402 Commits

Include renames

Author	SHA1	Message	Date
McKayla はな	5ca0143992	refactor: upgrade golangci-lint to v2.0.2 (#28416)	2026-08-21 23:46:27 -06:00
Ethan	cbb36e613d	ci(.github): skip Playwright apt installation (#28292) ... Playwright's `--with-deps` flag performs a live apt refresh and install in the E2E and Storybook jobs, even though the runner images already contain the required system libraries. Install only Playwright's pinned Chromium build in CI so apt mirror failures cannot block browser setup. Closes DEVEX-792	2026-08-20 16:14:16 +01:00
dependabot[bot]	f09cb20b1e	ci: bump dorny/paths-filter from 4.0.2 to 4.0.3 in the github-actions group (#28119) ... Bumps the github-actions group with 1 update: [dorny/paths-filter](https://github.com/dorny/paths-filter). Updates `dorny/paths-filter` from 4.0.2 to 4.0.3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/dorny/paths-filter/releases">dorny/paths-filter's releases</a>.</em></p> <blockquote> <h2>v4.0.3</h2> <h2>What's Changed</h2> <ul> <li>Update Outputs in readme to account for the 'every' predicate-quantifier by <a href="https://github.com/hintron"><code>@​hintron</code></a> in <a href="https://redirect.github.com/dorny/paths-filter/pull/247">dorny/paths-filter#247</a></li> <li>fix: scope base-ignored warning to API path by <a href="https://github.com/saschabratton"><code>@​saschabratton</code></a> in <a href="https://redirect.github.com/dorny/paths-filter/pull/319">dorny/paths-filter#319</a></li> <li>docs: add contents permission to PR example by <a href="https://github.com/134130"><code>@​134130</code></a> in <a href="https://redirect.github.com/dorny/paths-filter/pull/248">dorny/paths-filter#248</a></li> <li>feat: add 'some-with-excludes' predicate quantifier by <a href="https://github.com/arxeiss"><code>@​arxeiss</code></a> in <a href="https://redirect.github.com/dorny/paths-filter/pull/322">dorny/paths-filter#322</a></li> <li>Document safe handling of file list outputs in workflows by <a href="https://github.com/dorny"><code>@​dorny</code></a> in <a href="https://redirect.github.com/dorny/paths-filter/pull/326">dorny/paths-filter#326</a></li> </ul> <h2>Security</h2> <ul> <li>Escape multi-line filenames in list-files shell and csv output] by <a href="https://github.com/ken-matsui"><code>@​ken-matsui</code></a> and <a href="https://github.com/tjswlsgg"><code>@​tjswlsgg</code></a> in <a href="https://github.com/advisories/GHSA-7hc6-8hq5-9q2m">https://github.com/advisories/GHSA-7hc6-8hq5-9q2m</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/hintron"><code>@​hintron</code></a> made their first contribution in <a href="https://redirect.github.com/dorny/paths-filter/pull/247">dorny/paths-filter#247</a></li> <li><a href="https://github.com/134130"><code>@​134130</code></a> made their first contribution in <a href="https://redirect.github.com/dorny/paths-filter/pull/248">dorny/paths-filter#248</a></li> <li><a href="https://github.com/arxeiss"><code>@​arxeiss</code></a> made their first contribution in <a href="https://redirect.github.com/dorny/paths-filter/pull/322">dorny/paths-filter#322</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/dorny/paths-filter/compare/v4...v4.0.3">https://github.com/dorny/paths-filter/compare/v4...v4.0.3</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/dorny/paths-filter/blob/master/CHANGELOG.md">dorny/paths-filter's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2>v4.0.3</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/326">Document safe handling of file list outputs in workflows</a></li> <li><a href="https://github.com/advisories/GHSA-7hc6-8hq5-9q2m">Escape multi-line filenames in list-files shell and csv output</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/322">Add 'some-with-excludes' predicate quantifier</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/248">Add contents permission to PR example</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/319">Scope base-ignored warning to API path</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/247">Update outputs in readme to account for the 'every' predicate-quantifier</a></li> </ul> <h2>v4.0.2</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/317">Work around git dubious ownership errors in container jobs</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/303">Use rev-parse instead of branch --show-current for older git compat</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/282">Fix warning message</a></li> </ul> <h2>v4.0.1</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/255">Support merge queue</a></li> </ul> <h2>v4.0.0</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/294">Update action runtime to node24</a></li> </ul> <h2>v3.0.4</h2> <ul> <li><a href="https://github.com/advisories/GHSA-7hc6-8hq5-9q2m">Escape multi-line filenames in list-files shell and csv output</a></li> </ul> <h2>v3.0.3</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/279">Add missing predicate-quantifier</a></li> </ul> <h2>v3.0.2</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/224">Add config parameter for predicate quantifier</a></li> </ul> <h2>v3.0.1</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/133">Compare base and ref when token is empty</a></li> </ul> <h2>v3.0.0</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/210">Update to Node.js 20</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/215">Update all dependencies</a></li> </ul> <h2>v2.11.1</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/167">Update @​actions/core to v1.10.0 - Fixes warning about deprecated set-output</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/168">Document need for pull-requests: read permission</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/164">Updating to actions/checkout@v3</a></li> </ul> <h2>v2.11.0</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/157">Set list-files input parameter as not required</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/161">Update Node.js</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/162">Fix incorrect handling of Unicode characters in exec()</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/163">Use Octokit pagination</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/160">Updates real world links</a></li> </ul> <h2>v2.10.2</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/dorny/paths-filter/commit/ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d"><code>ceb8a2b</code></a> Update CHANGELOG.md for v4.0.3 and v3.0.4 (<a href="https://redirect.github.com/dorny/paths-filter/issues/327">#327</a>)</li> <li><a href="https://github.com/dorny/paths-filter/commit/ef09b88f3eacdbec6ce135a7c9a193a6849545c1"><code>ef09b88</code></a> Document safe handling of file list outputs in workflows (<a href="https://redirect.github.com/dorny/paths-filter/issues/326">#326</a>)</li> <li><a href="https://github.com/dorny/paths-filter/commit/44adc5b06dc135dba334efce9bf3cf0624512d2d"><code>44adc5b</code></a> Merge commit from fork</li> <li><a