487 commits

This branch

This branch

All branches

Author	SHA1	Message	Date
eifinger	e3a4ecc55e	chore: update known checksums for 0.11.12	2026-05-09 05:07:02 +00:00
dependabot[bot]	c4fec0d78d	chore(deps): bump github/codeql-action from 4.32.2 to 4.35.3 (#875) ... Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.32.2 to 4.35.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action's releases</a>.</em></p> <blockquote> <h2>v4.35.3</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3837">#3837</a></li> <li>Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. <a href="https://redirect.github.com/github/codeql-action/pull/3850">#3850</a></li> <li>Best-effort connection tests for private registries now use <code>GET</code> requests instead of <code>HEAD</code> for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. <a href="https://redirect.github.com/github/codeql-action/pull/3853">#3853</a></li> <li>Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. <a href="https://redirect.github.com/github/codeql-action/pull/3852">#3852</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.3">2.25.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3865">#3865</a></li> </ul> <h2>v4.35.2</h2> <ul> <li>The undocumented TRAP cache cleanup feature that could be enabled using the <code>CODEQL_ACTION_CLEANUP_TRAP_CACHES</code> environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the <code>trap-caching: false</code> input to the <code>init</code> Action. <a href="https://redirect.github.com/github/codeql-action/pull/3795">#3795</a></li> <li>The Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. <a href="https://redirect.github.com/github/codeql-action/pull/3789">#3789</a></li> <li>Python analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. <a href="https://redirect.github.com/github/codeql-action/pull/3794">#3794</a></li> <li>Fixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. <a href="https://redirect.github.com/github/codeql-action/pull/3807">#3807</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.2">2.25.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3823">#3823</a></li> </ul> <h2>v4.35.1</h2> <ul> <li>Fix incorrect minimum required Git version for <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a>: it should have been 2.36.0, not 2.11.0. <a href="https://redirect.github.com/github/codeql-action/pull/3781">#3781</a></li> </ul> <h2>v4.35.0</h2> <ul> <li>Reduced the minimum Git version required for <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a> from 2.38.0 to 2.11.0. <a href="https://redirect.github.com/github/codeql-action/pull/3767">#3767</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.1">2.25.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3773">#3773</a></li> </ul> <h2>v4.34.1</h2> <ul> <li>Downgrade default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.3">2.24.3</a> due to issues with a small percentage of Actions and JavaScript analyses. <a href="https://redirect.github.com/github/codeql-action/pull/3762">#3762</a></li> </ul> <h2>v4.34.0</h2> <ul> <li>Added an experimental change which disables TRAP caching when <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a> is enabled, since improved incremental analysis supersedes TRAP caching. This will improve performance and reduce Actions cache usage. We expect to roll this change out to everyone in March. <a href="https://redirect.github.com/github/codeql-action/pull/3569">#3569</a></li> <li>We are rolling out improved incremental analysis to C/C++ analyses that use build mode <code>none</code>. We expect this rollout to be complete by the end of April 2026. <a href="https://redirect.github.com/github/codeql-action/pull/3584">#3584</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.0">2.25.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3585">#3585</a></li> </ul> <h2>v4.33.0</h2> <ul> <li> <p>Upcoming change: Starting April 2026, the CodeQL Action will skip collecting file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses. Pull request analyses will log a warning about this upcoming change. <a href="https://redirect.github.com/github/codeql-action/pull/3562">#3562</a></p> <p>To opt out of this change:</p> <ul> <li><strong>Repositories owned by an organization:</strong> Create a custom repository property with the name <code>github-codeql-file-coverage-on-prs</code> and the type &quot;True/false&quot;, then set this property to <code>true</code> in the repository's settings. For more information, see <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">Managing custom properties for repositories in your organization</a>. Alternatively, if you are using an advanced setup workflow, you can set the <code>CODEQL_ACTION_FILE_COVERAGE_ON_PRS</code> environment variable to <code>true</code> in your workflow.</li> <li><strong>User-owned repositories using default setup:</strong> Switch to an advanced setup workflow and set the <code>CODEQL_ACTION_FILE_COVERAGE_ON_PRS</code> environment variable to <code>true</code> in your workflow.</li> <li><strong>User-owned repositories using advanced setup:</strong> Set the <code>CODEQL_ACTION_FILE_COVERAGE_ON_PRS</code> environment variable to <code>true</code> in your workflow.