chore(deps): update docker/build-push-action action to v7.4.0

[scality-renovate]

This PR contains the following updates:

Package	Type	Update	Change
docker/build-push-action	action	minor	v7.3.0 → v7.4.0

---

Release Notes

docker/build-push-action (docker/build-push-action)

v7.4.0

Compare Source

• Use the shared error helper for Buildx commands by @​crazy-max in #​1620
• Prevent workflow command injection in metadata logs by @​crazy-max in #​1617
• Bump @​docker/actions-toolkit from 0.92.0 to 0.100.0 in #​1614 #​1618 #​1621
• Bump @​humanfs/node from 0.16.7 to 0.16.8 in #​1609
• Bump brace-expansion from 1.1.13 to 1.1.18 in #​1592
• Bump csv-parse from 7.0.0 to 7.0.2 in #​1613
• Bump js-yaml from 4.3.0 to 4.3.2 in #​1605 #​1615
• Bump nanoid from 3.3.16 to 3.3.18 in #​1611
• Bump postcss from 8.5.10 to 8.5.25 in #​1590
• Bump postcss-selector-parser from 7.1.1 to 7.1.5 in #​1606
• Bump sigstore from 4.1.0 to 4.1.1 in #​1577
• Bump undici from 6.27.0 to 6.28.0 in #​1594

Full Changelog: docker/build-push-action@v7.3.0...v7.4.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 9am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[github-actions]

Dependency Bump Evaluation

Version change: docker/build-push-action v7.3.0 → v7.4.0 (minor)
Semver bump type: minor

Changes:

• Security fix: prevent workflow command injection in metadata logs (#1617)
• Refactor: use shared error helper for Buildx commands (#1620)
• Internal dependency bumps (actions-toolkit, js-yaml, nanoid, undici, etc.)

Breaking changes: None

Security concerns: None — the update improves security by fixing a workflow command injection vector in metadata logs

Impact on codebase: The action is used in .github/workflows/build.yaml with standard inputs (context, build-args, push, tags, cache-from, cache-to). None of these are affected by the changes. The diff is a single-line SHA pin update.

Recommendation: SAFE TO MERGE (once CI is green)

Notes: CI checks are still in progress at time of evaluation. Merge after all checks pass.

— Claude Code