⬆️ deps(github-actions): update getplumber/plumber action to v0.4.2

[Open-Source-Bot]

This PR contains the following updates:

Package	Type	Update	Change
getplumber/plumber	action	minor	v0.3.89 → v0.4.2

---

Release Notes

getplumber/plumber (getplumber/plumber)

v0.4.2

Compare Source

🐛 Bug Fixes

• gate: restore the pre-0.4.0 pass for GitHub repositories without (usable) workflows (f22f5ef)

👷 CI/CD

• release: pin v0.4.1 refs [skip ci] (b885b8b)

v0.4.1

Compare Source

🐛 Bug Fixes

• gate: restore the pre-0.4.0 pass for GitHub repositories without (usable) workflows (f22f5ef)

👷 CI/CD

• release: pin v0.4.1 refs [skip ci] (b885b8b)

v0.4.0

Compare Source

✨ Features

• control: Add control actionRefsMustExistUpstream that emits issue 707 (b9817e3)

👷 CI/CD

• release: pin v0.4.0 refs [skip ci] (ddcfee6)

v0.3.101

Compare Source

⚠ BREAKING CHANGES

• gate: the JSON report and the GitHub Action no longer expose
  'compliance'; 'passed' is redefined as 'score gate met'; the default
  artifact name changed to plumber-report. Runs with nothing scoreable
  now fail closed (exit 1): on GitHub, a repository with no workflows
  previously passed the compliance gate and now fails, and a
  configuration that enables zero controls for the scanned provider (or
  a skip-all filter) also fails instead of passing with a perfect
  score. Skip Plumber or use soft-fail on repos that intentionally have
  no CI.

Co-Authored-By: Claude Fable 5 noreply@anthropic.com

✨ Features

• gate: gate runs on the Plumber Score, drop the compliance percentage (2bd2639), closes #​320 #​320

👷 CI/CD

• claude: use claude-opus-4-8 for PR review checks (0c65684)
• release: pin v0.3.101 refs [skip ci] (e209f31)

v0.3.100

Compare Source

✨ Features

• control: Add control to check for cache poisoning releaseWorkflowsMustNotRestoreUntrustedCache (2272c47)

🐛 Bug Fixes

• control: close review FP/FN gaps in cache-poisoning control (6b3a01b)
• control: Fix init to contain more default values (3b37256)

👷 CI/CD

• release: pin v0.3.100 refs [skip ci] (3baf582)

v0.3.99

Compare Source

🐛 Bug Fixes

• docker: build with Go 1.26.5 to clear GO-2026-4970 (Container Scan) (7d7921d)

👷 CI/CD

• add advisory Claude PR review automation (3d2dca6)
• claude: close review-agent secret-exfil surface + dedup/reliability (e0d4057)
• claude: extract poster logic to a unit-tested module (ad39721)
• claude: fix dedup/redaction/sandbox issues from self-review (26ae307)
• claude: fix fingerprint/sanitize/parse bugs + add a relevance bar (c370371)
• claude: fix stateful posting bugs from cursor review (897d3d1)
• claude: harden dedup fence, unanchored-on-failure, multi-line summary (7748dd9)
• claude: post each finding as a resolvable review comment (5f6c56b)
• claude: prompt for whole-system, cross-run review (c079b1a)
• claude: semantic dedup of reworded findings via Haiku (f23ee28)
• claude: stop the review from reviewing its own machinery (ab52069)
• claude: strip planted markers from untrusted finding text (5a3d334)
• claude: use Sonnet for semantic dedup to cut duplicate comments (902f900)
• fix scripts-test to pass the test file explicitly (ffd7b4c)
• release: pin v0.3.99 refs [skip ci] (8f851d5)

v0.3.98

Compare Source

🐛 Bug Fixes

• control: Update control rendered display name for workflowMustNotExportEntireSecretsContext (253822e)

👷 CI/CD

• release: pin v0.3.98 refs [skip ci] (adbdb12)

v0.3.97

Compare Source

🐛 Bug Fixes

• build: bump Go toolchain to 1.26.5 / 1.25.12 for GO-2026-5856 (868b45e)

👷 CI/CD

• release: pin v0.3.97 refs [skip ci] (3f0c5d9)

v0.3.96

Compare Source

🔧 Chores

• ci: bump docker/login-action from 4.2.0 to 4.4.0 (ae7e389)

👷 CI/CD

• release: pin v0.3.96 refs [skip ci] (71c411f)

v0.3.95

Compare Source

🔧 Chores

• ci: bump docker/setup-buildx-action from 4.1.0 to 4.2.0 (1a91876)

👷 CI/CD

• release: pin v0.3.94 refs [skip ci] (b682530)
• release: pin v0.3.95 refs [skip ci] (f521eaf)

v0.3.94

Compare Source

🔧 Chores

• ci: bump docker/setup-buildx-action from 4.1.0 to 4.2.0 (1a91876)

👷 CI/CD

• release: pin v0.3.94 refs [skip ci] (b682530)
• release: pin v0.3.95 refs [skip ci] (f521eaf)

v0.3.93

Compare Source

🔧 Chores

• ci: bump docker/build-push-action from 7.2.0 to 7.3.0 (b5a767b)

👷 CI/CD

• release: pin v0.3.93 refs [skip ci] (9344075)

v0.3.92

Compare Source

🔧 Chores

• deps: bump github.com/schollz/progressbar/v3 (93df998)

👷 CI/CD

• release: pin v0.3.91 refs [skip ci] (d562715)
• release: pin v0.3.92 refs [skip ci] (2c39b14)

v0.3.91

Compare Source

🔧 Chores

• deps: bump github.com/schollz/progressbar/v3 (93df998)

👷 CI/CD

• release: pin v0.3.91 refs [skip ci] (d562715)
• release: pin v0.3.92 refs [skip ci] (2c39b14)

v0.3.90

Compare Source

🔧 Chores

• deps: bump github.com/open-policy-agent/opa from 1.18.1 to 1.18.2 (edd7d9a)

👷 CI/CD

• release: pin v0.3.90 refs [skip ci] (fd41b0e)

---

Configuration

📅 Schedule: (in timezone Europe/Paris)

• Branch creation
  • At 10:00 PM through 11:59 PM and 12:00 AM through 06:59 AM (* 22-23,0-6 * * *)
  • Only on Sunday and Saturday (* * * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.