</li> </ul> </li> <li> <p>Fixed <a href="https://redirect.github.com/github/codeql-action/issues/3555">a bug</a> which caused the CodeQL Action to fail loading repository properties if a &quot;Multi select&quot; repository property was configured for the repository. <a href="https://redirect.github.com/github/codeql-action/pull/3557">#3557</a></p> </li> <li> <p>The CodeQL Action now loads <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">custom repository properties</a> on GitHub Enterprise Server, enabling the customization of features such as <code>github-codeql-disable-overlay</code> that was previously only available on GitHub.com. <a href="https://redirect.github.com/github/codeql-action/pull/3559">#3559</a></p> </li> <li> <p>Once <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">private package registries</a> can be configured with OIDC-based authentication for organizations, the CodeQL Action will now be able to accept such configurations. <a href="https://redirect.github.com/github/codeql-action/pull/3563">#3563</a></p> </li> <li> <p>Fixed the retry mechanism for database uploads. Previously this would fail with the error &quot;Response body object should not be disturbed or locked&quot;. <a href="https://redirect.github.com/github/codeql-action/pull/3564">#3564</a></p> </li> <li> <p>A warning is now emitted if the CodeQL Action detects a repository property whose name suggests that it relates to the CodeQL Action, but which is not one of the properties recognised by the current version of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3570">#3570</a></p> </li> </ul> <h2>v4.32.6</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.3">2.24.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3548">#3548</a></li> </ul> <h2>v4.32.5</h2> <ul> <li>Repositories owned by an organization can now set up the <code>github-codeql-disable-overlay</code> custom repository property to disable <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis for CodeQL</a>. First, create a custom repository property with the name <code>github-codeql-disable-overlay</code> and the type &quot;True/false&quot; in the organization's settings. Then in the repository's settings, set this property to <code>true</code> to disable improved incremental analysis. For more information, see <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">Managing custom properties for repositories in your organization</a>. This feature is not yet available on GitHub Enterprise Server. <a href="https://redirect.github.com/github/codeql-action/pull/3507">#3507</a></li> <li>Added an experimental change so that when <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a> fails on a runner — potentially due to insufficient disk space — the failure is recorded in the Actions cache so that subsequent runs will automatically skip improved incremental analysis until something changes (e.g. a larger runner is provisioned or a new CodeQL version is released). We expect to roll this change out to everyone in March. <a href="https://redirect.github.com/github/codeql-action/pull/3487">#3487</a></li> <li>The minimum memory check for improved incremental analysis is now skipped for CodeQL 2.24.3 and later, which has reduced peak RAM usage. <a href="https://redirect.github.com/github/codeql-action/pull/3515">#3515</a></li> <li>Reduced log levels for best-effort private package registry connection check failures to reduce noise from workflow annotations. <a href="https://redirect.github.com/github/codeql-action/pull/3516">#3516</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4">2.25.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3881">#3881</a></li> </ul> <h2>4.35.3 - 01 May 2026</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3837">#3837</a></li> <li>Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. <a href="https://redirect.github.com/github/codeql-action/pull/3850">#3850</a></li> <li>Best-effort connection tests for private registries now use <code>GET</code> requests instead of <code>HEAD</code> for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. <a href="https://redirect.github.com/github/codeql-action/pull/3853">#3853</a></li> <li>Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. <a href="https://redirect.github.com/github/codeql-action/pull/3852">#3852</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.3">2.25.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3865">#3865</a></li> </ul> <h2>4.35.2 - 15 Apr 2026</h2> <ul> <li>The undocumented TRAP cache cleanup feature that could be enabled using the <code>CODEQL_ACTION_CLEANUP_TRAP_CACHES</code> environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the <code>trap-caching: false</code> input to the <code>init</code> Action. <a href="https://redirect.github.com/github/codeql-action/pull/3795">#3795</a></li> <li>The Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. <a href="https://redirect.github.com/github/codeql-action/pull/3789">#3789</a></li> <li>Python analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. <a href="https://redirect.github.com/github/codeql-action/pull/3794">#3794</a></li> <li>Fixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. <a href="https://redirect.github.com/github/codeql-action/pull/3807">#3807</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.2">2.25.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3823">#3823</a></li> </ul> <h2>4.35.1 - 27 Mar 2026</h2> <ul> <li>Fix incorrect minimum required Git version for <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a>: it should have been 2.36.0, not 2.11.0. <a href="https://redirect.github.com/github/codeql-action/pull/3781">#3781</a></li> </ul> <h2>4.35.0 - 27 Mar 2026</h2> <ul> <li>Reduced the minimum Git version required for <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a> from 2.38.0 to 2.11.0. <a href="https://redirect.github.com/github/codeql-action/pull/3767">#3767</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.1">2.25.