href="https://github.com/dorny/paths-filter/commit/4711b7a31b4aa89103d8c6ffab2e3b8e7b6381c7"><code>4711b7a</code></a> feat: add 'some-with-excludes' predicate quantifier (<a href="https://redirect.github.com/dorny/paths-filter/issues/322">#322</a>)</li> <li><a href="https://github.com/dorny/paths-filter/commit/93c889f9e58fca66f35a0c83d8673ac7e88bb70a"><code>93c889f</code></a> fix: escape multi-line filenames in list-files shell and csv output</li> <li><a href="https://github.com/dorny/paths-filter/commit/b41dfa943b1939b9b646f67753bfe35cf6e4de03"><code>b41dfa9</code></a> docs: add contents permission to PR example (<a href="https://redirect.github.com/dorny/paths-filter/issues/248">#248</a>)</li> <li><a href="https://github.com/dorny/paths-filter/commit/9af6e5a9d010d1ae8ec570390b3d793e2b70a402"><code>9af6e5a</code></a> fix: scope base-ignored warning to API path (<a href="https://redirect.github.com/dorny/paths-filter/issues/319">#319</a>)</li> <li><a href="https://github.com/dorny/paths-filter/commit/cae9006b65a1a53044b518c68e13e835c54948a7"><code>cae9006</code></a> docs: update outputs in readme to account for the 'every' predicate-quantifie...</li> <li>See full diff in <a href="https://github.com/dorny/paths-filter/compare/7b450fff21473bca461d4b92ce414b9d0420d706...ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-13 11:09:07 +00:00
Thomas Kosiewski	2c35d33a28	fix(.github/workflows): run windows mise install under bash, tolerate missing mtimehash (#28020) ... Closes coder/internal#1630 (Linear CODAGT-879). ## Problem `test-go-pg (windows-2022)` flaked with `mtimehash: command not found` (exit 127) before any tests ran. The `Install Go mise tools` step ran `retry.sh` (a bash script) without `shell: bash`, so Windows executed it under the default PowerShell shell, which reports success without actually running the install. A warm mise tool cache masks the defect, making it intermittent. #27483 fixed the `ci.yaml` `test-go-pg` step, but two gaps remained. ## Changes - **`nightly-gauntlet.yaml`**: add `shell: bash` to its `Install Go mise tools` step, which had the identical unfixed defect on the `windows-2022` matrix entry (installs `gotestsum` the same way). - **`ci.yaml`**: the `Normalize File and Directory Timestamps` step now warns and skips instead of failing the job when `mtimehash` is missing, since it only optimizes Go test cache hits. This is the follow-up hardening suggested in coder/internal#1630 so a cache helper can never again prevent the tests from running. ## Reproduction and verification on a real Windows runner A temporary workflow on this branch (removed in the final commit) recreated the pre-#27483 step shape on `depot-windows-2022-16` with the mise CI cache disabled to emulate the cache-miss path: - **Repro run [31484281427](https://github.com/coder/coder/actions/runs/31484281427)**: the default-shell install step reported `success` under `pwsh.EXE` with no install output; the subsequent bash step failed with `mtimehash: command not found`, pipeline exit code 127 — exactly matching the flake evidence. - **Verification run [31484905616](https://github.com/coder/coder/actions/runs/31484905616)** (all green): with `shell: bash`, mise builds mtimehash and the exact production `find . -type f ! -path ./.git/\*\* | mtimehash` command runs cleanly. ## Validation - `actionlint` and `make lint/actions/zizmor` pass on the modified workflows. - Pre-commit hooks green on all commits. --- _Generated with [`mux`](https://github.com/coder/mux) • Model: `anthropic:claude-fable-5` • Thinking: `xhigh`_	2026-08-11 16:46:37 +02:00
dependabot[bot]	72ad835330	ci: bump the github-actions group with 10 updates (#28021) ... Bumps the github-actions group with 10 updates: | Package | From | To | | --- | --- | --- | | [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.20.0` | `2.20.1` | | [actions/checkout](https://github.com/actions/checkout) | `7.0.0` | `7.0.1` | | [pnpm/action-setup](https://github.com/pnpm/action-setup) | `6.0.9` | `6.0.10` | | [docker/login-action](https://github.com/docker/login-action) | `4.5.2` | `4.6.0` | | [actions/setup-java](https://github.com/actions/setup-java) | `5.6.0` | `5.7.0` | | [actions/attest](https://github.com/actions/attest) | `4.2.0` | `4.2.2` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.37.3` | `4.37.6` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.37.3` | `4.37.6` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.37.3` | `4.37.6` | | [umbrelladocs/action-linkspector](https://github.com/umbrelladocs/action-linkspector) | `1.5.4` | `1.5.5` | Updates `step-security/harden-runner` from 2.20.0 to 2.20.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/step-security/harden-runner/releases">step-security/harden-runner's releases</a>.</em></p> <blockquote> <h2>v2.20.1</h2> <h2>What's Changed</h2> <ul> <li>AWS CodeBuild-hosted runner support</li> <li>Implicitly allow single-labeled (internal) domains in block-mode</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/step-security/harden-runner/compare/v2.20.0...v2.20.1">https://github.com/step-security/harden-runner/compare/v2.20.0...v2.20.1</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/step-security/harden-runner/commit/b09bb98e06d4d774595224525879c09bc6e98c40"><code>b09bb98</code></a> Merge pull request <a href="https://redirect.github.com/step-security/harden-runner/issues/680">#680</a> from step-security/aws-code-build</li> <li><a href="https://github.com/step-security/harden-runner/commit/35cd77bcf669054f67ffd3d2802ee54a4f13b5b6"><code>35cd77b</code></a> docs: document the Global Block List in the features list</li> <li><a href="https://github.com/step-security/harden-runner/commit/bb6dbef4bf53876cd2710acd1d36413620d20fb3"><code>bb6dbef</code></a> chore: rebuild dist with clean dependency install</li> <li><a href="https://github.com/step-security/harden-runner/commit/98f73c5a0d2b2cc518e6fb8d973a0a4dde00ba13"><code>98f73c5</code></a> chore: update eBPF agent to v1.8.14</li> <li><a href="https://github.com/step-security/harden-runner/commit/54193c17a4fa3883977217b9afe20378ebe60b19"><code>54193c1</code></a> Reapply &quot;feat(runners): detect AWS CodeBuild-hosted runners as third-party pr...</li> <li><a href="https://github.com/step-security/harden-runner/commit/d22dd481cea4e96cedde031cfe600c248b592d54"><code>d22dd48</code></a> Revert &quot;fix(self-hosted): flush agent events at job end when deploy-on-self-h...</li> <li><a href="https://github.com/step-security/harden-runner/commit/0ff09412fb572363b483a3c86ffe52fe61d9fd19"><code>0ff0941</code></a> fix(self-hosted): flush agent events at job end when deploy-on-self-hosted-vm...</li> <li><a href="https://github.com/step-security/harden-runner/commit/a3c333d110c8d95f34488a22e0e56742cfb1b14f"><code>a3c333d</code></a> Revert &quot;feat(runners): detect AWS CodeBuild-hosted runners as third-party pro...