate runs independently of this digest bump.

Completed checks on the head commit are green (gitleaks, osv-scanner, snyk, zizmor, PR title, CI Detect Go module); CI Test/Lint/Security, opengrep and the kind smoke test were still running at review time with nothing failed.

[ferrfleet]

Re-review: the target digest moved from 30bd2ef (my last approval) to 6a248c7.

There are two commits between them, and neither touches a workflow:

• FerrLabs/.github#388 changes only .github/FUNDING.yml.
• FerrLabs/.github#390 changes only default.json (Renovate rules for @FerrLabs npm updates).

None of the four reusable workflows pinned here changed. This bump does nothing to FerrVault's CI. I did not check CI status on the head commit.