Update github-actions - #102
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
| - name: Install the latest version of uv | ||
| uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 | ||
| uses: astral-sh/setup-uv@d31148d669074a8d0a63714ba94f3201e7020bc3 # v8.3.0 |
| egress-policy: audit | ||
|
|
||
| - uses: cbrgm/mastodon-github-action@244bbe72e61b4490e2dc1c34f9537ae9299ae601 # v2.2.1 | ||
| - uses: cbrgm/mastodon-github-action@ac2d8e8c9986a17b824dd12dd9df4ce5fcd813c1 # v2.2.2 |
renovate
Bot
force-pushed
the
renovate/github-actions
branch
3 times, most recently
from
July 13, 2026 21:01
b3751a5 to
e02177c
Compare
|
|
||
| - name: "Create release" | ||
| uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1 | ||
| uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2 |
renovate
Bot
force-pushed
the
renovate/github-actions
branch
2 times, most recently
from
July 21, 2026 01:44
24d8e2f to
b2e3881
Compare
| egress-policy: audit | ||
|
|
||
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | ||
| - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 |
| egress-policy: audit | ||
|
|
||
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | ||
| - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 |
renovate
Bot
force-pushed
the
renovate/github-actions
branch
2 times, most recently
from
July 22, 2026 14:13
152a8e7 to
aca4f47
Compare
renovate
Bot
force-pushed
the
renovate/github-actions
branch
5 times, most recently
from
August 5, 2026 09:46
9a678d4 to
e254641
Compare
renovate
Bot
force-pushed
the
renovate/github-actions
branch
from
August 11, 2026 02:10
e254641 to
36b7201
Compare
| - name: Generate changelog | ||
| id: changelog | ||
| uses: metcalfc/changelog-generator@0440d0932f9a0dd1cc9ecd8412830761351323bd # v4.7.0 | ||
| uses: metcalfc/changelog-generator@98b12822c5dc6bad335d1d60d920cb69831b9c5d # v4.8.0 |
renovate
Bot
force-pushed
the
renovate/github-actions
branch
2 times, most recently
from
August 15, 2026 06:04
195dd7f to
baaff7e
Compare
renovate
Bot
force-pushed
the
renovate/github-actions
branch
2 times, most recently
from
August 26, 2026 07:13
3b67df8 to
7342dd7
Compare
renovate
Bot
force-pushed
the
renovate/github-actions
branch
from
August 26, 2026 21:30
7342dd7 to
5bdcd3d
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v6.0.3→v6.1.0v8.2.0→v8.3.2v2.2.1→v2.2.3v4.36.2→v4.37.9v4.7.0→v4.9.1v3.0.1→v3.0.2v2.19.4→v2.21.0Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
actions/checkout (actions/checkout)
v6.1.0Compare Source
astral-sh/setup-uv (astral-sh/setup-uv)
v8.3.2Compare Source
v8.3.1Compare Source
v8.3.0Compare Source
cbrgm/mastodon-github-action (cbrgm/mastodon-github-action)
v2.2.3Compare Source
What's Changed
Full Changelog: cbrgm/mastodon-github-action@v2...v2.2.3
v2.2.2Compare Source
What's Changed
Full Changelog: cbrgm/mastodon-github-action@v2...v2.2.2
github/codeql-action (github/codeql-action)
v4.37.9Compare Source
v4.37.8Compare Source
No user facing changes.
v4.37.7Compare Source
v4.37.6Compare Source
.github/codeql-config.ymlto align it with the suggested path that is used elsewhere. #4070v4.37.5Compare Source
initAction instead of falling back to downloading the bundle before extracting it. #4061v4.37.4Compare Source
v4.37.3Compare Source
No user facing changes.
v4.37.2Compare Source
config-fileinput that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, theremote=prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023v4.37.1Compare Source
v4.37.0Compare Source
config-fileinput for thecodeql-action/initstep will soon support a new[owner/]repo[@ref][:path]format. All components except the repository name are optional. If omitted,ownerdefaults to the same owner as the repository the analysis is running for,reftomain, andpathto.github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973v4.36.3Compare Source
No user facing changes.
metcalfc/changelog-generator (metcalfc/changelog-generator)
v4.9.1Compare Source
Patch release for the v4 line
Documentation and CI only.
dist/is byte-identical tov4.9.0,
so there is no functional change for consumers; this release exists so the
v4tag points at a commit whose docs are correct.
The README's "Simple output modifications" recipe percent-encoded newlines as
%0A, which the long-removed::set-outputcommand decoded.$GITHUB_OUTPUTdoes not, so anyone who copied that snippet got a single line with literal
%0Ain it. It now uses the heredoc form, with a random delimiter because thevalue is built from commit subjects.
The changelog output format remains unchanged from v4.8.0. See
v5.0.0
for the breaking change that renders commit subjects as literal text.
v4.9.0Compare Source
Maintenance release for the v4 line
Security and dependency fixes only. The changelog output format is unchanged
from v4.8.0 -- verified byte-identical -- so tracking
@v4is safe.the published bundle is now verified against a rebuild before attestation
@vercel/ncc0.45.0 and dev-dependency bumpsv5.0.0
contains these same fixes plus a breaking change: commit subjects render as
literal text, so a merged pull request's subject can no longer inject links or
mentions into your release notes. That change also stops
#123autolinkinginside subjects, which is why it is not on the v4 line.
v4.8.0Compare Source
Highlights
Failed changelog generation now fails the step
If the changelog could not be generated — an unresolvable ref, any git error — the action printed an
::error::annotation and then exited 0. The step went green,outputs.changelogwas never set, and downstream steps consumed an empty string without anything indicating a problem.It now exits non-zero.
fetch: trueno longer intermittently fails on shallow checkoutsThe default fetch path chained two
git fetch --depth=1calls ahead ofgit fetch --unshallow. Each rewrites.git/shallowwhile the next has already read it, so git would intermittently abort with:Because
fetch: trueis the default and the exit code was being discarded, this produced a silently empty changelog rather than a visible failure. It was happening in this repository's own CI.Now a single fetch, requesting
--unshallowonly when the checkout is actually shallow.Testing
make testpreviously rannpm test || echo "no tests available", wherenpm testwasexit 1— it reported success unconditionally. The project now has a real suite coveringchangelog.shagainst live git fixtures, ref validation, the release scripts, and the builtdist/bundle as the runner executes it. Both fixes above were found by adding it.Full changelog
softprops/action-gh-release (softprops/action-gh-release)
v3.0.2Compare Source
3.0.2is a patch release focused on release reliability and compatibility. Itreuses existing draft releases when publishing prereleases, supports replacing
release assets on Gitea, hardens streamed asset uploads, and provides clearer
release-creation diagnostics. It also includes TypeScript, coverage, and tooling
maintenance merged since
3.0.1.This release fixes #795, #438, and #803. The upload transport hardening covers the
historical failure reported in #790, although current hosted Node 24 runners did
not reproduce it naturally. The diagnostics work is related to #786 and does not
claim a reproducible release-creation fix.
What's Changed
Exciting New Features 🎉
Bug fixes 🐛
Other Changes 🔄
3.0.1step-security/harden-runner (step-security/harden-runner)
v2.21.0Compare Source
What's Changed
Full Changelog: step-security/harden-runner@v2.20.1...v2.21.0
v2.20.1Compare Source
What's Changed
Full Changelog: step-security/harden-runner@v2.20.0...v2.20.1
v2.20.0Compare Source
What's Changed
Full Changelog: step-security/harden-runner@v2.19.4...v2.20.0
Configuration
📅 Schedule: (UTC)
* 0-3 * * 1)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.