max-sixty__worktrunk

mirror of https://github.com/max-sixty/worktrunk.git synced 2026-09-14 20:00:38 +08:00

Author	SHA1	Message	Date
Maximilian Roos	5e03e2863c	docs(changelog): document the v0.69.2 drift (#3592 ) Eleven commits landed on `main` while #3590 sat in CI, so they ship in v0.69.2 with no changelog entry. Most are user-facing, and three are data-loss fixes — exactly the drift the release skill's step-12 check exists to catch. The tag is held until this lands. Entries added, most-impactful first: - #3589 — two ways shell integration deleted user data on a substring guess: an rc line that only quotes the init command, and a user's own `conf.d/wt.fish` deleted outright by `install`'s legacy cleanup. Plus forge detection moving from `host.contains("github")` to label-wise matching. - #3585 + #3591 — truncate-in-place rc writes replaced by write-temp-then-rename, then generalized to every user-file write. - #3578 — despite its `docs(step):` subject this carries three behavior fixes, including `wt step push` succeeding mid-rebase and moving the target branch onto a half-replayed history. - #3588 + #3587 — conflict markers can no longer reach a commit via `wt step relocate --commit`, and `wt merge` refuses in its own name. - #3554 — OpenCode marker writes could land in another session's worktree (thanks @4i3n6, who both reported and fixed it). Not documented, per convention: #3574 (doc comments only, no runtime or docs-site surface) and the three dependency bumps. Also corrects `.github/CLAUDE.md`, which lists three required status checks; there are four — `fast-checks` is required too, confirmed against the branch-protection API. Entries verified against the diffs by subagent. Two corrections came back and are folded in: the #3589 entry originally promised "two of them deleted" and described only one, and the #3578 entry mis-quoted the success line as `✓ Pushed to main` when it carries a commit count. > _This was written by Claude Code on behalf of max_	2026-07-24 20:27:42 -07:00
Maximilian Roos	6b29c2802b	Release v0.69.2 (#3590 ) Cuts v0.69.2, and fixes the Windows code-signing path it depends on. ## The signing fix v0.69.1 shipped an unsigned `wt.exe` under a green run and a Completed SignPath signing request. `archive: false` (#3566) had already made the GitHub artifact name `worktrunk-x86_64-pc-windows-msvc.zip`, and SignPath names its download after the artifact — so with `output-artifact-directory: target/distrib` the signed zip landed at `worktrunk-x86_64-pc-windows-msvc.zip.zip`, beside the untouched unsigned build. The checksum step and the release upload both kept reading the original. Confirmed by parsing the published asset's PE certificate table: `size=0`. The download now goes to a scratch directory and whatever single file lands there replaces the built zip, so SignPath's naming isn't load-bearing. ## Verification, because this failure is invisible Signing is `continue-on-error` by design (self-signed test certificate pending SignPath's OSS review), so nothing in the logs distinguishes "signed" from "silently unsigned" — which is how it slipped through twice, two different ways. `.github/verify-windows-signature.py` reads the zip's PE certificate tables directly, and runs at two points with distinct jobs: - before the overwrite — an unsigned release is tolerable while the certificate is a test one; a corrupt one never is, so the replacement has to verify before it can clobber a good build. - after — reports what the release actually ships, which is the question the logs never answered. ## Rehearsed before landing The signing path only runs on a tag, so each question about it used to cost a release. This chain was instead run on a Windows runner against the already-published v0.69.1 zip (identical bytes, no build): ``` saved to …\target\signpath\worktrunk-x86_64-pc-windows-msvc.zip.zip git-wt.exe: certificate table 8480 bytes wt.exe: certificate table 8472 bytes → mv → target/distrib/worktrunk-x86_64-pc-windows-msvc.zip target/distrib/worktrunk-x86_64-pc-windows-msvc.zip: all 2 executables signed worktrunk-x86_64-pc-windows-msvc.zip: OK (checksum matches) ``` That also settled the open question behind #3556: SignPath returns the signed zip itself, not a wrapper, so `skip-decompress: true` is correct — the extract mode does explode it into loose files. ## Release contents `wt remove`'s fsmonitor sweep (#3581), the troubleshooting doc trim, and this fix. The two refactors in range (#3582, #3584) are behavior-preserving and omitted per convention. Local gate green (4547 passed). Changelog entries verified against the diffs by subagent; two claims corrected (the doc entry's rationale, and an overclaim attributing v0.69.0's unsigned binary to this bug rather than the separate upload failure #3566 fixed). Data-loss surface reviewed across the cumulative diff. > _This was written by Claude Code on behalf of max_	2026-07-24 20:02:13 -07:00
Worktrunk Bot	eda641546f	chore: update tend workflows (0.1.11 → 0.1.12) (#3573 ) Automated nightly regeneration of tend's workflow files via `uvx tend@latest init`, picking up the tend release since the last regen. tend version: 0.1.11 → 0.1.12 Notable changes: - Notifications workflow tolerates transient `gh api` blips — the notifications fetch now retries on non-JSON responses (e.g. an HTML error page returned with a 200 during an API blip) and skips the cycle cleanly instead of aborting the step red (max-sixty/tend#780). - `review-runs` fails loud on transient `gh` errors — a failed run enumeration no longer reports a false all-clear; it surfaces the error so the run isn't silently treated as clean (max-sixty/tend#784). - `running-in-ci` guidance — the bot no longer asks outside contributors to do work it can't do itself (max-sixty/tend#789). - Harness bumps — Claude harness version bumped to 2.1.215 (max-sixty/tend#782) and the default harness timeout raised to 5h50m (max-sixty/tend#790). Compare: https://github.com/max-sixty/tend/compare/0.1.11...0.1.12 Co-authored-by: worktrunk-bot <254187624+worktrunk-bot@users.noreply.github.com>	2026-07-24 18:55:22 -07:00
dependabot[bot]	4ea2fe46a3	chore: bump taiki-e/install-action from 2.84.0 to 2.85.0 (#3570 ) Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.84.0 to 2.85.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/taiki-e/install-action/releases">taiki-e/install-action's releases</a>.</em></p> <blockquote> <h2>2.85.0</h2> <ul> <li> <p>Support <code>wild</code> (alias: <code>wild-linker</code>). (<a href="https://redirect.github.com/taiki-e/install-action/pull/1949">#1949</a>)</p> </li> <li> <p>Support <code>bpf-linker</code>. (<a href="https://redirect.github.com/taiki-e/install-action/pull/1950">#1950</a>)</p> </li> <li> <p>Support <code>rafn</code>. (<a href="https://redirect.github.com/taiki-e/install-action/pull/1935">#1935</a>, thanks <a href="https://github.com/DarkWanderer"><code>@DarkWanderer</code></a>)</p> </li> <li> <p>Update <code>cargo-neat@latest</code> to 0.5.1.</p> </li> <li> <p>Update <code>zizmor@latest</code> to 1.28.0.</p> </li> <li> <p>Update <code>wasmtime@latest</code> to 47.0.2.</p> </li> <li> <p>Update <code>uv@latest</code> to 0.11.31.</p> </li> <li> <p>Update <code>syft@latest</code> to 1.49.0.</p> </li> </ul> <h2>2.84.1</h2> <ul> <li> <p>Update <code>wasmtime@latest</code> to 47.0.1.</p> </li> <li> <p>Update <code>wasm-tools@latest</code> to 1.254.0.</p> </li> <li> <p>Update <code>uv@latest</code> to 0.11.30.</p> </li> <li> <p>Update <code>mise@latest</code> to 2026.7.11.</p> </li> <li> <p>Update <code>cargo-neat@latest</code> to 0.5.0.</p> </li> <li> <p>Update <code>cargo-crap@latest</code> to 0.3.1.</p> </li> <li> <p>Update <code>biome@latest</code> to 2.5.5.</p> </li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md">taiki-e/install-action's changelog</a>.</em></p> <blockquote> <h2>[2.85.0] - 2026-07-23</h2> <ul> <li> <p>Support <code>wild</code> (alias: <code>wild-linker</code>). (<a href="https://redirect.github.com/taiki-e/install-action/pull/1949">#1949</a>)</p> </li> <li> <p>Support <code>bpf-linker</code>. (<a href="https://redirect.github.com/taiki-e/install-action/pull/1950">#1950</a>)</p> </li> <li> <p>Support <code>rafn</code>. (<a href="https://redirect.github.com/taiki-e/install-action/pull/1935">#1935</a>, thanks <a href="https://github.com/DarkWanderer"><code>@DarkWanderer</code></a>)</p> </li> <li> <p>Update <code>cargo-neat@latest</code> to 0.5.1.</p> </li> <li> <p>Update <code>zizmor@latest</code> to 1.28.0.</p> </li> <li> <p>Update <code>wasmtime@latest</code> to 47.0.2.</p> </li> <li> <p>Update <code>uv@latest</code> to 0.11.31.</p> </li> <li> <p>Update <code>syft@latest</code> to 1.49.0.</p> </li> </ul> <h2>[2.84.1] - 2026-07-22</h2> <ul> <li> <p>Update <code>wasmtime@latest</code> to 47.0.1.</p> </li> <li> <p>Update <code>wasm-tools@latest</code> to 1.254.0.</p> </li> <li> <p>Update <code>uv@latest</code> to 0.11.30.</p> </li> <li> <p>Update <code>mise@latest</code> to 2026.7.11.</p> </li> <li> <p>Update <code>cargo-neat@latest</code> to 0.5.0.</p> </li> <li> <p>Update <code>cargo-crap@latest</code> to 0.3.1.</p> </li> <li> <p>Update <code>biome@latest</code> to 2.5.5.</p> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/taiki-e/install-action/commit/7572810d7dd469b651bb7793945692cf78da5dd7"><code>7572810</code></a> Release 2.85.0</li> <li><a href="https://github.com/taiki-e/install-action/commit/d73fed906d8b5a8fbe1165c7635ef41dbf5e6ccd"><code>d73fed9</code></a> Update changelog</li> <li><a href="https://github.com/taiki-e/install-action/commit/20d0440ac8346c2da5bfa9bc79b6d50c30ee7658"><code>20d0440</code></a> Support bpf-linker (<a href="https://redirect.github.com/taiki-e/install-action/issues/1950">#1950</a>)</li> <li><a href="https://github.com/taiki-e/install-action/commit/05a01b63a23569d0bf6dde483954e312dce7d417"><code>05a01b6</code></a> Update vacuum manifest</li> <li><a href="https://github.com/taiki-e/install-action/commit/23a3cce147f42d0975d244f68a4af961ccd8fd53"><code>23a3cce</code></a> Update <code>cargo-neat@latest</code> to 0.5.1</li> <li><a href="https://github.com/taiki-e/install-action/commit/54ede987e296f0fc0b43f3f75d496577fad36a9c"><code>54ede98</code></a> Support rafn (<a href="https://redirect.github.com/taiki-e/install-action/issues/1935">#1935</a>)</li> <li><a href="https://github.com/taiki-e/install-action/commit/411aa4ba3c7fb6ad60a7421c46e881a3a1ceb8ad"><code>411aa4b</code></a> Support wild (<a href="https://redirect.github.com/taiki-e/install-action/issues/1949">#1949</a>)</li> <li><a href="https://github.com/taiki-e/install-action/commit/4427ee328dd40578670ed6724b4a766207e21f0e"><code>4427ee3</code></a> Update <code>zizmor@latest</code> to 1.28.0</li> <li><a href="https://github.com/taiki-e/install-action/commit/68a5a96ea71119471050840e296140c66135d7b8"><code>68a5a96</code></a> Update <code>wasmtime@latest</code> to 47.0.2</li> <li><a href="https://github.com/taiki-e/install-action/commit/f276a80345c4641da04f6613887cc496c332c232"><code>f276a80</code></a> Update <code>uv@latest</code> to 0.11.31</li> <li>Additional commits viewable in <a href="https://github.com/taiki-e/install-action/compare/v2.84.0...v2.85.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=taiki-e/install-action&package-manager=github_actions&previous-version=2.84.0&new-version=2.85.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-24 18:55:20 -07:00
dependabot[bot]	b636ae1a11	chore: bump max-sixty/tend from 0.1.11 to 0.1.12 (#3569 ) Bumps [max-sixty/tend](https://github.com/max-sixty/tend) from 0.1.11 to 0.1.12. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/max-sixty/tend/releases">max-sixty/tend's releases</a>.</em></p> <blockquote> <h2>0.1.12</h2> <h3>Improved</h3> <ul> <li><strong>The default harness timeout rises from 3 hours (10800s) to 5h50m (21000s)</strong> in both Claude harnesses (<code>claude/action.yaml</code> headless, <code>claude-interactive/action.yaml</code> PTY), leaving a 10-minute buffer under GitHub Actions' hard 6-hour job cap instead of cutting long sessions off at 3 hours. (<a href="https://redirect.github.com/max-sixty/tend/pull/790">#790</a>)</li> </ul> <h3>Fixed</h3> <ul> <li><strong>The bot no longer asks an upstream maintainer to do verification work it couldn't do itself.</strong> When a check needs hardware or an environment CI doesn't have, the <code>running-in-ci</code> skill now escalates in order — do it yourself, add the capability to your own repo, ask a contributor, ask your own maintainer — and never hands the ask outward to someone reviewing the bot's change as a favor. (<a href="https://redirect.github.com/max-sixty/tend/pull/789">#789</a>)</li> <li><strong><code>list-recent-runs.sh</code> fails loud on a transient <code>gh</code> API error instead of silently reporting zero runs.</strong> A dropped <code>gh workflow list</code>/<code>gh run list</code> call previously read as a false all-clear that permanently skipped that window; it now retries with backoff and exits non-zero if every attempt fails. (<a href="https://redirect.github.com/max-sixty/tend/pull/784">#784</a>)</li> <li><strong>The notifications workflow tolerates a transient non-JSON response from the GitHub API</strong> instead of failing the step outright. (<a href="https://redirect.github.com/max-sixty/tend/pull/780">#780</a>)</li> </ul> <h3>Internal</h3> <ul> <li>Bumped pinned <code>claude_version</code> to 2.1.215. (<a href="https://redirect.github.com/max-sixty/tend/pull/782">#782</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/max-sixty/tend/blob/main/CHANGELOG.md">max-sixty/tend's changelog</a>.</em></p> <blockquote> <h2>0.1.12</h2> <h3>Improved</h3> <ul> <li><strong>The default harness timeout rises from 3 hours (10800s) to 5h50m (21000s)</strong> in both Claude harnesses (<code>claude/action.yaml</code> headless, <code>claude-interactive/action.yaml</code> PTY), leaving a 10-minute buffer under GitHub Actions' hard 6-hour job cap instead of cutting long sessions off at 3 hours. (<a href="https://redirect.github.com/max-sixty/tend/pull/790">#790</a>)</li> </ul> <h3>Fixed</h3> <ul> <li><strong>The bot no longer asks an upstream maintainer to do verification work it couldn't do itself.</strong> When a check needs hardware or an environment CI doesn't have, the <code>running-in-ci</code> skill now escalates in order — do it yourself, add the capability to your own repo, ask a contributor, ask your own maintainer — and never hands the ask outward to someone reviewing the bot's change as a favor. (<a href="https://redirect.github.com/max-sixty/tend/pull/789">#789</a>)</li> <li><strong><code>list-recent-runs.sh</code> fails loud on a transient <code>gh</code> API error instead of silently reporting zero runs.</strong> A dropped <code>gh workflow list</code>/<code>gh run list</code> call previously read as a false all-clear that permanently skipped that window; it now retries with backoff and exits non-zero if every attempt fails. (<a href="https://redirect.github.com/max-sixty/tend/pull/784">#784</a>)</li> <li><strong>The notifications workflow tolerates a transient non-JSON response from the GitHub API</strong> instead of failing the step outright. (<a href="https://redirect.github.com/max-sixty/tend/pull/780">#780</a>)</li> </ul> <h3>Internal</h3> <ul> <li>Bumped pinned <code>claude_version</code> to 2.1.215. (<a href="https://redirect.github.com/max-sixty/tend/pull/782">#782</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/max-sixty/tend/commit/f90bacaf61dc655fa6331ff558006cb730501772"><code>f90baca</code></a> chore: release 0.1.12 (<a href="https://redirect.github.com/max-sixty/tend/issues/791">#791</a>)</li> <li><a href="https://github.com/max-sixty/tend/commit/a843719b8c32b66a5e2c4408b7512dccb93771d7"><code>a843719</code></a> chore: bump harness timeout default to 5h50m (<a href="https://redirect.github.com/max-sixty/tend/issues/790">#790</a>)</li> <li><a href="https://github.com/max-sixty/tend/commit/ba5a7dee5fe23776255a5c759137269bd5a09c0a"><code>ba5a7de</code></a> fix(running-in-ci): don't ask outsiders to do work the bot can't do itself (#...</li> <li><a href="https://github.com/max-sixty/tend/commit/bbeb9d2cc5df849ed3cc517c8f5ce59ef38f7066"><code>bbeb9d2</code></a> fix(list-recent-runs): fail loud on transient gh errors instead of a false al...</li> <li><a href="https://github.com/max-sixty/tend/commit/8d217418307c9365e2a8e1d67c8e3435c6c675e6"><code>8d21741</code></a> chore: bump claude_version to 2.1.215 (<a href="https://redirect.github.com/max-sixty/tend/issues/782">#782</a>)</li> <li><a href="https://github.com/max-sixty/tend/commit/c3fd0c46d5f9bf4d202ffe7991b56e042f2b0348"><code>c3fd0c4</code></a> fix(notifications): tolerate transient non-JSON gh api responses (<a href="https://redirect.github.com/max-sixty/tend/issues/780">#780</a>)</li> <li><a href="https://github.com/max-sixty/tend/commit/44beffddf7930a82932ab7d7f70a9697b5d1200b"><code>44beffd</code></a> chore: regenerate workflows with tend 0.1.11 (<a href="https://redirect.github.com/max-sixty/tend/issues/778">#778</a>)</li> <li>See full diff in <a href="https://github.com/max-sixty/tend/compare/0.1.11...0.1.12">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=max-sixty/tend&package-manager=github_actions&previous-version=0.1.11&new-version=0.1.12)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-24 18:55:17 -07:00