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3773">#3773</a></li> </ul> <h2>4.34.1 - 20 Mar 2026</h2> <ul> <li>Downgrade default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.3">2.24.3</a> due to issues with a small percentage of Actions and JavaScript analyses. <a href="https://redirect.github.com/github/codeql-action/pull/3762">#3762</a></li> </ul> <h2>4.34.0 - 20 Mar 2026</h2> <ul> <li>Added an experimental change which disables TRAP caching when <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a> is enabled, since improved incremental analysis supersedes TRAP caching. This will improve performance and reduce Actions cache usage. We expect to roll this change out to everyone in March. <a href="https://redirect.github.com/github/codeql-action/pull/3569">#3569</a></li> <li>We are rolling out improved incremental analysis to C/C++ analyses that use build mode <code>none</code>. We expect this rollout to be complete by the end of April 2026. <a href="https://redirect.github.com/github/codeql-action/pull/3584">#3584</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.0">2.25.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3585">#3585</a></li> </ul> <h2>4.33.0 - 16 Mar 2026</h2> <ul> <li> <p>Upcoming change: Starting April 2026, the CodeQL Action will skip collecting file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses. Pull request analyses will log a warning about this upcoming change. <a href="https://redirect.github.com/github/codeql-action/pull/3562">#3562</a></p> <p>To opt out of this change:</p> <ul> <li><strong>Repositories owned by an organization:</strong> Create a custom repository property with the name <code>github-codeql-file-coverage-on-prs</code> and the type &quot;True/false&quot;, then set this property to <code>true</code> in the repository's settings. For more information, see <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">Managing custom properties for repositories in your organization</a>. Alternatively, if you are using an advanced setup workflow, you can set the <code>CODEQL_ACTION_FILE_COVERAGE_ON_PRS</code> environment variable to <code>true</code> in your workflow.</li> <li><strong>User-owned repositories using default setup:</strong> Switch to an advanced setup workflow and set the <code>CODEQL_ACTION_FILE_COVERAGE_ON_PRS</code> environment variable to <code>true</code> in your workflow.</li> </ul> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="e46ed2cbd0"><code>e46ed2c</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3867">#3867</a> from github/update-v4.35.3-8c6e48dbe</li> <li><a href="b73d1d1634"><code>b73d1d1</code></a> Add changelog entry for <a href="https://redirect.github.com/github/codeql-action/issues/3853">#3853</a></li> <li><a href="24e0bb00a9"><code>24e0bb0</code></a> Reorder changelog entries</li> <li><a href="ec298daba7"><code>ec298da</code></a> Update changelog for v4.35.3</li> <li><a href="8c6e48dbe0"><code>8c6e48d</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3865">#3865</a> from github/update-bundle/codeql-bundle-v2.25.3</li> <li><a href="719098349e"><code>7190983</code></a> Add changelog note</li> <li><a href="2bb209555a"><code>2bb2095</code></a> Update default bundle to codeql-bundle-v2.25.3</li> <li><a href="7851e55dc3"><code>7851e55</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3850">#3850</a> from github/mbg/private-registry/cloudsmith-gcp</li> <li><a href="262a15f6cf"><code>262a15f</code></a> Add generic non-printable chars test for OIDC configs</li> <li><a href="a6109b1c07"><code>a6109b1</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3853">#3853</a> from github/mbg/start-proxy/improved-checks</li> <li>Additional commits viewable in <a href="45cbd0c69e...e46ed2cbd0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-09 03:58:07 +02:00
github-actions[bot]	9d91aa17e1	chore: update known checksums for 0.11.11 (#873) ... chore: update known checksums for 0.11.11 Co-authored-by: eifinger <eifinger@users.noreply.github.com>	2026-05-07 09:14:04 +02:00
github-actions[bot]	363818fa0d	chore: update known checksums for 0.11.9/0.11.10 (#871) ... chore: update known checksums for 0.11.9/0.11.10 Co-authored-by: eifinger <eifinger@users.noreply.github.com>	2026-05-06 08:13:20 +02:00
github-actions[bot]	05143d3dcd	chore: update known checksums for 0.11.8 (#867) ... chore: update known checksums for 0.11.8 Co-authored-by: eifinger <eifinger@users.noreply.github.com>	2026-04-28 07:45:14 +02:00
dependabot[bot]	2ae9516c03	chore(deps): bump actions/setup-node from 6.3.0 to 6.4.0 (#866) ... Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-04-27 09:31:20 -04:00
dependabot[bot]	c0c76fcf76	chore(deps): bump zizmorcore/zizmor-action from 0.5.2 to 0.5.3 (#864) ... Bumps [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) from 0.5.2 to 0.5.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/zizmorcore/zizmor-action/releases">zizmorcore/zizmor-action's releases</a>.</em></p> <blockquote> <h2>v0.5.3</h2> <h2>What's Changed</h2> <ul> <li><code>1.24.0</code> and <code>1.24.1</code> are now available via the action</li> <li><code>1.24.1</code> is now the default version of zizmor used by the action</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/zizmorcore/zizmor-action/compare/v0.5.2...v0.5.3">https://github.com/zizmorcore/zizmor-action/compare/v0.5.2...v0.5.3</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="b1d7e1fb5d"><code>b1d7e1f</code></a> Sync zizmor versions (<a href="https://redirect.github.com/zizmorcore/zizmor-action/issues/102">#102</a>)</li> <li><a href="a195b57475"><code>a195b57</code></a> Sync zizmor versions (<a href="https://redirect.github.com/zizmorcore/zizmor-action/issues/100">#100</a>)</li> <li><a href="629d5d01fe"><code>629d5d0</code></a> chore(deps): bump github/codeql-action in the github-actions group (<a href="https://redirect.github.com/zizmorcore/zizmor-action/issues/99">#99</a>)</li> <li><a href="453d591467"><code>453d591</code></a> chore(deps): bump the github-actions group with 2 updates (<a href="https://redirect.github.com/zizmorcore/zizmor-action/issues/98">#98</a>)</li> <li><a href="ea2c18b942"><code>ea2c18b</code></a> Bump pins (<a href="https://redirect.github.com/zizmorcore/zizmor-action/issues/97">#97</a>)</li> <li>See full diff in <a href="71321a20a9...b1d7e1fb5d">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-04-20 14:26:05 +02:00
