Skip to content

ci: bump the actions group across 1 directory with 9 updates - #64

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-f649f2f94f
Open

ci: bump the actions group across 1 directory with 9 updates#64
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-f649f2f94f

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the actions group with 9 updates in the / directory:

Package From To
bounded-systems/.github/.github/workflows/_claim-sweep.yml 14c1a9b3ade8bb6416f46c890eda21823647da09 1716efd3a3cc81ba97e0ff2be0f9a0a0ebd6574c
actions/setup-node 7.0.0 7.1.0
actions/deploy-pages 5.0.0 5.0.1
bounded-systems/ci-workflows/.github/workflows/osv-scan.yml 0.1.4 0.1.5
bounded-systems/.github/.github/actions/broker-gh-token 183f6865b651a4b1a324029d85ec2c5bd402e690 1716efd3a3cc81ba97e0ff2be0f9a0a0ebd6574c
bounded-systems/.github/.github/workflows/_pr-claim.yml bc4cb7dada47cc59eed416372a4851201bd6f503 1716efd3a3cc81ba97e0ff2be0f9a0a0ebd6574c
bounded-systems/mint/.github/workflows/release-provenance.yml 0.5.0 0.8.0
actions/upload-artifact 7.0.1 7.0.2
bounded-systems/mint/.github/workflows/version.yml 0.5.0 0.8.0

Updates bounded-systems/.github/.github/workflows/_claim-sweep.yml from 14c1a9b3ade8bb6416f46c890eda21823647da09 to 1716efd3a3cc81ba97e0ff2be0f9a0a0ebd6574c

Commits
  • 1716efd ci: adopt auto-merge, so a green PR here merges without waiting for a person ...
  • 848335c CLAUDE.md: name scripts/ and its runner in the pre-push commands (#419)
  • 5e180d1 conformance: name the rulesets a row's gate-absent should be attributed to (#...
  • 6a70979 cold-hook-coverage: gate the SessionStart declarations against the cold path ...
  • bb2589a claim-ceremony: say WHICH 403 it was, so nobody re-derives the transport agai...
  • a0330ae _auto-merge: gated means a CI context is required — the claim alone is not a ...
  • 2080f24 PRs open ready, not draft: retire the draft convention (#400)
  • 8851780 conformance: the legacy armer is no longer org-managed, and no longer reporte...
  • d63837a selftest: the reference caller triggers on merge_group, and conformance measu...
  • eccc232 claim-ceremony: announce through the injecting proxy, and never send the sent...
  • Additional commits viewable in compare view

Updates actions/setup-node from 7.0.0 to 7.1.0

Release notes

Sourced from actions/setup-node's releases.

v7.1.0

What's Changed

Enhancements:

Bug fixes:

Documentation updates:

Dependency updates:

New Contributors

Full Changelog: actions/setup-node@v7.0.0...v7.1.0

Commits
  • 949feb2 Bump eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0 (#1635)
  • 7207c4f chore: update dependencies and add license files (#1642)
  • 54337e0 Bump eslint-plugin-n from 18.1.0 to 18.3.0 (#1638)
  • fb54fa8 Bump jest-each from 30.4.1 to 30.5.2 (#1636)
  • 7f84f1d Bump pnpm/action-setup from 6.0.10 to 6.1.0 (#1631)
  • 0c54c7b Bump @​typescript-eslint/parser from 8.62.0 to 8.70.0 (#1615)
  • a829419 Bump @​types/semver from 7.7.1 to 7.8.0 (#1616)
  • 680d1e4 Support absolute paths in node-version-file (#1633)
  • db0fb3a Bump baseline-browser-mapping from 2.10.38 to 2.11.22 (#1629)
  • 94196ee Bump pnpm/action-setup from 6.0.9 to 6.0.10 (#1602)
  • Additional commits viewable in compare view

Updates actions/deploy-pages from 5.0.0 to 5.0.1

Release notes

Sourced from actions/deploy-pages's releases.

v5.0.1

Changelog

See details of all code changes since previous release.

⚠️ For use with products other than GitHub.com, such as GitHub Enterprise Server, please consult the compatibility table.