Maximilian Roos	7b741d0791	fix(release): stop double-zipping the SignPath upload artifact (#3566 ) ## Summary - `actions/upload-artifact` wraps every upload in its own GitHub storage zip unless `archive: false`. The uploaded file here is already a zip (`worktrunk-x86_64-pc-windows-msvc.zip`), so the default produced a zip-of-a-zip — SignPath treated the outer storage wrapper as "the artifact" and the configured `<pe-file path="wt.exe">` never matched anything inside it. - Root-caused this against the real v0.69.0 release run: the SignPath dashboard shows the failed request's unsigned artifact as `unsigned-windows-zip.zip` (16.8MB, matching GitHub's storage-wrapper name, not the real filename) with error `Expected path to match exactly 1 item, but found 0` for `wt.exe`. - `archive: false` uploads the file as-is (single-file only, which is what we have), so SignPath receives the real zip directly, one level shallower — matching the artifact configuration as originally written. - Also fixes the v0.69.0 CHANGELOG's SignPath entry, which read "Signed with a test certificate" — overclaiming, since the actual signing attempt on that release failed. Reworded to describe the pipeline's intent rather than a specific run's result. v0.69.0 shipped with an unsigned Windows binary as a result (signing failure was masked by the intentional `continue-on-error`, so the release itself succeeded — this is exactly the non-blocking behavior that was designed in). This fix should make the next release's signing attempt succeed for real. ## Test plan - [x] `actionlint .github/workflows/release.yaml` — no new warnings - [x] Root cause confirmed directly against the SignPath dashboard's error details and artifact tab for the failed v0.69.0 signing request - [x] Verified `archive: false` semantics against `actions/upload-artifact@v7`'s own `action.yml` (single-file upload, uploaded as-is) > _This was written by Claude Code on behalf of Max_	2026-07-23 19:30:19 -07:00
Maximilian Roos	481125801f	ci: publish to crates.io via trusted publishing (#3564 ) ## What `publish-cargo` now mints its crates.io credential per run through `rust-lang/crates-io-auth-action` (GitHub Actions OIDC) instead of reading the `CARGO_REGISTRY_TOKEN` environment secret. The job gains `id-token: write` for the OIDC exchange and `contents: read` for checkout, narrowing it from the workflow-level `contents: write`. The token lives for about 30 minutes and the action's post step revokes it, so no long-lived publish credential exists anywhere. ## Why The stored token expires on a schedule, and each expiry is a silent trap: nothing breaks until the next release tag, which is exactly when you don't want to discover it. ## Prerequisite, already in place A Trusted Publisher is configured for `worktrunk` on crates.io — repository `max-sixty/worktrunk`, workflow `release.yaml`, environment `release`. It had to land before this merge, since otherwise `publish-cargo` would fail at the auth step on the next release tag. `CARGO_REGISTRY_TOKEN` can be deleted from the `release` environment once a release has gone out this way. `AUR_SSH_PRIVATE_KEY` stays. > _This was written by Claude Code on behalf of max_	2026-07-23 18:46:12 -07:00
Maximilian Roos	8f55d15301	fix(release): preserve signed Windows zip filename, match checksum format (#3556 ) ## Summary - The SignPath action's `skip-decompress` defaults to `false`, so it would have extracted the returned zip's contents as loose files into `target/distrib/` instead of saving back a signed `worktrunk-x86_64-pc-windows-msvc.zip`. The checksum step would have silently hashed the still-unsigned zip, and the release would have shipped unsigned Windows binaries with no CI failure to flag it. - `sha256sum` without `-b` omits the `` binary-mode marker; cargo-dist's own checksums use `<hash> <filename>` (confirmed against a real release asset). Added `-b` to match. Confirmed via `gh run view` on #3553's own CI run that `build-local-artifacts` is skipped on PRs in this repo, so this code path has never actually executed — this is the first real fix before it runs for real on a tagged release. ## Test plan - [x] `actionlint .github/workflows/release.yaml` — no new warnings (same pre-existing shellcheck style notes as before) - [x] Verified `skip-decompress` behavior against the action's own `action.yml` input spec - [x] Verified checksum format against a real downloaded release asset (`v0.68.0`) > _This was written by Claude Code on behalf of Max_	2026-07-23 16:13:30 -07:00
Maximilian Roos	5f8c301dec	feat(release): sign Windows binaries via SignPath (#3553 ) ## Summary - Signs the Windows release zip (`wt.exe` + `git-wt.exe`) via [SignPath](https://signpath.io)'s free OSS code-signing program, using the `test-signing` policy (self-signed test certificate) while the project's Foundation-program application is under review. - Non-blocking (`continue-on-error`) so a signing hiccup can't take down crates.io/homebrew/winget/AUR publishing. - Recomputes the `.sha256` checksum after signing, since the signed zip's bytes differ from the unsigned one. - Uses a dedicated low-privilege `CI builds` SignPath identity (submitter-only), not an admin account. ## Test plan - [x] `actionlint` clean (only pre-existing shellcheck style warnings elsewhere in the file) - [x] Artifact configuration (zip containing `wt.exe` + `git-wt.exe`) validated against SignPath's own XML parser and against the real file layout inside a downloaded `v0.68.0` Windows release zip - [ ] First real Windows build after merge will be the first live signing round-trip through GitHub Actions — watch that release's CI run > _This was written by Claude Code on behalf of Max_ --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-23 12:19:32 -07:00
Maximilian Roos	a7c4a7a120	refactor(wt-perf): place fixtures under target/wt-perf, not the cache dir (#3547 ) ## What Move every `wt-perf` on-disk fixture out of the per-user cache dir and under the cargo target dir at `<target>/wt-perf/`, resolved by a renamed `wt_perf_fixture_dir()`: - `setup <config>` fixtures → `<target>/wt-perf/<config>` (was `~/.cache/wt-perf/<config>`). - The rust-lang/rust clone and `prune-real` fixtures → `<target>/wt-perf/bench-repos/` (was `~/.cache/wt-perf/bench-repos/`). - `wt_perf_cache_dir()` → `wt_perf_fixture_dir()`. The target dir is derived from the running executable's own path (it lives inside whichever dir cargo built into — `<target>/debug/wt-perf`, `<target>/release/deps/<bench>`), so it honors `CARGO_TARGET_DIR`, a config-file `build.target-dir`, and cargo-llvm-cov's `target/llvm-cov-target/` — none of which a bare `CARGO_TARGET_DIR` env read covers. Falls back to `<workspace>/target` if the binary isn't under a recognizable profile dir. The `etcetera` dependency is dropped. - The `WT_PERF_CACHE_DIR` env override (and the empty-value guard it required) is removed; the benchmarks workflow now caches the deterministic `target/wt-perf/bench-repos` path directly. - In-process throwaway fixtures (`create_repo`) are unchanged — they keep using `tempfile::TempDir`. This reverses the location decision from #3542, which had moved these into `~/.cache/wt-perf`. ## Why `target/` is the conventional home for build/test-generated artifacts — gitignored, reaped by `cargo clean`, and already where criterion writes (`target/criterion`). Keeping every wt-perf fixture there gives one predictable location under the repo that `cargo clean` fully resets. Deriving the target dir from the running binary (rather than assuming `<workspace>/target`) keeps that property intact even when the target dir is relocated. ## Tradeoff (accepted) `target/` is not shared across git worktrees (worktrees don't share it) and is wiped by `cargo clean`. So the ~15 GiB `prune-real` rust clone re-clones per worktree and after every `cargo clean` — the cost #3542 avoided by using the cache dir. This is deliberate and documented on `wt_perf_fixture_dir`; it's cheap for the synthetic `setup` fixtures, which rebuild in seconds. ## Testing - `cargo build -p wt-perf --all-targets`, `cargo test -p wt-perf` — clean. - New unit test `target_dir_from_exe_finds_cargo_target` covers the resolution logic (relocated `CARGO_TARGET_DIR`, bench binary under `release/deps/`, cargo-llvm-cov's nested target, closest-profile-wins, and the outside-any-target fallback). - `pre-commit run --all-files` (fmt, clippy, yaml, typos, cargo-lock, custom hooks) — clean. - Smoke-tested end-to-end: `setup branches-2` lands at `<worktree>/target/wt-perf/branches-2` and writes nothing to `~/.cache/`; a copy of the binary run from a fake `<dir>/debug/wt-perf` correctly resolves fixtures to `<dir>/wt-perf/`, proving a relocated target dir is honored. > _This was written by Claude Code on behalf of Maximilian_ --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-22 13:44:50 -07:00
Maximilian Roos	4121dc979c	refactor(wt-perf): cache fixtures in the platform cache dir, not /tmp or target/ (#3542 ) ## What Move `wt-perf`'s benchmark/debug fixture repos out of `std::env::temp_dir()` and `target/bench-repos/` into the per-user cache dir, resolved by a new `wt_perf_cache_dir()`: - `$WT_PERF_CACHE_DIR` if set, else `<cache>/wt-perf` via `etcetera::choose_base_strategy().cache_dir()` — `~/.cache/wt-perf` (or `$XDG_CACHE_HOME/wt-perf`) on Linux and macOS. This matches worktrunk's own base-dir convention (`src/config/user/path.rs` resolves user config through the same XDG-on-macOS strategy). - `setup <config>` fixtures → `<cache>/<config>` (was `temp_dir()/wt-perf-<config>`). `--path` still overrides. - Real cloned fixtures (`prune-real`, the rust-lang/rust clone) → `<cache>/bench-repos/` (was `target/bench-repos/`). - In-process throwaway fixtures (`create_repo`) are unchanged — they keep using `tempfile::TempDir`. ## Why Both old homes were wrong for a reused fixture (these are given stable names, persist between runs, and are referenced from docs and `-C <path>` — that's a cache, not a temp file): - A fixed name in a shared `/tmp` (Linux) collides across users: `/tmp` is sticky (`1777`), so a second user's `setup` hits `remove_dir_all().unwrap()` on a dir they don't own → `EPERM` → panic. It's also a predictable-path/TOCTOU hazard, and `systemd-tmpfiles` reaps `/tmp` per-file at 10 days by `max(atime,mtime,ctime)` — on a `noatime` mount an actively-read fixture still loses cold `.git/objects/pack/.pack` mid-use → silent git corruption. - On macOS, `temp_dir()` is already `/var/folders/.../T` (per-user, `0700`), so the docs' `/tmp/wt-perf-` paths were simply wrong there. - `target/` is per-worktree (git worktrees don't share it) and wiped by `cargo clean`, so the ~15 GiB rust clone was re-cloned per worktree — worst for the most expensive fixture, in a worktree-heavy workflow. The cache dir is per-user (no collision, no TOCTOU), stable and discoverable (docs/`-C` references still work), shared across worktrees (clone once per machine), and survives `cargo clean` — matching sccache, cargo, rustup, Go, Bazel, and Hugging Face, which all place large reusable caches there rather than in `/tmp`. ## Migration notes - First bench/setup run after this rebuilds the cache under the new location (the old `target/bench-repos/` is no longer read). Existing fixtures can be dropped with `rm -rf target/bench-repos`. - `.github/workflows/benchmarks.yaml` sets `WT_PERF_CACHE_DIR` and caches `$WT_PERF_CACHE_DIR/bench-repos`, so the cached path and the path wt-perf writes stay pinned together (no drift if a runner sets `$XDG_CACHE_HOME`); key unchanged. - Docs (`benches/CLAUDE.md`, `src/commands/CLAUDE.md`) updated to the new paths, noting that `wt-perf setup` prints the exact path. ## Testing - `cargo build --workspace --all-targets`, `cargo clippy --workspace --all-targets --features shell-integration-tests -- -D warnings` — clean. - `cargo test -p wt-perf` — passes. - Smoke-tested default resolution (`~/.cache/wt-perf/…` on macOS), `$WT_PERF_CACHE_DIR` override, and the `prune-real --path` rejection (now names the resolved cache path). > _This was written by Claude Code on behalf of Maximilian_ --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-22 03:05:10 -07:00
dependabot[bot]	89b58e2522	chore: bump taiki-e/install-action from 2.83.3 to 2.84.0 (#3529 ) Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.83.3 to 2.84.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/taiki-e/install-action/releases">taiki-e/install-action's releases</a>.</em></p> <blockquote> <h2>2.84.0</h2> <ul> <li> <p>Support <code>d2</code>. (<a href="https://redirect.github.com/taiki-e/install-action/pull/1944">#1944</a>)</p> </li> <li> <p>Support <code>protoc-gen-connect-openapi</code>. (<a href="https://redirect.github.com/taiki-e/install-action/pull/1922">#1922</a>, thanks <a href="https://github.com/JasterV"><code>@JasterV</code></a>)</p> </li> <li> <p>Update <code>convco@latest</code> to 0.7.0. (<a href="https://redirect.github.com/taiki-e/install-action/pull/1941">#1941</a>, thanks <a href="https://github.com/graelo"><code>@graelo</code></a>)</p> </li> <li> <p>Update <code>just@latest</code> to 1.57.0.</p> </li> <li> <p>Update <code>cargo-semver-checks@latest</code> to 0.49.0.</p> </li> <li> <p>Update <code>tombi@latest</code> to 1.2.4.</p> </li> <li> <p>Update <code>cosign@latest</code> to 3.1.2.</p> </li> </ul> <h2>2.83.4</h2> <ul> <li> <p>Update <code>vacuum@latest</code> to 0.29.10.</p> </li> <li> <p>Update <code>uv@latest</code> to 0.11.29.</p> </li> <li> <p>Update <code>syft@latest</code> to 1.48.0.</p> </li> <li> <p>Update <code>prek@latest</code> to 0.4.10.</p> </li> <li> <p>Update <code>mise@latest</code> to 2026.7.7.</p> </li> <li> <p>Update <code>cargo-shear@latest</code> to 1.13.2.</p> </li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md">taiki-e/install-action's changelog</a>.</em></p> <blockquote> <h2>[2.84.0] - 2026-07-20</h2> <ul> <li> <p>Support <code>d2</code>. (<a href="https://redirect.github.com/taiki-e/install-action/pull/1944">#1944</a>)</p> </li> <li> <p>Support <code>protoc-gen-connect-openapi</code>. (<a href="https://redirect.github.com/taiki-e/install-action/pull/1922">#1922</a>, thanks <a href="https://github.com/JasterV"><code>@JasterV</code></a>)</p> </li> <li> <p>Update <code>convco@latest</code> to 0.7.0. (<a href="https://redirect.github.com/taiki-e/install-action/pull/1941">#1941</a>, thanks <a href="https://github.com/graelo"><code>@graelo</code></a>)</p> </li> <li> <p>Update <code>just@latest</code> to 1.57.0.</p> </li> <li> <p>Update <code>cargo-semver-checks@latest</code> to 0.49.0.</p> </li> <li> <p>Update <code>tombi@latest</code> to 1.2.4.</p> </li> <li> <p>Update <code>cosign@latest</code> to 3.1.2.</p> </li> </ul> <h2>[2.83.4] - 2026-07-17</h2> <ul> <li> <p>Update <code>vacuum@latest</code> to 0.29.10.</p> </li> <li> <p>Update <code>uv@latest</code> to 0.11.29.</p> </li> <li> <p>Update <code>syft@latest</code> to 1.48.0.</p> </li> <li> <p>Update <code>prek@latest</code> to 0.4.10.</p> </li> <li> <p>Update <code>mise@latest</code> to 2026.7.7.</p> </li> <li> <p>Update <code>cargo-shear@latest</code> to 1.13.2.</p> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/taiki-e/install-action/commit/a6b2e2dcd845ddd7f509ce4f3ed3d922b80cc5d9"><code>a6b2e2d</code></a> Release 2.84.0</li> <li><a href="https://github.com/taiki-e/install-action/commit/fbdd9c50c029b1f2d5667c090563e4a31cc3f43c"><code>fbdd9c5</code></a> Update cargo-neat manifest</li> <li><a href="https://github.com/taiki-e/install-action/commit/424c5f90440984601897d473b7936cc3fd52bda8"><code>424c5f9</code></a> Update changelog</li> <li><a href="https://github.com/taiki-e/install-action/commit/a1fa02c1f9b8ef65d443ad6b3f0b99f5863b6f4f"><code>a1fa02c</code></a> Support <code>protoc-gen-connect-openapi</code> (<a href="https://redirect.github.com/taiki-e/install-action/issues/1922">#1922</a>)</li> <li><a href="https://github.com/taiki-e/install-action/commit/9e22773f98774c41688b7cc39a5f7f7eaa4ca97d"><code>9e22773</code></a> Update DEVELOPMENT.md</li> <li><a href="https://github.com/taiki-e/install-action/commit/8d5009fee2da9de26fee96bb727c2df318ffce42"><code>8d5009f</code></a> Support d2</li> <li><a href="https://github.com/taiki-e/install-action/commit/5193316cc852ca0f37d4819875e939522c4f7c47"><code>5193316</code></a> Update <code>tombi@latest</code> to 1.2.4</li> <li><a href="https://github.com/taiki-e/install-action/commit/4c740c71c8320819d812216022c3ff178e1a3394"><code>4c740c7</code></a> Update <code>tombi@latest</code> to 1.2.3</li> <li><a href="https://github.com/taiki-e/install-action/commit/de240ff26f6e8b33bacd85a1a7c621c92d8d7c70"><code>de240ff</code></a> Update <code>just@latest</code> to 1.57.0</li> <li><a href="https://github.com/taiki-e/install-action/commit/dfca8548668aebabd66da598ea31d87a03819d43"><code>dfca854</code></a> Update <code>cargo-semver-checks@latest</code> to 0.49.0</li> <li>Additional commits viewable in <a href="https://github.com/taiki-e/install-action/compare/v2.83.3...v2.84.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=taiki-e/install-action&package-manager=github_actions&previous-version=2.83.3&new-version=2.84.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-21 18:46:09 -07:00
dependabot[bot]	013d1cc221	chore: bump KSXGitHub/github-actions-deploy-aur from 4.1.3 to 4.2.0 (#3472 ) Bumps [KSXGitHub/github-actions-deploy-aur](https://github.com/ksxgithub/github-actions-deploy-aur) from 4.1.3 to 4.2.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/ksxgithub/github-actions-deploy-aur/releases">KSXGitHub/github-actions-deploy-aur's releases</a>.</em></p> <blockquote> <h2>v4.2.0</h2> <p>Add a feature to sync AUR repo (<a href="https://redirect.github.com/KSXGitHub/github-actions-deploy-aur/pull/52">KSXGitHub/github-actions-deploy-aur#52</a>).</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/KSXGitHub/github-actions-deploy-aur/commit/084b0d9b15415bf9cdb65d44dad1efe37a354050"><code>084b0d9</code></a> style: consistency (<a href="https://redirect.github.com/ksxgithub/github-actions-deploy-aur/issues/55">#55</a>)</li> <li><a href="https://github.com/KSXGitHub/github-actions-deploy-aur/commit/9e2f21095c586521806151200746082d8e02bb90"><code>9e2f210</code></a> fix: force-add <code>PKGBUILD</code> and <code>.SRCINFO</code> in the asset_dir/assets path (<a href="https://redirect.github.com/ksxgithub/github-actions-deploy-aur/issues/53">#53</a>)</li> <li><a href="https://github.com/KSXGitHub/github-actions-deploy-aur/commit/7acb32fe8c43848121eee16dd39d8294ec2bf25b"><code>7acb32f</code></a> feat: full asset sync (<a href="https://redirect.github.com/ksxgithub/github-actions-deploy-aur/issues/52">#52</a>)</li> <li>See full diff in <a href="https://github.com/ksxgithub/github-actions-deploy-aur/compare/v4.1.3...v4.2.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=KSXGitHub/github-actions-deploy-aur&package-manager=github_actions&previous-version=4.1.3&new-version=4.2.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-19 11:21:35 -07:00
