chore(deps): update dependency workflow-notification to v4

[renovate]

Note

Mend has cancelled the proposed renaming of the Renovate GitHub app being renamed to mend[bot].

This notice will be removed on 2025-10-07.

---

This PR contains the following updates:

Package	Update	Change
Kong/public-shared-actions/slack-actions/workflow-notification (source)	major	2 -> 4.0.1

---

Warning

Deprecated preset: Kong/public-shared-renovate:kong-frontend-config

Your config references a deprecated preset. To prevent disruption, this file now composes the org default building blocks and layers a few tweaks so behavior stays close to the historical frontend configuration.

What’s different from the default

• Weekday automerge cadence and daily run windows (schedule:automergeWeekdays + schedule:daily + :noUnscheduledUpdates)
• Automerge enabled for minor and patch updates with required status checks
• Adds the mend-bot label alongside Renovate’s standard dependency labeling
• Timezone set to America/New_York
• Disables specific actions: Kong/kong-api-tests and the-actions-org/workflow-dispatch
• Extra grouping for GitHub Actions: non-major stable updates grouped under "non-major github actions with stable versions"

Recommended migration

Prefer switching to the default preset and applying only the bits you still need locally. Example configuration to replicate this preset’s behavior on top of the default:

{
  "extends": [
    "Kong/public-shared-renovate",
    "schedule:automergeWeekdays",
    "schedule:daily",
    ":automergeMinor",
    ":automergePatch",
    ":automergeRequireAllStatusChecks",
    ":labels(dependencies,mend-bot)",
    ":noUnscheduledUpdates",
    ":timezone(America/New_York)"
  ],
  "packageRules": [
    {
      "matchPackageNames": ["*"],
      "matchDepTypes": ["action"],
      "matchUpdateTypes": ["minor", "patch"],
      "matchCurrentVersion": "!/^v0/",
      "groupName": "non-major github actions with stable versions"
    }
  ]
}

To disable the same actions locally, add the helpers after the default in your extends list:

[
  "Kong/public-shared-renovate",
  "Kong/public-shared-renovate//helpers/disable-action(Kong/kong-api-tests)",
  "Kong/public-shared-renovate//helpers/disable-action(the-actions-org/workflow-dispatch)"
]

Timeline

This compatibility preset will be removed in January 2026. Please migrate to the default preset with local overrides before then.

---

Caution

This PR upgrades Kong/public-shared-actions sub-action to v4+ and pins it to the commit digest. It is prioritized (bypasses schedules/rate limits).

Closing this PR will not stop it; Renovate will automatically reopen or recreate it until it is merged.

---

Mandatory upgrade to v4+ with automatic digest pinning for Kong/public-shared-actions

Renovate is configured to upgrade any Kong/public-shared-actions sub-action still on versions below 4 to the latest v4+ version. As part of this upgrade, it will automatically pin each reference to the exact commit digest (and keep that digest refreshed over time).

Background

The Kong/public-shared-actions monorepo now publishes per-sub-action tags in the form <sub-action>@<version> (for example, [email protected]) instead of plain vX.Y.Z tags. Older references like ...@v2 cannot be auto-migrated by tag alone.

Why tag-only migration is not supported

Important: Renovate will not change the tag format for you. Migrating from the older plain vX.Y.Z tags to the new per-sub-action tags while keeping tag-only references would require rewriting refs such as ...@v2 to a different tag name like ...@[email protected]. This contradicts the goal of dependency update automation because it relies on humans to manage tag-name changes and ongoing updates, which our automation is not designed to perform. For this reason, tag-only migration is not supported.

Instead, this preset enforces digest pinning. Renovate resolves releases by tag, then writes the reference as the commit SHA for that release with a trailing human-friendly comment (e.g., ...@<sha> # v5.1.1). Tracking commits rather than tag names keeps updates automated and robust even if tag naming conventions change.

Security

GitHub Actions security guidance recommends pinning third-party actions to a full commit SHA to protect against tag moving and supply-chain attacks.

References

• https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions

---

Release Notes

Kong/public-shared-actions (workflow-notification)

v4.0.1

Compare Source

♻️ Chores

• ci: pin actions (#​231) (b20e862)

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - Monday through Friday ( * * * * 1-5 ) in timezone America/New_York.

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.