ci: bump docker/login-action from 0267638d8ae53966df71bb06d552129dd542dfa7 to 946f94de75ea52995b6aa1e54fd3e0aeed6cc573 in the github-actions group across 1 directory

[dependabot]

Bumps the github-actions group with 1 update in the / directory: docker/login-action.

Updates docker/login-action from 0267638d8ae53966df71bb06d552129dd542dfa7 to 946f94de75ea52995b6aa1e54fd3e0aeed6cc573

Commits

• 946f94d Merge pull request #1007 from crazy-max/ci-creds-update
• f50e5f8 ci: update registry to auth to gar
• c5e5fd0 ci: update registry to auth to acr
• 60e5331 ci: update registry to auth to ecr
• 6a848e5 ci: update secrets to auth to docker hub
• See full diff in compare view

[Evrard-Nil]

@dependabot rebase

[PierreLeGuen]

Routine Dependabot bump of the docker/login-action commit pin from 0267638d to 946f94de across four workflows (build.yml, promote.yml, retag.yml, rollback.yml). The change is safe to merge:

• The new SHA exists upstream in docker/login-action and matches the verified tip of upstream master, merged by the maintainer on 2026-06-09 (not a fork commit).
• The delta from the old pin (5 commits) touches only docker/login-action's own internal CI workflow — no changes to action.yml or the compiled dist/ runtime, so this is functionally a no-op for consumers.
• All four references were updated consistently; no stale references to the old SHA remain in .github/, and all four files parse as valid YAML.

One non-blocking observation: neither the old nor the new pin corresponds to a release tag — this repo is pinning floating master commits (.github/workflows/build.yml:34, promote.yml:49, retag.yml:77, rollback.yml:61), so each Dependabot bump ingests unreleased code from the upstream default branch. That practice predates this PR, but consider re-pinning to the latest release SHA (v4.2.0, 650006c6eb7dba73a995cc03b0b2d7f5ca915bee) with a # v4.2.0 comment so Dependabot tracks releases instead of branch tips.

Checks run locally: inspected the full PR diff (4 files, 4 insertions/4 deletions, pin bump only); verified both SHAs resolve upstream via the GitHub API and compared old→new and master→new; grepped .github/ for stale old-SHA references (none); YAML-parsed all four modified workflows (valid); git diff --check clean. actionlint was skipped (not installed); cargo build/test skipped since no Rust code changed. PR CI showed Lint passing with Test Suite and security_audit still pending at review time — none of those jobs exercise the changed workflows.

[lloydmak99]

Approve. Mechanical SHA bump for docker/login-action across 4 CI workflows — no logic changes.