chore(deps): update github-actions

[renovate-orgmentem]

This PR contains the following updates:

Package	Type	Update	Change
anchore/sbom-action	action	patch	v0.24.0 → v0.24.2
go	uses-with	minor	1.26.6 → 1.27.0
golangci/golangci-lint	uses-with	minor	v2.12.2 → v2.13.2

---

Release Notes

anchore/sbom-action (anchore/sbom-action)

v0.24.2

Compare Source

Added Features

• bump eslint from 10.8.1 to 10.9.0 [#​724 @​dependabot]

Additional Changes

• add makefile target to bump syft [#​620 @​willmurphyscode]
• update zizmor workflow triggers [#​624 @​wagoodman]
• require zizmor security events [#​621 @​wagoodman]

(Full Changelog)

v0.24.1

Compare Source

actions/go-versions (go)

v1.27.0: 1.27.0

Compare Source

Go 1.27.0

v1.26.7: 1.26.7

Compare Source

Go 1.26.7

golangci/golangci-lint (golangci/golangci-lint)

v2.13.2

Compare Source

Released on 2026-08-28

1. Bug fixes
   • Decrease cache entropy
2. Linters bug fixes
   • iface: from 1.5.0 to 1.5.1
   • staticcheck: from 0.8.0 to 0.8.1
   • unparam: from 3f964bc to 2fa3d84
   • canonicalheader: from v1.1.2 to a temporary fork

v2.13.1

Compare Source

Released on 2026-08-20

1. Linters bug fixes
   • ginkgolinter: from 0.23.1 to 0.24.0
   • gofmt: from d62b90e to e84e050
   • staticcheck: from 0.8.0-rc.1 to 0.8.0
   • wsl_v5: from 5.8.0 to 5.9.0

v2.13.0

Compare Source

Released on 2026-08-19

1. Enhancements
   • 🎉 go1.27 support
2. Bug fixes
   • fix: cache package facts
3. Linters new features or changes
   • dupword: from 0.1.7 to 0.1.8 (new option skip-raw-strings)
   • errcheck: from 1.10.0 to 1.20.0
   • exhaustruct_v5: from 4.0.0 to 5.0.2 (new configuration)
   • exhaustruct: deprecated and replaced by exhaustruct_v5
   • fatcontext: from 0.9.0 to 0.10.0 (new options: check-loops, check-function-literals)
   • goconst: from 1.10.0 to 1.11.0 (new options: ignore-map-keys, exclude-types)
   • gofumpt: from 0.9.2 to 0.11.0 (new options: extra.group-params, extra.clothe-returns, extra.balance-calls)
   • gomoddirectives: from 0.8.0 to 0.9.0 (new option: replace-allow-all)
   • gosec: from 2.26.1 to 2.27.1
   • govet-modernize: from 0.44.0 to 0.49.0 (fmtappendf is removed. New analyzers atomictypes, embedlit, errorsastype, importcomment, reflecttypeassert, slicesclip, and slicesbackward. waitgroup is renamed waitgroupgo)
   • iface: from 1.4.3 to 1.5.0 (new analyzer: unusedmethod)
   • noinlineerr: from 1.0.5 to 1.0.6
   • nonamedreturns: from 1.0.6 to 1.0.8 (new option: allow-unused-named-returns)
   • recvcheck: from 0.2.0 to 0.3.0 (new default exclusions)
   • unparam: from 5beb8c8 to 3f964bc
4. Linters bug fixes
   • clickhouse-go-linter: from 1.2.0 to 1.2.1
   • errname: from 1.1.1 to 1.1.2
   • exhaustruct: from 5.0.2 to 5.0.3
   • funcorder: add missing Function field
   • ginkgolinter: from 0.23.0 to 0.23.1
   • gocheckcompilerdirectives: from 1.3.0 to 1.4.0
   • gocritic: from 0.14.3 to 0.14.4
   • gomoddirectives: add missing IgnoreForbidden field
   • iface: from 1.4.2 to 1.4.3
   • mirror: from 1.3.0 to 1.3.3
   • nilnil: from 1.1.1 to 1.1.2
   • protogetter: from 0.3.20 to 0.3.21

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.