Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>

Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>

Bumps [@actions/exec](https://github.com/actions/toolkit/tree/HEAD/packages/exec) from 1.1.0 to 1.1.1.
- [Release notes](https://github.com/actions/toolkit/releases)
- [Changelog](https://github.com/actions/toolkit/blob/main/packages/exec/RELEASES.md)
- [Commits](https://github.com/actions/toolkit/commits/@actions/tool-cache@1.1.1/packages/exec)

---
updated-dependencies:
- dependency-name: "@actions/exec"
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>

chore: update dev dependencies and workflow

Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>

…ions/exec-1.1.1

Bump @actions/exec from 1.1.0 to 1.1.1

Bumps [actions/cache](https://github.com/actions/cache) from 2 to 3.
- [Release notes](https://github.com/actions/cache/releases)
- [Commits](actions/cache@v2...v3)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

…ctions/cache-3

Bump actions/cache from 2 to 3

Bumps [@actions/github](https://github.com/actions/toolkit/tree/HEAD/packages/github) from 5.0.0 to 5.0.1.
- [Release notes](https://github.com/actions/toolkit/releases)
- [Changelog](https://github.com/actions/toolkit/blob/main/packages/github/RELEASES.md)
- [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/github)

---
updated-dependencies:
- dependency-name: "@actions/github"
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>

…ions/github-5.0.1

Bump @actions/github from 5.0.0 to 5.0.1

Bumps [minimist](https://github.com/substack/minimist) from 1.2.5 to 1.2.6.
- [Release notes](https://github.com/substack/minimist/releases)
- [Commits](https://github.com/substack/minimist/compare/1.2.5...1.2.6)

---
updated-dependencies:
- dependency-name: minimist
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

…imist-1.2.6

Bump minimist from 1.2.5 to 1.2.6

Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 2 to 3.
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/master/CHANGELOG.md)
- [Commits](codecov/codecov-action@v2...v3)

---
updated-dependencies:
- dependency-name: codecov/codecov-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

…odecov/codecov-action-3

Bump codecov/codecov-action from 2 to 3

Bumps [semver](https://github.com/npm/node-semver) from 7.3.5 to 7.3.7.
- [Release notes](https://github.com/npm/node-semver/releases)
- [Changelog](https://github.com/npm/node-semver/blob/main/CHANGELOG.md)
- [Commits](npm/node-semver@v7.3.5...v7.3.7)

---
updated-dependencies:
- dependency-name: semver
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>

…ver-7.3.7

Bump semver from 7.3.5 to 7.3.7

Bumps [csv-parse](https://github.com/adaltas/node-csv/tree/HEAD/packages/csv-parse) from 4.16.3 to 5.0.4.
- [Release notes](https://github.com/adaltas/node-csv/releases)
- [Changelog](https://github.com/adaltas/node-csv/blob/master/packages/csv-parse/CHANGELOG.md)
- [Commits](https://github.com/adaltas/node-csv/commits/csv-parse@5.0.4/packages/csv-parse)

---
updated-dependencies:
- dependency-name: csv-parse
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>

Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>

…-parse-5.0.4

Bump csv-parse from 4.16.3 to 5.0.4

Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>

Bumps [docker/metadata-action](https://github.com/docker/metadata-action) from 3 to 4.
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Upgrade guide](https://github.com/docker/metadata-action/blob/master/UPGRADE.md)
- [Commits](docker/metadata-action@v3...v4)

---
updated-dependencies:
- dependency-name: docker/metadata-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

…ocker/metadata-action-4

Bump docker/metadata-action from 3 to 4

Standalone mode support

Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>

ci: fix standalone test

Node 16 as default runtime

Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>

…-parse-5.3.3

chore(deps): Bump csv-parse from 5.3.0 to 5.3.3

Bumps [json5](https://github.com/json5/json5) from 2.2.0 to 2.2.3.
- [Release notes](https://github.com/json5/json5/releases)
- [Changelog](https://github.com/json5/json5/blob/main/CHANGELOG.md)
- [Commits](json5/json5@v2.2.0...v2.2.3)

---
updated-dependencies:
- dependency-name: json5
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

…n5-2.2.3

chore(deps): Bump json5 from 2.2.0 to 2.2.3

Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>

Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>

Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>

Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>

Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>

Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>

Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>

Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>

Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>

…inputs

add attests, provenance and sbom inputs

Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>

Log GitHub Actions runtime token access controls

Signed-off-by: ruslandoga <67764432+ruslandoga@users.noreply.github.com>

Signed-off-by: ruslandoga <67764432+ruslandoga@users.noreply.github.com>

build-args newline split

This reverts commit 6afac85, reversing
changes made to 1d910c8.

Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>

Revert build-args newline split

When `provenance: false`, we should not set the builder-id.

Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>

Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>

Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>

Fix provenance input

Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>

test: move envs to jest config