feat(renovate): allow to disable renovate job

chore(release): 2.36.0

* **renovate:** allow to disable renovate job ([fec5c0b8](fec5c0b8))

chore(deps): update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v2.35.2

fix: use custom goreleaser-cross image

Fixes failing tenctl release, allows more up-to-date Go versions to be
used.

chore(release): 2.36.1

* use custom goreleaser-cross image ([3fe6d82f](3fe6d82f))

* **deps:** update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v2.35.2 ([eece629c](eece629c))

chore(deps): update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v2.36.0

chore(deps): update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v2.36.1

feat: allow mock release with goreleaser

chore(release): 2.37.0

* allow mock release with goreleaser ([6b905ed5](6b905ed5))

* **deps:** update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v2.36.0 ([a0f8b6fd](a0f8b6fd))
* **deps:** update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v2.36.1 ([3592320f](3592320f))

chore(deps): update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v2.37.0

chore(deps): update dependency zricethezav/gitleaks to v8.19.1

feat: use golang-fips for compiling FIPS goreleaser modules

chore(release): 2.38.0

* use golang-fips for compiling FIPS goreleaser modules ([4b015195](4b015195))

* **deps:** update dependency zricethezav/gitleaks to v8.19.1 ([5682ac26](5682ac26))
* **deps:** update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v2.37.0 ([154cc13b](154cc13b))

chore(deps): update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v2.38.0

chore: use truncated versions for Goreleaser

Now that we manage our own goreleaser container images, it's more
straight-forward to publish truncated version tags.

This will further reduce the number of Renovate MRs.

feat: allow Goreleaser to run on default branch

chore(release): 2.39.0

* allow Goreleaser to run on default branch ([8ade73e0](8ade73e0))

* use truncated versions for Goreleaser ([96cc0364](96cc0364))

* **deps:** update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v2.38.0 ([0d77c48b](0d77c48b))

fix: typo in goreleaser rules

Fixes a typo in the rules for running goreleaser

chore(release): 2.39.1

* typo in goreleaser rules ([cea03a13](cea03a13))

chore(deps): update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v2.39.0

feat: add support for ChainGuard registry access

chore(release): 2.40.0

* add support for ChainGuard registry access ([d2c15aa0](d2c15aa0))

* **deps:** update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v2.39.0 ([8616dfb6](8616dfb6))

chore(deps): update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v2.39.1

chore(deps): update ghcr.io/containerbase/base docker tag to v11.11.17

fix: revert release_on_main_branch

Turns out this isn't as helpful as I'd hoped. Removing as it's low
value.

chore(release): 2.40.1

* revert release_on_main_branch ([ab417a3b](ab417a3b))

* **deps:** update ghcr.io/containerbase/base docker tag to v11.11.17 ([3f4b1109](3f4b1109))
* **deps:** update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v2.39.1 ([ebd0375a](ebd0375a))

chore(deps): update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v2.40.1

fix: easier debugging of common-ci-tasks

Including secret configuration source.

chore(release): 2.40.2

* easier debugging of common-ci-tasks ([485161a7](485161a7))

* **deps:** update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v2.40.1 ([3fbe6a93](3fbe6a93))

chore(deps): update dependency python/cpython to v3.12.6

chore(deps): update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v2.40.2

fix(goreleaser): remove expose_as from Gorelease artifacts

This configuration is causing some pipelines to fail, eg

https://gitlab.com/gitlab-com/gl-infra/terra-transformer/-/pipelines/1458330067

The error message is:

```
This GitLab CI configuration is invalid:
jobs:goreleaser_build:artifacts paths can't contain '*'
when used with 'expose_as'.
```

Additionally, it is not needed, nor used.

chore(release): 2.40.3

* **goreleaser:** remove expose_as from Gorelease artifacts ([a2ecb5ba](a2ecb5ba))

