chore(deps): update nsheaps + squink github actions

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
nsheaps/agents (changelog)	action	digest	9384e01 → e430440
nsheaps/ai-mktpl (changelog)	action	digest	63e26f5 → 8bcd014
nsheaps/github-actions (changelog)	action	digest	c1794f6 → 1e12939

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • "after 10am and before 4pm every weekday"

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

Dismissed: new commits since last approval require re-review.

[henry-nsheaps]

👍 Clean SHA-pin refresh — independently re-verified from first principles, ready to merge

✅ Net change vs main is 7 lines / 6 files, all SHA pins — the LICENSE.md hunks are a merge-base artifact and merge to zero (details)
✅ Every callee interface re-checked against the new SHA — inputs, secrets, and job permissions all still line up
✅ nsheaps/agents bump spans 60 commits but review-dispatch.yaml is byte-identical at both SHAs (details)
✅ nsheaps/ai-mktpl self-pin targets a non-executing example file; action interface unchanged (details)
⚠️ Pre-existing (not caused here): checkout-as-app is now consumed at two different SHAs; root cause diagnosed (details)

🖱️ Click to expand for full details

What this PR actually changes

The GitHub diff view shows 7 files including LICENSE.md, which makes this look larger than it is. The merge-base (1f41088) predates main's follow-up lint commit (8bcd014), and both branches produced byte-identical prettier output. Measured against main directly:

$ git diff --stat origin/main bc1af2a
 .github/actions/claude-debug/claude-debug-example.yml | 2 +-
 .github/workflows/apply-repo-settings.yaml            | 4 ++--
 .github/workflows/dispatch-review.yaml                | 2 +-
 .github/workflows/pr-status-dispatch.yaml             | 2 +-
 .github/workflows/sync-main-to-edge.yaml              | 2 +-
 .github/workflows/sync-plugin-specs.yaml              | 2 +-
 6 files changed, 7 insertions(+), 7 deletions(-)

$ git diff --quiet origin/main bc1af2a -- LICENSE.md && echo IDENTICAL
IDENTICAL

Seven SHA-pin lines. Nothing else.

Upstream compatibility — verified per bump

nsheaps/github-actions c1794f6 → 1e12939 (5 refs across 4 files)

ahead_by: 1. The single commit is Fix sync-plugin-specs workflow self-triggering with no plugins/ (#120), and it changes exactly one file: .github/workflows/sync-plugin-specs.yaml (0 added / 12 deleted). It strips the callee's own push: / schedule: / workflow_dispatch: triggers, which were causing the workflow to self-fire in a repo that has no plugins/ directory.

• checkout-as-app, apply-repo-settings, github-app-auth, sync-main-to-edge — content-identical at both SHAs, so those four refs are pure no-op refreshes.
• sync-plugin-specs — the callee still declares plugins-dir and commit-message, both optional, and still grants contents: write at the job level. This repo's caller passes plugins-dir: plugins, grants contents: write, and keeps its own push/schedule/workflow_dispatch block, so spec sync here keeps firing exactly as before. The removed triggers were callee-side only. Analysis carried in discussion_r3798538592.

nsheaps/agents 9384e01 → e430440 (1 ref)

ahead_by: 60, 28 files touched — but .github/workflows/review-dispatch.yaml is not one of them. The consumed workflow is byte-identical; only its spec doc moved. Interface re-read at the new SHA and matched line-by-line against the caller. Full table in discussion_r3798581520.

nsheaps/ai-mktpl 63e26f5 → 8bcd014 (1 ref, self-referential)

Targets .github/actions/claude-debug/claude-debug-example.yml — outside .github/workflows/, so it is documentation and never executes. action.yml is absent from the compare's changed-file list, and 8bcd014 is the live main HEAD. See discussion_r3798582216.

Security

All three sources are first-party nsheaps/* repositories, and every ref is a full 40-character commit SHA with the trailing # main marker the repo convention (and Renovate) expects. The nsheaps/agents callee pins its own transitive dependencies by SHA, so that chain is immutable end to end.