dependabot[bot]	99704db62f	chore: bump taiki-e/install-action from 2.83.2 to 2.83.3 (#3497 ) Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.83.2 to 2.83.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/taiki-e/install-action/releases">taiki-e/install-action's releases</a>.</em></p> <blockquote> <h2>2.83.3</h2> <ul> <li> <p>Update <code>release-plz@latest</code> to 0.3.160.</p> </li> <li> <p>Update <code>prek@latest</code> to 0.4.9.</p> </li> <li> <p>Update <code>mise@latest</code> to 2026.7.6.</p> </li> <li> <p>Update <code>dprint@latest</code> to 0.55.2.</p> </li> <li> <p>Update <code>cargo-dinghy@latest</code> to 0.8.5.</p> </li> <li> <p>Update <code>cargo-binstall@latest</code> to 1.21.0.</p> </li> <li> <p>Update <code>biome@latest</code> to 2.5.4.</p> </li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md">taiki-e/install-action's changelog</a>.</em></p> <blockquote> <h2>[2.83.3] - 2026-07-16</h2> <ul> <li> <p>Update <code>release-plz@latest</code> to 0.3.160.</p> </li> <li> <p>Update <code>prek@latest</code> to 0.4.9.</p> </li> <li> <p>Update <code>mise@latest</code> to 2026.7.6.</p> </li> <li> <p>Update <code>dprint@latest</code> to 0.55.2.</p> </li> <li> <p>Update <code>cargo-dinghy@latest</code> to 0.8.5.</p> </li> <li> <p>Update <code>cargo-binstall@latest</code> to 1.21.0.</p> </li> <li> <p>Update <code>biome@latest</code> to 2.5.4.</p> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/taiki-e/install-action/commit/ed67fa35ac944f3a9b33f12c4dd43b6f31a47e20"><code>ed67fa3</code></a> Release 2.83.3</li> <li><a href="https://github.com/taiki-e/install-action/commit/618fa5589cc587c869ec39ae0606a6cf6ef03c0b"><code>618fa55</code></a> Update prek manifest</li> <li><a href="https://github.com/taiki-e/install-action/commit/47579092c792f14738b668ee240d199bcad0d8e2"><code>4757909</code></a> Update zizmor manifest</li> <li><a href="https://github.com/taiki-e/install-action/commit/f1fa00538cc2e7231cb60e4d47c24597e0c387b7"><code>f1fa005</code></a> Update uv manifest</li> <li><a href="https://github.com/taiki-e/install-action/commit/aa8dc906017e56077bc125256c4d9301b1cde72a"><code>aa8dc90</code></a> Update <code>release-plz@latest</code> to 0.3.160</li> <li><a href="https://github.com/taiki-e/install-action/commit/b9654978ff643e657a453245addf012127caa2c5"><code>b965497</code></a> Update <code>prek@latest</code> to 0.4.9</li> <li><a href="https://github.com/taiki-e/install-action/commit/7aab3a9c373d60a23a5b89c212174c0baa6a0fa0"><code>7aab3a9</code></a> Update <code>mise@latest</code> to 2026.7.6</li> <li><a href="https://github.com/taiki-e/install-action/commit/bfee8d1ca4d6f82a5c3f7151f046e75e6c202ff5"><code>bfee8d1</code></a> Update kingfisher manifest</li> <li><a href="https://github.com/taiki-e/install-action/commit/b65771b2e228b44f33eb596fbf78979075cd8aa7"><code>b65771b</code></a> Update <code>dprint@latest</code> to 0.55.2</li> <li><a href="https://github.com/taiki-e/install-action/commit/20468927b3c1d5f14e6c4c1379ced0c6cc1ed103"><code>2046892</code></a> Update <code>cargo-dinghy@latest</code> to 0.8.5</li> <li>Additional commits viewable in <a href="https://github.com/taiki-e/install-action/compare/v2.83.2...v2.83.3">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=taiki-e/install-action&package-manager=github_actions&previous-version=2.83.2&new-version=2.83.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-19 11:21:30 -07:00
Worktrunk Bot	5967df2dfc	chore(ci): weekly renovation 2026-07-19 (#3518 )	2026-07-19 08:39:31 -07:00
Worktrunk Bot	a1332d46bd	chore: update tend workflows (0.1.10 → 0.1.11) (#3500 ) Automated nightly regeneration of tend's workflow files, picking up the upstream release. tend version: 0.1.10 → 0.1.11 Notable changes (consumer-relevant): - Skip no-op `tend-mention` sessions triggered by the bot's own comments — a new pre-mention guard in the generated `tend-mention.yaml` short-circuits before the engagement heuristics (max-sixty/tend#751). - Respond to actionable bot self-reviews instead of exiting as a self-loop: a review the review workflow leaves on its own PR is the bot's reviewer role, so it gets actioned rather than silently skipped (max-sixty/tend#762). - Sandbox: adopter levers to reach inside the Claude-family sandbox, and derive the sandbox `PATH` from the runner's `PATH` (max-sixty/tend#768, max-sixty/tend#767). - `running-in-ci`: permit maintainer-invited upstream contributions, and prohibit self-authored attribution sign-offs (max-sixty/tend#770, max-sixty/tend#773). - Action reliability: self-heal duplicate `tend-outage` issues from concurrent leg failures, and recover dropped cron ticks in list-recent-runs via a previous-run anchor (max-sixty/tend#744, max-sixty/tend#753). Compare: https://github.com/max-sixty/tend/compare/0.1.10...0.1.11 Co-authored-by: worktrunk-bot <254187624+worktrunk-bot@users.noreply.github.com>	2026-07-17 12:59:12 -07:00
dependabot[bot]	8ab797f595	chore: bump max-sixty/tend from 0.1.10 to 0.1.11 (#3496 )	2026-07-16 23:00:21 -07:00
Maximilian Roos	0a1cd19cc9	chore: drop the NEXTEST_NO_INPUT_HANDLER workaround (#3482 ) nextest#2878 (the run suspending with SIGTTOU when a test spawns an interactive shell, as the `shell-integration-tests` feature does) was fixed in nextest 0.9.118, so the `NEXTEST_NO_INPUT_HANDLER=1` workaround threaded through the insta hook, CI, and the test docs is obsolete. Verified on nextest 0.9.132: the shell-wrapper tests run to completion under a real PTY without the variable. `.config/nextest.toml` now pins `nextest-version = "0.9.118"`, so an older nextest fails with a clear version error instead of suspending mid-run. > _This was written by Claude Code on behalf of max_ --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-07-15 15:02:56 -07:00
dependabot[bot]	334b9c6165	chore: bump taiki-e/install-action from 2.83.0 to 2.83.2 (#3444 ) Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.83.0 to 2.83.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/taiki-e/install-action/releases">taiki-e/install-action's releases</a>.</em></p> <blockquote> <h2>2.83.2</h2> <ul> <li> <p>Update <code>parse-dockerfile@latest</code> to 0.1.8.</p> </li> <li> <p>Update <code>mise@latest</code> to 2026.7.5.</p> </li> <li> <p>Update <code>just@latest</code> to 1.56.0.</p> </li> <li> <p>Update <code>gungraun-runner@latest</code> to 0.19.4.</p> </li> <li> <p>Update <code>cargo-neat@latest</code> to 0.4.1.</p> </li> </ul> <h2>2.83.1</h2> <ul> <li> <p>Update <code>rclone@latest</code> to 1.74.4.</p> </li> <li> <p>Update <code>mise@latest</code> to 2026.7.4.</p> </li> <li> <p>Update <code>cargo-deny@latest</code> to 0.20.2.</p> </li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md">taiki-e/install-action's changelog</a>.</em></p> <blockquote> <h2>[2.83.2] - 2026-07-12</h2> <ul> <li> <p>Update <code>parse-dockerfile@latest</code> to 0.1.8.</p> </li> <li> <p>Update <code>mise@latest</code> to 2026.7.5.</p> </li> <li> <p>Update <code>just@latest</code> to 1.56.0.</p> </li> <li> <p>Update <code>gungraun-runner@latest</code> to 0.19.4.</p> </li> <li> <p>Update <code>cargo-neat@latest</code> to 0.4.1.</p> </li> </ul> <h2>[2.83.1] - 2026-07-10</h2> <ul> <li> <p>Update <code>rclone@latest</code> to 1.74.4.</p> </li> <li> <p>Update <code>mise@latest</code> to 2026.7.4.</p> </li> <li> <p>Update <code>cargo-deny@latest</code> to 0.20.2.</p> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/taiki-e/install-action/commit/43aecc8d72668fbcfe75c31400bc4f890f1c5853"><code>43aecc8</code></a> Release 2.83.2</li> <li><a href="https://github.com/taiki-e/install-action/commit/fca47892c74f4dffa1e86ad93eca31cf898c2541"><code>fca4789</code></a> Update prek manifest</li> <li><a href="https://github.com/taiki-e/install-action/commit/b41cc1f9ab348b9db341d8597853df93b08652f0"><code>b41cc1f</code></a> Update <code>parse-dockerfile@latest</code> to 0.1.8</li> <li><a href="https://github.com/taiki-e/install-action/commit/8d866f8ca86db77044d7d29639e24660d0b37b88"><code>8d866f8</code></a> Update <code>mise@latest</code> to 2026.7.5</li> <li><a href="https://github.com/taiki-e/install-action/commit/7ebe462223a33af951eed3c3ab1f754ddf2992e2"><code>7ebe462</code></a> Update <code>just@latest</code> to 1.56.0</li> <li><a href="https://github.com/taiki-e/install-action/commit/01ab5633b01b19988c158b5366d64947fd6cacce"><code>01ab563</code></a> Update <code>gungraun-runner@latest</code> to 0.19.4</li> <li><a href="https://github.com/taiki-e/install-action/commit/f164a682e7e0033cf72f1d5722d079fe82275c1e"><code>f164a68</code></a> Update <code>cargo-neat@latest</code> to 0.4.1</li> <li><a href="https://github.com/taiki-e/install-action/commit/2ca9b94c269419b7b0c711c09d0b21c4e1d51145"><code>2ca9b94</code></a> Release 2.83.1</li> <li><a href="https://github.com/taiki-e/install-action/commit/8598f86981150fb7f6511798af658bbf80a8ea46"><code>8598f86</code></a> Update parse-dockerfile manifest</li> <li><a href="https://github.com/taiki-e/install-action/commit/76cfe4de2d710e12bae93580164f20dff9fd96e9"><code>76cfe4d</code></a> Update <code>rclone@latest</code> to 1.74.4</li> <li>Additional commits viewable in <a href="https://github.com/taiki-e/install-action/compare/v2.83.0...v2.83.2">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=taiki-e/install-action&package-manager=github_actions&previous-version=2.83.0&new-version=2.83.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-13 16:01:45 -07:00
Worktrunk Bot	d7e3aac9a0	ci: bump pinned tool versions (cargo-nextest, worktrunk, nushell) (#3429 )	2026-07-12 08:16:40 -07:00
dependabot[bot]	fbf380b447	chore: bump taiki-e/install-action from 2.82.11 to 2.83.0 (#3405 ) Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.82.11 to 2.83.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/taiki-e/install-action/releases">taiki-e/install-action's releases</a>.</em></p> <blockquote> <h2>2.83.0</h2> <ul> <li> <p>Support <code>cargo-about</code>. (<a href="https://redirect.github.com/taiki-e/install-action/pull/1924">#1924</a>, thanks <a href="https://github.com/ruffsl"><code>@ruffsl</code></a>)</p> </li> <li> <p>Update <code>uv@latest</code> to 0.11.28.</p> </li> <li> <p>Update <code>martin@latest</code> to 1.12.0.</p> </li> <li> <p>Update <code>kingfisher@latest</code> to 1.106.0.</p> </li> <li> <p>Update <code>biome@latest</code> to 2.5.3.</p> </li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md">taiki-e/install-action's changelog</a>.</em></p> <blockquote> <h2>[2.83.0] - 2026-07-09</h2> <ul> <li> <p>Support <code>cargo-about</code>. (<a href="https://redirect.github.com/taiki-e/install-action/pull/1924">#1924</a>, thanks <a href="https://github.com/ruffsl"><code>@ruffsl</code></a>)</p> </li> <li> <p>Update <code>uv@latest</code> to 0.11.28.</p> </li> <li> <p>Update <code>martin@latest</code> to 1.12.0.</p> </li> <li> <p>Update <code>kingfisher@latest</code> to 1.106.0.</p> </li> <li> <p>Update <code>biome@latest</code> to 2.5.3.</p> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/taiki-e/install-action/commit/c7eb1735f09259a5035e8e5d44b1406b1cddc0fb"><code>c7eb173</code></a> Release 2.83.0</li> <li><a href="https://github.com/taiki-e/install-action/commit/84d4171800adc3ccfe039969324217bde4ca0f25"><code>84d4171</code></a> Update changelog</li> <li><a href="https://github.com/taiki-e/install-action/commit/21e5d859bea44c4a9c990a48a63fed2203e01d68"><code>21e5d85</code></a> Support cargo-about (<a href="https://redirect.github.com/taiki-e/install-action/issues/1924">#1924</a>)</li> <li><a href="https://github.com/taiki-e/install-action/commit/786ded99bea7500a913f1f19b18bfcfdf782fb97"><code>786ded9</code></a> Update <code>uv@latest</code> to 0.11.28</li> <li><a href="https://github.com/taiki-e/install-action/commit/1c1bbcf779fa11c2ef8cf0bda69bba43465230e6"><code>1c1bbcf</code></a> Update rclone manifest</li> <li><a href="https://github.com/taiki-e/install-action/commit/4e5eb09101d68b0b5f52740d1abc011ae003ac6f"><code>4e5eb09</code></a> Update <code>martin@latest</code> to 1.12.0</li> <li><a href="https://github.com/taiki-e/install-action/commit/dc84fc5f1a7ad878e27656eb3ed173e393c62867"><code>dc84fc5</code></a> Update <code>kingfisher@latest</code> to 1.106.0</li> <li><a href="https://github.com/taiki-e/install-action/commit/cf10e546be4ee50afcfd94a851bcd9eb64cba30d"><code>cf10e54</code></a> Update <code>biome@latest</code> to 2.5.3</li> <li>See full diff in <a href="https://github.com/taiki-e/install-action/compare/v2.82.11...v2.83.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=taiki-e/install-action&package-manager=github_actions&previous-version=2.82.11&new-version=2.83.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-10 03:43:43 -07:00
Worktrunk Bot	103e9a70ab	chore: update tend workflows (0.1.9 → 0.1.10) (#3413 ) Automated nightly regeneration of tend's workflow files, picking up tend 0.1.10. tend version: 0.1.9 → 0.1.10 Notable changes: - Skip a no-op `tend-mention` session when the only trigger is the bot's own empty-body approved review — the review is terminal, so there's nothing to act on (a bot `CHANGES_REQUESTED`/`COMMENTED` review, or an approval carrying nits in its body, still fires). This is the substantive body change in this regen (`tend-mention.yaml`) (max-sixty/tend#749). - Attribute bot commits and PRs solely to the tend bot account (max-sixty/tend#760). - `report-failure` now renders every outage entry as a single table in `tend-outage` issues (max-sixty/tend#748). - Prompt update: make project excellence an explicit priority for the bot (max-sixty/tend#758). Compare: https://github.com/max-sixty/tend/compare/0.1.9...0.1.10 Co-authored-by: worktrunk-bot <254187624+worktrunk-bot@users.noreply.github.com>	2026-07-10 03:43:30 -07:00
Maximilian Roos	57b303fda2	fix(nix): provide lsof to the flake's test sandbox (#3410 ) The nix-flake job has failed on main since #3396: `test_remove_reap_kills_process` discovers its child via `lsof -d cwd`, but the flake's `worktrunk-tests` check didn't provide `lsof`, so `processes_under` fails to spawn it, returns an empty list forever, and the test's 5s discovery poll panics with `child <pid> never discovered`. Failing main run: https://github.com/max-sixty/worktrunk/actions/runs/29066326142. Three changes: - `flake.nix`: add `pkgs.lsof` to the test check's inputs, the same pattern as `git`/`python3`/`procps`. `ps` (procps) already works in the sandbox, so /proc-based process inspection is available there and the test should be genuinely exercised rather than excluded. - `.github/workflows/nightly.yaml`: add `flake.nix`, `flake.lock`, and `nix/**` to the trigger paths (push and PR gate). A flake change couldn't previously trigger the nix-flake job that validates it; this PR relies on the fixed trigger for its own validation. - `tests/integration_tests/remove.rs`: point the discovery-timeout panic message at lsof, so the next environment missing it doesn't need re-diagnosing. Validation: nix isn't available locally, so the proof is this PR's own nightly run going green on the nix-flake job. > _This was written by Claude Code on behalf of max_ Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-07-09 23:29:40 -07:00
Maximilian Roos	c8de0d872a	ci: move lychee link check to the nightly workflow (#3402 ) Moves the lychee link check out of PR CI into the `nightly` workflow. Link health depends on external sites (429s, bot-blocking, link rot), which made `lint` the flakiest PR check, and breakage isn't correlated with the PR that trips it: the most recent main run's lint job went red on the docs.anthropic.com restructure (fixed in #3399) with no code change involved. The hook stays defined once in `.pre-commit-config.yaml`, moved to the `manual` stage, so the PR `lint` job, local `pre-commit run --all-files`, and the `wt merge` gate all skip it (the wt.toml Windows conditional existed only to skip lychee and collapses). The new `link-check` nightly job runs that stage with the pinned lychee and is wired into `create-issue-on-nightly-failure`, so breakage lands in the nightly-failure issue for tend instead of blocking unrelated PRs. Running through pre-commit rather than `git ls-files \| xargs lychee` keeps file selection at one definition: pre-commit's `types: [file]` filter excludes the 16 tracked `.md`/`.txt` symlinks, which would otherwise false-positive on relative links resolved against the symlink's directory. The trade: a PR that introduces a genuinely wrong URL now merges green and is caught up to a day later, asynchronously. Verified locally that the default stage no longer selects the hook and that `pre-commit run lychee-system --all-files --hook-stage manual` reproduces the CI lint run's selection exactly (same two flagged inputs). The nightly job itself first runs on the next cron or a `workflow_dispatch`. > _This was written by Claude Code on behalf of max_ Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-07-09 20:12:03 -07:00
