build(deps): bump picomatch from 4.0.3 to 4.0.4

Bumps [picomatch](https://github.com/micromatch/picomatch) from 4.0.3 to 4.0.4.
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](https://github.com/micromatch/picomatch/compare/4.0.3...4.0.4)

---
updated-dependencies:
- dependency-name: picomatch
  dependency-version: 4.0.4
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/dependabot.yml

@@ -4,12 +4,6 @@ updates:
     directory: "/"
     schedule:
       interval: "daily"
-    cooldown:
-      default-days: 2
-    groups:
-      crazy-max-dot-github:
-        patterns:
-          - "crazy-max/.github/*"
     labels:
       - "dependencies"
       - "bot"
@@ -17,10 +11,6 @@ updates:
     directory: "/"
     schedule:
       interval: "daily"
-    cooldown:
-      default-days: 2
-      exclude:
-        - "@docker/actions-toolkit"
     versioning-strategy: "increase"
     allow:
       - dependency-type: "production"

.github/workflows/ci.yml

@@ -1,8 +1,5 @@
 name: ci
 
-permissions:
-  contents: read
-
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -25,7 +22,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@v6
       -
         name: Set up QEMU
         id: qemu
@@ -48,7 +45,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@v6
       -
         name: Set up QEMU
         id: qemu
@@ -65,7 +62,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@v6
       -
         name: Stop docker
         run: |
@@ -95,7 +92,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@v6
       -
         name: Set up QEMU
         id: qemu
@@ -119,29 +116,9 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@v6
       -
         name: Set up QEMU
         uses: ./
         with:
           image: ${{ matrix.image }}
-
-  reset:
-    runs-on: ubuntu-latest
-    steps:
-      -
-        name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      -
-        name: Install multiarch/qemu-user-static
-        run: |
-          docker run --rm --privileged multiarch/qemu-user-static --reset -p yes -c yes
-      -
-        name: Set up QEMU
-        id: qemu
-        uses: ./
-        with:
-          reset: true
-      -
-        name: Available platforms
-        run: echo ${{ steps.qemu.outputs.platforms }}

.github/workflows/codeql.yml

@@ -1,8 +1,5 @@
 name: codeql
 
-permissions:
-  contents: read
-
 on:
   push:
     branches:
@@ -10,19 +7,21 @@ on:
       - 'releases/v*'
   pull_request:
 
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
 env:
   NODE_VERSION: "24"
 
 jobs:
   analyze:
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      security-events: write
     steps:
       -
         name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@v6
       -
         name: Enable corepack
         run: |
@@ -30,17 +29,17 @@ jobs:
           yarn --version
       -
         name: Set up Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@v6
         with:
           node-version: ${{ env.NODE_VERSION }}
       -
         name: Initialize CodeQL
-        uses: github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
+        uses: github/codeql-action/init@v4
         with:
           languages: javascript-typescript
           build-mode: none
       -
         name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
+        uses: github/codeql-action/analyze@v4
         with:
           category: "/language:javascript-typescript"

.github/workflows/pr-assign-author.yml

@@ -4,14 +4,14 @@ permissions:
   contents: read
 
 on:
-  pull_request_target: # zizmor: ignore[dangerous-triggers] safe to use without checkout
+  pull_request_target:
     types:
       - opened
       - reopened
 
 jobs:
   run:
-    uses: crazy-max/.github/.github/workflows/pr-assign-author.yml@9ba6e6f9450baf3b1237f8035c1fdc45932510bd # v1.8.0
+    uses: crazy-max/.github/.github/workflows/pr-assign-author.yml@20ef82212dc54bab5749f5e05576ca6d3c8a5773 # v1.1.0
     permissions:
       contents: read
       pull-requests: write

.github/workflows/publish.yml

@@ -1,12 +1,5 @@
 name: publish
 
-permissions:
-  contents: read
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
 on:
   release:
     types:
@@ -22,7 +15,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@v6
       -
         name: Publish
-        uses: actions/publish-immutable-action@4bc8754ffc40f27910afb20287dbbbb675a4e978 # v0.0.4
+        uses: actions/publish-immutable-action@v0.0.4

.github/workflows/test.yml

@@ -1,8 +1,5 @@
 name: test
 
-permissions:
-  contents: read
-
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -20,16 +17,16 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@v6
       -
         name: Test
-        uses: docker/bake-action@6614cfa25eff9a0b2b2697efb0b6159e7680d584 # v7.2.0
+        uses: docker/bake-action@v7
         with:
           source: .
           targets: test
       -
         name: Upload coverage
-        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
+        uses: codecov/codecov-action@v5
         with:
           files: ./coverage/clover.xml
           token: ${{ secrets.CODECOV_TOKEN }}

