chore(deps): update docker/login-action action to v4.4.0

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
docker/login-action	action	minor	v4.1.0 → v4.4.0	v4.5.2 (+2)

---

Release Notes

docker/login-action (docker/login-action)

v4.4.0

Compare Source

v4.3.0

Compare Source

• Preserve names in esbuild bundle by @​crazy-max in #​1022
• Bump @​aws-sdk/client-ecr and @​aws-sdk/client-ecr-public to 3.1076.0 #​999 #​1030
• Bump @​docker/actions-toolkit from 0.90.0 to 0.92.0 in #​1004 #​1027
• Bump @​sigstore/core from 3.1.0 to 3.2.1 in #​1023
• Bump @​sigstore/verify from 3.1.0 to 3.1.1 in #​1029
• Bump http-proxy-agent and https-proxy-agent to 9.1.0 in #​1017
• Bump js-yaml from 4.1.1 to 5.2.0 in #​1028
• Bump sigstore from 4.1.0 to 4.1.1 in #​1031
• Bump tmp from 0.2.5 to 0.2.7 in #​1002
• Bump undici from 6.24.1 to 6.27.0 in #​1020
• Bump vite from 7.3.3 to 7.3.6 in #​1019

Full Changelog: docker/login-action@v4.2.0...v4.3.0

v4.2.0

Compare Source

• Bump @​actions/core from 3.0.0 to 3.0.1 in #​976
• Bump @​aws-sdk/client-ecr and @​aws-sdk/client-ecr-public to 3.1050.0 in #​960
• Bump @​docker/actions-toolkit from 0.86.0 to 0.90.0 in #​970
• Bump brace-expansion from 2.0.1 to 5.0.6 in #​993
• Bump fast-xml-builder from 1.1.4 to 1.2.0 in #​985
• Bump fast-xml-parser from 5.3.6 to 5.8.0 in #​963
• Bump http-proxy-agent and https-proxy-agent to 9.0.0 in #​961
• Bump postcss from 8.5.6 to 8.5.10 in #​979
• Bump tar from 6.2.1 to 7.5.15 in #​991
• Bump vite from 7.3.1 to 7.3.3 in #​986

Full Changelog: docker/login-action@v4.1.0...v4.2.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (* 0-4,22-23 * * 1-5)
  • Only on Sunday and Saturday (* * * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Renovate PR Review Results

⚖️ Safety Assessment: ✅ Safe

🔍 Release Content Analysis

This PR updates docker/login-action from v4.1.0 to v4.4.0, spanning three minor releases (v4.2.0, v4.3.0, and v4.4.0).

v4.2.0 Changes:

• Dependency updates: @actions/core, AWS SDK packages, Docker actions toolkit, and various security-related packages
• Notable upgrades: tar, postcss, fast-xml-parser, http-proxy-agent libraries
• No breaking changes or API modifications

v4.3.0 Changes:

• Build improvement: Preserve names in esbuild bundle (enhances debugging)
• Dependency updates: AWS SDK (3.1076.0), Docker actions toolkit (0.92.0), Sigstore packages, js-yaml (4.1.1 → 5.2.0)
• Security patches: undici, vite, http-proxy-agent updates
• No breaking changes or API modifications

v4.4.0 Changes:

• Bug fix: Skip empty registry-auth secret mask
• Dependency update: AWS SDK packages to 3.1077.0
• No breaking changes or API modifications

Security Fixes:

• Multiple dependency security patches across all three releases
• Updates to critical packages like undici, tar, and vite address known vulnerabilities

Breaking Changes:
None identified across all three releases.

🎯 Impact Scope Investigation

Usage Location:

• Single usage in .github/workflows/release-please.yml:58
• Used for authentication to GitHub Container Registry (ghcr.io)
• Current configuration:

  registry: ghcr.io
  username: ${{ github.actor }}
  password: ${{ github.token }}

Current Implementation Analysis:

• The action is used in the publish job to authenticate before pushing Docker images
• Uses standard GitHub-provided credentials (github.actor and github.token)
• No custom registry-auth secrets or advanced features utilized

Dependency Impact:

• No other workflows use docker/login-action
• No configuration files require updates
• The action's input/output interface remains unchanged between v4.1.0 and v4.4.0

Compatibility Verification:

• All CI checks passed successfully (Build, Lint, Unit Tests, E2E Tests)
• Socket Security checks passed
• No merge conflicts detected (PR is mergeable)

💡 Recommended Actions

Immediate Action:

• ✅ Safe to merge immediately - This is a straightforward dependency update with no breaking changes

Post-Merge Verification:

• Monitor the next release workflow run to confirm Docker login continues working as expected
• No code changes required in the repository

Why This Is Safe:

1. No API changes to action inputs or outputs
2. Backward-compatible dependency updates only
3. Bug fixes and security patches improve stability
4. Single usage point follows standard authentication pattern
5. All automated checks passed successfully

🔗 Reference Links

• v4.4.0 Release Notes
• v4.3.0 Release Notes
• v4.2.0 Release Notes
• Full Changelog v4.1.0...v4.4.0
• docker/login-action Repository

Generated by koki-develop/claude-renovate-review