</li> <li><a href="https://github.com/step-security/harden-runner/commit/bf94c00d6bba2ae7c4a479b86653039811569968"><code>bf94c00</code></a> feat(runners): detect AWS CodeBuild-hosted runners as third-party provider</li> <li><a href="https://github.com/step-security/harden-runner/commit/514522c5e449f9e28fc901f770e08a573d413e67"><code>514522c</code></a> fix(self-hosted): resolve runner user when USER env var is unset</li> <li>See full diff in <a href="https://github.com/step-security/harden-runner/compare/bf7454d06d71f1098171f2acdf0cd4708d7b5920...b09bb98e06d4d774595224525879c09bc6e98c40">compare view</a></li> </ul> </details> <br /> Updates `actions/checkout` from 7.0.0 to 7.0.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/releases">actions/checkout's releases</a>.</em></p> <blockquote> <h2>v7.0.1</h2> <h2>What's Changed</h2> <ul> <li>skip running unsafe pr check if input is default by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2518">actions/checkout#2518</a></li> <li>trim only ascii whitespace for branch by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2521">actions/checkout#2521</a></li> <li>escape values passed to --unset by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2530">actions/checkout#2530</a></li> <li>Various dependency updates</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v7...v7.0.1">https://github.com/actions/checkout/compare/v7...v7.0.1</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2>v7.0.1</h2> <ul> <li>Skip running unsafe pr check if input is default by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2518">actions/checkout#2518</a></li> <li>Trim only ascii whitespace for branch by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2521">actions/checkout#2521</a></li> <li>Escape values passed to --unset by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2530">actions/checkout#2530</a></li> <li>Various dependency updates</li> </ul> <h2>v7.0.0</h2> <ul> <li>Block checking out fork PR for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> <li>Various dependency updates</li> </ul> <h2>v6.0.3</h2> <ul> <li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li> <li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> </ul> <h2>v6.0.2</h2> <ul> <li>Fix tag handling: preserve annotations and explicit fetch-tags by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li> </ul> <h2>v6.0.1</h2> <ul> <li>Add worktree support for persist-credentials includeIf by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li> </ul> <h2>v6.0.0</h2> <ul> <li>Persist creds to a separate file by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li> <li>Update README to include Node.js 24 support details and requirements by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li> </ul> <h2>v5.0.1</h2> <ul> <li>Port v6 cleanup to v5 by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li> </ul> <h2>v5.0.0</h2> <ul> <li>Update actions checkout to use node 24 by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li> </ul> <h2>v4.3.1</h2> <ul> <li>Port v6 cleanup to v4 by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li> </ul> <h2>v4.3.0</h2> <ul> <li>docs: update README.md by <a href="https://github.com/motss"><code>@​motss</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li> <li>Add internal repos for checking out multiple repositories by <a href="https://github.com/mouismail"><code>@​mouismail</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li> <li>Documentation update - add recommended permissions to Readme by <a href="https://github.com/benwells"><code>@​benwells</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li> <li>Adjust positioning of user email note and permissions heading by <a href="https://github.com/joshmgross"><code>@​joshmgross</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li> <li>Update README.md by <a href="https://github.com/nebuk89"><code>@​nebuk89</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li> <li>Update CODEOWNERS for actions by <a href="https://github.com/TingluoHuang"><code>@​TingluoHuang</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li> <li>Update package dependencies by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li> </ul> <h2>v4.2.2</h2> <ul> <li><code>url-helper.ts</code> now leverages well-known environment variables by <a href="https://github.com/jww3"><code>@​jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li> <li>Expand unit test coverage for <code>isGhes</code> by <a href="https://github.com/jww3"><code>@​jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li> </ul> <h2>v4.2.1</h2> <ul> <li>Check out other refs/* by commit if provided, fall back to ref by <a href="https://github.com/orhantoy"><code>@​orhantoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/actions/checkout/compare/v7...3d3c42e5aac5ba805825da76410c181273ba90b1">compare view</a></li> </ul> </details> <br /> Updates `pnpm/action-setup` from 6.0.9 to 6.0.10 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pnpm/action-setup/releases">pnpm/action-setup's releases</a>.</em></p> <blockquote> <h2>v6.0.10</h2> <h2>What's Changed</h2> <ul> <li>docs(README): point users to the successor pnpm/setup action by <a href="https://github.com/BlackHole1"><code>@​BlackHole1</code></a> in <a href="https://redirect.github.com/pnpm/action-setup/pull/282">pnpm/action-setup#282</a></li> <li>refactor: introduce restore keys for cache by <a href="https://github.com/SukkaW"><code>@​SukkaW</code></a> in <a href="https://redirect.github.com/pnpm/action-setup/pull/280">pnpm/action-setup#280</a></li> <li>ci: use pnpm 11 for <code>pr-check</code> by <a href="https://github.com/jamietanna"><code>@​jamietanna</code></a> in <a href="https://redirect.github.com/pnpm/action-setup/pull/284">pnpm/action-setup#284</a></li> <li>fix: update pnpm to v11.19.0 by <a href="https://github.com/jamietanna"><code>@​jamietanna</code></a> in <a href="https://redirect.github.com/pnpm/action-setup/pull/283">pnpm/action-setup#283</a></li> <li>docs: update README to include devEngines.packageManager by <a href="https://github.com/nemchik"><code>@​nemchik</code></a> in <a href="https://redirect.github.com/pnpm/action-setup/pull/273">pnpm/action-setup#273</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/jamietanna"><code>@​jamietanna</code></a> made their first contribution in <a href="https://redirect.github.com/pnpm/action-setup/pull/284">pnpm/action-setup#284</a></li> <li><a href="https://github.com/nemchik"><code>@​nemchik</code></a> made their first contribution in <a href="https://redirect.github.com/pnpm/action-setup/pull/273">pnpm/action-setup#273</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/pnpm/action-setup/compare/v6...v6.0.10">https://github.com/pnpm/action-setup/compare/v6...v6.0.10</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pnpm/action-setup/commit/0977fd99725f1db4007ccb2928dbb4e90d06cc86"><code>0977fd9</code></a> docs: Update README to include devEngines.packageManager (<a href="https://redirect.github.com/pnpm/action-setup/issues/273">#273</a>)</li> <li><a href="https://github.com/pnpm/action-setup/commit/48261aca053e825d84804e8ce05524d558249ac9"><code>48261ac</code></a> fix: