[renovate]

This PR contains the following updates:

Package	Type	Update	Change
datum-cloud/actions	workflow	minor	v1.24.0 → v1.26.0

---

Release Notes

datum-cloud/actions

v1.26.0: : Basic CI for repos that have none

Compare Source

Repositories with no CI can now get a build-and-test check from one line, and the shared workflows default to Node 26.

What's new

• ci-basic reusable workflow (#​119): detects the stack and runs install, typecheck, lint, build and test for Node (npm, pnpm or bun), go build and go test for Go, Poetry install and pytest for Python, and a no-push Docker build. Inputs: path, skip, run, dockerfile, docker-context, node-version, python-version. Tracked in datum-cloud/infra#8201.
• Node 26 by default (#​118): the three reusable workflows that set up Node now default to 26. A caller that relies on the default moves to Node 26 when it picks up this release; set node-version to stay on an older line. Node 26 traps (no corepack, no yarn in the official images) are in infra's Node upgrade guide.
• mcp 1.30.0 (#​110): security update.

v1.25.0: : Distrusted CA roots dropped from published images

Compare Source

Images published through the shared Docker workflow no longer trust the eMudhra emSign roots that Mozilla and the browsers have dropped, so a repository is fixed by moving to this version.

What's new

• Distrusted CA roots dropped. publish-docker builds your Dockerfile as before, then adds one layer that removes emSign Root CA - C1, emSign ECC Root CA - C3 and emSign ECC Root CA - G3 from the image's CA certificate files. Entrypoint, user and config are unchanged, and an image without those roots gets an empty layer. (#​115)
• Faster CI here. This repository's own test workflows cancel runs a newer push has superseded. (#​116)

[!NOTE]
This is on by default. Set drop-distrusted-roots: false to push the Dockerfile's output unchanged. Language-specific stores such as Java's cacerts are not filtered; Python's certifi already follows Mozilla.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[ecv]

Approved: datum-cloud/actions pin bump to a release the owner authorized.

[ecv]

Approve.

Pin bump only. Between the old pin and v1.26.0 the only behavioral change to what this repo calls is publish-docker gaining a default-on step that strips the dropped emSign CA roots from the built image, and the inputs, secrets and outputs this caller uses are unchanged.

• publish-docker v1.26.0 builds locally, then pushes via a second build that layers a busybox-filtered CA-root removal over it; set drop-distrusted-roots: false to opt out. The PR run exercised this path green (Check workflow commit, Checkout root filter, Build, Drop distrusted roots and push all succeeded).

Follow-ups:

• After the first release-tag publish, pull one image and confirm entrypoint, user and CA bundle are intact: publish-docker now builds to a local OCI layout and pushes a second, rebuilt image, so digests differ from before.