From 7c1fe7dd03582833826fa3a1bd9d3adb2c61f918 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 14 Oct 2026 01:23:30 +0000 Subject: [PATCH] ci: bump the actions group across 1 directory with 7 updates Bumps the actions group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [bounded-systems/.github/.github/workflows/_auto-merge.yml](https://github.com/bounded-systems/.github) | `a0330aea1a9fc899ff1002bf52d20ef8d9b2edad` | `1716efd3a3cc81ba97e0ff2be0f9a0a0ebd6574c` | | [bounded-systems/.github/.github/workflows/_claim-sweep.yml](https://github.com/bounded-systems/.github) | `14c1a9b3ade8bb6416f46c890eda21823647da09` | `1716efd3a3cc81ba97e0ff2be0f9a0a0ebd6574c` | | [bounded-systems/ci-workflows/.github/workflows/osv-scan.yml](https://github.com/bounded-systems/ci-workflows) | `0.1.4` | `0.1.5` | | [bounded-systems/.github/.github/actions/broker-gh-token](https://github.com/bounded-systems/.github) | `99e88a0335519cb78be8a1b6623105613fa6aca1` | `1716efd3a3cc81ba97e0ff2be0f9a0a0ebd6574c` | | [actions/setup-node](https://github.com/actions/setup-node) | `7.0.0` | `7.1.0` | | [bounded-systems/.github/.github/workflows/_pr-claim.yml](https://github.com/bounded-systems/.github) | `bc4cb7dada47cc59eed416372a4851201bd6f503` | `1716efd3a3cc81ba97e0ff2be0f9a0a0ebd6574c` | | [bounded-systems/.github/.github/workflows/repo-standard.yml](https://github.com/bounded-systems/.github) | `99e88a0335519cb78be8a1b6623105613fa6aca1` | `1716efd3a3cc81ba97e0ff2be0f9a0a0ebd6574c` | Updates `bounded-systems/.github/.github/workflows/_auto-merge.yml` from a0330aea1a9fc899ff1002bf52d20ef8d9b2edad to 1716efd3a3cc81ba97e0ff2be0f9a0a0ebd6574c - [Release notes](https://github.com/bounded-systems/.github/releases) - [Commits](https://github.com/bounded-systems/.github/compare/a0330aea1a9fc899ff1002bf52d20ef8d9b2edad...1716efd3a3cc81ba97e0ff2be0f9a0a0ebd6574c) Updates `bounded-systems/.github/.github/workflows/_claim-sweep.yml` from 14c1a9b3ade8bb6416f46c890eda21823647da09 to 1716efd3a3cc81ba97e0ff2be0f9a0a0ebd6574c - [Release notes](https://github.com/bounded-systems/.github/releases) - [Commits](https://github.com/bounded-systems/.github/compare/14c1a9b3ade8bb6416f46c890eda21823647da09...1716efd3a3cc81ba97e0ff2be0f9a0a0ebd6574c) Updates `bounded-systems/ci-workflows/.github/workflows/osv-scan.yml` from 0.1.4 to 0.1.5 - [Commits](https://github.com/bounded-systems/ci-workflows/compare/30978ba6776c30081379e23fa20a12f36db3a48c...fb7ca62fd9fb8af90af1097a0b21ee703c103dc4) Updates `bounded-systems/.github/.github/actions/broker-gh-token` from 99e88a0335519cb78be8a1b6623105613fa6aca1 to 1716efd3a3cc81ba97e0ff2be0f9a0a0ebd6574c - [Release notes](https://github.com/bounded-systems/.github/releases) - [Commits](https://github.com/bounded-systems/.github/compare/99e88a0335519cb78be8a1b6623105613fa6aca1...1716efd3a3cc81ba97e0ff2be0f9a0a0ebd6574c) Updates `actions/setup-node` from 7.0.0 to 7.1.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/820762786026740c76f36085b0efc47a31fe5020...949feb2413d6458794dcd2491c4babbbce0c15c1) Updates `bounded-systems/.github/.github/workflows/_pr-claim.yml` from bc4cb7dada47cc59eed416372a4851201bd6f503 to 1716efd3a3cc81ba97e0ff2be0f9a0a0ebd6574c - [Release notes](https://github.com/bounded-systems/.github/releases) - [Commits](https://github.com/bounded-systems/.github/compare/bc4cb7dada47cc59eed416372a4851201bd6f503...1716efd3a3cc81ba97e0ff2be0f9a0a0ebd6574c) Updates `bounded-systems/.github/.github/workflows/repo-standard.yml` from 99e88a0335519cb78be8a1b6623105613fa6aca1 to 1716efd3a3cc81ba97e0ff2be0f9a0a0ebd6574c - [Release