Bump docker/build-push-action from 4 to 5 (#2328)

* Bump docker/build-push-action from 4 to 5

Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 4 to 5.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](docker/build-push-action@v4...v5)

---
updated-dependencies:
- dependency-name: docker/build-push-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* deps(gha): use commit id for docker/build-push-action version

* deps(gha): use commit id for docker/login-action version

* deps(gha): use commit id for docker/metadata-action version

Upgrades the action to 96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0

Release notes:

Release notes
Sourced from docker/metadata-action's releases.

v5.0.0
Node 20 as default runtime (requires Actions Runner v2.308.0 or later) by @​crazy-max in docker/metadata-action#328
Bump @​actions/core from 1.10.0 to 1.10.1 in docker/metadata-action#333
Bump csv-parse from 5.4.0 to 5.5.0 in docker/metadata-action#320
Bump semver from 7.5.1 to 7.5.2 in docker/metadata-action#304
Bump handlebars from 4.7.7 to 4.7.8 in docker/metadata-action#315
Full Changelog: docker/metadata-action@v4.6.0...v5.0.0

v4.6.0
Dedup and sort labels by @​crazy-max in docker/metadata-action#301
Bump @​docker/actions-toolkit from 0.3.0 to 0.5.0 in docker/metadata-action#302
Full Changelog: docker/metadata-action@v4.5.0...v4.6.0

v4.5.0
Bump @​docker/actions-toolkit from 0.1.0 to 0.3.0 in docker/metadata-action#296
Bump csv-parse from 5.3.8 to 5.4.0 in docker/metadata-action#294
Full Changelog: docker/metadata-action@v4.4.0...v4.5.0

v4.4.0
Add context input to define the metadata provider by @​neilime in docker/metadata-action#248
Switch to actions-toolkit implementation by @​crazy-max in docker/metadata-action#266 docker/metadata-action#273 docker/metadata-action#284
Bump csv-parse from 5.3.3 to 5.3.8 in docker/metadata-action#271 docker/metadata-action#286
Bump moment-timezone from 0.5.40 to 0.5.43 in docker/metadata-action#268 docker/metadata-action#278 docker/metadata-action#281
Bump semver from 7.4.0 to 7.5.0 in docker/metadata-action#285
Full Changelog: docker/metadata-action@v4.3.0...v4.4.0

v4.3.0
Provide outputs as env vars by @​crazy-max (#257)
Full Changelog: docker/metadata-action@v4.2.0...v4.3.0

v4.2.0
Add tz attribute to handlebar date function by @​chroju (#251)
Bump minimatch from 3.0.4 to 3.1.2 (#242)
Bump csv-parse from 5.3.1 to 5.3.3 (#245)
Bump json5 from 2.2.0 to 2.2.3 (#252)
Full Changelog: docker/metadata-action@v4.1.1...v4.2.0

v4.1.1
Revert changes to set associated head sha on pull request event by @​crazy-max (#239)
User can still set associated head sha on PR by setting the env var DOCKER_METADATA_PR_HEAD_SHA=true
Bump csv-parse from 5.3.0 to 5.3.1 (#237)
Full Changelog: docker/metadata-action@v4.1.0...v4.1.1

... (truncated)

Ref #2332

* deps(gha): upgrade the setup-buildx-action to v3.0.0

Uses commit id for docker/setup-buildx-action version

Release notes at https://github.com/docker/setup-buildx-action/releases/tag/v3.0.0

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Julio <1953782+julio-lopez@users.noreply.github.com>

.github/workflows/atlas-image-build.yaml

@@ -36,10 +36,10 @@ jobs:
     if: needs.check-files.outputs.changed == 'true'
     steps:
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v2
+      uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
     - name: Image metadata
       id: meta
-      uses: docker/metadata-action@v4
+      uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0
       with:
         images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
         tags: |
@@ -48,13 +48,13 @@ jobs:
           {{date 'YYYY.MM.DD-HHmm'}}
           ${{ inputs.tag }}
     - name: Login to GHCR
-      uses: docker/login-action@v3
+      uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
       with:
         registry: ${{ env.REGISTRY }}
         username: ${{ github.actor }}
         password: ${{ secrets.GITHUB_TOKEN }}
     - name: Build and push
-      uses: docker/build-push-action@v4
+      uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0
       with:
         context: "{{defaultContext}}:docker/mongodb-atlas"
         push: true

.github/workflows/kanister-image-build.yaml

@@ -39,10 +39,10 @@ jobs:
     # if: needs.check-files.outputs.changed == 'true'
     steps:
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v2
+      uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
     - name: Image metadata
       id: meta
-      uses: docker/metadata-action@v4
+      uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0
       with:
         images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
         tags: |
@@ -51,13 +51,13 @@ jobs:
           {{date 'YYYY.MM.DD-HHmm'}}
           ${{ inputs.tag }}
     - name: Login to GHCR
-      uses: docker/login-action@v3
+      uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
       with:
         registry: ${{ env.REGISTRY }}
         username: ${{ github.actor }}
         password: ${{ secrets.GITHUB_TOKEN }}
     - name: Build and push
-      uses: docker/build-push-action@v4
+      uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0
       with:
         context: "{{defaultContext}}:docker/build"
         push: true

.github/workflows/main.yaml

@@ -82,7 +82,7 @@ jobs:
     - uses: actions/download-artifact@v3
       with:
         name: src
-    - uses: docker/login-action@v3
+    - uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
       with:
         registry: ghcr.io
         username: ${{ github.actor }}