Commits
  • 368f825 Merge pull request #444 from actions/yoannchaudet-deployment-polling-backoff
  • 7e97763 Validate deployment polling intervals
  • 0143e11 Add backoff and jitter to deployment polling
  • 5e98f10 Merge pull request #440 from actions/user/adwitiya
  • 8b0625a Improve deployment request test coverage
  • See full diff in compare view

Updates bounded-systems/ci-workflows/.github/workflows/osv-scan.yml from 0.1.4 to 0.1.5

Commits

Updates bounded-systems/.github/.github/actions/broker-gh-token from 183f6865b651a4b1a324029d85ec2c5bd402e690 to 1716efd3a3cc81ba97e0ff2be0f9a0a0ebd6574c

Commits
  • 1716efd ci: adopt auto-merge, so a green PR here merges without waiting for a person ...
  • 848335c CLAUDE.md: name scripts/ and its runner in the pre-push commands (#419)
  • 5e180d1 conformance: name the rulesets a row's gate-absent should be attributed to (#...
  • 6a70979 cold-hook-coverage: gate the SessionStart declarations against the cold path ...
  • bb2589a claim-ceremony: say WHICH 403 it was, so nobody re-derives the transport agai...
  • a0330ae _auto-merge: gated means a CI context is required — the claim alone is not a ...
  • 2080f24 PRs open ready, not draft: retire the draft convention (#400)
  • 8851780 conformance: the legacy armer is no longer org-managed, and no longer reporte...
  • d63837a selftest: the reference caller triggers on merge_group, and conformance measu...
  • eccc232 claim-ceremony: announce through the injecting proxy, and never send the sent...
  • Additional commits viewable in compare view

Updates bounded-systems/.github/.github/workflows/_pr-claim.yml from bc4cb7dada47cc59eed416372a4851201bd6f503 to 1716efd3a3cc81ba97e0ff2be0f9a0a0ebd6574c

Commits
  • 1716efd ci: adopt auto-merge, so a green PR here merges without waiting for a person ...
  • 848335c CLAUDE.md: name scripts/ and its runner in the pre-push commands (#419)
  • 5e180d1 conformance: name the rulesets a row's gate-absent should be attributed to (#...
  • 6a70979 cold-hook-coverage: gate the SessionStart declarations against the cold path ...
  • bb2589a claim-ceremony: say WHICH 403 it was, so nobody re-derives the transport agai...
  • a0330ae _auto-merge: gated means a CI context is required — the claim alone is not a ...
  • 2080f24 PRs open ready, not draft: retire the draft convention (#400)
  • 8851780 conformance: the legacy armer is no longer org-managed, and no longer reporte...
  • d63837a selftest: the reference caller triggers on merge_group, and conformance measu...
  • eccc232 claim-ceremony: announce through the injecting proxy, and never send the sent...
  • Additional commits viewable in compare view

Updates bounded-systems/mint/.github/workflows/release-provenance.yml from 0.5.0 to 0.8.0

Release notes

Sourced from bounded-systems/mint/.github/workflows/release-provenance.yml's releases.

v0.8.0

0.8.0 — 2026-08-23

Minor

  • npm-publish.yml — a reusable npm publish lane, and one prescribed release entry point per repo (npm validates the CALLING workflow)

v0.7.2

0.7.2 — 2026-08-22

Patch

  • mint release no longer dies with Command failed: git config --get commit.gpgsign on a machine that has not opted into commit signing — an unset key is the default, not an error. And the release tag is annotated with --cleanup=verbatim, so the changelog entry's ## <version> and ### <bump> headings survive into the tag and the GitHub release notes; git's default strips every line beginning with #, which silently reduced the annotation to bullets on every tag mint has ever cut and merged a multi-section entry's Minor and Patch changes into one undifferentiated list.

v0.7.1

  • release-cut.yml writes the changelog entry as the tag annotation instead of the tag name, so a CI-cut release gets the same GitHub release notes a laptop cut does. Both release workflows publish with --notes-from-tag, so the annotation is the notes; the text is read out of the release Statement the cut already derives, making it byte-identical to the entry that Statement attests.

v0.7.0

Changelog

Sourced from bounded-systems/mint/.github/workflows/release-provenance.yml's changelog.

