Bump the ci group with 2 updates

[dependabot]

Bumps the ci group with 2 updates: docker/github-builder/.github/workflows/build.yml and docker/scout-action.

Updates docker/github-builder/.github/workflows/build.yml from 1.2.0 to 1.4.0

Release notes

Sourced from docker/github-builder/.github/workflows/build.yml's releases.

v1.4.0

• build/bake: arm64 hosted runners now supported in all repositories by @​yubiuser in docker/github-builder#149

Full Changelog: docker/github-builder@v1.3.0...v1.4.0

v1.3.0

• build/bake: support metadata handlebars for some inputs by @​crazy-max in docker/github-builder#142
• update docker/actions-toolkit to 0.83.0 by @​crazy-max in docker/github-builder#144

Full Changelog: docker/github-builder@v1.2.0...v1.3.0

Commits

• 7031322 Merge pull request #149 from yubiuser/fix/privateRepo
• a5f72b3 Allow arm64 runners in private repos
• 61b16ec Merge pull request #145 from docker/dependabot/github_actions/astral-sh/setup...
• 82f1462 Merge pull request #144 from docker/actions-toolkit-0.83.0
• 1344c73 update actions-toolkit to 0.83.0
• 1fe8d34 Merge pull request #142 from crazy-max/metadata-handlebars
• 27996e3 Merge pull request #141 from crazy-max/build-fix-test
• bd5f864 build(deps): Bump astral-sh/setup-uv from 7.4.0 to 7.5.0
• b9cdc58 support metadata handlebars in build and bake inputs
• 6f4f002 ci(test): fix digest output
• See full diff in compare view

Updates docker/scout-action from 1.20.2 to 1.20.3

Release notes

Sourced from docker/scout-action's releases.

v1.20.3

What's Changed

• Improve retries of temporary and network errors @​chrispatrick
• Fix handling of dockerfiles included in provenance attestations @​chrispatrick
• Fix handling of cosign sig tags @​chrispatrick
• Use Docker Desktop HTTP proxy transport when available @​benja-M-1
• Escape mentions from CVE descriptions to prevent spam notifications @​benja-M-1

Commits

• 8910519 Merge pull request #100 from docker/release/v1.20.3
• 0690e90 [BOT] Update assets for v1.20.3 release
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Overview

Image reference	score-radius:latest	score-radius:latest
- digest	d23fd017702c	9a65d09baf97
- tag	latest	latest
- provenance	3c75b6f	fa4851f
- vulnerabilities
- platform	linux/amd64	linux/amd64
- size	5.4 MB	5.4 MB (+12 B)
- packages	40	40

Policies (0 improved, 0 worsened)

Policy Name	score-radius:latest	score-radius:latest	Change	Standing
Default non-root user	✅	✅		No Change
No AGPL v3 licenses	✅	✅		No Change
No fixable critical or high vulnerabilities	✅	✅		No Change
No high-profile vulnerabilities	✅	✅		No Change
No outdated base images	✅	✅		No Change
No unapproved base images	✅	✅		No Change
Supply chain attestations	✅	✅		No Change
Valid Docker Hardened Image (DHI) or DHI base image	⚠️ 2	⚠️ 2		No Change

Packages and Vulnerabilities (1 package changes and 0 vulnerability changes)

• ♾️ 1 packages changed
• 39 packages unchanged

Changes for packages of type golang (1 changes)

	Package	Version score-radius:latest	Version score-radius:latest
♾️	github.com/score-spec/score-radius	0.0.0-20260316201747-3c75b6fa5333+dirty	0.0.10-0.20260322221256-fa4851fc5864+dirty