notes](https://github.com/bounded-systems/.github/releases) - [Commits](https://github.com/bounded-systems/.github/compare/99e88a0335519cb78be8a1b6623105613fa6aca1...1716efd3a3cc81ba97e0ff2be0f9a0a0ebd6574c) --- updated-dependencies: - dependency-name: bounded-systems/.github/.github/workflows/_auto-merge.yml dependency-version: 1716efd3a3cc81ba97e0ff2be0f9a0a0ebd6574c dependency-type: direct:production dependency-group: actions - dependency-name: bounded-systems/.github/.github/workflows/_claim-sweep.yml dependency-version: 1716efd3a3cc81ba97e0ff2be0f9a0a0ebd6574c dependency-type: direct:production dependency-group: actions - dependency-name: bounded-systems/ci-workflows/.github/workflows/osv-scan.yml dependency-version: 0.1.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: bounded-systems/.github/.github/actions/broker-gh-token dependency-version: 1716efd3a3cc81ba97e0ff2be0f9a0a0ebd6574c dependency-type: direct:production dependency-group: actions - dependency-name: actions/setup-node dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: bounded-systems/.github/.github/workflows/_pr-claim.yml dependency-version: 1716efd3a3cc81ba97e0ff2be0f9a0a0ebd6574c dependency-type: direct:production dependency-group: actions - dependency-name: bounded-systems/.github/.github/workflows/repo-standard.yml dependency-version: 1716efd3a3cc81ba97e0ff2be0f9a0a0ebd6574c dependency-type: direct:production dependency-group: actions ... Signed-off-by: dependabot[bot] --- .github/workflows/auto-merge.yml | 2 +- .github/workflows/claim-sweep.yml | 2 +- .github/workflows/deps.yml | 2 +- .github/workflows/front-desk-add.yml | 2 +- .github/workflows/npm-publish.yml | 2 +- .github/workflows/pr-claim.yml | 2 +- .github/workflows/release-cut.yml | 2 +- .github/workflows/release-provenance.yml | 2 +- .github/workflows/release.yml | 4 ++-- .github/workflows/standard.yml | 2 +- .github/workflows/version.yml | 2 +- 11 files changed, 12 insertions(+), 12 deletions(-) diff --git a/.github/workflows/auto-merge.yml b/.github/workflows/auto-merge.yml index 104d819..b17b783 100644 --- a/.github/workflows/auto-merge.yml +++ b/.github/workflows/auto-merge.yml @@ -57,4 +57,4 @@ jobs: contents: read id-token: write # SHA-pinned, per org policy — never a branch. The broker door pins this SHA too. - uses: bounded-systems/.github/.github/workflows/_auto-merge.yml@a0330aea1a9fc899ff1002bf52d20ef8d9b2edad + uses: bounded-systems/.github/.github/workflows/_auto-merge.yml@1716efd3a3cc81ba97e0ff2be0f9a0a0ebd6574c diff --git a/.github/workflows/claim-sweep.yml b/.github/workflows/claim-sweep.yml index 318a448..d5a73e8 100644 --- a/.github/workflows/claim-sweep.yml +++ b/.github/workflows/claim-sweep.yml @@ -69,7 +69,7 @@ concurrency: jobs: sweep: # SHA-pinned, per org policy — never a branch. - uses: bounded-systems/.github/.github/workflows/_claim-sweep.yml@14c1a9b3ade8bb6416f46c890eda21823647da09 + uses: bounded-systems/.github/.github/workflows/_claim-sweep.yml@1716efd3a3cc81ba97e0ff2be0f9a0a0ebd6574c permissions: contents: read issues: write diff --git a/.github/workflows/deps.yml b/.github/workflows/deps.yml index b34ad0a..69eecb0 100644 --- a/.github/workflows/deps.yml +++ b/.github/workflows/deps.yml @@ -43,4 +43,4 @@ jobs: osv: # SHA-pinned per org policy. `# main` records what the SHA was at the time, so a # reviewer can tell an intentional bump from a drifted one. - uses: bounded-systems/ci-workflows/.github/workflows/osv-scan.yml@30978ba6776c30081379e23fa20a12f36db3a48c # main + uses: bounded-systems/ci-workflows/.github/workflows/osv-scan.yml@fb7ca62fd9fb8af90af1097a0b21ee703c103dc4 # main diff --git a/.github/workflows/front-desk-add.yml