Skip to content

chore(deps): update github actions - #90

Open
bootc-bot[bot] wants to merge 1 commit into
mainfrom
bootc-renovate/github-actions
Open

chore(deps): update github actions#90
bootc-bot[bot] wants to merge 1 commit into
mainfrom
bootc-renovate/github-actions

Conversation

@bootc-bot

@bootc-bot bootc-bot Bot commented Sep 6, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change
actions/create-github-app-token action minor v3.2.0 → v3.3.0
github/gh-aw uses-with major v0.88.2 → v1.0.1
peter-evans/create-pull-request action major v7 → v8
ubuntu github-runner major 24.04 → 26.04

Release Notes

actions/create-github-app-token

v3.3.0

Compare Source

Features
Bug Fixes
  • deps: bump nested undici from 6.24.0 to 6.29.0 (#​403) (12461a3)
  • deps: bump the production-dependencies group across 1 directory with 3 updates (#​395) (a69c19d)
github/gh-aw

v1.0.1

Compare Source

🌟 Release Highlights

v1.0.1 focuses on safer pull request outputs, smoother compile and update workflows, and improved observability.

✨ What's New
  • Lock-safe pull request outputs: code-producing workflows now use lock-safe PR outputs, with a suggested lock exclusion when workflow permission pushes fail (#​72396, #​72423).
  • Actions-lock integration: compile can now optionally integrate with actions-lock (#​72395).
  • Guided pull_request_target fixes: guided remediation with safe role restriction (#​72412).
  • Interactive org and enterprise update rollouts (#​72418).
  • Native Actions expression grammar replaces legacy expression parsing (#​72413).
  • Richer unified sessions: safe-output, safe job/script, and memory-save outcomes are now recorded (#​72146, #​72138, #​72133), plus harness retry telemetry in spans and usage artifacts (#​71934).
  • Copilot CLI upgraded to 1.0.103 with a reviewed checksum pin (#​72099).
🐛 Bug Fixes & Improvements
  • Preserve cancelled startup failure diagnostics and suppress noisy startup-failure reports for cancelled jobs (#​72432, #​72405).
  • Fix privileged AWF environment forwarding on sudo-rs (#​72409).
  • Merge imported job outputs with main workflow precedence (#​72407).
  • Honor newer cached action pins in runtime setup (#​72272).
  • Trust same-repository bot PRs triggered by labels (#​72074).
  • Enforce ubuntu-slim timeout limits and upgrade default runners for longer jobs (#​72131).
  • Fill model pricing gaps and accept none/max for pinned Codex routing (#​72414, #​70952).
  • Harden AWF release download retries and fix work-queue provisioning recovery (#​72157, #​72400).
📚 Documentation
  • New explanation of the activation gate and CAO integration (#​72379) and a leaner troubleshooting guide (#​72280).