0.8.0 — 2026-08-23

Minor

  • npm-publish.yml — a reusable npm publish lane, and one prescribed release entry point per repo (npm validates the CALLING workflow)

0.7.2 — 2026-08-22

Patch

  • mint release no longer dies with Command failed: git config --get commit.gpgsign on a machine that has not opted into commit signing — an unset key is the default, not an error. And the release tag is annotated with --cleanup=verbatim, so the changelog entry's ## <version> and ### <bump> headings survive into the tag and the GitHub release notes; git's default strips every line beginning with #, which silently reduced the annotation to bullets on every tag mint has ever cut and merged a multi-section entry's Minor and Patch changes into one undifferentiated list.

0.7.1 — 2026-08-22

Patch

  • release-cut.yml writes the changelog entry as the tag annotation instead of the tag name, so a CI-cut release gets the same GitHub release notes a laptop cut does. Both release workflows publish with --notes-from-tag, so the annotation is the notes; the text is read out of the release Statement the cut already derives, making it byte-identical to the entry that Statement attests.

0.7.0 — 2026-08-22

Minor

  • Relicensed to MIT (org license tiering, #34). The manifests changed in the 0.6.0 bump, but 0.6.0 was manifest-only and was never tagged or published — 0.7.0 is the first release that actually ships under MIT. Everything up to and including 0.5.0 remains under PolyForm-Noncommercial-1.0.0.
  • release-provenance.yml takes a tag input, so it can be chained after release-cut.yml. It defaults to the triggering ref, leaving the on: push: tags path every consumer uses today byte-identical; a chained caller passes the cut tag rather than getting the branch.
  • mint adopts its own release-cut: a new cut workflow dispatches the tag cut in CI and chains release.yml as a dependent job, so a release no longer needs a laptop. release.yml gains a workflow_call trigger and a tag input; its push: tags trigger is unchanged, so a locally-cut release still works.
  • release-provenance: create the GitHub release as a draft and publish it only once assets are attached, so a separate binaries job can no longer hit 422: Cannot upload assets to an immutable release; adds assets-artifact (attach a caller artifact from the same run) and finalize inputs
Commits
  • 37d3bb7 release.yml: a recovery door, which mint of all repos needs (#51)
  • 1e2b2f9 Version 0.8.0 (#50)
  • 66e3b42 npm-publish.yml: own the npm lane, and prescribe one release entry point (#49)
  • 44d61e1 Version 0.7.2 (#47)
  • 12edc64 Annotate the tag with --cleanup=verbatim, and stop dying on an unset commit.g...
  • 854c9f8 Version 0.7.1 (#44)
  • 9d062b1 Write the changelog as the tag annotation, not the tag name (#43)
  • 01951d9 Version 0.7.0 (#40)
  • eca6eb0 Adopt release-cut on mint itself (#41)
  • 37c4824 Give release-provenance a tag input, so it composes with release-cut (#38)
  • Additional commits viewable in compare view

Updates actions/upload-artifact from 7.0.1 to 7.0.2

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.2

What's Changed

  • Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
  • Updates @​actions/artifact to v6.3.1.

New Contributors

Full Changelog: actions/upload-artifact@v7.0.1...v7.0.2

Commits
  • cf430e0 Merge pull request #822 from actions/tunc-d-prepare-upload-v7-0-2
  • c2acded chore: prepare v7.0.2 release
  • 4687c1b Merge pull request #821 from actions/tunc-d-upload-artifact-package-bump
  • 8cbe1be Bump @​actions/artifact to 6.3.1
  • See full diff in compare view

Updates bounded-systems/mint/.github/workflows/version.yml from 0.5.0 to 0.8.0

Release notes

Sourced from bounded-systems/mint/.github/workflows/version.yml's releases.

v0.8.0

0.8.0 — 2026-08-23

Minor

  • npm-publish.yml — a reusable npm publish lane, and one prescribed release entry point per repo (npm validates the CALLING workflow)

v0.7.2

0.7.2 — 2026-08-22

Patch

  • mint release no longer dies with Command failed: git config --get commit.gpgsign on a machine that has not opted into commit signing — an unset key is the default, not an error. And the release tag is annotated with --cleanup=verbatim, so the changelog entry's ## <version> and ### <bump> headings survive into the tag and the GitHub release notes; git's default strips every line beginning with #, which silently reduced the annotation to bullets on every tag mint has ever cut and merged a multi-section entry's Minor and Patch changes into one undifferentiated list.

v0.7.1

  • release-cut.yml writes the changelog entry as the tag annotation instead of the tag name, so a CI-cut release gets the same GitHub release notes a laptop cut does. Both release workflows publish with --notes-from-tag, so the annotation is the notes; the text is read out of the release Statement the cut already derives, making it byte-identical to the entry that Statement attests.

v0.7.0

Changelog

Sourced from bounded-systems/mint/.github/workflows/version.yml's changelog.

