build(deps): Bump docker/build-push-action from 6 to 7

[dependabot]

Bumps docker/build-push-action from 6 to 7.

Release notes

Sourced from docker/build-push-action's releases.

v7.0.0

• Node 24 as default runtime (requires Actions Runner v2.327.1 or later) by @​crazy-max in docker/build-push-action#1470
• Remove deprecated DOCKER_BUILD_NO_SUMMARY and DOCKER_BUILD_EXPORT_RETENTION_DAYS envs by @​crazy-max in docker/build-push-action#1473
• Remove legacy export-build tool support for build summary by @​crazy-max in docker/build-push-action#1474
• Switch to ESM and update config/test wiring by @​crazy-max in docker/build-push-action#1466
• Bump @​actions/core from 1.11.1 to 3.0.0 in docker/build-push-action#1454
• Bump @​docker/actions-toolkit from 0.62.1 to 0.79.0 in docker/build-push-action#1453docker/build-push-action#1472docker/build-push-action#1479
• Bump minimatch from 3.1.2 to 3.1.5 in docker/build-push-action#1463

Full Changelog: docker/build-push-action@v6.19.2...v7.0.0

v6.19.2

• Preserve port in GIT_AUTH_TOKEN host by @​crazy-max in docker/build-push-action#1458

Full Changelog: docker/build-push-action@v6.19.1...v6.19.2

v6.19.1

• Derive GIT_AUTH_TOKEN host from GitHub server URL by @​crazy-max in docker/build-push-action#1456

Full Changelog: docker/build-push-action@v6.19.0...v6.19.1

v6.19.0

• Scope default git auth token to github.com by @​crazy-max in docker/build-push-action#1451
• Bump brace-expansion from 1.1.11 to 1.1.12 in docker/build-push-action#1396
• Bump form-data from 2.5.1 to 2.5.5 in docker/build-push-action#1391
• Bump js-yaml from 3.14.1 to 3.14.2 in docker/build-push-action#1429
• Bump lodash from 4.17.21 to 4.17.23 in docker/build-push-action#1446
• Bump tmp from 0.2.3 to 0.2.4 in docker/build-push-action#1398
• Bump undici from 5.28.4 to 5.29.0 in docker/build-push-action#1397

Full Changelog: docker/build-push-action@v6.18.0...v6.19.0

v6.18.0

• Bump @​docker/actions-toolkit from 0.61.0 to 0.62.1 in docker/build-push-action#1381

[!NOTE] Build summary is now supported with Docker Build Cloud.

Full Changelog: docker/build-push-action@v6.17.0...v6.18.0

v6.17.0

• Bump @​docker/actions-toolkit from 0.59.0 to 0.61.0 by @​crazy-max in docker/build-push-action#1364

[!NOTE] Build record is now exported using the buildx history export command instead of the legacy export-build tool.

Full Changelog: docker/build-push-action@v6.16.0...v6.17.0

v6.16.0

• Handle no default attestations env var by @​crazy-max in docker/build-push-action#1343

... (truncated)

Commits

• d08e5c3 Merge pull request #1479 from docker/dependabot/npm_and_yarn/docker/actions-t...
• cbd2dff chore: update generated content
• f76f51f chore(deps): Bump @​docker/actions-toolkit from 0.78.0 to 0.79.0
• 7d03e66 Merge pull request #1473 from crazy-max/rm-deprecated-envs
• 98f853d chore: update generated content
• cadccf6 remove deprecated envs
• 03fe877 Merge pull request #1478 from docker/dependabot/github_actions/docker/setup-b...
• 827e366 chore(deps): Bump docker/setup-buildx-action from 3 to 4
• e25db87 Merge pull request #1474 from crazy-max/rm-export-build-tool
• 1ac2573 Merge pull request #1470 from crazy-max/node24
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[claude]

Claude finished @julienrbrt's task in 1m 24s —— View job

---

PR Review

• Gather context
• Review changed files
• Check CI status
• Post review feedback

---

Summary

This PR contains two distinct changes:

1. Dependabot bump: docker/build-push-action v6 → v7 across 3 workflow files
2. Flaky test fix (types/state_test.go): Refactors the "last header hash mismatch" test cases to handle stateful grace period logic

---

Workflow Changes (.github/workflows/*.yml)

The v6→v7 bump is straightforward. Notable v7 changes to be aware of:

• Node 24 runtime — requires Actions Runner v2.327.1+. Worth confirming self-hosted runners (if any) are on a compatible version.
• Removal of deprecated DOCKER_BUILD_NO_SUMMARY and DOCKER_BUILD_EXPORT_RETENTION_DAYS env vars — no action needed unless those are set somewhere in your workflows (they are not in this repo).

No issues found here.

---

Test Refactor (types/state_test.go)

The fix is correct and well-motivated. The comment explains the reasoning clearly:

// The last-header-hash grace period is stateful: the first mismatch is// tolerated (based-sequencer transition), the second is an error.// These two calls must run in order on the same global state, so they// cannot be independent map entries.

Moving the two cases out of the unordered map into a sequential t.Run sub-test properly expresses the ordering dependency. Good fix.

---

Underlying Concern in types/state.go (not introduced by this PR, but worth noting)

The grace-period logic relies on package-level globals:

// types/state.go:70-73var (
basedSequencerTracking sync.OncelastHeaderHashErrCount=0
)

This has several design issues worth tracking:

1. Shared across all State instances: All nodes in the same process share a single sync.Once + counter. In multi-node test scenarios (e.g., just run-n 3) or tests that create multiple State objects, the first based-sequencer transition anywhere in the process permanently exhausts the grace period for all other instances.

2. sync.Once is not resettable: Once fired, the grace is consumed for the process lifetime. There's no way to reset it, making this logic brittle in long-running nodes that go through multiple sequencer transitions.

3. Race condition potential: lastHeaderHashErrCount is read at line 97 without holding a lock, while sync.Once protects the write at line 101-103. The read at if lastHeaderHashErrCount == 1 is technically a data race if called concurrently, since sync.Once only prevents the write from running twice — it doesn't synchronize the read.

The test fix is the right short-term move. A follow-up refactor to move this state onto the State struct itself (or use an atomic) would make the code more robust.

---

Verdict

✅ Approve: The action version bump is clean, the test fix correctly resolves the flakiness. The underlying state.go globals are pre-existing and out of scope for this PR.

[github-actions]

The latest Buf updates on your PR. Results from workflow CI / buf-check (pull_request).

Build	Format	Lint	Breaking	Updated (UTC)
✅ passed	⏩ skipped	✅ passed	✅ passed	Mar 10, 2026, 8:02 AM

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 60.23%. Comparing base (87d8ba9) to head (28cf22b).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files

@@ Coverage Diff @@## main #3151 +/- ##
=======================================
Coverage 60.23% 60.23% =======================================
Files 115 115 Lines 11899 11899 =======================================
Hits 7167 7167 Misses 3922 3922 Partials 810 810 

Flag	Coverage Δ
combined	60.23% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.