chore(deps): update docker/build-push-action action to v7.4.0

[scality-renovate]

This PR contains the following updates:

Package	Type	Update	Change
docker/build-push-action	action	minor	v7.3.0 → v7.4.0

---

Release Notes

docker/build-push-action (docker/build-push-action)

v7.4.0

Compare Source

• Use the shared error helper for Buildx commands by @​crazy-max in #​1620
• Prevent workflow command injection in metadata logs by @​crazy-max in #​1617
• Bump @​docker/actions-toolkit from 0.92.0 to 0.100.0 in #​1614 #​1618 #​1621
• Bump @​humanfs/node from 0.16.7 to 0.16.8 in #​1609
• Bump brace-expansion from 1.1.13 to 1.1.18 in #​1592
• Bump csv-parse from 7.0.0 to 7.0.2 in #​1613
• Bump js-yaml from 4.3.0 to 4.3.2 in #​1605 #​1615
• Bump nanoid from 3.3.16 to 3.3.18 in #​1611
• Bump postcss from 8.5.10 to 8.5.25 in #​1590
• Bump postcss-selector-parser from 7.1.1 to 7.1.5 in #​1606
• Bump sigstore from 4.1.0 to 4.1.1 in #​1577
• Bump undici from 6.27.0 to 6.28.0 in #​1594

Full Changelog: docker/build-push-action@v7.3.0...v7.4.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 9am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[github-actions]

Dependency Bump Evaluation

Version change: v7.3.0 → v7.4.0 (minor)
Semver bump type: minor

Changes:

• Security fix: Prevents workflow command injection in metadata logs (#1617) — the docker-container driver writes the GitHub event payload into --metadata-file, and untrusted content (PR titles, branch names) could inject workflow commands when logged. Fixed by using printUntrusted to bracket output with ::stop-commands::.
• Shared error helper for Buildx commands (#1620)
• 10 internal dependency bumps (@docker/actions-toolkit 0.92.0→0.100.0, js-yaml, nanoid, postcss, undici, etc.)

Breaking changes: None

Security concerns: None — the update improves security by closing a moderate-to-high command injection vector in metadata logging.

Impact on codebase: Single usage in .github/workflows/build.yaml with standard inputs (context, build-args, push, tags, cache-from, cache-to). No inputs or behavior used by this repo are affected by the changes.

Recommendation: SAFE TO MERGE

Notes: This update is recommended promptly as it includes a security hardening fix. The action's API surface is unchanged — all changes are internal (error handling, log sanitization, transitive dependency bumps).

— Claude Code