dependabot[bot]	b4aba5c4a3	chore: bump taiki-e/install-action from 2.82.9 to 2.82.11 (#3387 ) Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.82.9 to 2.82.11. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/taiki-e/install-action/releases">taiki-e/install-action's releases</a>.</em></p> <blockquote> <h2>2.82.11</h2> <ul> <li> <p>Update <code>wasm-tools@latest</code> to 1.253.0.</p> </li> <li> <p>Update <code>uv@latest</code> to 0.11.27.</p> </li> <li> <p>Update <code>mise@latest</code> to 2026.7.2.</p> </li> <li> <p>Update <code>mdbook@latest</code> to 0.5.4.</p> </li> </ul> <h2>2.82.10</h2> <ul> <li> <p>Update <code>tombi@latest</code> to 1.2.0.</p> </li> <li> <p>Update <code>cargo-nextest@latest</code> to 0.9.140.</p> </li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md">taiki-e/install-action's changelog</a>.</em></p> <blockquote> <h2>[2.82.11] - 2026-07-08</h2> <ul> <li> <p>Update <code>wasm-tools@latest</code> to 1.253.0.</p> </li> <li> <p>Update <code>uv@latest</code> to 0.11.27.</p> </li> <li> <p>Update <code>mise@latest</code> to 2026.7.2.</p> </li> <li> <p>Update <code>mdbook@latest</code> to 0.5.4.</p> </li> </ul> <h2>[2.82.10] - 2026-07-07</h2> <ul> <li> <p>Update <code>tombi@latest</code> to 1.2.0.</p> </li> <li> <p>Update <code>cargo-nextest@latest</code> to 0.9.140.</p> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/taiki-e/install-action/commit/5ebac0d9522d786674368e47e92963ba13f2c376"><code>5ebac0d</code></a> Release 2.82.11</li> <li><a href="https://github.com/taiki-e/install-action/commit/0ef1b06f246983bfc9b14d94cff7855d90529e46"><code>0ef1b06</code></a> Update <code>wasm-tools@latest</code> to 1.253.0</li> <li><a href="https://github.com/taiki-e/install-action/commit/78ce37c0ce7da0b633b3ee9a800d18e6d4fb11e7"><code>78ce37c</code></a> Update <code>mise@latest</code> to 2026.7.2</li> <li><a href="https://github.com/taiki-e/install-action/commit/080cc5c6de6a4709eb3c099c56ad225fa3db5492"><code>080cc5c</code></a> Update wasm-tools manifest</li> <li><a href="https://github.com/taiki-e/install-action/commit/c870c7a1dbaa5d99671937765392df21151c7808"><code>c870c7a</code></a> Update <code>uv@latest</code> to 0.11.27</li> <li><a href="https://github.com/taiki-e/install-action/commit/dcc765d42b0daa9842059edfb11fda14143027e2"><code>dcc765d</code></a> Update <code>mise@latest</code> to 2026.7.1</li> <li><a href="https://github.com/taiki-e/install-action/commit/98fa0bac11003b6f1143fd1634b47d42624003b2"><code>98fa0ba</code></a> Update <code>mdbook@latest</code> to 0.5.4</li> <li><a href="https://github.com/taiki-e/install-action/commit/544756b7938b454b9339922116f9f21301cc8169"><code>544756b</code></a> Update martin manifest</li> <li><a href="https://github.com/taiki-e/install-action/commit/116765984988a711571bdb8292667a67de89b08e"><code>1167659</code></a> Update kingfisher manifest</li> <li><a href="https://github.com/taiki-e/install-action/commit/ca5e0a7228a263c12320511f1b10890972a12bbc"><code>ca5e0a7</code></a> Update biome manifest</li> <li>Additional commits viewable in <a href="https://github.com/taiki-e/install-action/compare/v2.82.9...v2.82.11">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=taiki-e/install-action&package-manager=github_actions&previous-version=2.82.9&new-version=2.82.11)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-09 09:22:36 -07:00
dependabot[bot]	c9044d01b5	chore: bump taiki-e/install-action from 2.82.7 to 2.82.9 (#3375 ) Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.82.7 to 2.82.9. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/taiki-e/install-action/releases">taiki-e/install-action's releases</a>.</em></p> <blockquote> <h2>2.82.9</h2> <ul> <li> <p>Update <code>vacuum@latest</code> to 0.29.9.</p> </li> <li> <p>Update <code>prek@latest</code> to 0.4.8.</p> </li> <li> <p>Update <code>cargo-tarpaulin@latest</code> to 0.37.0.</p> </li> <li> <p>Update <code>cargo-leptos@latest</code> to 0.3.7.</p> </li> </ul> <h2>2.82.8</h2> <ul> <li> <p>Update <code>vacuum@latest</code> to 0.29.8.</p> </li> <li> <p>Update <code>uv@latest</code> to 0.11.26.</p> </li> <li> <p>Update <code>typos@latest</code> to 1.48.0.</p> </li> <li> <p>Update <code>trivy@latest</code> to 0.72.0.</p> </li> <li> <p>Update <code>tombi@latest</code> to 1.1.7.</p> </li> <li> <p>Update <code>prek@latest</code> to 0.4.6.</p> </li> <li> <p>Update <code>mise@latest</code> to 2026.7.0.</p> </li> <li> <p>Update <code>just@latest</code> to 1.55.1.</p> </li> <li> <p>Update <code>biome@latest</code> to 2.5.2.</p> </li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md">taiki-e/install-action's changelog</a>.</em></p> <blockquote> <h2>[2.82.9] - 2026-07-05</h2> <ul> <li> <p>Update <code>vacuum@latest</code> to 0.29.9.</p> </li> <li> <p>Update <code>prek@latest</code> to 0.4.8.</p> </li> <li> <p>Update <code>cargo-tarpaulin@latest</code> to 0.37.0.</p> </li> <li> <p>Update <code>cargo-leptos@latest</code> to 0.3.7.</p> </li> </ul> <h2>[2.82.8] - 2026-07-03</h2> <ul> <li> <p>Update <code>vacuum@latest</code> to 0.29.8.</p> </li> <li> <p>Update <code>uv@latest</code> to 0.11.26.</p> </li> <li> <p>Update <code>typos@latest</code> to 1.48.0.</p> </li> <li> <p>Update <code>trivy@latest</code> to 0.72.0.</p> </li> <li> <p>Update <code>tombi@latest</code> to 1.1.7.</p> </li> <li> <p>Update <code>prek@latest</code> to 0.4.6.</p> </li> <li> <p>Update <code>mise@latest</code> to 2026.7.0.</p> </li> <li> <p>Update <code>just@latest</code> to 1.55.1.</p> </li> <li> <p>Update <code>biome@latest</code> to 2.5.2.</p> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/taiki-e/install-action/commit/4684b8405694ae9dd42c9f39ba901a70ae83f4a3"><code>4684b84</code></a> Release 2.82.9</li> <li><a href="https://github.com/taiki-e/install-action/commit/29fb1dbe52c0247f03f90f9dd43b08d3c603510b"><code>29fb1db</code></a> Update <code>vacuum@latest</code> to 0.29.9</li> <li><a href="https://github.com/taiki-e/install-action/commit/584230b16680bbb1ddef3c65a89568570fd36f69"><code>584230b</code></a> Update tombi manifest</li> <li><a href="https://github.com/taiki-e/install-action/commit/1872019a1c4268421e4c2d5f230285190a08b258"><code>1872019</code></a> Update <code>prek@latest</code> to 0.4.8</li> <li><a href="https://github.com/taiki-e/install-action/commit/3e817d29dde43a866e242560569eb7f418035f1a"><code>3e817d2</code></a> Update <code>cargo-tarpaulin@latest</code> to 0.37.0</li> <li><a href="https://github.com/taiki-e/install-action/commit/a71dd1a66df622ab4134f69df1b8c4b7a8889ddf"><code>a71dd1a</code></a> Update <code>cargo-leptos@latest</code> to 0.3.7</li> <li><a href="https://github.com/taiki-e/install-action/commit/c93ccc03e00cd0e08e494f5fd058a6c55a6a1907"><code>c93ccc0</code></a> Release 2.82.8</li> <li><a href="https://github.com/taiki-e/install-action/commit/5083f1886534d6d96c49df934ae7106b35fd488e"><code>5083f18</code></a> Update <code>vacuum@latest</code> to 0.29.8</li> <li><a href="https://github.com/taiki-e/install-action/commit/fdd68a857612ac3f29f4abaa6be9f4d379946632"><code>fdd68a8</code></a> Update <code>uv@latest</code> to 0.11.26</li> <li><a href="https://github.com/taiki-e/install-action/commit/3b61d4b2086bc6aee10b8e58f1e6a25675e03da4"><code>3b61d4b</code></a> Update <code>typos@latest</code> to 1.48.0</li> <li>Additional commits viewable in <a href="https://github.com/taiki-e/install-action/compare/v2.82.7...v2.82.9">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=taiki-e/install-action&package-manager=github_actions&previous-version=2.82.7&new-version=2.82.9)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-06 19:41:42 -07:00
Worktrunk Bot	0beeb3b738	chore(ci): weekly renovation 2026-07-05 (#3368 )	2026-07-05 06:51:48 -07:00
Maximilian Roos	baa12fe198	ci: watch nightly in Tend; issue on full-tests failure; release runs nightly (#3345 ) Follow-up to #3332 (fast-checks split + nightly `full-tests`), landing the monitoring/wiring that makes `nightly` a reliable safety net for the cargo-affected rollout. The benchmarks-split half of the original follow-up was dropped — #3337 did it independently, and more completely. ## What changed - Tend watches `nightly` (`.config/tend.yaml` + the generated `tend-ci-fix.yaml`). `nightly` hosts `full-tests` (the full 3-OS suite that catches what cargo-affected under-selects), so a red nightly is actionable — Tend now opens a fix PR instead of leaving it silent. #3339's 0.1.9 regen left the watched list at `[ci, publish-docs]`; this adds `nightly`. Tend watches at the workflow level, so it also covers the other nightly jobs (minimal-versions, nix-flake, udeps). - `create-issue-on-nightly-failure` now needs `full-tests`, so a cron `full-tests` failure files a tracking issue (neither #3332 nor #3337 wired it in). - The `release` skill dispatches `nightly` (benchmark-free) and waits on it — a release's full linux/macos/windows validation once the PR path moves to cargo-affected selection and stops running the full `test` matrix. ## Notes - The generated `tend-ci-fix.yaml` line was hand-applied to match `.config/tend.yaml`; a `uvx tend@latest init` regen reproduces it. - Trade-off: watching `nightly` at the workflow level also signs Tend up for the noisier nightly jobs (resolution drift, nix sandbox). Accepted to keep the safety net green. ## Testing CI-config plus one skill; validated with `actionlint` and pre-commit. The Tend trigger and the release step only exercise on a real nightly failure / release run. > _This was written by Claude Code on behalf of max_ --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-01 03:23:04 -07:00
dependabot[bot]	9478fc6675	chore: bump taiki-e/install-action from 2.82.6 to 2.82.7 (#3342 ) Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.82.6 to 2.82.7. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/taiki-e/install-action/releases">taiki-e/install-action's releases</a>.</em></p> <blockquote> <h2>2.82.7</h2> <ul> <li> <p>Update <code>tombi@latest</code> to 1.1.6.</p> </li> <li> <p>Update <code>kingfisher@latest</code> to 1.105.0.</p> </li> <li> <p>Update <code>gungraun-runner@latest</code> to 0.19.3.</p> </li> <li> <p>Update <code>editorconfig-checker@latest</code> to 3.8.0.</p> </li> <li> <p>Update <code>dprint@latest</code> to 0.55.1.</p> </li> <li> <p>Update <code>cargo-tarpaulin@latest</code> to 0.36.0.</p> </li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md">taiki-e/install-action's changelog</a>.</em></p> <blockquote> <h2>[2.82.7] - 2026-06-30</h2> <ul> <li> <p>Update <code>tombi@latest</code> to 1.1.6.</p> </li> <li> <p>Update <code>kingfisher@latest</code> to 1.105.0.</p> </li> <li> <p>Update <code>gungraun-runner@latest</code> to 0.19.3.</p> </li> <li> <p>Update <code>editorconfig-checker@latest</code> to 3.8.0.</p> </li> <li> <p>Update <code>dprint@latest</code> to 0.55.1.</p> </li> <li> <p>Update <code>cargo-tarpaulin@latest</code> to 0.36.0.</p> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/taiki-e/install-action/commit/16b05812d776ae1dfaabc8277e421fb6d2506419"><code>16b0581</code></a> Release 2.82.7</li> <li><a href="https://github.com/taiki-e/install-action/commit/68c845308d9b56d38e797c62e48eddfe1b4ba94f"><code>68c8453</code></a> Update uv manifest</li> <li><a href="https://github.com/taiki-e/install-action/commit/8532697fda4ee37ccd65901e90d87a785c45d7bd"><code>8532697</code></a> Update trivy manifest</li> <li><a href="https://github.com/taiki-e/install-action/commit/2959f9e73b89d18f2d72d0aa55ed797e70062732"><code>2959f9e</code></a> Update <code>tombi@latest</code> to 1.1.6</li> <li><a href="https://github.com/taiki-e/install-action/commit/9bfa119f6c347b458726d629758b16dd861727a4"><code>9bfa119</code></a> Update <code>kingfisher@latest</code> to 1.105.0</li> <li><a href="https://github.com/taiki-e/install-action/commit/f198b91ffb69aa6008cb3b0ea9cf6eb6b0af01f4"><code>f198b91</code></a> Update just manifest</li> <li><a href="https://github.com/taiki-e/install-action/commit/20feedd5827d6d189bca20753dbd5582948e7478"><code>20feedd</code></a> Update <code>gungraun-runner@latest</code> to 0.19.3</li> <li><a href="https://github.com/taiki-e/install-action/commit/314197aa953241335b4a4c41c2d6e8066d6150da"><code>314197a</code></a> Update <code>editorconfig-checker@latest</code> to 3.8.0</li> <li><a href="https://github.com/taiki-e/install-action/commit/f8632ebbd28b43dce012ff3db91c959c7751db33"><code>f8632eb</code></a> Update <code>dprint@latest</code> to 0.55.1</li> <li><a href="https://github.com/taiki-e/install-action/commit/4234dc0f7acb7e7774a1716b103fcaf2d9ed9b4d"><code>4234dc0</code></a> Update <code>cargo-tarpaulin@latest</code> to 0.36.0</li> <li>Additional commits viewable in <a href="https://github.com/taiki-e/install-action/compare/v2.82.6...v2.82.7">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=taiki-e/install-action&package-manager=github_actions&previous-version=2.82.6&new-version=2.82.7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-30 20:57:07 -07:00
Worktrunk Bot	d422b1b9be	chore: update tend workflows (0.1.7 → 0.1.9) (#3339 )	2026-06-30 01:33:23 -07:00
Maximilian Roos	820666741f	ci: run benchmarks on their own daily schedule, split from nightly (#3337 ) The criterion suite ran as a job inside `nightly.yaml`: ~80 min, checking performance rather than correctness, yet feeding nightly's failure aggregator and dominating its wall-clock. This moves it into a standalone `benchmarks.yaml` on its own daily schedule, decoupled from nightly's correctness checks. `benchmarks.yaml` runs on its own cron (3:47 UTC, offset from nightly's 5:37 so the two long runs don't contend) plus `workflow_dispatch`. The env block is carried over so the shared `test` cache key still matches (per `.github/CLAUDE.md`); the gist time-series append stays gated to `schedule` events; and a dedicated `create-issue-on-benchmark-failure` job keeps a broken bench harness visible, since benchmarks no longer ride nightly's aggregator. One behavior change: benchmarks no longer run on PRs at all. Previously the job ran on a PR carrying the `nightly` label or touching `Cargo.*`. `workflow_dispatch` against a branch covers on-demand bench runs. `nightly.yaml` loses the `benchmarks` job, its header line, and its `needs` entry in the failure aggregator. Docs updated: the `CLAUDE.md` benchmarks note (benchmarks no longer gate merges since they're off PRs) and the `running-tend` skill's `setup-nu` call-site list. This branch also merges current `main`, which includes #3324 (drop `cache-apt-pkgs-action` for plain `apt-get`); `benchmarks.yaml` installs zsh/fish the same way rather than reintroducing the dropped action. > _This was written by Claude Code on behalf of max_ Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-29 23:35:10 -07:00
Maximilian Roos	fb20a315a1	ci: split fast checks from the full suite; add nightly full-tests safety net (#3332 ) Prep work toward making the advisory `cargo-affected` legs the PR test path, without flipping any merge gate yet. ## What changed - `ci.yaml` — the `test (linux/macos/windows)` job bundled five gates through one `wt hook pre-merge` call. Split the platform-independent ones — `Cargo.lock` freshness, doctests, and the rustdoc `-Dwarnings` build — into a new Linux-only `fast-checks` job. `test` now runs only the full nextest suite (`insta`), so it's a clean drop-in shape for the affected legs later. `fast-checks` stays required and unchanged across the eventual flip. - `nightly.yaml` — added a `full-tests` matrix job (linux/macos/windows, the full suite). This is the safety net for what cargo-affected can't cover: tests it under-selects, plus non-Rust/build inputs it can't trace (`include_str!`, templates, `build.rs`, toolchain, proc-macros). It also hosts the Linux `--unreferenced reject` orphan check. It runs on nightly cron, the `nightly` label, dispatch, and dep-pushes — deliberately not on the main-gating path, so a cargo-affected miss surfaces in nightly (non-blocking, Tend-fixable) rather than reddening main. Nothing is gated by the affected legs yet; `test ()` stays the required PR gate during calibration. The flip (make affected required, delete the PR `test` job) is a later, separate change — documented in the `ci.yaml` comment block. ## ⚠️ Branch-protection follow-up Splitting `lockfile`/`doctest`/`doc` out of the required `test` job means `fast-checks` must be added to the required status checks* (the "Merge access" ruleset). Until it is, those three gates don't block PRs. This is an admin action that should accompany the merge. ## Testing CI-config only; validated with `actionlint` and pre-commit (yaml/eof/whitespace/typos). The workflow behavior itself validates on this PR's run. > _This was written by Claude Code on behalf of max_ Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-29 22:53:00 -07:00
