Update GitHub Action docker/login-action to v3.7.0

[hash-worker]

This PR contains the following updates:

Package	Type	Update	Change
docker/login-action	action	minor	v3.6.0 → v3.7.0

---

Release Notes

docker/login-action (docker/login-action)

v3.7.0

Compare Source

• Add scope input to set scopes for the authentication token by @​crazy-max in #​912
• Add support for AWS European Sovereign Cloud ECR by @​dphi in #​914
• Ensure passwords are redacted with registry-auth input by @​crazy-max in #​911
• build(deps): bump lodash from 4.17.21 to 4.17.23 in #​915

Full Changelog: docker/login-action@v3.6.0...v3.7.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 2am on saturday"
• Automerge
  • "before 4am every weekday,every weekend"

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hash	Ready	Preview, Comment	Jul 18, 2026 12:48am
hashdotdesign-tokens	Ready	Preview, Comment	Jul 18, 2026 12:48am
petrinaut	Ready	Preview, Comment	Jul 18, 2026 12:48am

[cursor]

PR Summary

Low Risk
Renovate-style CI dependency pin with no changes to credentials, registry targets, or deploy logic; v3.7.0 adds optional features this repo does not use.

Overview
Pins docker/login-action from v3.6.0 to v3.7.0 (commit c94ce9fb…) everywhere GHCR is authenticated in deploy-related automation.

The composite docker-build-push action and the manifest job in deploy.yml still log in to ghcr.io with the same registry / username / password inputs; only the action reference changes. ECR login continues to use the local docker-ecr-login action.

^{Reviewed by Cursor Bugbot for commit 2ddeca9. Bugbot is set up for automated code reviews on this repo. Configure here.}

[codspeed-hq]

Merging this PR will degrade performance by 15.38%

⚠️ Different runtime environments detected

Some benchmarks with significant performance changes were compared across different runtime environments,
which may affect the accuracy of the results.

Open the report in CodSpeed to investigate

❌ 2 regressed benchmarks
✅ 96 untouched benchmarks

Warning

Please fix the performance issues or acknowledge them on CodSpeed.

Performance Changes

	Benchmark	BASE	HEAD	Efficiency
❌	bit_matrix/dense/iter_row[64]	140.8 ns	170 ns	-17.16%
❌	bit_matrix/dense/iter_row[200]	185.8 ns	215 ns	-13.57%

Tip

Investigate this regression by commenting @codspeedbot fix this regression on this PR, or directly use the CodSpeed MCP with your agent.

---

_{Comparing deps/gha/docker-login-action-3.x (2ddeca9) with main (a1d86bd)¹}

Footnotes

1. No successful run was found on main (f421c64) during the generation of this report, so a1d86bd was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 59.06%. Comparing base (9b7faef) to head (2ddeca9).
⚠️ Report is 150 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #9053      +/-   ##
==========================================
- Coverage   59.06%   59.06%   -0.01%     
==========================================
  Files        1346     1346              
  Lines      129820   129820              
  Branches     5876     5876              
==========================================
- Hits        76680    76678       -2     
- Misses      52237    52239       +2     
  Partials      903      903              

Flag	Coverage Δ
apps.hash-ai-worker-ts	1.39% <ø> (ø)
apps.hash-api	0.00% <ø> (ø)
blockprotocol.type-system	40.84% <ø> (ø)
local.claude-hooks	0.00% <ø> (ø)
local.harpc-client	51.49% <ø> (ø)
local.hash-backend-utils	2.81% <ø> (ø)
local.hash-graph-sdk	9.63% <ø> (ø)
local.hash-isomorphic-utils	0.00% <ø> (ø)
rust.antsi	0.00% <ø> (ø)
rust.error-stack	90.87% <ø> (ø)
rust.harpc-codec	84.70% <ø> (ø)
rust.harpc-net	96.18% <ø> (-0.04%)	⬇️
rust.harpc-tower	67.03% <ø> (ø)
rust.harpc-types	0.00% <ø> (ø)
rust.harpc-wire-protocol	92.23% <ø> (ø)
rust.hash-codec	72.76% <ø> (ø)
rust.hash-graph-api	2.52% <ø> (ø)
rust.hash-graph-authorization	62.34% <ø> (ø)
rust.hash-graph-postgres-store	26.74% <ø> (ø)
rust.hash-graph-store	37.76% <ø> (ø)
rust.hash-graph-temporal-versioning	47.95% <ø> (ø)
rust.hash-graph-types	0.00% <ø> (ø)
rust.hash-graph-validation	83.45% <ø> (ø)
rust.hashql-ast	87.23% <ø> (ø)
rust.hashql-compiletest	28.26% <ø> (ø)
rust.hashql-core	79.28% <ø> (ø)
rust.hashql-diagnostics	72.53% <ø> (ø)
rust.hashql-eval	75.69% <ø> (ø)
rust.hashql-hir	89.06% <ø> (ø)
rust.hashql-mir	86.94% <ø> (ø)
rust.hashql-syntax-jexpr	94.06% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.