update pnpm to v11.19.0 (<a href="https://redirect.github.com/pnpm/action-setup/issues/283">#283</a>)</li> <li><a href="https://github.com/pnpm/action-setup/commit/75677f717d48404e86ae8ee4891543f40de175aa"><code>75677f7</code></a> ci: use pnpm 11 for <code>pr-check</code> (<a href="https://redirect.github.com/pnpm/action-setup/issues/284">#284</a>)</li> <li><a href="https://github.com/pnpm/action-setup/commit/769ae71fb33e6e448a5dc92ad5da997c268eecec"><code>769ae71</code></a> refactor: introduce restore keys for cache (<a href="https://redirect.github.com/pnpm/action-setup/issues/280">#280</a>)</li> <li><a href="https://github.com/pnpm/action-setup/commit/6fed91f804570c1144bfe1911c348642cb986bd4"><code>6fed91f</code></a> docs(README): point users to the successor pnpm/setup action (<a href="https://redirect.github.com/pnpm/action-setup/issues/282">#282</a>)</li> <li>See full diff in <a href="https://github.com/pnpm/action-setup/compare/0ebf47130e4866e96fce0953f49152a61190b271...0977fd99725f1db4007ccb2928dbb4e90d06cc86">compare view</a></li> </ul> </details> <br /> Updates `docker/login-action` from 4.5.2 to 4.6.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/docker/login-action/releases">docker/login-action's releases</a>.</em></p> <blockquote> <h2>v4.6.0</h2> <ul> <li>Harden buildx scoped config path handling by <a href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in <a href="https://redirect.github.com/docker/login-action/pull/1059">docker/login-action#1059</a></li> <li>Bump <code>@​aws-sdk/client-ecr</code> and <code>@​aws-sdk/client-ecr-public</code> to 3.1095.0 in <a href="https://redirect.github.com/docker/login-action/pull/1051">docker/login-action#1051</a></li> <li>Bump js-yaml from 5.2.1 to 5.2.2 in <a href="https://redirect.github.com/docker/login-action/pull/1057">docker/login-action#1057</a></li> <li>Bump postcss from 8.5.10 to 8.5.22 in <a href="https://redirect.github.com/docker/login-action/pull/1056">docker/login-action#1056</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/docker/login-action/compare/v4.5.2...v4.6.0">https://github.com/docker/login-action/compare/v4.5.2...v4.6.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/docker/login-action/commit/dbcb813823bdd20940b903addbd779551569679f"><code>dbcb813</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/1051">#1051</a> from docker/dependabot/npm_and_yarn/aws-sdk-dependen...</li> <li><a href="https://github.com/docker/login-action/commit/5bcb015ee6ec720ecdeaef2dc1164122e9b209fc"><code>5bcb015</code></a> [dependabot skip] chore: update generated content</li> <li><a href="https://github.com/docker/login-action/commit/b30b2f2d3196c1714318ba0c3c3bec211d949752"><code>b30b2f2</code></a> build(deps): bump the aws-sdk-dependencies group across 1 directory with 2 up...</li> <li><a href="https://github.com/docker/login-action/commit/9087f1e6d666fe0292409e3c819680c18526e108"><code>9087f1e</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/1057">#1057</a> from docker/dependabot/npm_and_yarn/js-yaml-5.2.2</li> <li><a href="https://github.com/docker/login-action/commit/0009830ea169ca16c24c0ea4cac1c325bfa3aee4"><code>0009830</code></a> [dependabot skip] chore: update generated content</li> <li><a href="https://github.com/docker/login-action/commit/23255232d3e43c8f0052d9a0dba82a515a88ce92"><code>2325523</code></a> build(deps): bump js-yaml from 5.2.1 to 5.2.2</li> <li><a href="https://github.com/docker/login-action/commit/4ec1d4a769e8b05a89a7396551dc38b329211688"><code>4ec1d4a</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/1056">#1056</a> from docker/dependabot/npm_and_yarn/postcss-8.5.22</li> <li><a href="https://github.com/docker/login-action/commit/5fc99ba47bca274c5a499688f71c7ea79c0ea1b3"><code>5fc99ba</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/1053">#1053</a> from docker/dependabot/github_actions/aws-actions/co...</li> <li><a href="https://github.com/docker/login-action/commit/e512bd59d16c53d79ea5c0f0e345fe554453c4bb"><code>e512bd5</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/1052">#1052</a> from docker/dependabot/github_actions/codeql-actions...</li> <li><a href="https://github.com/docker/login-action/commit/a146c91b8f371700d323bae808af7cbdc2766ed5"><code>a146c91</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/1059">#1059</a> from crazy-max/harden-buildx-scope-paths</li> <li>Additional commits viewable in <a href="https://github.com/docker/login-action/compare/371161bbe7024a29a25c5e19bfcbc0804fe9ad2c...dbcb813823bdd20940b903addbd779551569679f">compare view</a></li> </ul> </details> <br /> Updates `actions/setup-java` from 5.6.0 to 5.7.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/setup-java/releases">actions/setup-java's releases</a>.</em></p> <blockquote> <h2>v5.7.0</h2> <h2>What's Changed</h2> <ul> <li>Fix npm audit failures on releases/v5 by <a href="https://github.com/brunoborges"><code>@​brunoborges</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/1154">actions/setup-java#1154</a></li> <li>Backport <a href="https://redirect.github.com/actions/setup-java/issues/1151">#1151</a>: Fix missing wrapper cache distributions by <a href="https://github.com/brunoborges"><code>@​brunoborges</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/1153">actions/setup-java#1153</a></li> <li>Deprecate legacy Adopt distributions in v5 by <a href="https://github.com/brunoborges"><code>@​brunoborges</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/1186">actions/setup-java#1186</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-java/compare/v5.6.0...v5.7.0">https://github.com/actions/setup-java/compare/v5.6.0...v5.7.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/setup-java/commit/b6effb05e454b25005698d916606bdc6ffcbf961"><code>b6effb0</code></a> Deprecate legacy Adopt distributions in v5 (<a href="https://redirect.github.com/actions/setup-java/issues/1186">#1186</a>)</li> <li><a href="https://github.com/actions/setup-java/commit/e498d2a66a953492f322542257b22125c989b422"><code>e498d2a</code></a> Backport <a href="https://redirect.github.com/actions/setup-java/issues/1151">#1151</a>: Fix missing wrapper cache distributions (<a href="https://redirect.github.com/actions/setup-java/issues/1153">#1153</a>)</li> <li><a href="https://github.com/actions/setup-java/commit/6a3384db745932178632d0e22b2bd28cad1678e6"><code>6a3384d</code></a> Fix npm audit failures on releases/v5 (<a href="https://redirect.github.com/actions/setup-java/issues/1154">#1154</a>)</li> <li>See full diff in <a href="https://github.com/actions/setup-java/compare/03ad4de0992f5dab5e18fcb136590ce7c4a0ac95...b6effb05e454b25005698d916606bdc6ffcbf961">compare view</a></li> </ul> </details> <br /> Updates `actions/attest` from 4.2.0 to 4.2.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/attest/releases">actions/attest's releases</a>.