dependabot[bot]	dff86cf972	chore(deps): bump peter-evans/create-pull-request from 8.1.0 to 8.1.1 (#863) ... Bumps [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) from 8.1.0 to 8.1.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/peter-evans/create-pull-request/releases">peter-evans/create-pull-request's releases</a>.</em></p> <blockquote> <h2>Create Pull Request v8.1.1</h2> <h2>What's Changed</h2> <ul> <li>build(deps-dev): bump the npm group with 2 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/peter-evans/create-pull-request/pull/4305">peter-evans/create-pull-request#4305</a></li> <li>build(deps): bump minimatch by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/peter-evans/create-pull-request/pull/4311">peter-evans/create-pull-request#4311</a></li> <li>build(deps): bump the github-actions group with 2 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/peter-evans/create-pull-request/pull/4316">peter-evans/create-pull-request#4316</a></li> <li>build(deps): bump <code>@​tootallnate/once</code> and jest-environment-jsdom by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/peter-evans/create-pull-request/pull/4323">peter-evans/create-pull-request#4323</a></li> <li>build(deps-dev): bump undici from 6.23.0 to 6.24.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/peter-evans/create-pull-request/pull/4328">peter-evans/create-pull-request#4328</a></li> <li>build(deps-dev): bump flatted from 3.3.1 to 3.4.2 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/peter-evans/create-pull-request/pull/4334">peter-evans/create-pull-request#4334</a></li> <li>build(deps): bump picomatch by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/peter-evans/create-pull-request/pull/4339">peter-evans/create-pull-request#4339</a></li> <li>build(deps-dev): bump handlebars from 4.7.8 to 4.7.9 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/peter-evans/create-pull-request/pull/4344">peter-evans/create-pull-request#4344</a></li> <li>build(deps-dev): bump the npm group with 3 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/peter-evans/create-pull-request/pull/4349">peter-evans/create-pull-request#4349</a></li> <li>fix: retry post-creation API calls on 422 eventual consistency errors by <a href="https://github.com/peter-evans"><code>@​peter-evans</code></a> in <a href="https://redirect.github.com/peter-evans/create-pull-request/pull/4356">peter-evans/create-pull-request#4356</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/peter-evans/create-pull-request/compare/v8.1.0...v8.1.1">https://github.com/peter-evans/create-pull-request/compare/v8.1.0...v8.1.1</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="5f6978faf0"><code>5f6978f</code></a> fix: retry post-creation API calls on 422 eventual consistency errors (<a href="https://redirect.github.com/peter-evans/create-pull-request/issues/4356">#4356</a>)</li> <li><a href="d32e88dac7"><code>d32e88d</code></a> build(deps-dev): bump the npm group with 3 updates (<a href="https://redirect.github.com/peter-evans/create-pull-request/issues/4349">#4349</a>)</li> <li><a href="8170bccad1"><code>8170bcc</code></a> build(deps-dev): bump handlebars from 4.7.8 to 4.7.9 (<a href="https://redirect.github.com/peter-evans/create-pull-request/issues/4344">#4344</a>)</li> <li><a href="00418193b4"><code>0041819</code></a> build(deps): bump picomatch (<a href="https://redirect.github.com/peter-evans/create-pull-request/issues/4339">#4339</a>)</li> <li><a href="b993918c85"><code>b993918</code></a> build(deps-dev): bump flatted from 3.3.1 to 3.4.2 (<a href="https://redirect.github.com/peter-evans/create-pull-request/issues/4334">#4334</a>)</li> <li><a href="36d7c8468b"><code>36d7c84</code></a> build(deps-dev): bump undici from 6.23.0 to 6.24.0 (<a href="https://redirect.github.com/peter-evans/create-pull-request/issues/4328">#4328</a>)</li> <li><a href="a45d1fb447"><code>a45d1fb</code></a> build(deps): bump <code>@​tootallnate/once</code> and jest-environment-jsdom (<a href="https://redirect.github.com/peter-evans/create-pull-request/issues/4323">#4323</a>)</li> <li><a href="3499eb6183"><code>3499eb6</code></a> build(deps): bump the github-actions group with 2 updates (<a href="https://redirect.github.com/peter-evans/create-pull-request/issues/4316">#4316</a>)</li> <li><a href="3f3b473b8c"><code>3f3b473</code></a> build(deps): bump minimatch (<a href="https://redirect.github.com/peter-evans/create-pull-request/issues/4311">#4311</a>)</li> <li><a href="6699836a21"><code>6699836</code></a> build(deps-dev): bump the npm group with 2 updates (<a href="https://redirect.github.com/peter-evans/create-pull-request/issues/4305">#4305</a>)</li> <li>See full diff in <a href="c0f553fe54...5f6978faf0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-04-20 09:50:35 +02:00
