build(deps): bump the actions group with 2 updates

[dependabot]

Bumps the actions group with 2 updates: actions/setup-go and theupdateframework/tuf-on-ci.

Updates actions/setup-go from 5.2.0 to 5.3.0

Release notes

Sourced from actions/setup-go's releases.

v5.3.0

What's Changed

• Use the new cache service: upgrade @actions/cache to ^4.0.0 by @​Link- in actions/setup-go#531
• Configure Dependabot settings by @​HarithaVattikuti in actions/setup-go#530
• Document update - permission section by @​HarithaVattikuti in actions/setup-go#533
• Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 by @​dependabot in actions/setup-go#534

New Contributors

• @​Link- made their first contribution in actions/setup-go#531

Full Changelog: actions/setup-go@v5...v5.3.0

Commits

• f111f33 Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 (#534)
• 3d10edb Add new permission section (#533)
• 43e1389 Configure Dependabot settings (#530)
• f81f022 Use the new cache service: upgrade @actions/cache to ^4.0.0 (#531)
• See full diff in compare view

Updates theupdateframework/tuf-on-ci from 0.15.1 to 0.15.2

Release notes

Sourced from theupdateframework/tuf-on-ci's releases.

v0.15.2

This point release fixes a bug introduced in 0.14.

• Only return open pull requests (PR) when searching for a signing event (#518). In cases where the signers rely on a fork to sign and then create a PR back to the main repository, both PRs will contain the same git commit at tip, and so multiple PRs would be returned, now only open PRs are considered.

Updating from 0.14 does not require any changes GitHub workflow files.

Changelog

Sourced from theupdateframework/tuf-on-ci's changelog.

Changelog

Unreleased

v0.15.2

This point release fixes a bug introduced in 0.14.

• Only return open pull requests (PR) when searching for a signing event (#518). In cases where the signers rely on a fork to sign and then create a PR back to the main repository, both PRs will contain the same git commit at tip, and so multiple PRs would be returned, now only open PRs are considered.

Updating from 0.14 does not require any changes GitHub workflow files.

v0.15.1

This point release fixes a bug introduced in 0.15.

• Fixed datetime handling in test-repository (#512): This is fallout from python-tuf upgrade in 0.15.0 and resulted in unexpected test-repository action failure

v0.15.0

• Fixed repository status page HTML rendering (#430)
• Dependency updates: Most importantly python-tuf and securesystemslib are now at current versions.

Updating from 0.14 does not require any changes to GitHub workflow files.

v0.14.0

• Updates the status page to include expiration time for metadata (#431)
• Compatibility updates for tuf-on-ci-sign, now runs on Python 3.9 (#433)
• Performance improvements to the signing-event action (#469)
• Dependency updates

v0.13.0

• Accept usernames without @ in .tuf-on-ci-sign.ini (#415)
• Add workaround for Sigstore root-signing migration (#422)
• Dependency updates

v0.12.0

In addition to dependency updates, this release contains one new (experimental) repository feature: Online signed targets. Updating to this version does not require any changes to GitHub workflow files.

... (truncated)

Commits

• c7edc80 Merge pull request #520 from theupdateframework/rel_v0_15_2
• 1ed1496 Merge pull request #521 from theupdateframework/revert-514-bump-python-to-3.13
• 5740cbf Revert "Bump repository and test Python version to 3.13 (#514)"
• 8ab0d23 Prepare for release v0.15.2
• ca94387 Merge pull request #518 from kommendorkapten/no-closed-prs
• f81f237 filter for only open PRs
• 6709630 Be more careful with GHA variable substitutions (#515)
• a4e046d Bump repository and test Python version to 3.13 (#514)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.