</em></p> <blockquote> <h2>v4.2.2</h2> <h2>What's Changed</h2> <ul> <li>Bump <code>@​sigstore/oci</code> from 0.7.1 to 0.7.2 by <a href="https://github.com/bdehamer"><code>@​bdehamer</code></a> in <a href="https://redirect.github.com/actions/attest/pull/469">actions/attest#469</a></li> <li>Bump brace-expansion by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/attest/pull/468">actions/attest#468</a></li> <li>Bump ip-address from 10.2.0 to 10.4.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/attest/pull/467">actions/attest#467</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/attest/compare/v4.2.1...v4.2.2">https://github.com/actions/attest/compare/v4.2.1...v4.2.2</a></p> <h2>v4.2.1</h2> <h2>What's Changed</h2> <ul> <li>Bump tar from 7.5.17 to 7.5.21 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/attest/pull/459">actions/attest#459</a></li> <li>fix: strip OCI image tag when pushing attestation to registry by <a href="https://github.com/bdehamer"><code>@​bdehamer</code></a> in <a href="https://redirect.github.com/actions/attest/pull/464">actions/attest#464</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/attest/compare/v4.2.0...v4.2.1">https://github.com/actions/attest/compare/v4.2.0...v4.2.1</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/attest/commit/1e69f48acb82d1966a394da916b4c1698aa569d6"><code>1e69f48</code></a> Bump ip-address from 10.2.0 to 10.4.0 (<a href="https://redirect.github.com/actions/attest/issues/467">#467</a>)</li> <li><a href="https://github.com/actions/attest/commit/02787ce2f81fbfbefd25c8a9c54441f7cdec4a1b"><code>02787ce</code></a> Bump brace-expansion (<a href="https://redirect.github.com/actions/attest/issues/468">#468</a>)</li> <li><a href="https://github.com/actions/attest/commit/98ac037e195b51fa969ebc56da4ccaa9c35fad71"><code>98ac037</code></a> bump <code>@​sigstore/oci</code> from 0.7.1 to 0.7.2 (<a href="https://redirect.github.com/actions/attest/issues/469">#469</a>)</li> <li><a href="https://github.com/actions/attest/commit/508db95dd578ae2727ebd6217d5ba78e4fbda05d"><code>508db95</code></a> fix: strip OCI image tag when pushing attestation to registry (<a href="https://redirect.github.com/actions/attest/issues/464">#464</a>)</li> <li><a href="https://github.com/actions/attest/commit/dda48f2935afea63fd4651871c16233251f9d06c"><code>dda48f2</code></a> Bump the npm-development group across 1 directory with 6 updates (<a href="https://redirect.github.com/actions/attest/issues/461">#461</a>)</li> <li><a href="https://github.com/actions/attest/commit/7d789a33ada19b33b74fbcdeb7f8e6cbb509a577"><code>7d789a3</code></a> Bump the actions-minor group with 3 updates (<a href="https://redirect.github.com/actions/attest/issues/463">#463</a>)</li> <li><a href="https://github.com/actions/attest/commit/1f3ca2fbe3d1c724d701286b30c7d90309029739"><code>1f3ca2f</code></a> Add release-cutter canvas extension (<a href="https://redirect.github.com/actions/attest/issues/454">#454</a>)</li> <li><a href="https://github.com/actions/attest/commit/d215549ae8a52064102300d4b4698f3fc1babad8"><code>d215549</code></a> Bump tar from 7.5.17 to 7.5.21 (<a href="https://redirect.github.com/actions/attest/issues/459">#459</a>)</li> <li><a href="https://github.com/actions/attest/commit/20c90ed94816337d30d322057e464c15e29f9890"><code>20c90ed</code></a> Bump the npm-development group with 2 updates (<a href="https://redirect.github.com/actions/attest/issues/455">#455</a>)</li> <li><a href="https://github.com/actions/attest/commit/43c2c81fd275fe2d0ac9a887891189fc000588f1"><code>43c2c81</code></a> Bump the actions-minor group with 4 updates (<a href="https://redirect.github.com/actions/attest/issues/456">#456</a>)</li> <li>Additional commits viewable in <a href="https://github.com/actions/attest/compare/f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6...1e69f48acb82d1966a394da916b4c1698aa569d6">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action/upload-sarif` from 4.37.3 to 4.37.6 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/upload-sarif's releases</a>.</em></p> <blockquote> <h2>v4.37.6</h2> <ul> <li>Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to <code>.github/codeql-config.yml</code> to align it with the suggested path that is used elsewhere. <a href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li> </ul> <h2>v4.37.5</h2> <ul> <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li> </ul> <h2>v4.37.4</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/upload-sarif's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.37.6 - 04 Aug 2026</h2> <ul> <li>Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to <code>.github/codeql-config.yml</code> to align it with the suggested path that is used elsewhere. <a href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li> </ul> <h2>4.37.5 - 03 Aug 2026</h2> <ul> <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li> </ul> <h2>4.37.4 - 29 Jul 2026</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li> </ul> <h2>4.37.3 - 22 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.37.2 - 21 Jul 2026</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> <h2>4.37.1 - 16 Jul 2026</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li> </ul> <h2>4.37.0 - 08 Jul 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li> <li>In addition to the existing input format, the <code>config-file</code> input for the <code>codeql-action/init</code> step will soon support a new <code>[owner/]repo[@ref][:path]</code> format. All components except the repository name are optional. If omitted, <code>owner</code> defaults to the same owner as the repository the analysis is running for, <code>ref</code> to <code>main</code>, and <code>path</code> to <code>.github/codeql-action.yaml</code>. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li> </ul> <h2>4.36.3 - 01 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.36.2 - 04 Jun 2026</h2> <ul> <li>Cache CodeQL CLI version information across Actions steps. <a href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li> <li>Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. <a href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/5595ccaf912efad79be6eef63a5619ff05969be3"><code>5595cca</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4071">#4071</a> from github/update-v4.37.6-6a9359a1b</li> <li><a href="https://github.com/github/codeql-action/commit/ec9c75796a7f2cee5af0c5ffa0b81dc3bb58754b"><code>ec9c757</code></a> Add change note for PR 4070</li> <li><a href="https://github.com/github/codeql-action/commit/45c8742e17cbd668814137f95e605d925b8722a2"><code>45c8742</code></a> Update changelog for v4.37.6</li> <li><a href="https://github.com/github/codeql-action/commit/6a9359a1bd054c53cae7bb737bd8d796cfbf3014"><code>6a9359a</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4070">#4070</a> from github/mbg/remote-address/change-file-default</li> <li><a href="https://github.com/github/codeql-action/commit/065cdc0394d424981db720df63ebc570e41b775f"><code>065cdc0</code></a> Change <code>DEFAULT_CONFIG_FILE_NAME</code></li> <li><a href="https://github.com/github/codeql-action/commit/f99dd5aeee9cf92e92d0c700cb0aa7afd7bbf431"><code>f99dd5a</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4066">#4066</a> from