chore(deps): update docker/metadata-action action to v6

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
docker/metadata-action	action	major	v5.10.0 → v6.0.0

---

Release Notes

docker/metadata-action (docker/metadata-action)

v6.0.0

Compare Source

• Node 24 as default runtime (requires Actions Runner v2.327.1 or later) by @​crazy-max in #​605
• List inputs now preserve # inside values while still supporting full-line # comments by @​crazy-max in #​607
• Switch to ESM and update config/test wiring by @​crazy-max in #​602
• Bump lodash from 4.17.21 to 4.17.23 in #​588
• Bump @​actions/core from 1.11.1 to 3.0.0 in #​599
• Bump @​actions/github from 6.0.1 to 9.0.0 in #​597
• Bump @​docker/actions-toolkit from 0.68.0 to 0.79.0 in #​604
• Bump @​isaacs/brace-expansion from 5.0.0 to 5.0.1 in #​600
• Bump semver from 7.7.3 to 7.7.4 in #​603

Full Changelog: docker/metadata-action@v5.10.0...v6.0.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Renovate PR Review Results

⚖️ Safety Assessment: ✅ Safe

🔍 Release Content Analysis

Major Changes:

• Node 24 Runtime Upgrade: The action now uses Node 24 as the default runtime, requiring GitHub Actions Runner v2.327.1 or later (released July 25, 2024)
• ESM Migration: Codebase switched to ECMAScript modules (internal architecture change)
• List Input Parsing Enhancement: Hash symbols (#) within values are now preserved, but inline comments (e.g., value # comment) are no longer supported - only full-line comments work

Breaking Changes:

• Requires GitHub Actions Runner v2.327.1+ for Node 24 support
• Inline comments in multiline inputs (tags, labels, etc.) must be moved to separate lines
• Example: type=semver,pattern={{version}} # production must become:

  # production
  type=semver,pattern={{version}}

Security & Dependency Updates:

• lodash: 4.17.21 → 4.17.23 (security patch)
• @actions/core: 1.11.1 → 3.0.0
• @actions/github: 6.0.1 → 9.0.0
• @docker/actions-toolkit: 0.68.0 → 0.79.0
• semver: 7.7.3 → 7.7.4

🎯 Impact Scope Investigation

Usage Location:

• Single occurrence in .github/workflows/release-please.yml:64
• Used in the publish job to generate Docker image metadata (tags and labels)

Current Configuration Analysis:

- uses: docker/metadata-action@v6.0.0
  id: meta
  with:
    images: ghcr.io/codize-dev/sandbox
    tags: |
      type=semver,pattern={{version}},value=${{ needs.release-please.outputs.tag }}
      type=semver,pattern={{major}}.{{minor}},value=${{ needs.release-please.outputs.tag }}
      type=semver,pattern={{major}},value=${{ needs.release-please.outputs.tag }}
      type=sha,format=long,prefix=
      type=raw,value=latest,enable={{is_default_branch}}

Compatibility Assessment:

• ✅ No inline comments present - all tag definitions use clean multiline format
• ✅ GitHub-hosted ubuntu-latest runners already support Actions Runner v2.327.1+ (updated regularly since July 2024)
• ✅ No API changes - inputs (images, tags) and outputs (tags, labels) remain identical
• ✅ No hash symbols in values - current configuration uses standard semver patterns

Impact on Dependencies:

• No impact on other GitHub Actions (isolated to this single action)
• No impact on Docker build process (outputs remain compatible with docker/build-push-action@v7.1.0)

💡 Recommended Actions

Immediate Action:

• ✅ Safe to merge immediately - no code changes or manual migration required

Post-Merge Verification:

1. Monitor the next release workflow execution to ensure:
   • Docker metadata generation succeeds
   • Tags are generated correctly (semver patterns, SHA, latest)
   • Image labels are properly applied
2. Verify the workflow logs show successful Node 24 runtime execution

Best Practices Going Forward:

• Continue using multiline format without inline comments in list inputs
• If adding comments to tag configurations, place them on separate lines above the values

🔗 Reference Links

• v6.0.0 Release Notes
• Node 24 Runtime PR #605
• List Input Parsing Changes PR #607
• Actions Runner v2.327.1 Release
• Full Changelog v5.10.0...v6.0.0

Generated by koki-develop/claude-renovate-review