* **deps:** update dependency python/cpython to v3.12.6 ([1eaca1cd](1eaca1cd))
* **deps:** update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v2.40.2 ([aecea365](aecea365))

chore(deps): update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v2.40.3

chore(deps): update dependency zricethezav/gitleaks to v8.19.2

chore(deps): update dependency zricethezav/gitleaks to v8.19.3

fix: Update docs to mention vault secrets for renovate only available on default branch

chore(release): 2.40.4

* Update docs to mention vault secrets for renovate only available on default branch ([5cedbaff](5cedbaff))

* **deps:** update dependency zricethezav/gitleaks to v8.19.2 ([0dc64754](0dc64754))
* **deps:** update dependency zricethezav/gitleaks to v8.19.3 ([af916c01](af916c01))
* **deps:** update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v2.40.3 ([fd7374ca](fd7374ca))

chore(deps): update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v2.40.4

chore(deps): update ghcr.io/containerbase/base docker tag to v11.11.29

chore(deps): update dependency git/git to v2.46.2

chore(deps): update golang-patch to v1.23.2

chore(deps): update dependency nodejs/node to v20.18.0

chore(deps): update ghcr.io/containerbase/base docker tag to v12

chore(deps): update dependency pre-commit to v4

chore(deps): update pre-commit hook pre-commit/pre-commit-hooks to v5

fix: pass CI_PROJECT_DIR to Goreleaser

Adds the GitLab CI Predefined Variable, `CI_PROJECT_DIR`.

chore(release): 2.40.5

* pass CI_PROJECT_DIR to Goreleaser ([f71694a4](f71694a4))

* **deps:** update dependency git/git to v2.46.2 ([486a2bc6](486a2bc6))
* **deps:** update dependency nodejs/node to v20.18.0 ([1cbdf5bd](1cbdf5bd))
* **deps:** update dependency pre-commit to v4 ([cd112e66](cd112e66))
* **deps:** update ghcr.io/containerbase/base docker tag to v11.11.29 ([102336e4](102336e4))
* **deps:** update ghcr.io/containerbase/base docker tag to v12 ([37018ca8](37018ca8))
* **deps:** update golang-patch to v1.23.2 ([8e583483](8e583483))
* **deps:** update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v2.40.4 ([958d4bab](958d4bab))
* **deps:** update pre-commit hook pre-commit/pre-commit-hooks to v5 ([dee71140](dee71140))

chore(deps): update dependency zricethezav/gitleaks to v8.20.1

chore(deps): update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v2.40.5

chore(deps): update dependency gitlab-com/gl-infra/jsonnet-tool to v1.15.8

chore(deps): update dependency python/cpython to v3.12.7

fix: add gettext to mise container and don't delete apt-get database

Currently mise containers are unable to use `apt` packages as the
database gets deleted. This fixes that problem.

It also uses `gettext` as `envsubst` can be a useful utility.

chore(release): 2.40.6

* add gettext to mise container and don't delete apt-get database ([7053f7b5](7053f7b5))

* **deps:** update dependency gitlab-com/gl-infra/jsonnet-tool to v1.15.8 ([4a04f124](4a04f124))
* **deps:** update dependency python/cpython to v3.12.7 ([0b618aa4](0b618aa4))
* **deps:** update dependency zricethezav/gitleaks to v8.20.1 ([6d0896d7](6d0896d7))
* **deps:** update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v2.40.5 ([39c3ba3d](39c3ba3d))

chore(deps): update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v2.40.6

feat: Add template for Chef tasks

chore(release): 2.41.0

* Add template for Chef tasks ([31fe310d](31fe310d))

* **deps:** update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v2.40.6 ([0a35c08d](0a35c08d))

chore(deps): update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v2.41.0

chore(deps): update dependency gitlab-com/gl-infra/jsonnet-tool to v1.15.10

chore(deps): update dependency pre-commit to v4.0.1

fix: add kaniko deprecation notices

Adds deprecation notices for Kaniko, since we're now a `docker buildx`
shop.

chore(release): 2.41.1

* add kaniko deprecation notices ([43de0c40](43de0c40))

* **deps:** update dependency gitlab-com/gl-infra/jsonnet-tool to v1.15.10 ([5e63a2a4](5e63a2a4))
* **deps:** update dependency pre-commit to v4.0.1 ([31b5488b](31b5488b))
* **deps:** update dependency pre-commit/pre-commit to v4.0.1 ([c5dd0b80](c5dd0b80))
* **deps:** update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v2.41.0 ([f517fd47](f517fd47))

chore(deps): update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v2.41.1

chore(deps): update dependency https://gitlab.com/gitlab-com/gl-infra/common-template-copier.git to v1.23.0

chore(deps): update dependency zricethezav/gitleaks to v8.21.1

chore(deps): update dependency mvdan/sh to v3.10.0

chore(deps): update dependency git/git to v2.47.0

chore(deps): update ghcr.io/containerbase/base docker tag to v12.0.10

fix: fix docker caching

Docker image caching doesn't appear to be working at present.

This change should fix the problems in downstream builds wrt caching.

chore(release): 2.41.2

* fix docker caching ([7946fdd0](7946fdd0))

* **deps:** update dependency git/git to v2.47.0 ([a6ffded4](a6ffded4))
* **deps:** update dependency https://gitlab.com/gitlab-com/gl-infra/common-template-copier.git to v1.23.0 ([26188cc3](26188cc3))
* **deps:** update dependency mvdan/sh to v3.10.0 ([370ad662](370ad662))
* **deps:** update dependency zricethezav/gitleaks to v8.21.1 ([b6fa7128](b6fa7128))
* **deps:** update ghcr.io/containerbase/base docker tag to v12.0.10 ([98922fed](98922fed))
* **deps:** update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v2.41.1 ([d1b7d8fe](d1b7d8fe))

chore(deps): update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v2.41.2

fix: terraform fmt pre-commit hook

Currently it's not writing the change. This fixes that problem.

chore(release): 2.41.3

* terraform fmt pre-commit hook ([185fcb80](185fcb80))

* **deps:** update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v2.41.2 ([7c89d4e9](7c89d4e9))

docs: add cosign to developer setup

chore(deps): update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v2.41.3

feat: support vendir in common-ci-tasks

chore(release): 2.42.0

* support vendir in common-ci-tasks ([1c6bfa09](1c6bfa09))

* add cosign to developer setup ([330690dc](330690dc))

* **deps:** update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v2.41.3 ([649dc05a](649dc05a))

chore(deps): update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v2.42.0

fix(renovate): upgrade GitLab configs in .gitlab directory

This configures Renovate to upgrade gitlab-ci YAML files in
`.gitlab/{ci,template}` subdirectories, as the default configuration
only checks the `.gitlab-ci.yml` file.

chore(release): 2.42.1

* **renovate:** upgrade GitLab configs in .gitlab directory ([8f4ae91c](8f4ae91c))

* **deps:** update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v2.42.0 ([34ac0b69](34ac0b69))

chore(deps): update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v2.42.1

chore(deps): update dependency gitlab-com/gl-infra/jsonnet-tool to v1.16.0

feat: switch from GitLab caching to Registry caching for docker builds

Looking for performance improvements.

chore(release): 2.43.0

* switch from GitLab caching to Registry caching for docker builds ([9a45fe19](9a45fe19))

* **deps:** update dependency gitlab-com/gl-infra/jsonnet-tool to v1.16.0 ([30824386](30824386))
* **deps:** update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v2.42.1 ([3eec173a](3eec173a))

fix: broken Docker tags builds

Also, stops renovate running when Semantic Releaser pushes directly to
main branch, as this has the affect of making it appear that the main
branch is broken, when it's not.

fix: revert to working renovate image

So that we can cut a release, which will then upgrade it again.

chore(release): 2.43.1

* broken Docker tags builds ([fccc5d03](fccc5d03))
* revert to working renovate image ([0b9b975b](0b9b975b))

fix: skip renovate-validate on semantic release pushes

We're already made this change for `renovate_bot` jobs: we need to do
the same for `renovate_validate` jobs for the same reason: the image
doesn't exist until after the tag pipeline is run.