github/dependabot/npm_and_yarn/js-yaml-5.2.2</li> <li><a href="https://github.com/github/codeql-action/commit/1804b211a343d69a6584d26fb3a68a8fe6ca39d4"><code>1804b21</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4068">#4068</a> from github/mergeback/v4.37.5-to-main-d1ba80a1</li> <li><a href="https://github.com/github/codeql-action/commit/3020a2f46286abb1704269b22ada83bd0e81c64f"><code>3020a2f</code></a> Rebuild</li> <li><a href="https://github.com/github/codeql-action/commit/93c3a5a40b7affbf8ea6a480767ed0db8e8d3c5c"><code>93c3a5a</code></a> Update changelog and version after v4.37.5</li> <li><a href="https://github.com/github/codeql-action/commit/d1ba80a13dd99fba24a470575428917156a28b43"><code>d1ba80a</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4067">#4067</a> from github/update-v4.37.5-1cd4d01d5</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81...5595ccaf912efad79be6eef63a5619ff05969be3">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action/init` from 4.37.3 to 4.37.6 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/init's releases</a>.</em></p> <blockquote> <h2>v4.37.6</h2> <ul> <li>Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to <code>.github/codeql-config.yml</code> to align it with the suggested path that is used elsewhere. <a href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li> </ul> <h2>v4.37.5</h2> <ul> <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li> </ul> <h2>v4.37.4</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/init's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.37.6 - 04 Aug 2026</h2> <ul> <li>Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to <code>.github/codeql-config.yml</code> to align it with the suggested path that is used elsewhere. <a href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li> </ul> <h2>4.37.5 - 03 Aug 2026</h2> <ul> <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li> </ul> <h2>4.37.4 - 29 Jul 2026</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li> </ul> <h2>4.37.3 - 22 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.37.2 - 21 Jul 2026</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> <h2>4.37.1 - 16 Jul 2026</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li> </ul> <h2>4.37.0 - 08 Jul 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li> <li>In addition to the existing input format, the <code>config-file</code> input for the <code>codeql-action/init</code> step will soon support a new <code>[owner/]repo[@ref][:path]</code> format. All components except the repository name are optional. If omitted, <code>owner</code> defaults to the same owner as the repository the analysis is running for, <code>ref</code> to <code>main</code>, and <code>path</code> to <code>.github/codeql-action.yaml</code>. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li> </ul> <h2>4.36.3 - 01 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.36.2 - 04 Jun 2026</h2> <ul> <li>Cache CodeQL CLI version information across Actions steps. <a href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li> <li>Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. <a href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/5595ccaf912efad79be6eef63a5619ff05969be3"><code>5595cca</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4071">#4071</a> from github/update-v4.37.6-6a9359a1b</li> <li><a href="https://github.com/github/codeql-action/commit/ec9c75796a7f2cee5af0c5ffa0b81dc3bb58754b"><code>ec9c757</code></a> Add change note for PR 4070</li> <li><a href="https://github.com/github/codeql-action/commit/45c8742e17cbd668814137f95e605d925b8722a2"><code>45c8742</code></a> Update changelog for v4.37.6</li> <li><a href="https://github.com/github/codeql-action/commit/6a9359a1bd054c53cae7bb737bd8d796cfbf3014"><code>6a9359a</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4070">#4070</a> from github/mbg/remote-address/change-file-default</li> <li><a href="https://github.com/github/codeql-action/commit/065cdc0394d424981db720df63ebc570e41b775f"><code>065cdc0</code></a> Change <code>DEFAULT_CONFIG_FILE_NAME</code></li> <li><a href="https://github.com/github/codeql-action/commit/f99dd5aeee9cf92e92d0c700cb0aa7afd7bbf431"><code>f99dd5a</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4066">#4066</a> from github/dependabot/npm_and_yarn/js-yaml-5.2.2</li> <li><a href="https://github.com/github/codeql-action/commit/1804b211a343d69a6584d26fb3a68a8fe6ca39d4"><code>1804b21</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4068">#4068</a> from github/mergeback/v4.37.5-to-main-d1ba80a1</li> <li><a href="https://github.com/github/codeql-action/commit/3020a2f46286abb1704269b22ada83bd0e81c64f"><code>3020a2f</code></a> Rebuild</li> <li><a href="https://github.com/github/codeql-action/commit/93c3a5a40b7affbf8ea6a480767ed0db8e8d3c5c"><code>93c3a5a</code></a> Update changelog and version after v4.37.5</li> <li><a href="https://github.com/github/codeql-action/commit/d1ba80a13dd99fba24a470575428917156a28b43"><code>d1ba80a</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4067">#4067</a> from github/update-v4.37.5-1cd4d01d5</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81...5595ccaf912efad79be6eef63a5619ff05969be3">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action/analyze` from 4.37.3 to 4.37.6 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/analyze's releases</a>.</em></p> <blockquote> <h2>v4.37.6</h2> <ul> <li>Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to <code>.github/codeql-config.yml</code> to align it with the suggested path that is used elsewhere. <a href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li> </ul> <h2>v4.37.5</h2> <ul> <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li> </ul> <h2>v4.37.4</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/analyze's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.37.6 - 04 Aug 2026</h2> <ul> <li>Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to <code>.github/codeql-config.yml</code> to align it with the suggested path that is used elsewhere. <a href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li> </ul> <h2>4.37.5 - 03 Aug 2026</h2> <ul> <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li> </ul> <h2>4.37.4 - 29 Jul 2026</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li> </ul> <h2>4.37.3 - 22 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.37.2 - 21 Jul 2026</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> <h2>4.37.1 - 16 Jul 2026</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li> </ul> <h2>4.37.0 - 08 Jul 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li> <li>In addition to the existing input format, the <code>config-file</code> input for the <code>codeql-action/init</code> step will soon support a new <code>[owner/]repo[@ref][:path]</code> format. All components except the repository name are optional. If omitted, <code>owner</code> defaults to the same owner as the repository the analysis is running for, <code>ref</code> to <code>main</code>, and <code>path</code> to <code>.github/codeql-action.yaml</code>. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li> </ul> <h2>4.36.3 - 01 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.36.2 - 04 Jun 2026</h2> <ul> <li>Cache CodeQL CLI version information across Actions steps. <a href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li> <li>Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. <a href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/5595ccaf912efad79be6eef63a5619ff05969be3"><code>5595cca</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4071">#4071</a> from github/update-v4.37.6-6a9359a1b</li> <li><a href="https://github.com/github/codeql-action/commit/ec9c75796a7f2cee5af0c5ffa0b81dc3bb58754b"><code>ec9c757</code></a> Add change note for PR 4070</li> <li><a href="https://github.com/github/codeql-action/commit/45c8742e17cbd668814137f95e605d925b8722a2"><code>45c8742</code></a> Update changelog for v4.37.6</li> <li><a href="https://github.com/github/codeql-action/commit/6a9359a1bd054c53cae7bb737bd8d796cfbf3014"><code>6a9359a</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4070">#4070</a> from github/mbg/remote-address/change-file-default</li> <li><a href="https://github.com/github/codeql-action/commit/065cdc0394d424981db720df63ebc570e41b775f"><code>065cdc0</code></a> Change <code>DEFAULT_CONFIG_FILE_NAME</code></li> <li><a href="https://github.com/github/codeql-action/commit/f99dd5aeee9cf92e92d0c700cb0aa7afd7bbf431"><code>f99dd5a</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4066">#4066</a> from github/dependabot/npm_and_yarn/js-yaml-5.2.2</li> <li><a href="https://github.com/github/codeql-action/commit/1804b211a343d69a6584d26fb3a68a8fe6ca39d4"><code>1804b21</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4068">#4068</a> from github/mergeback/v4.37.5-to-main-d1ba80a1</li> <li><a href="https://github.com/github/codeql-action/commit/3020a2f46286abb1704269b22ada83bd0e81c64f"><code>3020a2f</code></a> Rebuild</li> <li><a href="https://github.com/github/codeql-action/commit/93c3a5a40b7affbf8ea6a480767ed0db8e8d3c5c"><code>93c3a5a</code></a> Update changelog and version after v4.37.5</li> <li><a href="https://github.com/github/codeql-action/commit/d1ba80a13dd99fba24a470575428917156a28b43"><code>d1ba80a</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4067">#4067</a> from github/update-v4.37.5-1cd4d01d5</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81...5595ccaf912efad79be6eef63a5619ff05969be3">compare view</a></li> </ul> </details> <br /> Updates `umbrelladocs/action-linkspector` from 1.5.4 to 1.5.5 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/umbrelladocs/action-linkspector/releases">umbrelladocs/action-linkspector's releases</a>.</em></p> <blockquote> <h2>Release v1.5.5</h2> <p>v1.5.5: PR <a href="https://redirect.github.com/umbrelladocs/action-linkspector/issues/70">#70</a> - Update linkspector version to 0.5.6</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/UmbrellaDocs/action-linkspector/commit/568ec8d29fa92b31fd9ea5381e155c51e922af83"><code>568ec8d</code></a> Merge pull request <a href="https://redirect.github.com/umbrelladocs/action-linkspector/issues/70">#70</a> from UmbrellaDocs/update-linkspector-version</li> <li><a href="https://github.com/UmbrellaDocs/action-linkspector/commit/6132d9352f02722911dc20ede6cff55f5e1b6889"><code>6132d93</code></a> Update linkspector version to 0.5.6</li> <li><a href="https://github.com/UmbrellaDocs/action-linkspector/commit/2f82e255e59a3eff9fd481ff06ef80dacd7218f2"><code>2f82e25</code></a> Merge pull request <a href="https://redirect.github.com/umbrelladocs/action-linkspector/issues/68">#68</a> from sschuberth/patch-1</li> <li><a href="https://github.com/UmbrellaDocs/action-linkspector/commit/72f6bee7082d4a2ddfd80f0b126df4c03a503797"><code>72f6bee</code></a> fix brackets around dpkg</li> <li><a href="https://github.com/UmbrellaDocs/action-linkspector/commit/e0946b31e20e925e6b9d15d34093c606d9d3535e"><code>e0946b3</code></a> ci(github): Run all tests on Ubuntu 24.04 and 26.04</li> <li><a href="https://github.com/UmbrellaDocs/action-linkspector/commit/8b13e46659fda3489c2554d86bb3ad5323d698d2"><code>8b13e46</code></a> fix: Extend the AppArmor check to Ubuntu &gt; 24.04</li> <li>See full diff in <a href="https://github.com/umbrelladocs/action-linkspector/compare/6c637d70424624231467a4ca918be54fa3b792d0...568ec8d29fa92b31fd9ea5381e155c51e922af83">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-11 11:24:39 +00:00
Bobby Ho	bd693ad4ae	fix: raise test-go-pg timeout budget, lower macOS parallelism (#27997) ... `test-go-pg (macos-latest)` has recurred three times on [coder/internal#1365](https://github.com/coder/internal/issues/1365), most recently as the `cli` package hitting its own `go test -timeout 20m` after several minutes of runner-side scheduling delay, which marks hundreds of in-flight subtests as failed instead of surfacing the actual cause. Raise `GOTEST_FLAGS -timeout` from `20m` to `25m` and the matching `timeout-minutes` on every job that shares it (`test-go-pg`, `test-go-pg-17`, `test-go-race-pg` in `ci.yaml`; `flake_go` in `flake-go.yaml`; `test-go-pg` in `nightly-gauntlet.yaml`) from `25` to `30`, preserving the 5-minute margin that lets `go test`'s own timeout fire before GitHub cancels the job and produce a goroutine dump for a genuine hang. Also lower macOS `test-parallelism-tests` from `16` to `8`, matching Linux, to test whether the 2x core oversubscription is contributing scheduler contention. Windows keeps `16`; nothing in the current evidence implicates it. This is a mitigation, not a confirmed root cause; the runner scheduling delay itself is still unexplained. Refs coder/internal#1365 ## AI disclosure Per [AI Contribution guidelines](https://coder.com/docs/about/contributing/AI_CONTRIBUTING): this PR was primarily authored by Claude Code, directed by @BobbyHo, based on triage of the linked ticket's CI-flake-bot comments and a review of the current `Makefile`/`ci.yaml`/`flake-go.yaml`/`nightly-gauntlet.yaml` timeout configuration. **Verification:** - `make lint/actions/actionlint` and `make lint/actions/zizmor` both pass clean on the three edited workflow files. - `make pre-commit` passes (includes `make gen`, `make fmt`, `make lint`, and a full local build). - All three edited workflow YAMLs parse (`ruby -ryaml`) and `make -n test TEST_PACKAGES="./cli/..."` confirms `GOTEST_FLAGS` resolves to `-timeout 25m` as intended. - This is a config-only change (no application code touched); the intended effect can only be confirmed by watching real `test-go-pg` (macOS) runs on this PR and on `main` after merge, since the underlying runner-stall failure is intermittent.	2026-08-10 12:29:05 -07:00