.github/workflows/update-dist.yml

@@ -1,12 +1,5 @@
 name: update-dist
 
-permissions:
-  contents: read
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
 on:
   pull_request:
     types:
@@ -15,29 +8,27 @@ on:
 
 jobs:
   update-dist:
-    if: github.actor == 'dependabot[bot]' && github.event.pull_request.user.login == 'dependabot[bot]' && github.repository == github.event.pull_request.head.repo.full_name
+    if: github.actor == 'dependabot[bot]'
     runs-on: ubuntu-latest
     steps:
       -
         name: GitHub auth token from GitHub App
         id: docker-read-app
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@v3
         with:
           app-id: ${{ secrets.GHACTIONS_REPO_WRITE_APP_ID }}
           private-key: ${{ secrets.GHACTIONS_REPO_WRITE_APP_PRIVATE_KEY }}
           owner: docker
-          repositories: setup-qemu-action
-          permission-contents: write
       -
         name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@v6
         with:
           ref: ${{ github.event.pull_request.head.ref }}
           fetch-depth: 0
-          token: ${{ steps.docker-read-app.outputs.token }}
+          token: ${{ steps.docker-read-app.outputs.token || github.token }}
       -
         name: Build
-        uses: docker/bake-action@6614cfa25eff9a0b2b2697efb0b6159e7680d584 # v7.2.0
+        uses: docker/bake-action@v7
         with:
           source: .
           targets: build

.github/workflows/validate.yml

@@ -1,8 +1,5 @@
 name: validate
 
-permissions:
-  contents: read
-
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -22,11 +19,11 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@v6
       -
         name: Generate matrix
         id: generate
-        uses: docker/bake-action/subaction/matrix@6614cfa25eff9a0b2b2697efb0b6159e7680d584 # v7.2.0
+        uses: docker/bake-action/subaction/matrix@v7
         with:
           target: validate
 
@@ -41,6 +38,6 @@ jobs:
     steps:
       -
         name: Validate
-        uses: docker/bake-action@6614cfa25eff9a0b2b2697efb0b6159e7680d584 # v7.2.0
+        uses: docker/bake-action@v7
         with:
           targets: ${{ matrix.target }}

.github/workflows/zizmor.yml

@@ -1,29 +0,0 @@
-name: zizmor
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-on:
-  workflow_dispatch:
-  push:
-    branches:
-      - 'master'
-      - 'releases/v*'
-    tags:
-      - 'v*'
-  pull_request:
-
-jobs:
-  zizmor:
-    uses: crazy-max/.github/.github/workflows/zizmor.yml@9ba6e6f9450baf3b1237f8035c1fdc45932510bd # v1.8.0
-    permissions:
-      contents: read
-      security-events: write
-    with:
-      min-severity: medium
-      min-confidence: medium
-      persona: pedantic

.yarnrc.yml

@@ -1,10 +1,10 @@
 # https://yarnpkg.com/configuration/yarnrc
 
-nodeLinker: node-modules
+compressionLevel: mixed
+enableGlobalCache: false
+enableHardenedMode: true
 
 logFilters:
-  - code: YN0004
-    level: discard
   - code: YN0013
     level: discard
   - code: YN0019
@@ -14,8 +14,6 @@ logFilters:
   - code: YN0086
     level: discard
 
-compressionLevel: mixed
-enableGlobalCache: false
-enableHardenedMode: true
-enableScripts: false
-npmMinimalAgeGate: 2d
+nodeLinker: node-modules
+
+npmAuthToken: "${NODE_AUTH_TOKEN:-fallback}"