Kevin Stillhammer	c0b7f63f92	Bump setup-uv references to v8.1.0 SHA in docs (#862) ... Update all `astral-sh/setup-uv@` references in documentation from `cec208311d # v8.0.0` to `08807647e7 # v8.1.0`. Files updated: - `README.md` - `docs/caching.md` - `docs/customization.md` - `docs/environment-and-tools.md` - `docs/advanced-version-configuration.md`	2026-04-17 09:25:20 +02:00
Kevin Stillhammer	d854a6dce4	Add update-docs.yml workflow (#861)	2026-04-17 09:10:53 +02:00
Kevin Stillhammer	08807647e7	fix: grant contents:write to validate-release job (#860) ... ## Problem The release workflow fails at the `validate-release` job because `gh release view` cannot find draft releases. This is because the job only has `contents: read` permission, but GitHub requires `contents: write` to view draft releases. See failed run: https://github.com/astral-sh/setup-uv/actions/runs/24528604608 ## Fix Bump `validate-release` job permissions from `contents: read` to `contents: write`, matching the `release` job which already has this permission.	2026-04-16 21:58:54 +02:00
Zanie Blue	717d6aba0f	Add a release-gate step to the release workflow (#859)	2026-04-16 20:56:58 +02:00
Kevin Stillhammer	5a911eb3a3	Draft commitish releases (#858)	2026-04-16 20:26:15 +02:00
Kevin Stillhammer	080c31e04c	Add action-types.yml to instructions (#857)	2026-04-16 20:19:09 +02:00
Kevin Stillhammer	b3e97d2ba1	Add input no-project in combination with activate-environment (#856) ... Closes: #854	2026-04-16 15:48:02 +02:00
dependabot[bot]	7dd591db95	chore(deps): bump release-drafter/release-drafter from 7.1.1 to 7.2.0 (#855) ... Bumps [release-drafter/release-drafter](https://github.com/release-drafter/release-drafter) from 7.1.1 to 7.2.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/release-drafter/release-drafter/releases">release-drafter/release-drafter's releases</a>.</em></p> <blockquote> <h2>v7.2.0</h2> <h1>What's Changed</h1> <h2>New</h2> <ul> <li>feat: allow always collapsing a category (<a href="https://redirect.github.com/release-drafter/release-drafter/issues/1444">#1444</a>) <a href="https://github.com/mhanberg"><code>@​mhanberg</code></a></li> </ul> <h2>Bug Fixes</h2> <ul> <li>fix: improve advanced substitutions in replacers (<a href="https://redirect.github.com/release-drafter/release-drafter/issues/1555">#1555</a>) <a href="https://github.com/jetersen"><code>@​jetersen</code></a></li> <li>fix: support repo-only _extends and prevent .github/ path doubling (<a href="https://redirect.github.com/release-drafter/release-drafter/issues/1577">#1577</a>) <a href="https://github.com/jetersen"><code>@​jetersen</code></a></li> </ul> <h2>Maintenance</h2> <ul> <li>chore(deps): update dependency typescript to 6.0.2 (<a href="https://redirect.github.com/release-drafter/release-drafter/issues/1587">#1587</a>) @<a href="https://github.com/apps/renovate">renovate[bot]</a></li> <li>chore(deps): update vitest to 4.1.4 (<a href="https://redirect.github.com/release-drafter/release-drafter/issues/1585">#1585</a>) @<a href="https://github.com/apps/renovate">renovate[bot]</a></li> <li>ci(deps): update peter-evans/create-pull-request action to v8 (<a href="https://redirect.github.com/release-drafter/release-drafter/issues/1588">#1588</a>) @<a href="https://github.com/apps/renovate">renovate[bot]</a></li> <li>chore(deps): update dependency vite to 8.0.5 (<a href="https://redirect.github.com/release-drafter/release-drafter/issues/1579">#1579</a>) @<a href="https://github.com/apps/renovate">renovate[bot]</a></li> <li>chore(deps): update dependency nock to 14.0.12 (<a href="https://redirect.github.com/release-drafter/release-drafter/issues/1583">#1583</a>) @<a href="https://github.com/apps/renovate">renovate[bot]</a></li> <li>chore(deps): update dependency <code>@​types/node</code> to 24.12.2 (<a href="https://redirect.github.com/release-drafter/release-drafter/issues/1582">#1582</a>) @<a href="https://github.com/apps/renovate">renovate[bot]</a></li> <li>chore(deps): update dependency <code>@​biomejs/biome</code> to 2.4.10 (<a href="https://redirect.github.com/release-drafter/release-drafter/issues/1581">#1581</a>) @<a href="https://github.com/apps/renovate">renovate[bot]</a></li> <li>chore: move codegen to monthly scheduled workflow (<a href="https://redirect.github.com/release-drafter/release-drafter/issues/1578">#1578</a>) <a href="https://github.com/jetersen"><code>@​jetersen</code></a></li> <li>chore: replace vite-tsconfig-paths plugin with native resolve.tsconfigPaths (<a href="https://redirect.github.com/release-drafter/release-drafter/issues/1571">#1571</a>) <a href="https://github.com/jetersen"><code>@​jetersen</code></a></li> </ul> <h2>Documentation</h2> <ul> <li>docs: fix autolabeler example tag (<a href="https://redirect.github.com/release-drafter/release-drafter/issues/1568">#1568</a>) <a href="https://github.com/cchanche"><code>@​cchanche</code></a></li> </ul> <h2>Dependency Updates</h2> <ul> <li>build(deps): bump lodash and <code>@​graphql-codegen/plugin-helpers</code> (<a href="https://redirect.github.com/release-drafter/release-drafter/issues/1589">#1589</a>) @<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li> <li>fix(deps): update dependency <code>@​actions/github</code> to 9.1.0 (<a href="https://redirect.github.com/release-drafter/release-drafter/issues/1586">#1586</a>) @<a href="https://github.com/apps/renovate">renovate[bot]</a></li> <li>chore(deps): update dependency yaml to 2.8.3 (<a href="https://redirect.github.com/release-drafter/release-drafter/issues/1580">#1580</a>) @<a href="https://github.com/apps/renovate">renovate[bot]</a></li> <li>chore(deps): update node.js to v24.14.1 (<a href="https://redirect.github.com/release-drafter/release-drafter/issues/1584">#1584</a>) @<a href="https://github.com/apps/renovate">renovate[bot]</a></li> <li>chore(deps): update dependency <code>@​biomejs/biome</code> to 2.4.10 (<a href="https://redirect.github.com/release-drafter/release-drafter/issues/1581">#1581</a>) @<a href="https://github.com/apps/renovate">renovate[bot]</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/release-drafter/release-drafter/compare/v7.1.1...v7.2.0">https://github.com/release-drafter/release-drafter/compare/v7.1.1...v7.2.