The 5% deduction is for one thing only: the sync-plugin-specs reusable workflow internally calls nsheaps/github-actions/.github/actions/sync-plugin-specs@main and actions/checkout@v4, so pinning the wrapper here does not freeze what it delegates to. That is an upstream property, not something this PR can fix.

Repo conventions

• No plugins/** changes, so no version bump is required per .claude/rules/versioning.md.
• marketplace.json untouched — correct, it is CD-generated.
• No [skip ci] in either commit.
• The title mentions "squink" but no squink action changed; that is just Renovate's group name and the body's dependency table is accurate. Cosmetic.

Scoring rationale

Category	Score	Why
Code quality	100%	Seven mechanical digest bumps, correct format, correct markers, nothing extraneous.
Security	95%	First-party sources, full-SHA pins throughout; −5 because the sync-plugin-specs pin is not transitively immutable upstream.
Simplicity	100%	Cannot be made simpler — it is the minimal diff for the stated intent.
Confidence	97%	Every claim above is backed by an API compare or a local git command. −3 for what I cannot observe: runtime behavior of the upstream workflows under this repo's secrets.

Recommended follow-ups (non-blocking, do not belong in this Renovate branch):

• Unify the checkout-as-app pins. Six workflows sit at 6030528 while apply-repo-settings.yaml is now at 1e12939. The likely cause is the trailing comment: the six carry # checkout-as-app@main, which is not a resolvable ref, so Renovate leaves them frozen. Normalizing them to # main should fold them into the same update stream — diagnosis and grep output.
• Refresh the stale comment in dispatch-review.yaml. Lines 72–75 still describe the ref as @main = rolling updates, but it has been SHA-pinned and Renovate-managed for some time.
• Upstream: SHA-pin the transitive sync-plugin-specs@main and actions/checkout@v4 inside nsheaps/github-actions's reusable workflow, so consumers' pins become immutable end to end.

To sharpen future reviews on this repo I would benefit from actionlint / zizmor being runnable in the review environment, so I can validate workflow syntax and pinning policy mechanically rather than by inspection.

Notes:¹²³⁴

Footnotes

1. Workflow Run: https://github.com/nsheaps/ai-mktpl/actions/runs/32065170058/attempts/1 ↩

2. PR: nsheaps/ai-mktpl#763 ↩

3. Upstream change under the nsheaps/github-actions bump: nsheaps/github-actions#120 ↩

4. Security hardening for GitHub Actions — Using third-party actions (GitHub Docs, on pinning actions to a full-length commit SHA) ↩

[henry-nsheaps]

✅ Verified — this bump spans 60 upstream commits but is a functional no-op for this caller.

nsheaps/agents 9384e01...e430440 touches 28 files, and .github/workflows/review-dispatch.yaml is not among them — the reusable workflow this line consumes is byte-identical at both SHAs. The only file matching review-dispatch in the compare is the spec doc (plugins/claude-code/review-utils/specs/review-dispatch.md).

Interface check against the callee at e430440:

Callee declares	Caller supplies
inputs.target-repo (optional, default nsheaps/.ai-agent-henry)	not set — default applies
secrets.AUTOMATION_GITHUB_APP_ID (required)	✅ passed explicitly
secrets.AUTOMATION_GITHUB_APP_PRIVATE_KEY (required)	✅ passed explicitly
job permissions: contents: read, pull-requests: write, checks: write	✅ identical grant at the caller job level

The callee's own uses: are all SHA-pinned (actions/create-github-app-token v3, LouisBrunner/checks-action v3.1.0, peter-evans/repository-dispatch v4), so this pin is transitively immutable — unlike the sync-plugin-specs one, see #763 (comment).

Note on the @main comment block above this line

The comment on lines 72–75 says @main = rolling updates, but the ref has been SHA-pinned for a while now and Renovate refreshes it. The trailing # main marker preserves Renovate's ability to track the branch, so the mechanism is intact — the prose is just stale. Not introduced by this PR and not worth blocking on; noted as a follow-up in the review summary.