0.8.0 — 2026-08-23

Minor

  • npm-publish.yml — a reusable npm publish lane, and one prescribed release entry point per repo (npm validates the CALLING workflow)

0.7.2 — 2026-08-22

Patch

  • mint release no longer dies with Command failed: git config --get commit.gpgsign on a machine that has not opted into commit signing — an unset key is the default, not an error. And the release tag is annotated with --cleanup=verbatim, so the changelog entry's ## <version> and ### <bump> headings survive into the tag and the GitHub release notes; git's default strips every line beginning with #, which silently reduced the annotation to bullets on every tag mint has ever cut and merged a multi-section entry's Minor and Patch changes into one undifferentiated list.

0.7.1 — 2026-08-22

Patch

  • release-cut.yml writes the changelog entry as the tag annotation instead of the tag name, so a CI-cut release gets the same GitHub release notes a laptop cut does. Both release workflows publish with --notes-from-tag, so the annotation is the notes; the text is read out of the release Statement the cut already derives, making it byte-identical to the entry that Statement attests.

0.7.0 — 2026-08-22

Minor

  • Relicensed to MIT (org license tiering, #34). The manifests changed in the 0.6.0 bump, but 0.6.0 was manifest-only and was never tagged or published — 0.7.0 is the first release that actually ships under MIT. Everything up to and including 0.5.0 remains under PolyForm-Noncommercial-1.0.0.
  • release-provenance.yml takes a tag input, so it can be chained after release-cut.yml. It defaults to the triggering ref, leaving the on: push: tags path every consumer uses today byte-identical; a chained caller passes the cut tag rather than getting the branch.
  • mint adopts its own release-cut: a new cut workflow dispatches the tag cut in CI and chains release.yml as a dependent job, so a release no longer needs a laptop. release.yml gains a workflow_call trigger and a tag input; its push: tags trigger is unchanged, so a locally-cut release still works.
  • release-provenance: create the GitHub release as a draft and publish it only once assets are attached, so a separate binaries job can no longer hit 422: Cannot upload assets to an immutable release; adds assets-artifact (attach a caller artifact from the same run) and finalize inputs
Commits
  • 37d3bb7 release.yml: a recovery door, which mint of all repos needs (#51)
  • 1e2b2f9 Version 0.8.0 (#50)
  • 66e3b42 npm-publish.yml: own the npm lane, and prescribe one release entry point (#49)
  • 44d61e1 Version 0.7.2 (#47)
  • 12edc64 Annotate the tag with --cleanup=verbatim, and stop dying on an unset commit.g...
  • 854c9f8 Version 0.7.1 (#44)
  • 9d062b1 Write the changelog as the tag annotation, not the tag name (#43)
  • 01951d9 Version 0.7.0 (#40)
  • eca6eb0 Adopt release-cut on mint itself (#41)
  • 37c4824 Give release-provenance a tag input, so it composes with release-cut (#38)
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 14, 2026
@dependabot
ci: bump the actions group across 1 directory with 9 updates
cb05a8e 
Bumps the actions group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [bounded-systems/.github/.github/workflows/_claim-sweep.yml](https://github.com/bounded-systems/.github) | `14c1a9b3ade8bb6416f46c890eda21823647da09` | `1716efd3a3cc81ba97e0ff2be0f9a0a0ebd6574c` |
| [actions/setup-node](https://github.com/actions/setup-node) | `7.0.0` | `7.1.0` |
| [actions/deploy-pages](https://github.com/actions/deploy-pages) | `5.0.0` | `5.0.1` |
| [bounded-systems/ci-workflows/.github/workflows/osv-scan.yml](https://github.com/bounded-systems/ci-workflows) | `0.1.4` | `0.1.5` |
| [bounded-systems/.github/.github/actions/broker-gh-token](https://github.com/bounded-systems/.github) | `183f6865b651a4b1a324029d85ec2c5bd402e690` | `1716efd3a3cc81ba97e0ff2be0f9a0a0ebd6574c` |
| [bounded-systems/.github/.github/workflows/_pr-claim.yml](https://github.com/bounded-systems/.github) | `bc4cb7dada47cc59eed416372a4851201bd6f503` | `1716efd3a3cc81ba97e0ff2be0f9a0a0ebd6574c` |
| [bounded-systems/mint/.github/workflows/release-provenance.yml](https://github.com/bounded-systems/mint) | `0.5.0` | `0.8.0` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.1` | `7.0.2` |
| [bounded-systems/mint/.github/workflows/version.yml](https://github.com/bounded-systems/mint) | `0.5.0` | `0.8.0` |



