update ansible collections sops, docker and debops

ansible_collections/community/docker/.github/workflows/docker-images.yml

@@ -28,7 +28,7 @@ env:
 jobs:
   build:
     name: Build image ${{ matrix.name }}:${{ matrix.tag }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
@@ -43,9 +43,13 @@ jobs:
             tag: check
             tag-as-latest: true
 
+    permissions:
+      contents: read
+      packages: write
+
     steps:
       - name: Check out repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
@@ -53,10 +57,10 @@ jobs:
         run: |
           sudo apt-get install podman buildah
 
-      - name: Set up Go 1.22
-        uses: actions/setup-go@v6
+      - name: Set up Go 1.26
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
         with:
-          go-version: '1.22'
+          go-version: '1.26'
           cache: false  # true (default) results in warnings since we don't use Go modules
 
       - name: Build ${{ matrix.name }} image
@@ -66,25 +70,22 @@ jobs:
 
       - name: Tag image as latest
         if: matrix.tag-as-latest && matrix.tag != 'latest'
-        run: |
-          podman tag "${CONTAINER_REGISTRY}/${{ matrix.name }}:${{ matrix.tag }}" "${CONTAINER_REGISTRY}/${{ matrix.name }}:latest"
+        env:
+          SOURCE_IMAGE: ${{ matrix.name }}:${{ matrix.tag }}
+          DEST_IMAGE: ${{ matrix.name }}:latest
+        run: >-
+          podman tag "${CONTAINER_REGISTRY}/${SOURCE_IMAGE}" "${CONTAINER_REGISTRY}/${DEST_IMAGE}"
 
       - name: Publish container image ${{ env.CONTAINER_REGISTRY }}/${{ matrix.name }}:${{ matrix.tag }}
         if: github.event_name != 'pull_request'
-        uses: redhat-actions/push-to-registry@v2
-        with:
-          registry: ${{ env.CONTAINER_REGISTRY }}
-          image: ${{ matrix.name }}
-          tags: ${{ matrix.tag }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+        env:
+          IMAGE: ${{ matrix.name }}:${{ matrix.tag }}
+        run: >-
+          podman manifest push --all "${IMAGE}" "${CONTAINER_REGISTRY}/${IMAGE}" --tls-verify=true --creds=${{ github.actor }}:${{ secrets.GITHUB_TOKEN }}
 
       - name: Publish container image ${{ env.CONTAINER_REGISTRY }}/${{ matrix.name }}:latest
         if: github.event_name != 'pull_request' && matrix.tag-as-latest && matrix.tag != 'latest'
-        uses: redhat-actions/push-to-registry@v2
-        with:
-          registry: ${{ env.CONTAINER_REGISTRY }}
-          image: ${{ matrix.name }}
-          tags: latest
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+        env:
+          IMAGE: ${{ matrix.name }}:latest
+        run: >-
+          podman manifest push --all "${IMAGE}" "${CONTAINER_REGISTRY}/${IMAGE}" --tls-verify=true --creds=${{ github.actor }}:${{ secrets.GITHUB_TOKEN }}

ansible_collections/community/docker/.github/workflows/nox.yml

@@ -15,6 +15,14 @@ name: nox
     - cron: '0 9 * * *'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
+concurrency:
+  # Make sure there is at most one active run per PR, but do not cancel any non-PR runs
+  group: ${{ github.workflow }}-${{ (github.head_ref && github.event.number) || github.run_id }}
+  cancel-in-progress: true
+
 jobs:
   nox:
     uses: ansible-community/antsibull-nox/.github/workflows/reusable-nox-run.yml@main
@@ -30,6 +38,6 @@ jobs:
       upload-codecov-pr: false
       upload-codecov-push: false
       upload-codecov-schedule: true
-      max-ansible-core: "2.17"
+      allow-coverage-cd-override: true
     secrets:
       CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}