Generated by 🚀 Release · copilot · auto · ~15 AIC · ⊞ 12.9K

What's Changed

  • Trust same-repository bot PRs triggered by labels by @pelikhan with @Copilot in #​72074
  • Upgrade Copilot CLI to 1.0.103 with reviewed checksum pin by @pelikhan with @Copilot in #​72099
  • [blog] Agent of the Day – 2026-10-26 by @github-actions[bot] in #​72127
  • Soften container pin update failure messages by @dsyme in #​72093
  • Use Gonum helpers for grader descriptive statistics by @pelikhan with @Copilot in #​72100
  • Correct map tool usage in built-in ledger smoke workflow by @pelikhan with @Copilot in #​72095
  • Make setup action reference tests deterministic by @pelikhan in #​72155
  • Enforce ubuntu-slim timeout limits and upgrade default runners for longer jobs by @pelikhan with @Copilot in #​72131
  • Record memory save outcomes in unified sessions and conclusion data by @pelikhan with @Copilot in #​72133
  • Model routing: accept none/max for pinned Codex and add routed Codex smoke by @SivaKesava1 with @Copilot in #​70952
  • Preserve harness retry telemetry in spans and usage artifacts by @pelikhan with @Copilot in #​71934
  • Record safe job and script outcomes in unified sessions by @pelikhan with @Copilot in #​72146
  • Record privacy-preserving safe-output outcomes in unified sessions by @pelikhan with @Copilot in #​72138
  • Fix Aider Go test stub package declarations by @pelikhan in #​72164
  • Harden AWF release download retries and diagnostics by @pelikhan in #​72157
  • Preview Notices by @salilsub in #​72217
  • Revert "Preview Notices (#​72217)" by @pelikhan in #​72281
  • Retry transient PR Sous Chef API failures by @pelikhan in #​72282
  • [docs] docs: unbloat troubleshooting/common-issues.md by @github-actions[bot] in #​72280
  • [log] Add debug logging to unlogged branches in cli package-manifest/actionlint code by @github-actions[bot] in #​72299
  • [instructions] Sync instruction files with release v0.93.5 by @github-actions[bot] in #​72363
  • Honor newer cached action pins in runtime setup by @pelikhan with @Copilot in #​72272
  • docs: explain the activation gate and CAO integration by @pelikhan in #​72379
  • chore: update action and container pins by @pelikhan in #​72377
  • build(deps-dev): bump fast-uri from 3.1.8 to 3.1.9 in /actions/setup/js in the npm_and_yarn group across 1 directory by @dependabot[bot] in #​71506
  • build(deps): bump undici from 6.29.0 to 6.29.1 in /actions/setup/js in the npm_and_yarn group across 1 directory by @dependabot[bot] in #​72384
  • build(deps): bump library/alpine from 294b683 to be26560 by @dependabot[bot] in #​72393
  • Refactor arXiv paper memory to use a built-in ledger by @pelikhan in #​72394
  • build(deps): apply pending Dependabot updates by @pelikhan in #​72397
  • [docs] Update documentation for features from 2026-10-27 by @github-actions[bot] in #​72406
  • Fix work-queue provisioning transport recovery by @pelikhan in #​72400
  • fix: fill model pricing gaps and restore 1ES-compatible Vite by @pelikhan in #​72414
  • feat: add optional actions-lock integration to compile by @pelikhan in #​72395
  • Suppress startup-failure reports for cancelled agent jobs by @pelikhan with @Copilot in #​72405
  • Add guided pull_request_target fixes and safe role restriction by @pelikhan in #​72412
  • Merge imported job outputs with main workflow precedence by @pelikhan in #​72407
  • Add lock-safe pull request outputs and migrate code-producing workflows by @pelikhan in #​72396
  • Add interactive org and enterprise update rollouts by @pelikhan in #​72418
  • Replace legacy expression parsing with native Actions grammar by @pelikhan in #​72413
  • Suggest lock exclusion for workflow permission push failures by @pelikhan in #​72423
  • fix: refresh vendored Node image pin to patched build by @pelikhan in #​72382
  • [blog] Agent of the Day – 2026-10-27 by @github-actions[bot] in #​72460
  • Preserve cancelled startup failure diagnostics by @pelikhan in #​72432
  • [dead-code] chore: remove dead functions — 3 functions removed by @github-actions[bot] in #​72463
  • Refactor issue and comment Markdown into report trees by @pelikhan in #​72415
  • Fix privileged AWF environment forwarding on sudo-rs by @pelikhan in #​72409

Full Changelog: github/gh-aw@v1.0.0...v1.0.1

v1.0.0

Compare Source

🔧 Maintenance Release

v1.0.0 focuses on housekeeping: documentation refreshes, GitHub Actions version updates, improved debug logging, and expanded schema coverage.

📚 Documentation
  • Added an AI Transparency Notice (#​71520).
  • Refreshed the glossary, architecture diagram, and synced instruction files.
🔧 Under the Hood
  • Added debug logging to agentdrain and actionpins for easier troubleshooting.
  • Added a schema coverage demo for the work-queue-policy field.
  • Updated the Safe Outputs conformance checker for recent spec changes.

Generated by 🚀 Release · copilot · auto · ~13 AIC · ⊞ 12.6K

What's Changed

Full Changelog: github/gh-aw@v0.93.6...v1.0.0

v0.93.6

Compare Source

🌟 Release Highlights

A focused release strengthening infrastructure dependencies, compile/audit reliability, and validation.

✨ What's New
  • Updated runtime stack: MCP Gateway bumped to v0.5.0 and the firewall to v0.29.0.
  • Better expression validation: missing step references in Actions/AW expressions are now detected at compile time.
  • Resilient MCP tooling: compile and audit timeouts now return stage-aware partial results instead of failing outright.
🐛 Bug Fixes & Improvements
  • Threat detection that is skipped no longer reports inherited agent tokens.
  • Fixed a compile-progress file permission policy violation.
  • Hardened fetch-script portability and structured lint reporting.
  • Cached state is now read before workflow analysis, and title-parsing benchmarks are separated from file I/O costs.

