chore(deps): update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v3.12

See merge request !1363

chore(deps): update dependency open-policy-agent/conftest to v0.67.0

See merge request !1370

chore(deps): update dependency jdx/mise to v2026.3.9

See merge request !1368

chore(deps): update ghcr.io/containerbase/base docker tag to v14.6.4

See merge request !1369

chore(deps): update dependency renovate to v43.77.0

See merge request !1371

# Conflicts:
#   appsec-container-scan.md
#   templates/appsec-container-scan/README.md

feat: remove appsec container scanning

See merge request !1296

Craig Miskell authored Mar 17, 2026 and Andrew Newdigate committed Mar 17, 2026

Prevent artifacts from other jobs (e.g. parent pipeline jobs with
modified files) being injected into the goreleaser workspace.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

chore: Add Release and Deploy folks to CODEOWNERS

See merge request !1372

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

feat(gitlab-scanners): add include_dependency_scanning input to allow disabling dep scanning

See merge request !1365

## [3.13.0](https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks/-/compare/...) (2026-03-18)

### Features

* **gitlab-scanners:** add include_dependency_scanning input to allow disabling dep scanning ([009869b8](009869b8))

### Others

* gitignore claude local settings file ([0f0fb9b7](0f0fb9b7))

### Dependencies

* **deps:** update dependency jdx/mise to v2026.3.9 ([73886366](73886366))
* **deps:** update dependency open-policy-agent/conftest to v0.67.0 ([bcf26a80](bcf26a80))
* **deps:** update dependency renovate to v43.77.0 ([d94c51c1](d94c51c1))
* **deps:** update ghcr.io/containerbase/base docker tag to v14.6.4 ([476204e5](476204e5))
* **deps:** update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v3.12 ([ee9d4fbb](ee9d4fbb))

- opa.yml: change `.include:` to `include:` — the leading dot made this
  a hidden YAML key, silently dropping the minimal-clone and
  other-versions includes
- jsonnetfmt.yml: fix after_script help text referencing wrong job name
  ("jsonfmt" instead of "jsonnetfmt")
- go-mod-tidy.yml: remove redundant first rule that is a strict subset
  of the second rule (MR-only is already covered by MR-or-default-branch)

AI-assisted: GitLab Duo Agentic Chat (Claude Opus 4.6)

correct three CI component bugs found during codebase audit

See merge request !1373

## [3.13.1](https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks/-/compare/...) (2026-03-19)

### Fixes

* correct three CI component bugs found during codebase audit ([420721e1](420721e1))

fix: localize goreleaser artifacts with `dependencies: []`

See merge request !1366

chore(deps): update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v3.13

See merge request !1376

## [3.13.2](https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks/-/compare/...) (2026-03-19)

### Fixes

* **goreleaser:** localize artifacts with dependencies: [] ([eaca41a8](eaca41a8))

### Dependencies

* **deps:** update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v3.13 ([8fecbd9c](8fecbd9c))