README.md

@@ -35,34 +35,6 @@ jobs:
         uses: docker/setup-qemu-action@v4
 ```
 
-This action registers QEMU emulators with `binfmt_misc`, so later steps can run
-containers built for another architecture on the GitHub-hosted runner.
-
-```yaml
-name: run-cross-platform-container
-
-on:
-  workflow_dispatch:
-
-jobs:
-  qemu-example:
-    runs-on: ubuntu-latest
-    steps:
-      -
-        name: Set up QEMU
-        uses: docker/setup-qemu-action@v4
-      -
-        name: Run an arm64 container
-        run: docker run --rm --platform linux/arm64 alpine uname -m
-```
-
-The command above prints `aarch64` even though the job itself is running on
-`ubuntu-latest`.
-
-> [!TIP]
-> `setup-qemu-action` enables user-mode emulation for registered platforms. It
-> does not install `qemu-system-*` tools or add `qemu-*` binaries to your PATH.
-
 > [!NOTE]
 > If you are using [`docker/setup-buildx-action`](https://github.com/docker/setup-buildx-action),
 > this action should come before it:
@@ -86,7 +58,6 @@ The following inputs can be used as `step.with` keys:
 |---------------|--------|-------------------------------------------------------------------------------|----------------------------------------------------|
 | `image`       | String | [`tonistiigi/binfmt:latest`](https://hub.docker.com/r/tonistiigi/binfmt/tags) | QEMU static binaries Docker image                  |
 | `platforms`   | String | `all`                                                                         | Platforms to install (e.g., `arm64,riscv64,arm`)   |
-| `reset`       | Bool   | `false`                                                                       | Uninstall current emulators before installation    |
 | `cache-image` | Bool   | `true`                                                                        | Cache binfmt image to GitHub Actions cache backend |
 
 ### outputs

__tests__/context.test.ts

@@ -17,13 +17,11 @@ describe('getInputs', () => {
     [
       0,
       new Map<string, string>([
-        ['reset', 'false'],
         ['cache-image', 'true'],
       ]),
       {
         image: 'docker.io/tonistiigi/binfmt:latest',
         platforms: 'all',
-        reset: false,
         cacheImage: true,
       }
     ],
@@ -32,13 +30,11 @@ describe('getInputs', () => {
       new Map<string, string>([
         ['image', 'docker/binfmt:latest'],
         ['platforms', 'arm64,riscv64,arm'],
-        ['reset', 'false'],
         ['cache-image', 'false'],
       ]),
       {
         image: 'docker/binfmt:latest',
         platforms: 'arm64,riscv64,arm',
-        reset: false,
         cacheImage: false,
       }
     ],
@@ -46,13 +42,11 @@ describe('getInputs', () => {
       2,
       new Map<string, string>([
         ['platforms', 'arm64, riscv64, arm '],
-        ['reset', 'false'],
         ['cache-image', 'true'],
       ]),
       {
         image: 'docker.io/tonistiigi/binfmt:latest',
         platforms: 'arm64,riscv64,arm',
-        reset: false,
         cacheImage: true,
       }
     ]

action.yml

@@ -15,10 +15,6 @@ inputs:
     description: 'Platforms to install (e.g. arm64,riscv64,arm)'
     default: 'all'
     required: false
-  reset:
-    description: 'Uninstall current emulators before installation'
-    default: 'false'
-    required: false
   cache-image:
     description: 'Cache binfmt image to GitHub Actions cache backend'
     default: 'true'
@@ -30,5 +26,5 @@ outputs:
 
 runs:
   using: 'node24'
-  main: 'dist/index.cjs'
-  post: 'dist/index.cjs'
+  main: 'dist/index.js'
+  post: 'dist/index.js'

dist/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "module"
+}

package.json

@@ -4,11 +4,10 @@
   "type": "module",
   "main": "src/main.ts",
   "scripts": {
-    "build": "esbuild src/main.ts --bundle --platform=node --target=node24 --format=cjs --outfile=dist/index.cjs --sourcemap --minify && yarn run license",
+    "build": "ncc build src/main.ts --source-map --minify --license licenses.txt",
     "lint": "eslint --max-warnings=0 .",
     "format": "eslint --fix .",
-    "test": "vitest run",
-    "license": "generate-license-file --input package.json --output dist/licenses.txt --overwrite --ci --no-spinner --eol lf"
+    "test": "vitest run"
   },
   "repository": {
     "type": "git",
@@ -21,23 +20,22 @@
   ],
   "author": "Docker Inc.",
   "license": "Apache-2.0",
-  "packageManager": "yarn@4.15.0",
+  "packageManager": "yarn@4.9.2",
   "dependencies": {
-    "@actions/core": "^3.0.1",
-    "@docker/actions-toolkit": "^0.91.0"
+    "@actions/core": "^3.0.0",
+    "@docker/actions-toolkit": "^0.79.0"
   },
   "devDependencies": {
     "@eslint/js": "^9.39.3",
     "@types/node": "^24.11.0",
     "@typescript-eslint/eslint-plugin": "^8.56.1",
     "@typescript-eslint/parser": "^8.56.1",
+    "@vercel/ncc": "^0.38.4",
     "@vitest/coverage-v8": "^4.0.18",
     "@vitest/eslint-plugin": "^1.6.9",
-    "esbuild": "^0.28.0",
     "eslint": "^9.39.3",
     "eslint-config-prettier": "^10.1.8",
     "eslint-plugin-prettier": "^5.5.5",
-    "generate-license-file": "^4.1.1",
     "globals": "^17.3.0",
     "prettier": "^3.8.1",
     "typescript": "^5.9.3",

src/context.ts

@@ -4,7 +4,6 @@ import {Util} from '@docker/actions-toolkit/lib/util.js';
 export interface Inputs {
   image: string;
   platforms: string;
-  reset: boolean;
   cacheImage: boolean;
 }
 
@@ -12,7 +11,6 @@ export function getInputs(): Inputs {
   return {
     image: core.getInput('image') || 'docker.io/tonistiigi/binfmt:latest',
     platforms: Util.getInputList('platforms').join(',') || 'all',
-    reset: core.getBooleanInput('reset'),
     cacheImage: core.getBooleanInput('cache-image')
   };
 }

src/main.ts

@@ -44,18 +44,6 @@ actionsToolkit.run(
       });
     });
 
-    if (input.reset) {
-      await core.group(`Uninstalling current emulators`, async () => {
-        await Docker.getExecOutput(['run', '--rm', '--privileged', input.image, '--uninstall', 'qemu-*'], {
-          ignoreReturnCode: true
-        }).then(res => {
-          if (res.stderr.length > 0 && res.exitCode != 0) {
-            throw new Error(res.stderr.match(/(.*)\s*$/)?.[0]?.trim() ?? 'unknown error');
-          }
-        });
-      });
-    }
-
     await core.group(`Installing QEMU static binaries`, async () => {
       await Docker.getExecOutput(['run', '--rm', '--privileged', input.image, '--install', input.platforms], {
         ignoreReturnCode: true