[dependabot]

Bumps crazy-max/ghaction-import-gpg from 6.3.0 to 7.0.0.

Release notes

Sourced from crazy-max/ghaction-import-gpg's releases.

v7.0.0

• Node 24 as default runtime (requires Actions Runner v2.327.1 or later) by @​crazy-max in crazy-max/ghaction-import-gpg#241
• Switch to ESM and update config/test wiring by @​crazy-max in crazy-max/ghaction-import-gpg#239
• Bump @​actions/core from 1.11.1 to 3.0.0 in crazy-max/ghaction-import-gpg#232
• Bump @​actions/exec from 1.1.1 to 3.0.0 in crazy-max/ghaction-import-gpg#242
• Bump brace-expansion from 1.1.11 to 1.1.12 in crazy-max/ghaction-import-gpg#221
• Bump minimatch from 3.1.2 to 3.1.5 in crazy-max/ghaction-import-gpg#240
• Bump openpgp from 6.1.0 to 6.3.0 in crazy-max/ghaction-import-gpg#233

Full Changelog: crazy-max/ghaction-import-gpg@v6.3.0...v7.0.0

Commits

• 2dc316d Merge pull request #242 from crazy-max/dependabot/npm_and_yarn/actions/exec-3...
• 5812792 chore: update generated content
• ceb906e build(deps): bump @​actions/exec from 1.1.1 to 3.0.0
• a9dffd9 Merge pull request #241 from crazy-max/node24
• 36d49fc node 24 as default runtime
• 50c4e4f Merge pull request #233 from crazy-max/dependabot/npm_and_yarn/openpgp-6.3.0
• c78fe49 chore: update generated content
• 8dbbb1e Merge pull request #221 from crazy-max/dependabot/npm_and_yarn/brace-expansio...
• fc715b0 build(deps): bump openpgp from 6.1.0 to 6.3.0
• 9946916 build(deps): bump brace-expansion from 1.1.11 to 1.1.12
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[Farjaad]

Dependency review: safe to merge

• Scope: One-line change in .github/workflows/release.yaml. The action stays SHA-pinned (e89d409 v6.3.0 → 2dc316d v7.0.0), and both SHAs match the upstream tags. No other workflow uses this action.
• How we use it: The "Import GPG Key" step passes only gpg_private_key and passphrase. Its fingerprint output goes to GoReleaser as GPG_FINGERPRINT, and src/.goreleaser.yml uses it with gpg --local-user … --detach-sign to sign the checksum file.
• Breaking changes: v7.0.0's only breaking change is the Node 24 runtime (needs runner ≥ v2.327.1). Between v6.3.0 and v7.0.0, action.yml changes only node20 → node24; inputs and outputs (fingerprint, keyid, name, email) are unchanged. The src/ changes are import/ESM housekeeping, with no change to passphrase, gpg-agent or trust handling. This job already runs Node 24 actions (actions/checkout v7.0.1, actions/setup-go v7.0.0) on GitHub-hosted ubuntu-latest.
• Verification: I reviewed the release notes, the upstream v6.3.0...v7.0.0 compare (action.yml and src/), our release workflow and the GoReleaser signing config. PR CI doesn't run the release workflow, so this action isn't exercised until the next release. After merging, check the "Import GPG Key" and GoReleaser signing steps on that run.