Maximilian Roos	16027a6a58	fix(ci): install zsh/fish via apt-get, drop cache-apt-pkgs-action (#3324 ) ## What this does Removes the third-party `awalsh128/cache-apt-pkgs-action` from CI entirely, installing zsh + fish with a plain `sudo apt-get update && sudo apt-get install -y zsh fish` at all four call sites: - `ci.yaml` — `code-coverage` - `nightly.yaml` — `feature-powerset` and `benchmarks` - `.github/actions/test-setup/action.yaml` — composite action used by the required `test` matrix It also drops the Dependabot `ignore` entry for the action (no longer needed once the action is gone). ## Why (and why this supersedes #3321) `awalsh128/cache-apt-pkgs-action@v1.6.2` (dependabot bump #3311) empties its own `packages: zsh fish` argument in the "Normalizing package list" step and aborts with `Packages argument is empty`, in ~20s, before any compilation — killing `code-coverage` on every PR, which in turn stopped `codecov/patch` from posting anywhere. Root cause is upstream PR #177 quoting `${packages}`, tracked at [awalsh128/cache-apt-pkgs-action#210](https://github.com/awalsh128/cache-apt-pkgs-action/issues/210). #3321 already fixed main by pinning back to `v1.6.1`. This PR takes the sturdier route — dropping the dependency — based on the upstream's health: - Issue #210 is open with no maintainer engagement; affected users call the action "basically non-functional," with a fresh repro confirmed on 2026-06-29. - No open PR reverts #177 or fixes the regression; v1.6.2 (broken) is still tagged `Latest`, and contributor PRs sit unmerged for months. - The action's mutable `v1`/`latest` tags are actively being retargeted upstream (open PR #211), which is how a `@v1.6.1` ref can resolve to drifted code — so even the pin isn't a stable anchor. `zsh` and `fish` are in the standard Ubuntu repos (no PPA), so the action only cached an install of two tiny packages — a negligible speed-up for a third-party dependency that is under-maintained, broke CI repo-wide, and can't be stably pinned. Dropping it removes the whole failure class and matches the existing `musl-tools` install already in `nightly.yaml`. Verified: the identical `apt-get` step already runs green in the required `test (linux)` job (installs zsh 5.9 + fish 3.7.0), and a full `code-coverage` run on this branch completed green end-to-end with `codecov/patch` posting again. ## Guard against recurrence #3311 merged while its own `code-coverage` was red because `code-coverage`/`codecov/patch` aren't required status checks (only `test (linux/macos/windows)` are), and `codecov/patch` was absent rather than red (the job died before uploading), so the mechanical-bump merge saw nothing blocking. Recommended guard: make the `code-coverage` job a required status check — it fails only on genuine breakage (the codecov upload already soft-fails on fork PRs), so it blocks this class without re-introducing the flake that keeps `codecov/patch` itself advisory. > _This was written by Claude Code on behalf of max_ Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-29 16:48:37 -07:00
Maximilian Roos	225b232b51	ci: gate rust caches to main and share one per OS to fit the 10 GB cap (#3323 ) ## What The Actions cache sat at 11.1 GB across 57 caches against GitHub's hard 10 GB per-repo cap, so every run was evicting older caches LRU-style — constant churn. ~57% of that was single-PR caches (`refs/pull/N/merge`) that no other PR can ever restore, depositing budget that evicted the reusable `main` caches. ## Changes - `save-if` gated to `main` on every rust-cache call. PRs restore `main`'s cache via the restore-key fallback and never deposit their own. This alone drops the footprint under the cap. - One shared cache per OS for the test family. `test-setup` now sets `shared-key`, with `test` as the sole saver (new `save-cache` input, default `true`); `affected-tests` / `collect-affected` / `release-target` pass `save-cache: "false"`. The PR-only `affected-tests` job needed this most — it never runs on `main`, so a per-job key had no baseline and cold-built every PR; it now rides `test`'s `main` cache. - Nightly/release jobs stop saving. Stable ones (`feature-powerset`, `benchmarks`, `crate-build`) restore the shared cache read-only; the nightly-toolchain ones (`check-unused`, `minimal-versions`) and the cross-target `release-target` just don't save — near-zero reuse against the cap. - `cache-bin: false` applied to the v0 jobs too (`lint`, `feature-check`, `msrv`, `code-coverage`), closing the latent rustup-proxy bug that `test-setup` already guarded against. ## Deliberate non-changes - `lint` / `feature-check` / `code-coverage` keep their own `main`-gated caches rather than joining the shared one. They build divergent artifacts (clippy-check, `--no-default-features`, coverage-instrumented), and we're no longer space-constrained after the above — a right-sized own cache beats a 1.3 GB restore for partial reuse. - Did not add PRQL's `Cargo.lock`-hash-in-prefix-key: rust-cache already keys on the lockfile, and `save-if: main` already prevents the PR-junk accumulation that trick fights (one mechanism per guarantee). - The `awalsh128/cache-apt-pkgs-action` stays pinned at `v1.6.1` (per #3321, merged into this branch) — not replaced. Only `Swatinem/rust-cache` config changes here. Projected active cache: ~3–5 GB, all `main`-scoped. No `wt` behavior change, so no changelog entry. > _This was written by Claude Code on behalf of max_ --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-29 12:39:55 -07:00
Worktrunk Bot	7daa0763d7	fix(ci): pin cache-apt-pkgs-action back to v1.6.1 (#3321 ) ## Problem CI on `main` fails in the required `code-coverage` job ([failed run](https://github.com/max-sixty/worktrunk/actions/runs/28358354325)). The `Install shells (zsh, fish)` step aborts: ``` PACKAGES: zsh fish Normalizing package list... Validating action arguments (version='1', packages='')... exit status 100Packages argument is empty. ##[error]Process completed with exit code 3. ``` This is a deterministic regression in `awalsh128/cache-apt-pkgs-action@v1.6.2`, introduced by the bump in #3311. v1.6.2's new "Normalize package list" step turns the input `zsh fish` into an empty string before validation. Upstream root cause: PR #177 added quotes around `${packages}` in `get_normalized_package_list`, so `apt_query` treats the entire space-separated list as one package name and the normalization yields nothing — tracked at [awalsh128/cache-apt-pkgs-action#210](https://github.com/awalsh128/cache-apt-pkgs-action/issues/210). v1.6.2 is still the latest release with no fix. #3311 bumped three of the four call sites (`ci.yaml` `code-coverage`, two in `nightly.yaml`); `.github/actions/test-setup/action.yaml` was never bumped and stayed on v1.6.1 — which is why test-setup-based jobs passed while `code-coverage` failed. ## Solution Revert the three v1.6.2 references to v1.6.1, the known-good version the test-setup action already uses, so all four sites are consistent again. Also add a Dependabot `ignore` for v1.6.2 of this action so the daily github-actions update doesn't immediately re-create the same broken bump; the entry is scoped to that one version, so Dependabot can bump forward once a fixed release ships. This is the right level: the failure is entirely upstream, the fix matches the existing precedent (#2583 pinned this action), and pinning back is a clean revert rather than a workaround layered on a broken release. ## Testing The fix is a CI-config change; correctness is verified by CI itself re-running the `code-coverage` job with v1.6.1. The v1.6.1 path is already exercised by every existing run via `test-setup`, which never failed on this step. Note: the advisory (non-required) `collect affected coverage (windows)` leg in the failed run also failed, on an unrelated PTY flake (`test_switch_picker_create_validates_templates_before_worktree`) — a separate known-flaky Windows shell-integration test, not caused by this commit and not addressed here. --- Automated fix for [failed run](https://github.com/max-sixty/worktrunk/actions/runs/28358354325) Co-authored-by: worktrunk-bot <254187624+worktrunk-bot@users.noreply.github.com> Co-authored-by: Claude <noreply@anthropic.com>	2026-06-29 11:28:52 -07:00
dependabot[bot]	b7cf4f0cf0	chore: bump taiki-e/install-action from 2.82.4 to 2.82.6 (#3312 ) Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.82.4 to 2.82.6. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/taiki-e/install-action/releases">taiki-e/install-action's releases</a>.</em></p> <blockquote> <h2>2.82.6</h2> <ul> <li> <p>Update <code>vacuum@latest</code> to 0.29.7.</p> </li> <li> <p>Update <code>uv@latest</code> to 0.11.25.</p> </li> <li> <p>Update <code>syft@latest</code> to 1.46.0.</p> </li> <li> <p>Update <code>dprint@latest</code> to 0.55.0.</p> </li> <li> <p>Update <code>cargo-auditable@latest</code> to 0.7.5.</p> </li> </ul> <h2>2.82.5</h2> <ul> <li> <p>Update <code>wasmtime@latest</code> to 46.0.1.</p> </li> <li> <p>Update <code>wasm-bindgen@latest</code> to 0.2.126.</p> </li> <li> <p>Update <code>vacuum@latest</code> to 0.29.6.</p> </li> <li> <p>Update <code>mise@latest</code> to 2026.6.14.</p> </li> <li> <p>Update <code>cargo-rdme@latest</code> to 2.1.0.</p> </li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md">taiki-e/install-action's changelog</a>.</em></p> <blockquote> <h2>[2.82.6] - 2026-06-29</h2> <ul> <li> <p>Update <code>vacuum@latest</code> to 0.29.7.</p> </li> <li> <p>Update <code>uv@latest</code> to 0.11.25.</p> </li> <li> <p>Update <code>syft@latest</code> to 1.46.0.</p> </li> <li> <p>Update <code>dprint@latest</code> to 0.55.0.</p> </li> <li> <p>Update <code>cargo-auditable@latest</code> to 0.7.5.</p> </li> </ul> <h2>[2.82.5] - 2026-06-26</h2> <ul> <li> <p>Update <code>wasmtime@latest</code> to 46.0.1.</p> </li> <li> <p>Update <code>wasm-bindgen@latest</code> to 0.2.126.</p> </li> <li> <p>Update <code>vacuum@latest</code> to 0.29.6.</p> </li> <li> <p>Update <code>mise@latest</code> to 2026.6.14.</p> </li> <li> <p>Update <code>cargo-rdme@latest</code> to 2.1.0.</p> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/taiki-e/install-action/commit/9bcaee1dcae34154180f412e2fa69355a7cda9f6"><code>9bcaee1</code></a> Release 2.82.6</li> <li><a href="https://github.com/taiki-e/install-action/commit/e43cd7ce2e2c5a6d08d652405a0ead8cda7bf2db"><code>e43cd7c</code></a> Update <code>vacuum@latest</code> to 0.29.7</li> <li><a href="https://github.com/taiki-e/install-action/commit/3761407ad0b5e4e5b42ccb62e48ffa2712e94703"><code>3761407</code></a> Update <code>uv@latest</code> to 0.11.25</li> <li><a href="https://github.com/taiki-e/install-action/commit/cb6ad0dba1ff078e589e75ae88bb03120688feef"><code>cb6ad0d</code></a> Update tombi manifest</li> <li><a href="https://github.com/taiki-e/install-action/commit/6022671c93f20efad71663e3adc06d63e7f1ec8a"><code>6022671</code></a> Update <code>syft@latest</code> to 1.46.0</li> <li><a href="https://github.com/taiki-e/install-action/commit/ab5aae8354703341b0939f4e6c1bb66372b446db"><code>ab5aae8</code></a> Update gungraun-runner manifest</li> <li><a href="https://github.com/taiki-e/install-action/commit/867613b49949fba1c8fe194d323c7c51b77b24d2"><code>867613b</code></a> Update editorconfig-checker manifest</li> <li><a href="https://github.com/taiki-e/install-action/commit/c5837ef63439ac9ebc0ecce97e23cca6a4a5aac4"><code>c5837ef</code></a> Update <code>dprint@latest</code> to 0.55.0</li> <li><a href="https://github.com/taiki-e/install-action/commit/7d41d74582778d0345db89bc1054e86f3802b6d2"><code>7d41d74</code></a> Update <code>cargo-auditable@latest</code> to 0.7.5</li> <li><a href="https://github.com/taiki-e/install-action/commit/bffeee26d4db9be238a4ea78d8826604ebcb594d"><code>bffeee2</code></a> Release 2.82.5</li> <li>Additional commits viewable in <a href="https://github.com/taiki-e/install-action/compare/v2.82.4...v2.82.6">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=taiki-e/install-action&package-manager=github_actions&previous-version=2.82.4&new-version=2.82.6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-29 01:18:52 -07:00
dependabot[bot]	1c31672a62	chore: bump awalsh128/cache-apt-pkgs-action from 1.6.1 to 1.6.2 (#3311 ) Bumps [awalsh128/cache-apt-pkgs-action](https://github.com/awalsh128/cache-apt-pkgs-action) from 1.6.1 to 1.6.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/awalsh128/cache-apt-pkgs-action/releases">awalsh128/cache-apt-pkgs-action's releases</a>.</em></p> <blockquote> <h2>v1.6.2</h2> <h2>What's Changed</h2> <ul> <li>Apply PR <a href="https://redirect.github.com/awalsh128/cache-apt-pkgs-action/issues/193">#193</a> dependency pinning to <code>action.yml</code> (overwrite current action refs) by <a href="https://github.com/awalsh128"><code>@awalsh128</code></a> with <a href="https://github.com/Copilot"><code>@Copilot</code></a> in <a href="https://redirect.github.com/awalsh128/cache-apt-pkgs-action/pull/201">awalsh128/cache-apt-pkgs-action#201</a></li> <li>install_and_cache_pkgs.sh: Fix two issues saving preinst and postinst scripts. by <a href="https://github.com/gtjoseph"><code>@gtjoseph</code></a> in <a href="https://redirect.github.com/awalsh128/cache-apt-pkgs-action/pull/195">awalsh128/cache-apt-pkgs-action#195</a></li> <li>[WIP] Fix test workflows for actions by <a href="https://github.com/awalsh128"><code>@awalsh128</code></a> with <a href="https://github.com/Copilot"><code>@Copilot</code></a> in <a href="https://redirect.github.com/awalsh128/cache-apt-pkgs-action/pull/184">awalsh128/cache-apt-pkgs-action#184</a></li> <li>Fix apt-cache package lookup failure in nektos/act environments by <a href="https://github.com/awalsh128"><code>@awalsh128</code></a> with <a href="https://github.com/Copilot"><code>@Copilot</code></a> in <a href="https://redirect.github.com/awalsh128/cache-apt-pkgs-action/pull/172">awalsh128/cache-apt-pkgs-action#172</a></li> <li>add shellcheck linting by <a href="https://github.com/mac-anysphere"><code>@mac-anysphere</code></a> in <a href="https://redirect.github.com/awalsh128/cache-apt-pkgs-action/pull/177">awalsh128/cache-apt-pkgs-action#177</a></li> <li>Harden <code>apt_query</code> virtual package resolution against <code>apt-cache showpkg</code> warnings by <a href="https://github.com/awalsh128"><code>@awalsh128</code></a> with <a href="https://github.com/Copilot"><code>@Copilot</code></a> in <a href="https://redirect.github.com/awalsh128/cache-apt-pkgs-action/pull/202">awalsh128/cache-apt-pkgs-action#202</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/gtjoseph"><code>@gtjoseph</code></a> made their first contribution in <a href="https://redirect.github.com/awalsh128/cache-apt-pkgs-action/pull/195">awalsh128/cache-apt-pkgs-action#195</a></li> <li><a href="https://github.com/mac-anysphere"><code>@mac-anysphere</code></a> made their first contribution in <a href="https://redirect.github.com/awalsh128/cache-apt-pkgs-action/pull/177">awalsh128/cache-apt-pkgs-action#177</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/awalsh128/cache-apt-pkgs-action/compare/v1.6.1...v1.6.2">https://github.com/awalsh128/cache-apt-pkgs-action/compare/v1.6.1...v1.6.2</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/awalsh128/cache-apt-pkgs-action/commit/5513791f75b039e2a79653b1a92238d3fb8d99b4"><code>5513791</code></a> fix: handle apt showpkg warnings</li> <li><a href="https://github.com/awalsh128/cache-apt-pkgs-action/commit/fe5b289324486feb07d9025df8e9238a624f28d8"><code>fe5b289</code></a> test: add apt warning regression coverage</li> <li><a href="https://github.com/awalsh128/cache-apt-pkgs-action/commit/e58a49f1deb2c70b97469d56a30a7a344b7cdf25"><code>e58a49f</code></a> add shellcheck linting</li> <li><a href="https://github.com/awalsh128/cache-apt-pkgs-action/commit/599df6ec23f0ff55f24e458f4092a0264e02a1c9"><code>599df6e</code></a> Fix apt-cache package lookup failure in nektos/act environments (<a href="https://redirect.github.com/awalsh128/cache-apt-pkgs-action/issues/172">#172</a>)</li> <li><a href="https://github.com/awalsh128/cache-apt-pkgs-action/commit/cd5ee21d96e6e91cfd14e1b6437aa31ae6b1026d"><code>cd5ee21</code></a> [WIP] Fix test workflows for actions (<a href="https://redirect.github.com/awalsh128/cache-apt-pkgs-action/issues/184">#184</a>)</li> <li><a href="https://github.com/awalsh128/cache-apt-pkgs-action/commit/c0e0741be64938eb55bb4e1831c6eaab079ca3b6"><code>c0e0741</code></a> install_and_cache_pkgs.sh: Fix two issues saving preinst and postinst scripts...</li> <li><a href="https://github.com/awalsh128/cache-apt-pkgs-action/commit/497648d2e1b97f712a3941670092a4a578235fe2"><code>497648d</code></a> Apply PR <a href="https://redirect.github.com/awalsh128/cache-apt-pkgs-action/issues/193">#193</a> dependency pinning to <code>action.yml</code> (overwrite current action re...</li> <li>See full diff in <a href="https://github.com/awalsh128/cache-apt-pkgs-action/compare/v1.6.1...v1.6.2">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=awalsh128/cache-apt-pkgs-action&package-manager=github_actions&previous-version=1.6.1&new-version=1.6.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-29 01:18:49 -07:00
Worktrunk Bot	93325018af	chore(ci): weekly renovation 2026-06-28 (#3284 )	2026-06-28 08:45:45 -07:00
dependabot[bot]	0b0f10497d	chore: bump taiki-e/install-action from 2.82.3 to 2.82.4 (#3255 ) Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.82.3 to 2.82.4. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/taiki-e/install-action/releases">taiki-e/install-action's releases</a>.</em></p> <blockquote> <h2>2.82.4</h2> <ul> <li> <p>Update <code>uv@latest</code> to 0.11.24.</p> </li> <li> <p>Update <code>mise@latest</code> to 2026.6.13.</p> </li> <li> <p>Update <code>just@latest</code> to 1.54.0.</p> </li> <li> <p>Update <code>biome@latest</code> to 2.5.1.</p> </li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md">taiki-e/install-action's changelog</a>.</em></p> <blockquote> <h2>[2.82.4] - 2026-06-25</h2> <ul> <li> <p>Update <code>uv@latest</code> to 0.11.24.</p> </li> <li> <p>Update <code>mise@latest</code> to 2026.6.13.</p> </li> <li> <p>Update <code>just@latest</code> to 1.54.0.</p> </li> <li> <p>Update <code>biome@latest</code> to 2.5.1.</p> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/taiki-e/install-action/commit/682e7d9e49c5e653d371fc6adbda67653461378a"><code>682e7d9</code></a> Release 2.82.4</li> <li><a href="https://github.com/taiki-e/install-action/commit/88e83503037db61d4f066a4d9cb32e6fc06b70c2"><code>88e8350</code></a> Update wasmtime manifest</li> <li><a href="https://github.com/taiki-e/install-action/commit/cf0e00b44cf05faddafcc8082c6c2366e2a02380"><code>cf0e00b</code></a> Update wasm-bindgen manifest</li> <li><a href="https://github.com/taiki-e/install-action/commit/a130ea674166df9065f363cbb53f1f2bc4a6298c"><code>a130ea6</code></a> Update vacuum manifest</li> <li><a href="https://github.com/taiki-e/install-action/commit/0bdcc65dc21d0ae46842dc5ad063d69ce8991365"><code>0bdcc65</code></a> Update <code>uv@latest</code> to 0.11.24</li> <li><a href="https://github.com/taiki-e/install-action/commit/3f52215559b820ee57b68e3fa9b38f6cd205e9c8"><code>3f52215</code></a> Update <code>mise@latest</code> to 2026.6.13</li> <li><a href="https://github.com/taiki-e/install-action/commit/294a073b0ebe66401c699c21b98e9ecb5a6da735"><code>294a073</code></a> Update <code>just@latest</code> to 1.54.0</li> <li><a href="https://github.com/taiki-e/install-action/commit/f9bf24932b3cbfe7ae26b5addcd257989e14ec4d"><code>f9bf249</code></a> Update cargo-rdme manifest</li> <li><a href="https://github.com/taiki-e/install-action/commit/98288d38cbfc5fa065ff61c6971d50dc3ba7d408"><code>98288d3</code></a> Update <code>biome@latest</code> to 2.5.1</li> <li>See full diff in <a href="https://github.com/taiki-e/install-action/compare/v2.82.3...v2.82.4">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=taiki-e/install-action&package-manager=github_actions&previous-version=2.82.3&new-version=2.82.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-26 17:44:59 -07:00