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="5de9358398"><code>5de9358</code></a> 7.2.0</li> <li><a href="e50d61c7de"><code>e50d61c</code></a> chore: rebuild dist</li> <li><a href="d3a61d3b77"><code>d3a61d3</code></a> chore: fix npm audit vulnerabilities</li> <li><a href="8bfa2791ec"><code>8bfa279</code></a> build(deps): bump lodash and <code>@​graphql-codegen/plugin-helpers</code> (<a href="https://redirect.github.com/release-drafter/release-drafter/issues/1589">#1589</a>)</li> <li><a href="c2a8a67ac9"><code>c2a8a67</code></a> chore: remove engine-strict from .npmrc to fix Dependabot resolution</li> <li><a href="e51e4adf16"><code>e51e4ad</code></a> chore(deps): update dependency typescript to 6.0.2 (<a href="https://redirect.github.com/release-drafter/release-drafter/issues/1587">#1587</a>)</li> <li><a href="0e7bd54846"><code>0e7bd54</code></a> fix(deps): update dependency <code>@​actions/github</code> to 9.1.0 (<a href="https://redirect.github.com/release-drafter/release-drafter/issues/1586">#1586</a>)</li> <li><a href="9c0b0a8cf1"><code>9c0b0a8</code></a> chore(deps): update dependency yaml to 2.8.3 (<a href="https://redirect.github.com/release-drafter/release-drafter/issues/1580">#1580</a>)</li> <li><a href="b27f820cbc"><code>b27f820</code></a> chore(deps): update vitest to 4.1.4 (<a href="https://redirect.github.com/release-drafter/release-drafter/issues/1585">#1585</a>)</li> <li><a href="eb9053430f"><code>eb90534</code></a> ci(deps): update peter-evans/create-pull-request action to v8 (<a href="https://redirect.github.com/release-drafter/release-drafter/issues/1588">#1588</a>)</li> <li>Additional commits viewable in <a href="139054aeaa...5de9358398">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-04-16 13:02:19 +02:00
github-actions[bot]	1541b77626	chore: update known checksums for 0.11.7 (#853) ... chore: update known checksums for 0.11.7 Co-authored-by: eifinger <eifinger@users.noreply.github.com>	2026-04-16 08:00:01 +02:00
Kevin Stillhammer	cdfb2ee6dd	Refactor version resolving (#852)	2026-04-11 11:38:41 +02:00
github-actions[bot]	cb84d12dc6	chore: update known checksums for 0.11.6 (#850) ... chore: update known checksums for 0.11.6 Co-authored-by: eifinger <eifinger@users.noreply.github.com>	2026-04-10 13:32:57 +02:00
github-actions[bot]	1912cc65f2	chore: update known checksums for 0.11.5 (#845) ... chore: update known checksums for 0.11.5 Co-authored-by: eifinger <eifinger@users.noreply.github.com>	2026-04-09 08:26:38 +02:00
github-actions[bot]	a0b52019f1	chore: update known checksums for 0.11.4 (#843) ... chore: update known checksums for 0.11.4 Co-authored-by: eifinger <eifinger@users.noreply.github.com>	2026-04-08 07:42:52 +02:00
Zanie Blue	7b222e12b6	Add a release workflow (#839) ... Uses a release workflow with environment protection for publishing releases instead of relying on user invocation. The `release` environment can then be protected, e.g., requiring approval from another team member. We can add a tag ruleset to prevent tags from being created outside of the `release` environment. I've never used Release drafter, but the workflow here differs from our other projects in that the release process just marks the draft release as final and adds the tag. The draft release is required, for simplicity.	2026-04-07 08:39:52 -05:00
github-actions[bot]	1c15d185f0	chore: update known checksums for 0.11.3 (#836) ... chore: update known checksums for 0.11.3 Co-authored-by: eifinger <eifinger@users.noreply.github.com>	2026-04-02 10:42:50 +02:00
Kevin Stillhammer	d7fe1a5a18	Update ignore-nothing-to-cache documentation (#833) ... Add the error message so it can be found when searching for it Helps issues like #831	2026-03-31 09:27:10 +02:00
Kevin Stillhammer	16592cddee	Pin setup-uv docs to v8 (#829) ... Update all README and docs examples to use the pinned v8 release SHA for astral-sh/setup-uv, with a comment showing the release version for clarity and best practices.	2026-03-29 19:36:34 +02:00
Kevin Stillhammer	cec208311d	Shortcircuit latest version from manifest (#828) ... The first version is guaranteed to be the latest	2026-03-28 17:43:22 +01:00
Kevin Stillhammer	4dd8ab4520	Simplify inputs.ts (#827) ... Do not pass around inputs. Its okay to freely work with core.getInput in this file	2026-03-28 17:38:30 +01:00
Kevin Stillhammer	7fdbe7cf0c	Remove update-major-minor-tags workflow (#826)	2026-03-28 16:29:52 +01:00
Kevin Stillhammer	485abd05e5	Bump release-drafter to v7.1.1 (#825)	2026-03-28 16:25:54 +01:00
Kevin Stillhammer	f82eb19c06	Refactor inputs (#823) ... Don't load at import time and make it easier to test	2026-03-28 16:23:26 +01:00
Kevin Stillhammer	868d1f74d9	Replace inline compile args with tsconfig (#824)	2026-03-28 16:19:09 +01:00
github-actions[bot]	447e6d02b1	chore: update known checksums for 0.11.2 (#821) ... chore: update known checksums for 0.11.2 Co-authored-by: eifinger <eifinger@users.noreply.github.com>	2026-03-27 07:12:16 +01:00
github-actions[bot]	5c62c59261	chore: update known checksums for 0.11.1 (#817) ... chore: update known checksums for 0.11.1 Co-authored-by: eifinger <eifinger@users.noreply.github.com>	2026-03-25 08:14:06 +01:00