Generated by 🚀 Release · copilot · auto · ~13 AIC · ⊞ 12.6K

What's Changed

Full Changelog: github/gh-aw@v0.93.5...v0.93.6

v0.93.5

Compare Source

🌟 Release Highlights

This release focuses on hardening: stronger static analysis linters, safer credential handling, and more robust diagnostics.

✨ What's New
  • Safe-output integration jobs can now use network credentials (#​71833).
  • Engine driver crashes are classified with secret-safe stderr diagnostics, making failures easier to triage (#​71883).
  • Pi CLI default updated to 1.4.0 (#​71899).
  • New and sharper custom linters: readerstringconv analyzer, parenthesized Flush discard detection, missing goroutine recovery through local closures, and closed detection gaps (#​71891, #​71896, #​71897, #​71880).
  • Secret-leak analysis now tracks credential handoffs through step outputs (#​71850).
🐛 Bug Fixes & Improvements
  • Fixed generated conclusion references and fetch warnings; Redis image pinned (#​71898).
  • Guarded indexing boundaries and prevented cron-step overflow (#​71889).
  • Refreshed Node image pins and enforced patched runtime dependencies (#​71879).
  • gh-aw-detection is no longer treated as experimental (#​71848).
  • Internal consolidation of permission scope expansion, GitHub Contents base64 decoding, and public API GET fallback transport (#​71888, #​71894, #​71893).
📚 Documentation
  • Documentation refreshed for recent features (#​71867).

Generated by 🚀 Release · copilot · auto · ~14 AIC · ⊞ 12.6K

What's Changed

Full Changelog: github/gh-aw@v0.93.4...v0.93.5

v0.93.4

Compare Source

🌟 Release Highlights

This release focuses on work-queue reliability, safer checkout credential handling, and a broad set of compiler and workflow fixes.

✨ What's New
  • Work queues: pools and workers now install on first use, with clearer diagnostics for missing pools and privacy-preserving GraphQL errors.
  • Safe outputs: standardized machine-readable error codes, add_comment constraints disclosed in the tool description, and visible staged-preview notices on PR and Claim guards.
  • Threat detection: matching-engine detection now inherits agent API targets, and validated status-only jobs are allowed after detection.
  • Environments: workflow environments now propagate to activation jobs.
  • Faster update: fewer network fetches, plus verbose request timings.
🐛 Bug Fixes & Improvements
  • Release checkouts no longer persist credentials; compiler-generated PR checkouts are narrowly exempted from artipacked warnings.
  • Compiler-generated constants are emitted as quoted strings, and schema-supported frontmatter shapes are accepted.
  • Copilot BYOK HTTP API targets are preserved.
  • Unmatched checkout.fetch refs no longer block other fetches.
  • Fixed prompt tool scanner false positives, mapdeletecheck with asymmetric parentheses, and empty repo-memory wiki note substitution.
  • Fixed missing embedded session-parser and grader runtime dependencies.
  • Workflow health checks now have a time budget and debug logging; log storage admission and observability audits are bounded.
  • Behavior-defined engine session capture is now protected.
📚 Documentation
  • MemoryOps pattern page streamlined and docs updated for recent features.

Generated by 🚀 Release · copilot · auto · ~14 AIC · ⊞ 12.6K

What's Changed

Full Changelog: github/gh-aw@v0.93.3...v0.93.4

v0.93.3

Compare Source

🌟 Release Highlights

This release tightens workflow quality checks and hardens threat detection.

✨ What's New
  • Workflow linting on by default – gh aw compile now lints workflows during compilation, surfacing problems earlier (#​71349).
  • Work-queue smoke workflows – New daily smoke workflows with Bash 3-compatible validation improve confidence in work-queue behavior (#​71363).
🐛 Bug Fixes & Improvements
  • Work-queue Claim settlement now verifies discussion cleanup effects (#​71361).
  • Threat detection is pinned to v0.5.3 for reproducible, safer runs (#​71501).
📚 Documentation
  • Clarified directory restrictions for reusable agentic workflows (#​71451).

Generated by 🚀 Release · copilot · auto · ~13 AIC · ⊞ 12.6K

What's Changed

Full Changelog: github/gh-aw@v0.93.2...v0.93.3

v0.93.2

Compare Source

🌟 Release Highlights

A reliability-focused release: Copilot CLI installs are more resilient, scanners and reports are more trustworthy, and Pi runs behave correctly on ARC/DinD runners.