b/.github/workflows/front-desk-add.yml index 4934806..a483bda 100644 --- a/.github/workflows/front-desk-add.yml +++ b/.github/workflows/front-desk-add.yml @@ -59,7 +59,7 @@ jobs: id: app-token if: ${{ vars.CF_BROKER_URL != '' }} continue-on-error: true - uses: bounded-systems/.github/.github/actions/broker-gh-token@99e88a0335519cb78be8a1b6623105613fa6aca1 # broker-gh-token (prx-26bq), .github#109 + uses: bounded-systems/.github/.github/actions/broker-gh-token@1716efd3a3cc81ba97e0ff2be0f9a0a0ebd6574c # broker-gh-token (prx-26bq), .github#109 with: app: front-desk broker-url: ${{ vars.CF_BROKER_URL }} diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml index 8d3e72b..3efd35a 100644 --- a/.github/workflows/npm-publish.yml +++ b/.github/workflows/npm-publish.yml @@ -136,7 +136,7 @@ jobs: ref: ${{ inputs.tag || github.ref_name }} - name: Setup Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: ${{ inputs.node-version }} registry-url: "https://registry.npmjs.org" diff --git a/.github/workflows/pr-claim.yml b/.github/workflows/pr-claim.yml index 871c69f..cebf7e0 100644 --- a/.github/workflows/pr-claim.yml +++ b/.github/workflows/pr-claim.yml @@ -81,4 +81,4 @@ jobs: issues: read pull-requests: read # SHA-pinned, per org policy — never a branch. - uses: bounded-systems/.github/.github/workflows/_pr-claim.yml@bc4cb7dada47cc59eed416372a4851201bd6f503 + uses: bounded-systems/.github/.github/workflows/_pr-claim.yml@1716efd3a3cc81ba97e0ff2be0f9a0a0ebd6574c diff --git a/.github/workflows/release-cut.yml b/.github/workflows/release-cut.yml index 006868e..eb8176e 100644 --- a/.github/workflows/release-cut.yml +++ b/.github/workflows/release-cut.yml @@ -213,7 +213,7 @@ jobs: ref: ${{ inputs.ref }} path: .mint - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: ${{ inputs.node-version }} diff --git a/.github/workflows/release-provenance.yml b/.github/workflows/release-provenance.yml index 7e716bf..b9f32b2 100644 --- a/.github/workflows/release-provenance.yml +++ b/.github/workflows/release-provenance.yml @@ -123,7 +123,7 @@ jobs: repository: bounded-systems/mint ref: ${{ inputs.ref }} path: .mint - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: ${{ inputs.node-version }} - name: Install mint deps diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 0100bd7..8882c16 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -144,7 +144,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5 with: ref: ${{ needs.resolve.outputs.tag }} - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: "22" - run: npm ci --no-audit --no-fund @@ -220,7 +220,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5 with: ref: ${{ needs.resolve.outputs.tag }} - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: "24" package-manager-cache: false diff --git a/.github/workflows/standard.yml b/.github/workflows/standard.yml index 67b0c3d..be258a6 100644 --- a/.github/workflows/standard.yml +++ b/.github/workflows/standard.yml @@ -7,7 +7,7 @@ permissions: contents: read jobs: standard: - uses: bounded-systems/.github/.github/workflows/repo-standard.yml@99e88a0335519cb78be8a1b6623105613fa6aca1 + uses: bounded-systems/.github/.github/workflows/repo-standard.yml@1716efd3a3cc81ba97e0ff2be0f9a0a0ebd6574c with: security: true test: true diff --git a/.github/workflows/version.yml b/.github/workflows/version.yml index 00b4da2..5c0bc5e 100644 --- a/.github/workflows/version.yml +++ b/.github/workflows/version.yml @@ -38,7 +38,7 @@ jobs: repository: bounded-systems/mint ref: ${{ inputs.ref }} path: .mint - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: "22" - name: Install mint deps