dependabot[bot]	0cbb4f643c	chore: bump max-sixty/tend from 0.1.7 to 0.1.8 (#3254 )	2026-06-26 06:37:14 -07:00
Worktrunk Bot	37c212dbfc	chore: update tend workflows (0.1.6 → 0.1.7) (#3200 ) Automated nightly regeneration of tend's workflow files. tend version: 0.1.6 → 0.1.7 Notable changes: - Fork-PR review checkout fixed properly (max-sixty/tend#725) — `tend-review` now uses `actions/checkout@v7` with `allow-unsafe-pr-checkout: true`, the upstream-intended way to re-enable fork-PR ref checkout that v7 blocks by default. This supersedes the manual `actions/checkout@v6` stopgap pinned in #3176: the generator now carries the fix, so the regen restores v7 with the explicit opt-in rather than the downgrade. - CI-poll loops trimmed to fit the Bash tool's 10-min cap (max-sixty/tend#695) — `running-in-ci` CI-monitoring loops are sized so they don't auto-background and drop a gated follow-up. - Scope blockers surfaced instead of routed around (max-sixty/tend#717) — when a scope rule blocks the correct action, the bot now reports the blocker on the thread rather than silently substituting a workaround. - Nightly regen worktree bases on the open PR, not the branch ref (max-sixty/tend#721) — keeps the regen diff incremental and the PR body accurate. - Shared step scripts; actions named by harness (max-sixty/tend#712) — explains the regenerated comment in `tend-notifications.yaml` ("the harness action's post-step"). Compare: https://github.com/max-sixty/tend/compare/0.1.6...0.1.7 Co-authored-by: worktrunk-bot <worktrunk-bot@users.noreply.github.com>	2026-06-24 19:37:38 -07:00
dependabot[bot]	daf432666c	chore: bump taiki-e/install-action from 2.82.2 to 2.82.3 (#3190 ) Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.82.2 to 2.82.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/taiki-e/install-action/releases">taiki-e/install-action's releases</a>.</em></p> <blockquote> <h2>2.82.3</h2> <ul> <li> <p>Update <code>zizmor@latest</code> to 1.26.1.</p> </li> <li> <p>Update <code>wasmtime@latest</code> to 46.0.0.</p> </li> <li> <p>Update <code>tombi@latest</code> to 1.1.5.</p> </li> <li> <p>Update <code>mise@latest</code> to 2026.6.12.</p> </li> <li> <p>Update <code>kingfisher@latest</code> to 1.104.0.</p> </li> <li> <p>Update <code>cargo-tarpaulin@latest</code> to 0.35.5.</p> </li> <li> <p>Update <code>cargo-nextest@latest</code> to 0.9.138.</p> </li> <li> <p>Update <code>cargo-crap@latest</code> to 0.3.0.</p> </li> <li> <p>Update <code>cargo-binstall@latest</code> to 1.20.1.</p> </li> <li> <p>Update <code>cargo-rdme@latest</code> to 2.0.1.</p> </li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md">taiki-e/install-action's changelog</a>.</em></p> <blockquote> <h2>[2.82.3] - 2026-06-24</h2> <ul> <li> <p>Update <code>zizmor@latest</code> to 1.26.1.</p> </li> <li> <p>Update <code>wasmtime@latest</code> to 46.0.0.</p> </li> <li> <p>Update <code>tombi@latest</code> to 1.1.5.</p> </li> <li> <p>Update <code>mise@latest</code> to 2026.6.12.</p> </li> <li> <p>Update <code>kingfisher@latest</code> to 1.104.0.</p> </li> <li> <p>Update <code>cargo-tarpaulin@latest</code> to 0.35.5.</p> </li> <li> <p>Update <code>cargo-nextest@latest</code> to 0.9.138.</p> </li> <li> <p>Update <code>cargo-crap@latest</code> to 0.3.0.</p> </li> <li> <p>Update <code>cargo-binstall@latest</code> to 1.20.1.</p> </li> <li> <p>Update <code>cargo-rdme@latest</code> to 2.0.1.</p> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/taiki-e/install-action/commit/ace6ebe54a6a0c86dfb5f7764b17f793b6925bc3"><code>ace6ebe</code></a> Release 2.82.3</li> <li><a href="https://github.com/taiki-e/install-action/commit/9593d26a566b2dea5528756ce1b593cda56ddf7f"><code>9593d26</code></a> Update <code>zizmor@latest</code> to 1.26.1</li> <li><a href="https://github.com/taiki-e/install-action/commit/0569c0141a12a1553b9c9a83491ff772d114a6e5"><code>0569c01</code></a> Update <code>wasmtime@latest</code> to 46.0.0</li> <li><a href="https://github.com/taiki-e/install-action/commit/5ea9fc8c273a1ac2a9f4c160d34b2e37dd1cb9e7"><code>5ea9fc8</code></a> Update uv manifest</li> <li><a href="https://github.com/taiki-e/install-action/commit/d9b6e0d11a25ad9f54aabdb65b4b4fe88d20f710"><code>d9b6e0d</code></a> Update <code>tombi@latest</code> to 1.1.5</li> <li><a href="https://github.com/taiki-e/install-action/commit/d22450fe07f49b408f280b0c4e4ec6c581dd7154"><code>d22450f</code></a> Update <code>mise@latest</code> to 2026.6.12</li> <li><a href="https://github.com/taiki-e/install-action/commit/586c055e27e0fa5c61e72baabffb3c90a6ec9cda"><code>586c055</code></a> Update <code>kingfisher@latest</code> to 1.104.0</li> <li><a href="https://github.com/taiki-e/install-action/commit/5e27d3091b1094b517876d28ce9933e444be309a"><code>5e27d30</code></a> Update just manifest</li> <li><a href="https://github.com/taiki-e/install-action/commit/eda88a4fdb0862974fa83c21b8ebec7d1ec53972"><code>eda88a4</code></a> Update <code>cargo-tarpaulin@latest</code> to 0.35.5</li> <li><a href="https://github.com/taiki-e/install-action/commit/30ff9da4b104d9918bd41562f2981303f48d3402"><code>30ff9da</code></a> Update <code>cargo-nextest@latest</code> to 0.9.138</li> <li>Additional commits viewable in <a href="https://github.com/taiki-e/install-action/compare/v2.82.2...v2.82.3">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=taiki-e/install-action&package-manager=github_actions&previous-version=2.82.2&new-version=2.82.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-24 09:53:10 -07:00
dependabot[bot]	e3664c6343	chore: bump actions/cache from 5 to 6 (#3191 ) Bumps [actions/cache](https://github.com/actions/cache) from 5 to 6. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/cache/releases">actions/cache's releases</a>.</em></p> <blockquote> <h2>v6.0.0</h2> <h2>What's Changed</h2> <ul> <li>Update packages, migrate to ESM by <a href="https://github.com/Samirat"><code>@Samirat</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1760">actions/cache#1760</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v5...v6.0.0">https://github.com/actions/cache/compare/v5...v6.0.0</a></p> <h2>v5.0.5</h2> <h2>What's Changed</h2> <ul> <li>Update ts-http-runtime dependency by <a href="https://github.com/yacaovsnc"><code>@yacaovsnc</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1747">actions/cache#1747</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v5...v5.0.5">https://github.com/actions/cache/compare/v5...v5.0.5</a></p> <h2>v5.0.4</h2> <h2>What's Changed</h2> <ul> <li>Add release instructions and update maintainer docs by <a href="https://github.com/Link"><code>@Link</code></a>- in <a href="https://redirect.github.com/actions/cache/pull/1696">actions/cache#1696</a></li> <li>Potential fix for code scanning alert no. 52: Workflow does not contain permissions by <a href="https://github.com/Link"><code>@Link</code></a>- in <a href="https://redirect.github.com/actions/cache/pull/1697">actions/cache#1697</a></li> <li>Fix workflow permissions and cleanup workflow names / formatting by <a href="https://github.com/Link"><code>@Link</code></a>- in <a href="https://redirect.github.com/actions/cache/pull/1699">actions/cache#1699</a></li> <li>docs: Update examples to use the latest version by <a href="https://github.com/XZTDean"><code>@XZTDean</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1690">actions/cache#1690</a></li> <li>Fix proxy integration tests by <a href="https://github.com/Link"><code>@Link</code></a>- in <a href="https://redirect.github.com/actions/cache/pull/1701">actions/cache#1701</a></li> <li>Fix cache key in examples.md for bun.lock by <a href="https://github.com/RyPeck"><code>@RyPeck</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1722">actions/cache#1722</a></li> <li>Update dependencies & patch security vulnerabilities by <a href="https://github.com/Link"><code>@Link</code></a>- in <a href="https://redirect.github.com/actions/cache/pull/1738">actions/cache#1738</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/XZTDean"><code>@XZTDean</code></a> made their first contribution in <a href="https://redirect.github.com/actions/cache/pull/1690">actions/cache#1690</a></li> <li><a href="https://github.com/RyPeck"><code>@RyPeck</code></a> made their first contribution in <a href="https://redirect.github.com/actions/cache/pull/1722">actions/cache#1722</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v5...v5.0.4">https://github.com/actions/cache/compare/v5...v5.0.4</a></p> <h2>v5.0.3</h2> <h2>What's Changed</h2> <ul> <li>Bump <code>@actions/cache</code> to v5.0.5 (Resolves: <a href="https://github.com/actions/cache/security/dependabot/33">https://github.com/actions/cache/security/dependabot/33</a>)</li> <li>Bump <code>@actions/core</code> to v2.0.3</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v5...v5.0.3">https://github.com/actions/cache/compare/v5...v5.0.3</a></p> <h2>v.5.0.2</h2> <h1>v5.0.2</h1> <h2>What's Changed</h2> <p>When creating cache entries, 429s returned from the cache service will not be retried.</p> <h2>v5.0.1</h2> <blockquote> <p>[!IMPORTANT] <strong><code>actions/cache@v5</code> runs on the Node.js 24 runtime and requires a minimum Actions Runner version of <code>2.327.1</code>.</strong></p> </blockquote> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/cache/blob/main/RELEASES.md">actions/cache's changelog</a>.</em></p> <blockquote> <h1>Releases</h1> <h2>How to prepare a release</h2> <blockquote> <p>[!NOTE] Relevant for maintainers with write access only.</p> </blockquote> <ol> <li>Switch to a new branch from <code>main</code>.</li> <li>Run <code>npm test</code> to ensure all tests are passing.</li> <li>Update the version in <a href="https://github.com/actions/cache/blob/main/package.json"><code>https://github.com/actions/cache/blob/main/package.json</code></a>.</li> <li>Run <code>npm run build</code> to update the compiled files.</li> <li>Update this <a href="https://github.com/actions/cache/blob/main/RELEASES.md"><code>https://github.com/actions/cache/blob/main/RELEASES.md</code></a> with the new version and changes in the <code>## Changelog</code> section.</li> <li>Run <code>licensed cache</code> to update the license report.</li> <li>Run <code>licensed status</code> and resolve any warnings by updating the <a href="https://github.com/actions/cache/blob/main/.licensed.yml"><code>https://github.com/actions/cache/blob/main/.licensed.yml</code></a> file with the exceptions.</li> <li>Commit your changes and push your branch upstream.</li> <li>Open a pull request against <code>main</code> and get it reviewed and merged.</li> <li>Draft a new release <a href="https://github.com/actions/cache/releases">https://github.com/actions/cache/releases</a> use the same version number used in <code>package.json</code> <ol> <li>Create a new tag with the version number.</li> <li>Auto generate release notes and update them to match the changes you made in <code>RELEASES.md</code>.</li> <li>Toggle the set as the latest release option.</li> <li>Publish the release.</li> </ol> </li> <li>Navigate to <a href="https://github.com/actions/cache/actions/workflows/release-new-action-version.yml">https://github.com/actions/cache/actions/workflows/release-new-action-version.yml</a> <ol> <li>There should be a workflow run queued with the same version number.</li> <li>Approve the run to publish the new version and update the major tags for this action.</li> </ol> </li> </ol> <h2>Changelog</h2> <h3>6.1.0</h3> <ul> <li>Bump <code>@actions/cache</code> to v6.1.0 to pick up <a href="https://redirect.github.com/actions/toolkit/pull/2435">actions/toolkit#2435 Handle cache write error due to read-only token</a></li> <li>Switch redundant "Cache save failed" warning to debug log in save-only</li> </ul> <h3>6.0.0</h3> <ul> <li>Updated <code>@actions/cache</code> to ^6.0.1, <code>@actions/core</code> to ^3.0.1, <code>@actions/exec</code> to ^3.0.0, <code>@actions/io</code> to ^3.0.2</li> <li>Migrated to ESM module system</li> <li>Upgraded Jest to v30 and test infrastructure to be ESM compatible</li> </ul> <h3>5.0.4</h3> <ul> <li>Bump <code>minimatch</code> to v3.1.5 (fixes ReDoS via globstar patterns)</li> <li>Bump <code>undici</code> to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)</li> <li>Bump <code>fast-xml-parser</code> to v5.5.6</li> </ul> <h3>5.0.3</h3> <ul> <li>Bump <code>@actions/cache</code> to v5.0.5 (Resolves: <a href="https://github.com/actions/cache/security/dependabot/33">https://github.com/actions/cache/security/dependabot/33</a>)</li> <li>Bump <code>@actions/core</code> to v2.0.3</li> </ul> <h3>5.0.2</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/cache/commit/2c8a9bd7457de244a408f35966fab2fb45fda9c8"><code>2c8a9bd</code></a> Merge pull request <a href="https://redirect.github.com/actions/cache/issues/1760">#1760</a> from actions/samirat/esm_migration_and_package_update</li> <li><a href="https://github.com/actions/cache/commit/e9b91fdc3fea7d79165fceb79042ef45c2d51023"><code>e9b91fd</code></a> Prettier fixes</li> <li><a href="https://github.com/actions/cache/commit/e4884b8ff7f92ef6b52c79eda480bbc86e685adb"><code>e4884b8</code></a> Rebuild dist</li> <li><a href="https://github.com/actions/cache/commit/10baf0191a3c426ea0fa4a3253a5c04233b6e18f"><code>10baf01</code></a> Fixed licenses</li> <li><a href="https://github.com/actions/cache/commit/e39b386c9004d72a15d864ade8c0b3a702d47a37"><code>e39b386</code></a> Fix test mock return order</li> <li><a href="https://github.com/actions/cache/commit/b6928203372a8571ff984c0c883ef3a1adfb0c06"><code>b692820</code></a> PR feedback</li> <li><a href="https://github.com/actions/cache/commit/60749128a44d25d3c520a489e576380cf00ff3f1"><code>6074912</code></a> Rebuild dist bundles as ESM to match type:module</li> <li><a href="https://github.com/actions/cache/commit/5a912e8b4af820fa082a0e75cfd2c782f8fbfe0e"><code>5a912e8</code></a> Fix lint and jest issues</li> <li><a href="https://github.com/actions/cache/commit/b9bf592b98b6a5d0cad9929c76247de1cac78abe"><code>b9bf592</code></a> Update documentation for v6 release</li> <li><a href="https://github.com/actions/cache/commit/80f777761d0990932f64ed2740522d7226a49062"><code>80f7777</code></a> Update packages, migrate to ESM</li> <li>See full diff in <a href="https://github.com/actions/cache/compare/v5...v6">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/cache&package-manager=github_actions&previous-version=5&new-version=6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-24 09:53:07 -07:00
dependabot[bot]	c52eb9ccfe	chore: bump clechasseur/rs-cargo from 5.0.5 to 5.0.6 (#3192 ) Bumps [clechasseur/rs-cargo](https://github.com/clechasseur/rs-cargo) from 5.0.5 to 5.0.6. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/clechasseur/rs-cargo/releases">clechasseur/rs-cargo's releases</a>.</em></p> <blockquote> <h2>v5.0.6</h2> <p>Patch release with updated dependencies, including a few security fixes.</p> <h2>What's Changed</h2> <ul> <li>fix: update <code>@clechasseur/rs-actions-core</code> to 8.0.2, run <code>npm update</code> by <a href="https://github.com/clechasseur"><code>@clechasseur</code></a> in <a href="https://redirect.github.com/clechasseur/rs-cargo/pull/417">clechasseur/rs-cargo#417</a></li> <li>fix: bump version to 5.0.6 by <a href="https://github.com/clechasseur"><code>@clechasseur</code></a> in <a href="https://redirect.github.com/clechasseur/rs-cargo/pull/418">clechasseur/rs-cargo#418</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/clechasseur/rs-cargo/compare/v5.0.5...v5.0.6">https://github.com/clechasseur/rs-cargo/compare/v5.0.5...v5.0.6</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/clechasseur/rs-cargo/commit/b897b7d2f083c6274295825fdbd5a39b825c3f82"><code>b897b7d</code></a> fix: bump version to 5.0.6 (<a href="https://redirect.github.com/clechasseur/rs-cargo/issues/418">#418</a>)</li> <li><a href="https://github.com/clechasseur/rs-cargo/commit/e86930b100f497dd376b47d1267dbbaf5cc807b4"><code>e86930b</code></a> fix: update <code>@clechasseur/rs-actions-core</code> to 8.0.2, run <code>npm update</code> (<a href="https://redirect.github.com/clechasseur/rs-cargo/issues/417">#417</a>)</li> <li><a href="https://github.com/clechasseur/rs-cargo/commit/f4d1ac0b2f7c2e3834f0d254f76d7778a5d6cfa5"><code>f4d1ac0</code></a> chore(deps): update dependency rollup to ^4.62.2 (<a href="https://redirect.github.com/clechasseur/rs-cargo/issues/409">#409</a>)</li> <li><a href="https://github.com/clechasseur/rs-cargo/commit/9b9848a1304beb540d9468b2e1d522a5243e691a"><code>9b9848a</code></a> chore(deps): update oxlint monorepo (<a href="https://redirect.github.com/clechasseur/rs-cargo/issues/410">#410</a>)</li> <li><a href="https://github.com/clechasseur/rs-cargo/commit/e23aa2ec9d64e703063acfb0687bc2a51b28d887"><code>e23aa2e</code></a> chore(deps): update dependency ts-jest to ^29.4.11 (<a href="https://redirect.github.com/clechasseur/rs-cargo/issues/412">#412</a>)</li> <li><a href="https://github.com/clechasseur/rs-cargo/commit/1e4bdf4931de37757e889e0d620e8d7d0614b296"><code>1e4bdf4</code></a> chore(deps): update dependency <code>@rollup/plugin-commonjs</code> to ^29.0.3 (<a href="https://redirect.github.com/clechasseur/rs-cargo/issues/413">#413</a>)</li> <li><a href="https://github.com/clechasseur/rs-cargo/commit/36d36cbd5327a8f82946af1a04cd85f430fa8c34"><code>36d36cb</code></a> chore(deps): update dependency prettier to ^3.8.4 (<a href="https://redirect.github.com/clechasseur/rs-cargo/issues/415">#415</a>)</li> <li><a href="https://github.com/clechasseur/rs-cargo/commit/e88bc84dc238a66cb5aebcae2bf428fefe42573e"><code>e88bc84</code></a> chore(deps): update actions/checkout action to v7 (<a href="https://redirect.github.com/clechasseur/rs-cargo/issues/416">#416</a>)</li> <li><a href="https://github.com/clechasseur/rs-cargo/commit/08a7041e8a8d48e1543a4a87d9ab1b3d7bd3f2d8"><code>08a7041</code></a> chore(deps): update dependency oxlint to ^1.64.0 (<a href="https://redirect.github.com/clechasseur/rs-cargo/issues/408">#408</a>)</li> <li><a href="https://github.com/clechasseur/rs-cargo/commit/e9f9767c0d76a9666af4dc1d204d1c565444ae27"><code>e9f9767</code></a> chore(deps): update dependency jest to ^30.4.2 (<a href="https://redirect.github.com/clechasseur/rs-cargo/issues/406">#406</a>)</li> <li>Additional commits viewable in <a href="https://github.com/clechasseur/rs-cargo/compare/v5.0.5...v5.0.6">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=clechasseur/rs-cargo&package-manager=github_actions&previous-version=5.0.5&new-version=5.0.6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-24 09:53:04 -07:00