[henry-nsheaps]

✅ Verified — self-referential pin, zero runtime risk.

Two things make this safe:

1. This file never executes. It lives at .github/actions/claude-debug/claude-debug-example.yml, not under .github/workflows/, so GitHub never picks it up as a workflow — it is documentation showing consumers how to wire the action up.
2. The action it points at is unchanged. .github/actions/claude-debug/action.yml is not in the 63e26f5...8bcd014 changed-file list, so the pinned interface is identical to the old one.

8bcd014 is also the current main HEAD of this repo, so the pin resolves to a real, reachable commit rather than a dangling ref.

[henry-nsheaps]

ℹ️ Heads-up for anyone reading the diff view: these LICENSE.md hunks are a merge-base artifact and have no net effect.

The PR's merge-base is 1f41088 ("Revise license terms for broader applicability" #764), which landed before main's follow-up 8bcd014 (chore: mise run lint). Both this branch's lint commit and main's lint commit produced byte-identical prettier output, so:

$ git diff --quiet origin/main bc1af2a -- LICENSE.md && echo IDENTICAL
IDENTICAL

The true net change of this PR against main is exactly 7 lines across 6 files, all SHA pins:

$ git diff --stat origin/main bc1af2a
 .github/actions/claude-debug/claude-debug-example.yml | 2 +-
 .github/workflows/apply-repo-settings.yaml            | 4 ++--
 .github/workflows/dispatch-review.yaml                | 2 +-
 .github/workflows/pr-status-dispatch.yaml             | 2 +-
 .github/workflows/sync-main-to-edge.yaml              | 2 +-
 .github/workflows/sync-plugin-specs.yaml              | 2 +-
 6 files changed, 7 insertions(+), 7 deletions(-)

For the record, the reformatting itself is semantically inert even in isolation: ***x*** → _**x**_ renders identically (bold + italic) in CommonMark, and collapsing the double space after a sentence period does not change rendered output. No license text was altered. Nothing to do here.

[henry-nsheaps]

✅ No-op refresh (c1794f6...1e12939 changed exactly one file, .github/workflows/sync-plugin-specs.yaml, so checkout-as-app and apply-repo-settings are byte-identical at both SHAs).

⚠️ Non-blocking, pre-existing, and not caused by this PR — but this line is the clearest place to record it: the repo now consumes checkout-as-app at two different SHAs, and this bump widens the gap.

$ git grep -nE 'checkout-as-app@' -- '.github/**'
.github/workflows/apply-repo-settings.yaml:56:   ...@1e129396... # main
.github/workflows/cd.yaml:143:                  ...@60305284... # checkout-as-app@main
.github/workflows/ci.yaml:32:                   ...@60305284... # checkout-as-app@main
.github/workflows/claude-agent-trigger.yaml:51: ...@60305284... # checkout-as-app@main
.github/workflows/claude-agent.yaml:22:         ...@60305284... # checkout-as-app@main
.github/workflows/claude-code-review.yaml:58:   ...@60305284... # checkout-as-app@main
.github/workflows/daily-report.yaml:43:         ...@60305284... # checkout-as-app@main

The likely root cause is the trailing comment. Renovate reads # <ref> to know which branch/tag a digest pin tracks. This line carries # main and gets refreshed; the other six carry # checkout-as-app@main, which is not a valid ref name in nsheaps/github-actions, so Renovate can't resolve it and those six stay frozen at 6030528.

The fix is a one-character-class change on each of the six — normalizing them to # main so they join this line's update stream:

uses: nsheaps/github-actions/.github/actions/checkout-as-app@603052841cd49b9fdc99bc32979ff9c45c9b669e # main

Deliberately not suggesting it inline here: those six lines are outside this PR's diff, and dragging unrelated workflow files into a Renovate branch would make the automerge riskier than the drift it fixes. Raised as a follow-up in the review summary instead.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.