update ansible collections sops, docker and debops

ansible_collections/community/docker/.github/workflows/docker-images.yml

@@ -28,7 +28,7 @@ env:
 jobs:
   build:
     name: Build image ${{ matrix.name }}:${{ matrix.tag }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
@@ -43,9 +43,13 @@ jobs:
             tag: check
             tag-as-latest: true
 
+    permissions:
+      contents: read
+      packages: write
+
     steps:
       - name: Check out repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
@@ -53,10 +57,10 @@ jobs:
         run: |
           sudo apt-get install podman buildah
 
-      - name: Set up Go 1.22
-        uses: actions/setup-go@v6
+      - name: Set up Go 1.26
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
         with:
-          go-version: '1.22'
+          go-version: '1.26'
           cache: false  # true (default) results in warnings since we don't use Go modules
 
       - name: Build ${{ matrix.name }} image
@@ -66,25 +70,22 @@ jobs:
 
       - name: Tag image as latest
         if: matrix.tag-as-latest && matrix.tag != 'latest'
-        run: |
-          podman tag "${CONTAINER_REGISTRY}/${{ matrix.name }}:${{ matrix.tag }}" "${CONTAINER_REGISTRY}/${{ matrix.name }}:latest"
+        env:
+          SOURCE_IMAGE: ${{ matrix.name }}:${{ matrix.tag }}
+          DEST_IMAGE: ${{ matrix.name }}:latest
+        run: >-
+          podman tag "${CONTAINER_REGISTRY}/${SOURCE_IMAGE}" "${CONTAINER_REGISTRY}/${DEST_IMAGE}"
 
       - name: Publish container image ${{ env.CONTAINER_REGISTRY }}/${{ matrix.name }}:${{ matrix.tag }}
         if: github.event_name != 'pull_request'
-        uses: redhat-actions/push-to-registry@v2
-        with:
-          registry: ${{ env.CONTAINER_REGISTRY }}
-          image: ${{ matrix.name }}
-          tags: ${{ matrix.tag }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+        env:
+          IMAGE: ${{ matrix.name }}:${{ matrix.tag }}
+        run: >-
+          podman manifest push --all "${IMAGE}" "${CONTAINER_REGISTRY}/${IMAGE}" --tls-verify=true --creds=${{ github.actor }}:${{ secrets.GITHUB_TOKEN }}
 
       - name: Publish container image ${{ env.CONTAINER_REGISTRY }}/${{ matrix.name }}:latest
         if: github.event_name != 'pull_request' && matrix.tag-as-latest && matrix.tag != 'latest'
-        uses: redhat-actions/push-to-registry@v2
-        with:
-          registry: ${{ env.CONTAINER_REGISTRY }}
-          image: ${{ matrix.name }}
-          tags: latest
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+        env:
+          IMAGE: ${{ matrix.name }}:latest
+        run: >-
+          podman manifest push --all "${IMAGE}" "${CONTAINER_REGISTRY}/${IMAGE}" --tls-verify=true --creds=${{ github.actor }}:${{ secrets.GITHUB_TOKEN }}