Merge pull request #4502 from fluxcd/backport-4491-to-release/v2.2.x

[release/v2.2.x] build(deps): bump the ci group with 3 updates

.github/workflows/backport.yaml

@@ -17,7 +17,7 @@ jobs:
  with:
  ref: ${{ github.event.pull_request.head.sha }}
  - name: Create backport PRs
- uses: korthout/backport-action@b982d297e31f500652b2246cf26714796312bd23 # v2.2.0
+ uses: korthout/backport-action@addffea45a2f0b5682f1d5ba0506f45bc18bf174 # v2.3.0
  # xref: https:/korthout/backport-action#inputs
  with:
  # Use token to allow workflows to be triggered for the created PR

.github/workflows/ossf.yaml

@@ -28,7 +28,7 @@ jobs:
  repo_token: ${{ secrets.GITHUB_TOKEN }}
  publish_results: true
  - name: Upload artifact
- uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
+ uses: actions/upload-artifact@c7d193f32edcb7bfad88892161225aeda64e9392 # v4.0.0
  with:
  name: SARIF file
  path: results.sarif

.github/workflows/release.yaml

@@ -36,7 +36,7 @@ jobs:
  - name: Setup Syft
  uses: anchore/sbom-action/download-syft@5ecf649a417b8ae17dc8383dc32d46c03f2312df # v0.15.1
  - name: Setup Cosign
- uses: sigstore/cosign-installer@1fc5bd396d372bee37d608f955b336615edf79c8 # v3.2.0
+ uses: sigstore/cosign-installer@9614fae9e5c5eddabb09f90a270fcb487c9f7149 # v3.3.0
  - name: Setup Kustomize
  uses: fluxcd/pkg/actions/kustomize@main
  - name: Login to GitHub Container Registry
@@ -155,7 +155,7 @@ jobs:
  --path="./flux-system" \
  --source=${{ github.repositoryUrl }} \
  --revision="${{ github.ref_name }}@sha1:${{ github.sha }}"
- - uses: sigstore/cosign-installer@1fc5bd396d372bee37d608f955b336615edf79c8 # v3.2.0
+ - uses: sigstore/cosign-installer@9614fae9e5c5eddabb09f90a270fcb487c9f7149 # v3.3.0
  - name: Sign manifests
  env:
  COSIGN_EXPERIMENTAL: 1