dependabot[bot]	46d446b0de	chore: bump actions/checkout from 6 to 7 (#3193 ) Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/releases">actions/checkout's releases</a>.</em></p> <blockquote> <h2>v7.0.0</h2> <h2>What's Changed</h2> <ul> <li>block checking out fork pr for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> <li>Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2458">actions/checkout#2458</a></li> <li>Bump flatted from 3.3.1 to 3.4.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2460">actions/checkout#2460</a></li> <li>Bump js-yaml from 4.1.0 to 4.2.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2461">actions/checkout#2461</a></li> <li>Bump <code>@actions/core</code> and <code>@actions/tool-cache</code> and Remove uuid by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2459">actions/checkout#2459</a></li> <li>upgrade module to esm and update dependencies by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2463">actions/checkout#2463</a></li> <li>Bump the minor-npm-dependencies group across 1 directory with 3 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2462">actions/checkout#2462</a></li> <li>getting ready for checkout v7 release by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2464">actions/checkout#2464</a></li> <li>update error wording by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2467">actions/checkout#2467</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6.0.3...v7.0.0">https://github.com/actions/checkout/compare/v6.0.3...v7.0.0</a></p> <h2>v6.0.3</h2> <h2>What's Changed</h2> <ul> <li>Update changelog by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2357">actions/checkout#2357</a></li> <li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> <li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li> <li>Update changelog for v6.0.3 by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2446">actions/checkout#2446</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/yaananth"><code>@yaananth</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6...v6.0.3">https://github.com/actions/checkout/compare/v6...v6.0.3</a></p> <h2>v6.0.2</h2> <h2>What's Changed</h2> <ul> <li>Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by <a href="https://github.com/TingluoHuang"><code>@TingluoHuang</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2355">actions/checkout#2355</a></li> <li>Fix tag handling: preserve annotations and explicit fetch-tags by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6.0.1...v6.0.2">https://github.com/actions/checkout/compare/v6.0.1...v6.0.2</a></p> <h2>v6.0.1</h2> <h2>What's Changed</h2> <ul> <li>Update all references from v5 and v4 to v6 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2314">actions/checkout#2314</a></li> <li>Add worktree support for persist-credentials includeIf by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li> <li>Clarify v6 README by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2328">actions/checkout#2328</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6...v6.0.1">https://github.com/actions/checkout/compare/v6...v6.0.1</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2>v7.0.0</h2> <ul> <li>Block checking out fork PR for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> <li>Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2458">actions/checkout#2458</a></li> <li>Bump flatted from 3.3.1 to 3.4.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2460">actions/checkout#2460</a></li> <li>Bump js-yaml from 4.1.0 to 4.2.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2461">actions/checkout#2461</a></li> <li>Bump <code>@actions/core</code> and <code>@actions/tool-cache</code> and Remove uuid by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2459">actions/checkout#2459</a></li> <li>upgrade module to esm and update dependencies by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2463">actions/checkout#2463</a></li> <li>Bump the minor-npm-dependencies group across 1 directory with 3 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2462">actions/checkout#2462</a></li> </ul> <h2>v6.0.3</h2> <ul> <li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li> <li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> </ul> <h2>v6.0.2</h2> <ul> <li>Fix tag handling: preserve annotations and explicit fetch-tags by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li> </ul> <h2>v6.0.1</h2> <ul> <li>Add worktree support for persist-credentials includeIf by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li> </ul> <h2>v6.0.0</h2> <ul> <li>Persist creds to a separate file by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li> <li>Update README to include Node.js 24 support details and requirements by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li> </ul> <h2>v5.0.1</h2> <ul> <li>Port v6 cleanup to v5 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li> </ul> <h2>v5.0.0</h2> <ul> <li>Update actions checkout to use node 24 by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li> </ul> <h2>v4.3.1</h2> <ul> <li>Port v6 cleanup to v4 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li> </ul> <h2>v4.3.0</h2> <ul> <li>docs: update README.md by <a href="https://github.com/motss"><code>@motss</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li> <li>Add internal repos for checking out multiple repositories by <a href="https://github.com/mouismail"><code>@mouismail</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li> <li>Documentation update - add recommended permissions to Readme by <a href="https://github.com/benwells"><code>@benwells</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li> <li>Adjust positioning of user email note and permissions heading by <a href="https://github.com/joshmgross"><code>@joshmgross</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li> <li>Update README.md by <a href="https://github.com/nebuk89"><code>@nebuk89</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li> <li>Update CODEOWNERS for actions by <a href="https://github.com/TingluoHuang"><code>@TingluoHuang</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li> <li>Update package dependencies by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li> </ul> <h2>v4.2.2</h2> <ul> <li><code>url-helper.ts</code> now leverages well-known environment variables by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li> <li>Expand unit test coverage for <code>isGhes</code> by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li> </ul> <h2>v4.2.1</h2> <ul> <li>Check out other refs/* by commit if provided, fall back to ref by <a href="https://github.com/orhantoy"><code>@orhantoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/checkout/commit/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0"><code>9c091bb</code></a> update error wording (<a href="https://redirect.github.com/actions/checkout/issues/2467">#2467</a>)</li> <li><a href="https://github.com/actions/checkout/commit/1044a6dea927916f2c38ba5aeffbc0a847b1221a"><code>1044a6d</code></a> getting ready for checkout v7 release (<a href="https://redirect.github.com/actions/checkout/issues/2464">#2464</a>)</li> <li><a href="https://github.com/actions/checkout/commit/f0282184c7ce73ab54c7e4ab5a617122602e575f"><code>f028218</code></a> Bump the minor-npm-dependencies group across 1 directory with 3 updates (<a href="https://redirect.github.com/actions/checkout/issues/2462">#2462</a>)</li> <li><a href="https://github.com/actions/checkout/commit/d914b262ffc244530a203ab40decab34c3abf34d"><code>d914b26</code></a> upgrade module to esm and update dependencies (<a href="https://redirect.github.com/actions/checkout/issues/2463">#2463</a>)</li> <li><a href="https://github.com/actions/checkout/commit/537c7ef99cef6e5ddb5e7ff5d16d14510503801d"><code>537c7ef</code></a> Bump <code>@actions/core</code> and <code>@actions/tool-cache</code> and Remove uuid (<a href="https://redirect.github.com/actions/checkout/issues/2459">#2459</a>)</li> <li><a href="https://github.com/actions/checkout/commit/130a169078a413d3a5246a393625e8e742f387f6"><code>130a169</code></a> Bump js-yaml from 4.1.0 to 4.2.0 (<a href="https://redirect.github.com/actions/checkout/issues/2461">#2461</a>)</li> <li><a href="https://github.com/actions/checkout/commit/7d09575332117a40b46e5e020664df234cd416f3"><code>7d09575</code></a> Bump flatted from 3.3.1 to 3.4.2 (<a href="https://redirect.github.com/actions/checkout/issues/2460">#2460</a>)</li> <li><a href="https://github.com/actions/checkout/commit/0f9f3aa320cb53abeb534aeb54048075d9697a0e"><code>0f9f3aa</code></a> Bump actions/publish-immutable-action (<a href="https://redirect.github.com/actions/checkout/issues/2458">#2458</a>)</li> <li><a href="https://github.com/actions/checkout/commit/f9e715a95fcd1f9253f77dd28f11e88d2d6460c7"><code>f9e715a</code></a> block checking out fork pr for pull_request_target and workflow_run (<a href="https://redirect.github.com/actions/checkout/issues/2454">#2454</a>)</li> <li>See full diff in <a href="https://github.com/actions/checkout/compare/v6...v7">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/checkout&package-manager=github_actions&previous-version=6&new-version=7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-24 09:53:01 -07:00
dependabot[bot]	1c2f869ba3	chore: bump max-sixty/tend from 0.1.6 to 0.1.7 (#3194 ) Bumps [max-sixty/tend](https://github.com/max-sixty/tend) from 0.1.6 to 0.1.7. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/max-sixty/tend/releases">max-sixty/tend's releases</a>.</em></p> <blockquote> <h2>0.1.7</h2> <h3>Improved</h3> <ul> <li><strong>Generated workflows pin <code>actions/checkout</code> to v7.</strong> All generated workflows (and tend's own) move from checkout v6 to v7. The review workflow opts into v7's fork-PR checkout guard (<code>allow-unsafe-pr-checkout: true</code>), which otherwise refuses to check out a fork's <code>refs/pull/N/{merge,head}</code> under <code>pull_request_target</code> (the "pwn request" guard), so fork-PR reviews keep running. (<a href="https://redirect.github.com/max-sixty/tend/pull/725">#725</a>)</li> <li><strong>Both Claude harnesses update to claude-code 2.1.185.</strong> (<a href="https://redirect.github.com/max-sixty/tend/pull/719">#719</a>)</li> <li><strong>The bot surfaces a blocking scope rule instead of silently routing around it.</strong> When a <code>running-in-ci</code> scope restriction blocks the right action — e.g. engaging an existing upstream thread in another repo — the bot now surfaces the blocker on the triggering thread and offers either to take the upstream action on approval or to relax the rule via the consuming repo's <code>running-tend</code> overlay, rather than substituting a second-best local workaround without signaling it hit a wall. (<a href="https://redirect.github.com/max-sixty/tend/pull/717">#717</a>)</li> </ul> <h3>Fixed</h3> <ul> <li><strong>CI-poll loops fit the Bash tool's 10-minute cap.</strong> The bundled <code>running-in-ci</code> poll recipes cap their <code>sleep</code> loops at 9 iterations and call the Bash step with <code>timeout: 600000</code>, so the harness no longer auto-backgrounds a longer loop and strands the gated follow-up (dismissing a stale approval, posting failure analysis). (<a href="https://redirect.github.com/max-sixty/tend/pull/695">#695</a>)</li> <li><strong>Nightly workflow-regen bases its worktree on an open PR, not branch-ref existence.</strong> The <code>nightly</code> skill's regen step now bases on the <code>tend/update-workflows</code> branch only when an open PR rides it, and otherwise bases on <code>HEAD</code> and drops any leftover remote branch. A PR previously closed without merge no longer leaves a stale branch that inflates the diff, produces an inaccurate PR body, or defeats the no-value skip. (<a href="https://redirect.github.com/max-sixty/tend/pull/721">#721</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>The codex <code>effort</code> value list in the README and the install-tend skill is corrected to <code>low \| medium \| high \| xhigh</code>. (<a href="https://redirect.github.com/max-sixty/tend/pull/710">#710</a>)</li> </ul> <h3>Internal</h3> <ul> <li>Composite-action step bodies are de-duplicated into scripts under <code>shared/steps/</code>, and each harness action lives under a harness-named path. Generated workflows now invoke <code>max-sixty/tend/claude@X.Y.Z</code> (and <code>claude-interactive</code>) rather than the bare-root default; existing pinned refs keep resolving and the nightly regen stamps the new path automatically. (<a href="https://redirect.github.com/max-sixty/tend/pull/712">#712</a>)</li> <li><code>review-reviewers</code> documents the <code>pull_request_review</code> self-trigger as expected (non-)behavior, and the <code>worker-deploy</code> comment corrects the live-stream count to two. (<a href="https://redirect.github.com/max-sixty/tend/pull/707">#707</a>, <a href="https://redirect.github.com/max-sixty/tend/pull/711">#711</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/max-sixty/tend/blob/main/CHANGELOG.md">max-sixty/tend's changelog</a>.</em></p> <blockquote> <h2>0.1.7</h2> <h3>Improved</h3> <ul> <li><strong>Generated workflows pin <code>actions/checkout</code> to v7.</strong> All generated workflows (and tend's own) move from checkout v6 to v7. The review workflow opts into v7's fork-PR checkout guard (<code>allow-unsafe-pr-checkout: true</code>), which otherwise refuses to check out a fork's <code>refs/pull/N/{merge,head}</code> under <code>pull_request_target</code> (the "pwn request" guard), so fork-PR reviews keep running. (<a href="https://redirect.github.com/max-sixty/tend/pull/725">#725</a>)</li> <li><strong>Both Claude harnesses update to claude-code 2.1.185.</strong> (<a href="https://redirect.github.com/max-sixty/tend/pull/719">#719</a>)</li> <li><strong>The bot surfaces a blocking scope rule instead of silently routing around it.</strong> When a <code>running-in-ci</code> scope restriction blocks the right action — e.g. engaging an existing upstream thread in another repo — the bot now surfaces the blocker on the triggering thread and offers either to take the upstream action on approval or to relax the rule via the consuming repo's <code>running-tend</code> overlay, rather than substituting a second-best local workaround without signaling it hit a wall. (<a href="https://redirect.github.com/max-sixty/tend/pull/717">#717</a>)</li> </ul> <h3>Fixed</h3> <ul> <li><strong>CI-poll loops fit the Bash tool's 10-minute cap.</strong> The bundled <code>running-in-ci</code> poll recipes cap their <code>sleep</code> loops at 9 iterations and call the Bash step with <code>timeout: 600000</code>, so the harness no longer auto-backgrounds a longer loop and strands the gated follow-up (dismissing a stale approval, posting failure analysis). (<a href="https://redirect.github.com/max-sixty/tend/pull/695">#695</a>)</li> <li><strong>Nightly workflow-regen bases its worktree on an open PR, not branch-ref existence.