Updates `bounded-systems/.github/.github/workflows/_claim-sweep.yml` from 14c1a9b3ade8bb6416f46c890eda21823647da09 to 1716efd3a3cc81ba97e0ff2be0f9a0a0ebd6574c
- [Release notes](https://github.com/bounded-systems/.github/releases)
- [Commits](bounded-systems/.github@14c1a9b...1716efd)

Updates `actions/setup-node` from 7.0.0 to 7.1.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@8207627...949feb2)

Updates `actions/deploy-pages` from 5.0.0 to 5.0.1
- [Release notes](https://github.com/actions/deploy-pages/releases)
- [Commits](actions/deploy-pages@cd2ce8f...368f825)

Updates `bounded-systems/ci-workflows/.github/workflows/osv-scan.yml` from 0.1.4 to 0.1.5
- [Commits](bounded-systems/ci-workflows@30978ba...fb7ca62)

Updates `bounded-systems/.github/.github/actions/broker-gh-token` from 183f6865b651a4b1a324029d85ec2c5bd402e690 to 1716efd3a3cc81ba97e0ff2be0f9a0a0ebd6574c
- [Release notes](https://github.com/bounded-systems/.github/releases)
- [Commits](bounded-systems/.github@183f686...1716efd)

Updates `bounded-systems/.github/.github/workflows/_pr-claim.yml` from bc4cb7dada47cc59eed416372a4851201bd6f503 to 1716efd3a3cc81ba97e0ff2be0f9a0a0ebd6574c
- [Release notes](https://github.com/bounded-systems/.github/releases)
- [Commits](bounded-systems/.github@bc4cb7d...1716efd)

Updates `bounded-systems/mint/.github/workflows/release-provenance.yml` from 0.5.0 to 0.8.0
- [Release notes](https://github.com/bounded-systems/mint/releases)
- [Changelog](https://github.com/bounded-systems/mint/blob/main/CHANGELOG.md)
- [Commits](bounded-systems/mint@v0.5.0...v0.8.0)

Updates `actions/upload-artifact` from 7.0.1 to 7.0.2
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@043fb46...cf430e0)

Updates `bounded-systems/mint/.github/workflows/version.yml` from 0.5.0 to 0.8.0
- [Release notes](https://github.com/bounded-systems/mint/releases)
- [Changelog](https://github.com/bounded-systems/mint/blob/main/CHANGELOG.md)
- [Commits](bounded-systems/mint@v0.5.0...v0.8.0)

---
updated-dependencies:
- dependency-name: actions/deploy-pages
  dependency-version: 5.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: actions/setup-node
  dependency-version: 7.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: bounded-systems/.github/.github/actions/broker-gh-token
  dependency-version: 1716efd3a3cc81ba97e0ff2be0f9a0a0ebd6574c
  dependency-type: direct:production
  dependency-group: actions
- dependency-name: bounded-systems/.github/.github/workflows/_claim-sweep.yml
  dependency-version: 1716efd3a3cc81ba97e0ff2be0f9a0a0ebd6574c
  dependency-type: direct:production
  dependency-group: actions
- dependency-name: bounded-systems/.github/.github/workflows/_pr-claim.yml
  dependency-version: 1716efd3a3cc81ba97e0ff2be0f9a0a0ebd6574c
  dependency-type: direct:production
  dependency-group: actions
- dependency-name: bounded-systems/ci-workflows/.github/workflows/osv-scan.yml
  dependency-version: 0.1.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: bounded-systems/mint/.github/workflows/release-provenance.yml
  dependency-version: 0.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: bounded-systems/mint/.github/workflows/version.yml
  dependency-version: 0.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/actions-f649f2f94f branch from e71550b to cb05a8e Compare November 2, 2026 20:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

Front Desk
Status: Todo

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants