chore(deps): update docker/setup-buildx-action action to v4 - autoclosed

[homelab-renovate-1234]

This PR contains the following updates:

Package	Type	Update	Change
docker/setup-buildx-action	action	major	v3 → v4

---

Release Notes

docker/setup-buildx-action (docker/setup-buildx-action)

v4.4.1

Compare Source

• Skip BuildKit image pre-pulls for explicit endpoints by @​crazy-max in #​624

Full Changelog: docker/setup-buildx-action@v4.4.0...v4.4.1

v4.4.0

Compare Source

• Use official Buildx releases for cloud driver by @​crazy-max in #​606
• Pull BuildKit image before builder creation by @​crazy-max in #​609
• Use shared error helpers for Buildx and Docker commands by @​crazy-max in #​620
• Bump @​docker/actions-toolkit from 0.95.0 to 0.100.0 in #​610 #​618 #​619
• Bump @​humanfs/node from 0.16.7 to 0.16.8 in #​614
• Bump js-yaml from 5.3.0 to 5.4.2 in #​608 #​617
• Bump postcss-selector-parser from 7.1.1 to 7.1.5 in #​611

Full Changelog: docker/setup-buildx-action@v4.3.0...v4.4.0

v4.3.0

Compare Source

• Bump @​docker/actions-toolkit from 0.92.0 to 0.95.0 in #​595
• Bump brace-expansion from 1.1.13 to 1.1.18 in #​600
• Bump js-yaml from 5.2.0 to 5.3.0 in #​585
• Bump postcss from 8.5.10 to 8.5.25 in #​598
• Bump undici from 6.27.0 to 6.28.0 in #​601

Full Changelog: docker/setup-buildx-action@v4.2.0...v4.3.0

v4.2.0

Compare Source

• Preserve names in esbuild bundle by @​crazy-max in #​572
• Bump @​actions/core from 3.0.0 to 3.0.1 in #​551
• Bump @​docker/actions-toolkit from 0.90.0 to 0.92.0 in #​557 #​580
• Bump @​sigstore/core from 3.1.0 to 3.2.1 in #​573
• Bump @​sigstore/verify from 3.1.0 to 3.1.1 in #​576
• Bump js-yaml from 4.1.1 to 5.2.0 in #​562
• Bump sigstore from 4.1.0 to 4.1.1 in #​577
• Bump tmp from 0.2.5 to 0.2.7 in #​556
• Bump undici from 6.25.0 to 6.27.0 in #​570
• Bump vite from 7.3.2 to 7.3.6 in #​569

Full Changelog: docker/setup-buildx-action@v4.1.0...v4.2.0

v4.1.0

Compare Source

• Bump @​docker/actions-toolkit from 0.79.0 to 0.90.0 in #​489
• Bump brace-expansion from 1.1.12 to 5.0.6 in #​547 #​508
• Bump fast-xml-builder from 1.0.0 to 1.2.0 in #​540
• Bump fast-xml-parser from 5.4.2 to 5.8.0 in #​496
• Bump flatted from 3.3.3 to 3.4.2 in #​499
• Bump glob from 10.3.12 to 13.0.6 in #​495
• Bump handlebars from 4.7.8 to 4.7.9 in #​504
• Bump lodash from 4.17.23 to 4.18.1 in #​523
• Bump picomatch from 4.0.3 to 4.0.4 in #​503
• Bump postcss from 8.5.6 to 8.5.10 in #​537
• Bump tar from 6.2.1 to 7.5.15 in #​545
• Bump undici from 6.23.0 to 6.25.0 in #​492
• Bump vite from 7.3.1 to 7.3.2 in #​520

Full Changelog: docker/setup-buildx-action@v4.0.0...v4.1.0

v4.0.0

Compare Source

• Node 24 as default runtime (requires Actions Runner v2.327.1 or later) by @​crazy-max in #​483
• Remove deprecated inputs/outputs by @​crazy-max in #​464
• Switch to ESM and update config/test wiring by @​crazy-max in #​481
• Bump @​actions/core from 1.11.1 to 3.0.0 in #​475
• Bump @​docker/actions-toolkit from 0.63.0 to 0.79.0 in #​482 #​485
• Bump js-yaml from 4.1.0 to 4.1.1 in #​452
• Bump lodash from 4.17.21 to 4.17.23 in #​472
• Bump minimatch from 3.1.2 to 3.1.5 in #​480

Full Changelog: docker/setup-buildx-action@v3.12.0...v4.0.0

v4

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[homelab-agents-1234]

🤖 Agent activity — one machine comment per timeline, appended in place (ADR-103). Run detail lives in the agent-ride check-run, the ledger and s3://agent-transcripts/; this is the index.

• 2026-09-25T11:10:33Z · picking this up (major bump, round 1) — docker/setup-buildx-action v3→v4; waiting on the in-flight ci verdict, then dispatching the reviewer to map the v4 migration onto this repo's two build workflows.
• 2026-09-25T11:20:05Z · migration documented, CI green, reviewer-approved — ready for a human to merge (major/awaiting-human). v4 breaking changes: Node 24 runtime, removed install input, deprecated endpoint/status/flags outputs — neither call site (ci.yaml, build-image.yaml) passes inputs or consumes outputs, both are bare uses:, so no adaptation was needed. ci passed at head (9m9s) on the self-hosted homelab-ephemeral runner, which is the empirical Node-24 compatibility proof. One residual the reviewer flagged and I am NOT filing as an issue: build-image.yaml is master-push-only, so v4 is unexercised on the push+multi-arch path — it self-resolves on the next master push, and the runner compatibility carries over from ci. reviewDecision stays REVIEW_REQUIRED by design: whole-repo CODEOWNERS + require_code_owner_review means the bot approval is input, never the gate. Auto-merge deliberately un-armed — @RasmusSoot approves and merges. Reviewer verdict: homelab-reviewer APPROVED at 2026-09-25T11:18:39Z.

[homelab-reviewer]

Migration investigation: docker/setup-buildx-action v3 → v4

v4.0.0 has three breaking changes; none require adaptation in this repo.

Breaking change	Usage in this repo	Verdict
Node 24 runtime (requires Actions Runner ≥ v2.327.1)	Both workflows run on homelab-ephemeral (self-hosted ARC). The ci check completed SUCCESS at this head with v4 — empirical proof the runner already supports Node 24.	✓ no action
Removed install input (docker/setup-buildx-action#464)	Both call sites use bare uses: with no with: block; install was never set.	✓ no action
Deprecated outputs endpoint, status, flags (use nodes)	Neither step declares an id:; no outputs are consumed downstream.	✓ no action

Unverified judgment

ci.yaml was exercised by v4 at head (the SUCCESS check). build-image.yaml triggers only on push to master, so it has not been exercised yet — it shares the homelab-ephemeral runner pool with ci, so runner compatibility carries over, but any divergence in the post-step cleanup or push path would only surface on the first master push post-merge. I did not take a look at the ARC runner version directly (no access); the ci-at-head SUCCESS is what I'm relying on.

Pin format

The SHA-pin with # v4 comment is Renovate's default supply-chain-hardening format for major bumps. It is stricter than the surrounding @v4/@v3/@v6 branch pins in these files, but consistent with what Renovate emits for majors and not a defect.

TOUCHES

undeclared — major bumps are coordinator-owned and do not close an issue.