</strong> The <code>nightly</code> skill's regen step now bases on the <code>tend/update-workflows</code> branch only when an open PR rides it, and otherwise bases on <code>HEAD</code> and drops any leftover remote branch. A PR previously closed without merge no longer leaves a stale branch that inflates the diff, produces an inaccurate PR body, or defeats the no-value skip. (<a href="https://redirect.github.com/max-sixty/tend/pull/721">#721</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>The codex <code>effort</code> value list in the README and the install-tend skill is corrected to <code>low \| medium \| high \| xhigh</code>. (<a href="https://redirect.github.com/max-sixty/tend/pull/710">#710</a>)</li> </ul> <h3>Internal</h3> <ul> <li>Composite-action step bodies are de-duplicated into scripts under <code>shared/steps/</code>, and each harness action lives under a harness-named path. Generated workflows now invoke <code>max-sixty/tend/claude@X.Y.Z</code> (and <code>claude-interactive</code>) rather than the bare-root default; existing pinned refs keep resolving and the nightly regen stamps the new path automatically. (<a href="https://redirect.github.com/max-sixty/tend/pull/712">#712</a>)</li> <li><code>review-reviewers</code> documents the <code>pull_request_review</code> self-trigger as expected (non-)behavior, and the <code>worker-deploy</code> comment corrects the live-stream count to two. (<a href="https://redirect.github.com/max-sixty/tend/pull/707">#707</a>, <a href="https://redirect.github.com/max-sixty/tend/pull/711">#711</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/max-sixty/tend/commit/c7a7b565178ac325b9f2be42b11361a78346e46b"><code>c7a7b56</code></a> chore: release 0.1.7 (<a href="https://redirect.github.com/max-sixty/tend/issues/726">#726</a>)</li> <li><a href="https://github.com/max-sixty/tend/commit/67da54b81b2b9aea2eced4cdfbe69c0775877c18"><code>67da54b</code></a> fix(nightly): base workflow-regen worktree on open PR, not branch ref (<a href="https://redirect.github.com/max-sixty/tend/issues/721">#721</a>)</li> <li><a href="https://github.com/max-sixty/tend/commit/0b22561d884eb29beee94d24c75ff2e8bca92cee"><code>0b22561</code></a> fix(review): opt into v7 fork-PR checkout so fork reviews run (<a href="https://redirect.github.com/max-sixty/tend/issues/725">#725</a>)</li> <li><a href="https://github.com/max-sixty/tend/commit/2de9bbaf0550aa85feb5892f77d79d30f4bf4477"><code>2de9bba</code></a> fix(running-in-ci): surface scope blockers instead of silently routing around...</li> <li><a href="https://github.com/max-sixty/tend/commit/9d31da3ee69ccc8f9dc475f94a60a48b9de37d62"><code>9d31da3</code></a> chore: bump claude_version to 2.1.185 (<a href="https://redirect.github.com/max-sixty/tend/issues/719">#719</a>)</li> <li><a href="https://github.com/max-sixty/tend/commit/6b03677b05779c437196120e23eba9170ed94579"><code>6b03677</code></a> fix(running-in-ci): trim CI-poll loops to fit Bash tool's 10-min cap (<a href="https://redirect.github.com/max-sixty/tend/issues/695">#695</a>)</li> <li><a href="https://github.com/max-sixty/tend/commit/4b7baf773787adb278b0f8883f2478a36da5ac6a"><code>4b7baf7</code></a> refactor(actions): share step scripts; name actions by harness (<a href="https://redirect.github.com/max-sixty/tend/issues/712">#712</a>)</li> <li><a href="https://github.com/max-sixty/tend/commit/579b646795c50e8ca4c5ca01f575a350d8740a31"><code>579b646</code></a> skills(review-reviewers): name pull_request_review self-trigger variant (<a href="https://redirect.github.com/max-sixty/tend/issues/707">#707</a>)</li> <li><a href="https://github.com/max-sixty/tend/commit/0e9a5a2337830e8deeba2284fe3fca0e3ebc81e3"><code>0e9a5a2</code></a> docs: correct codex effort value list (<a href="https://redirect.github.com/max-sixty/tend/issues/710">#710</a>)</li> <li><a href="https://github.com/max-sixty/tend/commit/2178194a7b15cac1fac9d7e3401073bbcda69a7b"><code>2178194</code></a> docs: correct worker-deploy stream count comment (<a href="https://redirect.github.com/max-sixty/tend/issues/711">#711</a>)</li> <li>Additional commits viewable in <a href="https://github.com/max-sixty/tend/compare/0.1.6...0.1.7">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=max-sixty/tend&package-manager=github_actions&previous-version=0.1.6&new-version=0.1.7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: worktrunk-bot <worktrunk-bot@users.noreply.github.com> Co-authored-by: Claude <noreply@anthropic.com>	2026-06-24 04:59:36 +00:00
Worktrunk Bot	d3f4b89ce7	ci(tend-review): pin actions/checkout back to v6 for fork-PR review (#3176 )	2026-06-23 07:02:35 -07:00
dependabot[bot]	9e8d4612c8	chore: bump actions/checkout from 6 to 7 (#3131 ) Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/releases">actions/checkout's releases</a>.</em></p> <blockquote> <h2>v7.0.0</h2> <h2>What's Changed</h2> <ul> <li>block checking out fork pr for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> <li>Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2458">actions/checkout#2458</a></li> <li>Bump flatted from 3.3.1 to 3.4.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2460">actions/checkout#2460</a></li> <li>Bump js-yaml from 4.1.0 to 4.2.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2461">actions/checkout#2461</a></li> <li>Bump <code>@actions/core</code> and <code>@actions/tool-cache</code> and Remove uuid by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2459">actions/checkout#2459</a></li> <li>upgrade module to esm and update dependencies by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2463">actions/checkout#2463</a></li> <li>Bump the minor-npm-dependencies group across 1 directory with 3 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2462">actions/checkout#2462</a></li> <li>getting ready for checkout v7 release by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2464">actions/checkout#2464</a></li> <li>update error wording by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2467">actions/checkout#2467</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6.0.3...v7.0.0">https://github.com/actions/checkout/compare/v6.0.3...v7.0.0</a></p> <h2>v6.0.3</h2> <h2>What's Changed</h2> <ul> <li>Update changelog by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2357">actions/checkout#2357</a></li> <li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> <li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li> <li>Update changelog for v6.0.3 by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2446">actions/checkout#2446</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/yaananth"><code>@yaananth</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6...v6.0.3">https://github.com/actions/checkout/compare/v6...v6.0.3</a></p> <h2>v6.0.2</h2> <h2>What's Changed</h2> <ul> <li>Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by <a href="https://github.com/TingluoHuang"><code>@TingluoHuang</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2355">actions/checkout#2355</a></li> <li>Fix tag handling: preserve annotations and explicit fetch-tags by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6.0.1...v6.0.2">https://github.com/actions/checkout/compare/v6.0.1...v6.0.2</a></p> <h2>v6.0.1</h2> <h2>What's Changed</h2> <ul> <li>Update all references from v5 and v4 to v6 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2314">actions/checkout#2314</a></li> <li>Add worktree support for persist-credentials includeIf by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li> <li>Clarify v6 README by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2328">actions/checkout#2328</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6...v6.0.1">https://github.com/actions/checkout/compare/v6...v6.0.1</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2>v7.0.0</h2> <ul> <li>Block checking out fork PR for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> <li>Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2458">actions/checkout#2458</a></li> <li>Bump flatted from 3.3.1 to 3.4.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2460">actions/checkout#2460</a></li> <li>Bump js-yaml from 4.1.0 to 4.2.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2461">actions/checkout#2461</a></li> <li>Bump <code>@actions/core</code> and <code>@actions/tool-cache</code> and Remove uuid by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2459">actions/checkout#2459</a></li> <li>upgrade module to esm and update dependencies by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2463">actions/checkout#2463</a></li> <li>Bump the minor-npm-dependencies group across 1 directory with 3 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2462">actions/checkout#2462</a></li> </ul> <h2>v6.0.3</h2> <ul> <li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li> <li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> </ul> <h2>v6.0.2</h2> <ul> <li>Fix tag handling: preserve annotations and explicit fetch-tags by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li> </ul> <h2>v6.0.1</h2> <ul> <li>Add worktree support for persist-credentials includeIf by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li> </ul> <h2>v6.0.0</h2> <ul> <li>Persist creds to a separate file by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li> <li>Update README to include Node.js 24 support details and requirements by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li> </ul> <h2>v5.0.1</h2> <ul> <li>Port v6 cleanup to v5 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li> </ul> <h2>v5.0.0</h2> <ul> <li>Update actions checkout to use node 24 by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li> </ul> <h2>v4.3.1</h2> <ul> <li>Port v6 cleanup to v4 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li> </ul> <h2>v4.3.0</h2> <ul> <li>docs: update README.md by <a href="https://github.com/motss"><code>@motss</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li> <li>Add internal repos for checking out multiple repositories by <a href="https://github.com/mouismail"><code>@mouismail</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li> <li>Documentation update - add recommended permissions to Readme by <a href="https://github.com/benwells"><code>@benwells</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li> <li>Adjust positioning of user email note and permissions heading by <a href="https://github.com/joshmgross"><code>@joshmgross</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li> <li>Update README.md by <a href="https://github.com/nebuk89"><code>@nebuk89</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li> <li>Update CODEOWNERS for actions by <a href="https://github.com/TingluoHuang"><code>@TingluoHuang</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li> <li>Update package dependencies by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li> </ul> <h2>v4.2.2</h2> <ul> <li><code>url-helper.ts</code> now leverages well-known environment variables by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li> <li>Expand unit test coverage for <code>isGhes</code> by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li> </ul> <h2>v4.2.1</h2> <ul> <li>Check out other refs/* by commit if provided, fall back to ref by <a href="https://github.com/orhantoy"><code>@orhantoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/checkout/commit/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0"><code>9c091bb</code></a> update error wording (<a href="https://redirect.github.com/actions/checkout/issues/2467">#2467</a>)</li> <li><a href="https://github.com/actions/checkout/commit/1044a6dea927916f2c38ba5aeffbc0a847b1221a"><code>1044a6d</code></a> getting ready for checkout v7 release (<a href="https://redirect.github.com/actions/checkout/issues/2464">#2464</a>)</li> <li><a href="https://github.com/actions/checkout/commit/f0282184c7ce73ab54c7e4ab5a617122602e575f"><code>f028218</code></a> Bump the minor-npm-dependencies group across 1 directory with 3 updates (<a href="https://redirect.github.com/actions/checkout/issues/2462">#2462</a>)</li> <li><a href="https://github.com/actions/checkout/commit/d914b262ffc244530a203ab40decab34c3abf34d"><code>d914b26</code></a> upgrade module to esm and update dependencies (<a href="https://redirect.github.com/actions/checkout/issues/2463">#2463</a>)</li> <li><a href="https://github.com/actions/checkout/commit/537c7ef99cef6e5ddb5e7ff5d16d14510503801d"><code>537c7ef</code></a> Bump <code>@actions/core</code> and <code>@actions/tool-cache</code> and Remove uuid (<a href="https://redirect.github.com/actions/checkout/issues/2459">#2459</a>)</li> <li><a href="https://github.com/actions/checkout/commit/130a169078a413d3a5246a393625e8e742f387f6"><code>130a169</code></a> Bump js-yaml from 4.1.0 to 4.2.0 (<a href="https://redirect.github.com/actions/checkout/issues/2461">#2461</a>)</li> <li><a href="https://github.com/actions/checkout/commit/7d09575332117a40b46e5e020664df234cd416f3"><code>7d09575</code></a> Bump flatted from 3.3.1 to 3.4.2 (<a href="https://redirect.github.com/actions/checkout/issues/2460">#2460</a>)</li> <li><a href="https://github.com/actions/checkout/commit/0f9f3aa320cb53abeb534aeb54048075d9697a0e"><code>0f9f3aa</code></a> Bump actions/publish-immutable-action (<a href="https://redirect.github.com/actions/checkout/issues/2458">#2458</a>)</li> <li><a href="https://github.com/actions/checkout/commit/f9e715a95fcd1f9253f77dd28f11e88d2d6460c7"><code>f9e715a</code></a> block checking out fork pr for pull_request_target and workflow_run (<a href="https://redirect.github.com/actions/checkout/issues/2454">#2454</a>)</li> <li>See full diff in <a href="https://github.com/actions/checkout/compare/v6...v7">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-22 14:03:53 -07:00
Worktrunk Bot	e0cfd884e9	chore(ci): weekly renovation 2026-06-21 (#3147 ) ## Summary Weekly CI renovation check. One pinned-version drift found and bumped: - `worktrunk`: `=0.58.0` → `=0.60.0` (MSRV 1.95, compatible with our pinned 1.95.0 toolchain) — `ci.yaml` `test` job. Flagged by a workflow annotation on the latest green `main` run ("New version for worktrunk available: 0.60.0"). ## Already up to date - Rust stable: latest is 1.96.0, so latest−1 = 1.95 — `rust-toolchain.toml` (1.95.0) and both `rust-version` pins (1.95) already match. No MSRV/toolchain bump. - cargo-install pins: cargo-insta 1.48.0, cargo-nextest 0.9.137, lychee 0.24.2, cargo-msrv 0.19.3, cargo-llvm-cov 0.8.7, cargo-udeps 0.1.61 — all current against crates.io. - setup-nu: 0.113.1 (latest nushell release). - zola: 0.22.1 (latest getzola release). - Runner images: ubuntu-24.04, macos-15, windows-2022 (windows-2022 stays pinned — actions/runner-images#12677). ## Notes - worktrunk 0.59.0 and 0.60.0 both declare `rust-version = "1.95"`; verified via crates.io API against the pinned toolchain. - Only the `test` job pins a specific worktrunk version; the `cargo-affected` install follows the default branch and is intentionally unpinned. --- 🤖 Automated weekly renovation Co-authored-by: worktrunk-bot <worktrunk-bot@users.noreply.github.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-22 13:59:05 -07:00
dependabot[bot]	56cc99c780	chore: bump taiki-e/install-action from 2.82.0 to 2.82.2 (#3155 ) Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.82.0 to 2.82.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/taiki-e/install-action/releases">taiki-e/install-action's releases</a>.</em></p> <blockquote> <h2>2.82.2</h2> <ul> <li> <p>Update <code>xh@latest</code> to 0.26.1.</p> </li> <li> <p>Update <code>uv@latest</code> to 0.11.23.</p> </li> <li> <p>Update <code>trivy@latest</code> to 0.71.2.</p> </li> <li> <p>Update <code>sccache@latest</code> to 0.16.0.</p> </li> </ul> <h2>2.82.1</h2> <ul> <li> <p>Update <code>vacuum@latest</code> to 0.29.4.</p> </li> <li> <p>Update <code>uv@latest</code> to 0.11.22.</p> </li> <li> <p>Update <code>osv-scanner@latest</code> to 2.4.0.</p> </li> <li> <p>Update <code>mise@latest</code> to 2026.6.11.</p> </li> <li> <p>Update <code>martin@latest</code> to 1.11.0.</p> </li> <li> <p>Update <code>just@latest</code> to 1.53.0.</p> </li> <li> <p>Update <code>cargo-zigbuild@latest</code> to 0.23.0.</p> </li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md">taiki-e/install-action's changelog</a>.</em></p> <blockquote> <h2>[2.82.2] - 2026-06-21</h2> <ul> <li> <p>Update <code>xh@latest</code> to 0.26.1.</p> </li> <li> <p>Update <code>uv@latest</code> to 0.11.23.</p> </li> <li> <p>Update <code>trivy@latest</code> to 0.71.2.</p> </li> <li> <p>Update <code>sccache@latest</code> to 0.16.0.</p> </li> </ul> <h2>[2.82.1] - 2026-06-20</h2> <ul> <li> <p>Update <code>vacuum@latest</code> to 0.29.4.</p> </li> <li> <p>Update <code>uv@latest</code> to 0.11.22.</p> </li> <li> <p>Update <code>osv-scanner@latest</code> to 2.4.0.</p> </li> <li> <p>Update <code>mise@latest</code> to 2026.6.11.</p> </li> <li> <p>Update <code>martin@latest</code> to 1.11.0.</p> </li> <li> <p>Update <code>just@latest</code> to 1.53.0.</p> </li> <li> <p>Update <code>cargo-zigbuild@latest</code> to 0.23.0.</p> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/taiki-e/install-action/commit/9e1e5806d4a4822de933115878265be9aaa786d9"><code>9e1e580</code></a> Release 2.82.2</li> <li><a href="https://github.com/taiki-e/install-action/commit/788896b6163ee187bf02f51161e573dbc028dba0"><code>788896b</code></a> Update zizmor manifest</li> <li><a href="https://github.com/taiki-e/install-action/commit/7631577b669c94d73e58cb9f217d0f56abd33a48"><code>7631577</code></a> Update <code>xh@latest</code> to 0.26.1</li> <li><a href="https://github.com/taiki-e/install-action/commit/e0f1a05cc9f43f4fd57d15fe7ee20ca5b78f65fc"><code>e0f1a05</code></a> Update <code>uv@latest</code> to 0.11.23</li> <li><a href="https://github.com/taiki-e/install-action/commit/3cda1e20d17fde3f9958653d219495e0591233ec"><code>3cda1e2</code></a> Update <code>trivy@latest</code> to 0.71.2</li> <li><a href="https://github.com/taiki-e/install-action/commit/11ac3210af3c20497864c3d27d4499b6a7108098"><code>11ac321</code></a> Update tombi manifest</li> <li><a href="https://github.com/taiki-e/install-action/commit/b5f9e335d3eaba5117342d9d9fda485aea29c524"><code>b5f9e33</code></a> Update <code>sccache@latest</code> to 0.16.0</li> <li><a href="https://github.com/taiki-e/install-action/commit/4e48cd5f5170589da6cad450be3e62ca61534cc1"><code>4e48cd5</code></a> Update cargo-tarpaulin manifest</li> <li><a href="https://github.com/taiki-e/install-action/commit/e0a923573389b28b6cefdbe8309332b471f55583"><code>e0a9235</code></a> Update cargo-rdme manifest</li> <li><a href="https://github.com/taiki-e/install-action/commit/8b3c737da4b541bf0fb5a3e0488ff20535badac9"><code>8b3c737</code></a> Release 2.82.1</li> <li>Additional commits viewable in <a href="https://github.com/taiki-e/install-action/compare/v2.82.0...v2.82.2">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=taiki-e/install-action&package-manager=github_actions&previous-version=2.82.0&new-version=2.82.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-22 13:59:03 -07:00

1 2 3 4 5 ...

377 Commits