github-actions[bot]	e1a7373adb	chore: update known checksums for 0.11.0 (#815) ... chore: update known checksums for 0.11.0 Co-authored-by: eifinger <eifinger@users.noreply.github.com>	2026-03-24 07:42:01 +01:00
Kevin Stillhammer	89709315bb	Remove deprecrated custom manifest (#813)	2026-03-23 09:15:51 +01:00
Kevin Stillhammer	8cc8d1cbfc	Fix latest-version workflow check (#812) ... ## Summary - make the latest-version workflow test use the action output for the exact installed version - allow `uv --version` to include additional platform/build metadata - keep validating that the reported version matches the latest GitHub release ## Testing - npm ci --ignore-scripts - npm run all - actionlint .github/workflows/test.yml Fixes the failure in https://github.com/astral-sh/setup-uv/actions/runs/23332230171/job/67866051063	2026-03-20 10:51:55 +01:00
github-actions[bot]	c20049fc26	chore: update known checksums for 0.10.11/0.10.12 (#811)	2026-03-20 07:48:09 +01:00
Zsolt Dollenstein	37802adc94	Fetch uv from Astral's mirror by default (#809) ... This PR tries fetching the uv artifact from `releases.astral.sh` by default, only in cases where the artifact would otherwise have come from `https://github.com/astral-sh/uv/releases/download/`. The checksums are supposed to be the same for the mirror, and can still come from `raw.githubusercontent.com/astral-sh/versions`. If the download fails, we fall back to the original URL. This avoids hitting GitHub's Releases API which is prone to rate limiting. As far as I can tell, together with https://github.com/astral-sh/setup-uv/pull/802 this PR makes a github token entirely unnecessary for this action. Towards https://github.com/astral-sh/uv/issues/18503.	2026-03-16 13:38:17 +01:00
dependabot[bot]	9f00d186ce	chore(deps): bump zizmorcore/zizmor-action from 0.5.0 to 0.5.2 (#808) ... Bumps [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) from 0.5.0 to 0.5.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/zizmorcore/zizmor-action/releases">zizmorcore/zizmor-action's releases</a>.</em></p> <blockquote> <h2>v0.5.2</h2> <h2>What's Changed</h2> <ul> <li>zizmor 1.23.1 is now the default used by this action.</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/zizmorcore/zizmor-action/compare/v0.5.1...v0.5.2">https://github.com/zizmorcore/zizmor-action/compare/v0.5.1...v0.5.2</a></p> <h2>v0.5.1</h2> <h2>What's Changed</h2> <ul> <li>zizmor 1.23.0 is now the default used by this action.</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/zizmorcore/zizmor-action/compare/v0.5.0...v0.5.1">https://github.com/zizmorcore/zizmor-action/compare/v0.5.0...v0.5.1</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="71321a20a9"><code>71321a2</code></a> Sync zizmor versions (<a href="https://redirect.github.com/zizmorcore/zizmor-action/issues/96">#96</a>)</li> <li><a href="5ed31db096"><code>5ed31db</code></a> Bump pins (<a href="https://redirect.github.com/zizmorcore/zizmor-action/issues/95">#95</a>)</li> <li><a href="195d10ad90"><code>195d10a</code></a> Sync zizmor versions (<a href="https://redirect.github.com/zizmorcore/zizmor-action/issues/94">#94</a>)</li> <li><a href="c65bc88761"><code>c65bc88</code></a> chore(deps): bump github/codeql-action in the github-actions group (<a href="https://redirect.github.com/zizmorcore/zizmor-action/issues/93">#93</a>)</li> <li><a href="c2c887f846"><code>c2c887f</code></a> chore(deps): bump zizmorcore/zizmor-action in the github-actions group (<a href="https://redirect.github.com/zizmorcore/zizmor-action/issues/91">#91</a>)</li> <li><a href="5507ab0c02"><code>5507ab0</code></a> Bump pins in README (<a href="https://redirect.github.com/zizmorcore/zizmor-action/issues/90">#90</a>)</li> <li>See full diff in <a href="0dce2577a4...71321a20a9">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-03-16 12:37:11 +01:00
Kevin Stillhammer	fd8f376b22	Switch to ESM for source and test, use CommonJS for dist (#806)	2026-03-14 17:43:49 +01:00
Kevin Stillhammer	f9070de1ea	Bump deps (#805)	2026-03-14 12:54:28 +01:00
github-actions[bot]	cadb67bdc9	chore: update known checksums for 0.10.10 (#804) ... chore: update known checksums for 0.10.10 Co-authored-by: eifinger <eifinger@users.noreply.github.com>	2026-03-14 09:45:38 +01:00
Kevin Stillhammer	e06108dd0a	Use astral-sh/versions as primary version provider (#802) ... Closes: #777 Closes: #325	2026-03-12 22:03:21 +01:00
Kevin Stillhammer	0f6ec07aaf	docs: replace copilot instructions with AGENTS.md (#794) ... ## Summary - replace the root `AGENTS.md` symlink with a real file - move the agent instructions out of `.github/copilot-instructions.md` into `AGENTS.md` - trim the content down to concise, repo-specific guidance and add a short repository orientation ## Testing - not run (docs-only change)	2026-03-10 18:32:16 +01:00
Kevin Stillhammer	821e5c9815	docs: add cross-client dependabot rollup skill (#793) ... ## Summary - add a reusable skill for the Dependabot PR rollup workflow - place it under `.agents/skills/` for cross-client discovery - keep the skill aligned with the Agent Skills standard and client-agnostic ## Details - adds `.agents/skills/dependabot-pr-rollup/SKILL.md` - documents the workflow for: - finding open Dependabot PRs - comparing PR heads to their base branch - replaying only net dependency changes in a fresh worktree - running `npm run all` - optionally committing, pushing, and opening a PR ## Notes - `.agents/skills/` is the shared interoperability location used across multiple coding agents - no code changes - tests not run (documentation-only skill)	2026-03-10 18:16:24 +01:00