🐛 Bug Fixes & Improvements
  • Copilot CLI install fallback — when the live compatibility matrix selects a release without a trusted checksum pin, setup now falls back to the bundled default (within the compatibility window), with checksum verification still required. (#​71339)
  • Pi on ARC/DinD — Pi streaming logs now go to the writable engine-log directory, fixing log, summary and session export on ARC/DinD runners. (#​71228)
  • Custom ledger safe outputs — custom ledger tool schemas now require a record, and invalid envelopes are rejected before queuing so agents can self-correct. (#​71240)
  • Grype scan completeness — empty or malformed Grype output is no longer cached as a zero-finding success, and per-image scan status is tracked. (#​71297)
  • Report formatting — bold labels in collapsible report summaries now render correctly instead of showing literal <b> tags. (#​71273)
  • Release notes — fixed apostrophe encoding guidance so highlights no longer publish u0027. (#​71272)
  • Conformance checks — removed false positives for PTI-005 and SEC-005. (#​71287, #​71286)
  • Windows CI — POSIX-only outcome API fixtures are skipped on Windows. (#​71247)
📚 Documentation

Generated by 🚀 Release · copilot · auto · ~18 AIC · ⊞ 12.6K

What's Changed

Full Changelog: github/gh-aw@v0.93.1...v0.93.2

v0.93.1

Compare Source

🌟 Release Highlights

v0.93.1 focuses on engine reliability, MCP trust configuration, and audit tooling, plus many CI and workflow stability fixes.

✨ What's New
  • Per-server custom CA trust for HTTP MCP servers — connect to MCP servers behind private PKI without weakening global trust (#​71229). Learn more
  • BM25 audit search — unified-session audit now supports search with automatic evidence grouping (#​70998). Learn more
  • Outcome evaluation moved into logs — the separate outcomes command is removed (#​71218).
  • Detection gates enforced for custom workflow jobs (#​70997) and hosted threat detection is isolated (#​71244).
  • Work-queue diagnostics included in health reports (#​70965).
  • MCP Gateway bumped to v0.4.37 (#​71219).
🐛 Bug Fixes & Improvements
  • Codex stages native TOML sub-agents with resolved models and fails closed before startup (#​70945); Copilot SDK refuses silent model substitution (#​70943).
  • Model-routing allowed-models now expands aliases (#​70942); Claude detection model aliases resolve before CLI launch (#​70861).
  • Pi main/sub-agent requests are attributed with x-awf-caller (#​71043).
  • CLI proxy and MCP gateway containers honor runner proxy settings (#​70347).
  • Scalar allowed-repos normalized in GitHub guard policies (#​70346); trusted-bot policy compilation covered and documented (#​70343).
  • Footer AIC costs show as rounded-up estimates (#​71193).
  • Dry-run telemetry disabled via documented opt-outs (#​71032).
  • Fixed Ollama CPU warm-up, Aider command replay, reviewer checkout after branch deletion, and unavailable prompt job output detection.
📚 Documentation

Daily documentation, glossary, and instruction syncs, plus an unbloated audit reference.

Generated by 🚀 Release · copilot · auto · ~13 AIC · ⊞ 12.4K

What's Changed

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (in timezone UTC)

  • Branch creation
    • "on sunday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

@bootc-bot
bootc-bot Bot force-pushed the bootc-renovate/github-actions branch 18 times, most recently from 4874b8c to 214c620 Compare September 13, 2026 23:23
@bootc-bot
bootc-bot Bot force-pushed the bootc-renovate/github-actions branch 3 times, most recently from 20fccf9 to 299de22 Compare September 20, 2026 01:07
@bootc-bot
bootc-bot Bot force-pushed the bootc-renovate/github-actions branch 3 times, most recently from 60981b0 to 7381719 Compare October 4, 2026 00:13
@bootc-bot
bootc-bot Bot force-pushed the bootc-renovate/github-actions branch 2 times, most recently from 03ff2ec to df02191 Compare October 18, 2026 01:08
@bootc-bot
bootc-bot Bot force-pushed the bootc-renovate/github-actions branch 3 times, most recently from 35efef3 to 48dea4f Compare October 25, 2026 18:31
@bootc-bot
chore(deps): update github actions
167d74b 
Signed-off-by: bootc-bot[bot] <225049296+bootc-bot[bot]@users.noreply.github.com>
Signed-off-by: bootc-bot[bot] <225049296+bootc-bot[bot]@users.noreply.github.com>
@bootc-bot
bootc-bot Bot force-pushed the bootc-renovate/github-actions branch from 48dea4f to 167d74b Compare November 1, 2026 00:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants