chore(deps): update public-sector catalog to v6.2.1

This MR contains the following updates:

Package	Update	Change	Pending
compliance	minor	v6.0.0 → v6.2.1	v6.2.2
container	minor	v6.0.0 → v6.2.1	v6.2.2
container-attest	minor	v6.0.0 → v6.2.1	v6.2.2
container-sbom	minor	v6.0.0 → v6.2.1	v6.2.2
container-scan-summary	minor	v6.0.0 → v6.2.1	v6.2.2
container-sign	minor	v6.0.0 → v6.2.1	v6.2.2
release	minor	v6.0.0 → v6.2.1	v6.2.2
vale	minor	v6.0.0 → v6.2.1	v6.2.2
verify	minor	v6.0.0 → v6.2.1	v6.2.2

---

Release Notes

gitlab-com/public-sector/pipeline (compliance)

v6.2.1: pipeline v6.2.1

Compare Source

Catalog v6.2.1

groundskeeper: iterationCreate now sends the required groupPath. The omission passed GraphQL validation (groupPath and projectPath are individually nullable; exactly one is enforced only at resolution) and stopped v6.2.0's first real apply fail-closed after milestone_window's batch had landed. The offline fake now enforces both mutations' required arguments, so this class fails the test suite instead of the estate.

v6.2.0

Compare Source

Catalog v6.2.0

groundskeeper: a scheduled component that keeps a standing demonstration estate from decaying. It plans by default, applies only when told to, and the estate carries no executable code. First release, hardened by an adversarial review (full manifest schema validation at load time, a documented field reference for every keeper kind) and by a live-fire fix to the iteration_horizon GraphQL query that the first real plan run surfaced. Also in this release: bots.yaml and a scheduled bot-maintenance audit that declare and check every standing credential in the group, and the ci-tools and ci-buildah images move to UBI10 for python 3.12 (ci-buildkit stays on UBI9; the reasons are recorded in the file). -----BEGIN PGP SIGNATURE-----

iLEEABMJADkWIQTQJJWB9gVmAb5GkodsdSCnUIsXvAUCaomklRsUgAAAAAAEAA5t YW51MiwyLjUrMS4xMiwwLDMACgkQbHUgp1CLF7ye4AF8CtlaJVY8QMNM45ucnhmO miPsUI4KIaPq2WlXX+Cng5EQ77iVk4kwvqV79VLeH0g5AX4pSHx/tq7ktwGstLqO v2XQrxpavqpx6PVv8opddcD0YWONkXkhUa6itiQ3adeovNQ= =iTMh -----END PGP SIGNATURE-----

v6.1.0: pipeline v6.1.0

Compare Source

Catalog v6.1.0

ci-go toolchain refresh: Go 1.26.4 -> 1.26.5, clearing GO-2026-5856 (CVE-2026-42505, a crypto/tls Encrypted Client Hello pre-shared-key identity disclosure), and golangci-lint v2.4.0 -> v2.12.2, whose predecessor panicked analyzing Go 1.26 code and kept consumer CI lint gates disabled. Consumers pinning ci-go can restore blocking audit gates and re-enable golangci-lint in CI at this tag.

Instance fix behind work item #​5; the Go-patch release cadence it proposes remains open.

v6.0.1: pipeline v6.0.1

Compare Source

Catalog v6.0.1

Fail-loud sweep across every template whose script block could mask a failure behind a trailing echo. binary's publish-to-package-registry and sign-blob loops, container's :latest/:TAG push blocks, and verify's :latest/:TAG verification blocks -- the highest-stakes instance, since verify exists solely to assert signature integrity -- now run under set -euo pipefail. A failed upload, sign, push, or verification now fails the job instead of shipping a green pipeline with a missing or unverified artifact.

Also carries the Renovate delivery work merged since v6.0.0: automerge for lockfile/pin/digest updates, catalog bumps exempt from the concurrent-MR cap, the renovate-fleet-audit delivery gate, lab projects moved to dashboard approval, and token-rotation survival.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻️ Rebasing: Whenever MR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this MR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this MR, check this box

---

This MR has been generated by Mend Renovate.