Kevin Stillhammer	6ee6290f1c	chore(deps): bump versions (#792) ... ## Summary - replicate the currently open Dependabot dependency updates in a single branch - update `smol-toml` to `^1.6.0` - update `@biomejs/biome` to `2.3.8` - regenerate `package-lock.json` and bundled `dist` output ## Notes - `main` already includes the open Octokit Dependabot bumps, so those PRs required no additional net changes here - the open `smol-toml` Dependabot PR currently resolves to `^1.6.0`, which is what this branch mirrors ## Validation - `npm run all`	2026-03-10 17:49:45 +01:00
Ludovic Henry	9f332a133a	Add riscv64 architecture support to platform detection (#791) ... Add `riscv64gc` as a recognized architecture in the `Architecture` type union and map Node.js's `riscv64` process.arch value to the `riscv64gc` uv platform identifier. This allows the action to correctly detect and download the appropriate uv binary on RISC-V 64-bit systems (e.g., linux/riscv64 runners).	2026-03-10 15:38:42 +01:00
dependabot[bot]	0acf9708ce	Bump actions/setup-node from 6.2.0 to 6.3.0 (#790) ... Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6.2.0 to 6.3.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/setup-node/releases">actions/setup-node's releases</a>.</em></p> <blockquote> <h2>v6.3.0</h2> <h2>What's Changed</h2> <h3>Enhancements:</h3> <ul> <li>Support parsing <code>devEngines</code> field by <a href="https://github.com/susnux"><code>@​susnux</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1283">actions/setup-node#1283</a></li> </ul> <blockquote> <p>When using node-version-file: package.json, setup-node now prefers devEngines.runtime over engines.node.</p> </blockquote> <h3>Dependency updates:</h3> <ul> <li>Fix npm audit issues by <a href="https://github.com/gowridurgad"><code>@​gowridurgad</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1491">actions/setup-node#1491</a></li> <li>Replace uuid with crypto.randomUUID() by <a href="https://github.com/trivikr"><code>@​trivikr</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1378">actions/setup-node#1378</a></li> <li>Upgrade minimatch from 3.1.2 to 3.1.5 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1498">actions/setup-node#1498</a></li> </ul> <h3>Bug fixes:</h3> <ul> <li>Remove hardcoded bearer for mirror-url <a href="https://github.com/marco-ippolito"><code>@​marco-ippolito</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1467">actions/setup-node#1467</a></li> <li>Scope test lockfiles by package manager and update cache tests by <a href="https://github.com/gowridurgad"><code>@​gowridurgad</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1495">actions/setup-node#1495</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/susnux"><code>@​susnux</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-node/pull/1283">actions/setup-node#1283</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-node/compare/v6...v6.3.0">https://github.com/actions/setup-node/compare/v6...v6.3.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="53b83947a5"><code>53b8394</code></a> Bump minimatch from 3.1.2 to 3.1.5 (<a href="https://redirect.github.com/actions/setup-node/issues/1498">#1498</a>)</li> <li><a href="54045abd5d"><code>54045ab</code></a> Scope test lockfiles by package manager and update cache tests (<a href="https://redirect.github.com/actions/setup-node/issues/1495">#1495</a>)</li> <li><a href="c882bffdbd"><code>c882bff</code></a> Replace uuid with crypto.randomUUID() (<a href="https://redirect.github.com/actions/setup-node/issues/1378">#1378</a>)</li> <li><a href="774c1d6296"><code>774c1d6</code></a> feat(node-version-file): support parsing <code>devEngines</code> field (<a href="https://redirect.github.com/actions/setup-node/issues/1283">#1283</a>)</li> <li><a href="efcb663fc6"><code>efcb663</code></a> fix: remove hardcoded bearer (<a href="https://redirect.github.com/actions/setup-node/issues/1467">#1467</a>)</li> <li><a href="d02c89dce7"><code>d02c89d</code></a> Fix npm audit issues (<a href="https://redirect.github.com/actions/setup-node/issues/1491">#1491</a>)</li> <li>See full diff in <a href="6044e13b5d...53b83947a5">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-03-10 12:06:28 +01:00
Kevin Stillhammer	fe3617d6e9	Delete .github/workflows/dependabot-build.yml (#789) ... Too many security issues and complex setup. Using a Skill instead	2026-03-07 12:12:14 +01:00
Kevin Stillhammer	2ff70eebcc	Harden Dependabot build workflow (#788) ... ## Summary - keep the Dependabot build workflow single-job, but harden it a bit - replace `git-auto-commit-action` with explicit `git` commands and step-scoped push auth - add concurrency, a timeout, stricter Dependabot gating, and a guard for moved PR heads ## Why The workflow currently fails in the commit step because `actions/checkout` uses `persist-credentials: false`, but `git-auto-commit-action` later tries to push via `origin` without any credentials: ``` fatal: could not read Username for 'https://github.com': No such device or address ``` This change fixes that failure while keeping credentials scoped to the push step instead of persisting them for the whole job. ## Details - require `github.event.pull_request.user.login == 'dependabot[bot]'` - also require the PR head repo to match `github.repository` - also require the head ref to start with `dependabot/` - check out the exact PR head SHA - run `npm ci --ignore-scripts` - disable git hooks before commit - skip the dist commit if the PR head moved during the run ## Validation - `actionlint .github/workflows/dependabot-build.yml`	2026-03-07 12:05:51 +01:00