chore(release): 2.43.2

* skip renovate-validate on semantic release pushes ([af0b1b23](af0b1b23))

chore(deps): update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v2.43.1

chore(deps): update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v2.43.2

feat(docker): turn branch write caching off by default

It turns out that for many docker jobs, writing the branch write cache
takes many times longer than the docker build itself, so make it
optional.

chore(release): 2.44.0

* **docker:** turn branch write caching off by default ([8700ca04](8700ca04))

* **deps:** update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v2.43.1 ([13e2a5d5](13e2a5d5))
* **deps:** update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v2.43.2 ([c5c56e28](c5c56e28))

fix: remove 'v' prefix from truncated versions in Renovate

chore(release): 2.44.1

* remove 'v' prefix from truncated versions in Renovate ([b30fcf20](b30fcf20))

chore(deps): update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v2.44.0

fix: Add SBOM attestation to Docker build

- Added `--attest type=sbom` flag to the `docker buildx build` command in the Dockerfile.
- This flag enables SBOM (Software Bill of Materials) attestation during the Docker build process.
- The SBOM attestation helps to track and manage the dependencies and components used in the Docker
image, ensuring compliance and security.

chore(deps): update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v2.44.1

chore(release): 2.44.2

* Add SBOM attestation to Docker build ([f509b7cf](f509b7cf))

* **deps:** update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v2.44.0 ([b6be82d5](b6be82d5))
* **deps:** update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v2.44.1 ([c7d10396](c7d10396))

chore: Add integration test requirement for Ansible Galaxy major version updates

- Added a new rule in the `renovate-versions-dedicated.json` Renovate preset file to
 require an integration test for Ansible-Galaxy major version updates.
- This rule is triggered when a major version update of an Ansible Galaxy dependency is detected.
- The rule adds a label to the pull request to indicate that an integration test is required.
- For non-major version updates, also includes a note in the pull request body to remind
 developers to perform a review app deployment to ensure that the upgrade works as expected.

chore(deps): update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v2.44.2

fix(renovate-bot): Change the order of precedence for deciding between Vault and Variable.

Issue: #29

fix(renovate-bot): Continue to support the `VAULT_RENOVATE_GITLAB_TOKEN_PATH` variable.

docs(renovate-bot): Document Renovate's access tokens in detail.

chore(deps): update dependency gitlab-com/gl-infra/common-ci-tasks to v2.44.2

chore(release): 2.44.3

* **renovate-bot:** Change the order of precedence for deciding between Vault and Variable. ([34b075df](34b075df)), closes [#29](https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks/-/issues/)
* **renovate-bot:** Continue to support the `VAULT_RENOVATE_GITLAB_TOKEN_PATH` variable. ([ec188cc5](ec188cc5))

* **renovate-bot:** Document Renovate's access tokens in detail. ([d945ad90](d945ad90))

* Add integration test requirement for Ansible Galaxy major version updates ([d29aed06](d29aed06))

* **deps:** update dependency gitlab-com/gl-infra/common-ci-tasks to v2.44.2 ([137fd48d](137fd48d))
* **deps:** update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v2.44.2 ([ffac32ad](ffac32ad))

chore(deps): update dependency gitlab-com/gl-infra/jsonnet-tool to v1.16.1

feat: Add Terraform Module publisher

chore(release): 2.45.0

* Add Terraform Module publisher ([c085207e](c085207e))

* **deps:** update dependency gitlab-com/gl-infra/jsonnet-tool to v1.16.1 ([204e9540](204e9540))

fix: fix documentation, broken script

Fix publish script for Terraform Module publish

chore(release): 2.45.1

* fix documentation, broken script ([a944f33e](a944f33e))

chore(deps): update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v2.45.0

feat: add job_image and job_allow_failure to input

Adding job_image and job_allow_failure to input will allow the fields to be
configurable if desired