dependabot[bot]	44cf21f7f1	ci: bump the github-actions group across 1 directory with 11 updates (#27835) ... Bumps the github-actions group with 11 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `7.0.0` | `7.0.1` | | [docker/login-action](https://github.com/docker/login-action) | `4.4.0` | `4.5.2` | | [actions/attest](https://github.com/actions/attest) | `4.1.1` | `4.2.0` | | [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) | `6.2.2` | `6.2.3` | | [fluxcd/flux2/action](https://github.com/fluxcd/flux2) | `2.9.2` | `2.9.3` | | [linear/linear-release-action](https://github.com/linear/linear-release-action) | `0.14.5` | `0.15.0` | | [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.3` | `2.4.4` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.37.0` | `4.37.3` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.37.0` | `4.37.3` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.37.0` | `4.37.3` | | [actions/stale](https://github.com/actions/stale) | `10.4.0` | `11.0.0` | Updates `actions/checkout` from 7.0.0 to 7.0.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/releases">actions/checkout's releases</a>.</em></p> <blockquote> <h2>v7.0.1</h2> <h2>What's Changed</h2> <ul> <li>skip running unsafe pr check if input is default by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2518">actions/checkout#2518</a></li> <li>trim only ascii whitespace for branch by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2521">actions/checkout#2521</a></li> <li>escape values passed to --unset by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2530">actions/checkout#2530</a></li> <li>Various dependency updates</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v7...v7.0.1">https://github.com/actions/checkout/compare/v7...v7.0.1</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2>v7.0.1</h2> <ul> <li>Skip running unsafe pr check if input is default by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2518">actions/checkout#2518</a></li> <li>Trim only ascii whitespace for branch by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2521">actions/checkout#2521</a></li> <li>Escape values passed to --unset by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2530">actions/checkout#2530</a></li> <li>Various dependency updates</li> </ul> <h2>v7.0.0</h2> <ul> <li>Block checking out fork PR for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> <li>Various dependency updates</li> </ul> <h2>v6.0.3</h2> <ul> <li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li> <li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> </ul> <h2>v6.0.2</h2> <ul> <li>Fix tag handling: preserve annotations and explicit fetch-tags by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li> </ul> <h2>v6.0.1</h2> <ul> <li>Add worktree support for persist-credentials includeIf by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li> </ul> <h2>v6.0.0</h2> <ul> <li>Persist creds to a separate file by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li> <li>Update README to include Node.js 24 support details and requirements by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li> </ul> <h2>v5.0.1</h2> <ul> <li>Port v6 cleanup to v5 by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li> </ul> <h2>v5.0.0</h2> <ul> <li>Update actions checkout to use node 24 by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li> </ul> <h2>v4.3.1</h2> <ul> <li>Port v6 cleanup to v4 by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li> </ul> <h2>v4.3.0</h2> <ul> <li>docs: update README.md by <a href="https://github.com/motss"><code>@​motss</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li> <li>Add internal repos for checking out multiple repositories by <a href="https://github.com/mouismail"><code>@​mouismail</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li> <li>Documentation update - add recommended permissions to Readme by <a href="https://github.com/benwells"><code>@​benwells</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li> <li>Adjust positioning of user email note and permissions heading by <a href="https://github.com/joshmgross"><code>@​joshmgross</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li> <li>Update README.md by <a href="https://github.com/nebuk89"><code>@​nebuk89</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li> <li>Update CODEOWNERS for actions by <a href="https://github.com/TingluoHuang"><code>@​TingluoHuang</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li> <li>Update package dependencies by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li> </ul> <h2>v4.2.2</h2> <ul> <li><code>url-helper.ts</code> now leverages well-known environment variables by <a href="https://github.com/jww3"><code>@​jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li> <li>Expand unit test coverage for <code>isGhes</code> by <a href="https://github.com/jww3"><code>@​jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li> </ul> <h2>v4.2.1</h2> <ul> <li>Check out other refs/* by commit if provided, fall back to ref by <a href="https://github.com/orhantoy"><code>@​orhantoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/checkout/commit/3d3c42e5aac5ba805825da76410c181273ba90b1"><code>3d3c42e</code></a> prep v7.0.1 release (<a href="https://redirect.github.com/actions/checkout/issues/2531">#2531</a>)</li> <li><a href="https://github.com/actions/checkout/commit/28802689a136bfcdb721715abd713740beecbe07"><code>2880268</code></a> escape values passed to --unset (<a href="https://redirect.github.com/actions/checkout/issues/2530">#2530</a>)</li> <li><a href="https://github.com/actions/checkout/commit/12cd2235efa0937479335606d7c3ac9f6c0973b1"><code>12cd223</code></a> trim only ascii whitespace for branch (<a href="https://redirect.github.com/actions/checkout/issues/2521">#2521</a>)</li> <li><a href="https://github.com/actions/checkout/commit/62661c4e71a304b2823ed026347b8d34c3eac541"><code>62661c4</code></a> skip running unsafe pr check if input is default (<a href="https://redirect.github.com/actions/checkout/issues/2518">#2518</a>)</li> <li><a href="https://github.com/actions/checkout/commit/e8d4307400f9427dba7cb98e488d6ab85f1cec5f"><code>e8d4307</code></a> Bump the minor-actions-dependencies group with 2 updates (<a href="https://redirect.github.com/actions/checkout/issues/2499">#2499</a>)</li> <li><a href="https://github.com/actions/checkout/commit/631c942040754b6e095e929c1677c07e10ed4f87"><code>631c942</code></a> eslint 9 (<a href="https://redirect.github.com/actions/checkout/issues/2474">#2474</a>)</li> <li><a href="https://github.com/actions/checkout/commit/4f1f4aec02e41874fa0262ea8ff5172d7978ad1e"><code>4f1f4ae</code></a> Bump actions/upload-artifact from 4 to 7 (<a href="https://redirect.github.com/actions/checkout/issues/2476">#2476</a>)</li> <li><a href="https://github.com/actions/checkout/commit/ba097532fb203f7e88c9c3c0b899b49469908a92"><code>ba09753</code></a> Bump actions/checkout from 6 to 7 (<a href="https://redirect.github.com/actions/checkout/issues/2488">#2488</a>)</li> <li><a href="https://github.com/actions/checkout/commit/b9e0990d219a03df7633c93f6f005a8fecbcab22"><code>b9e0990</code></a> Bump docker/login-action from 3.3.0 to 4.2.0 (<a href="https://redirect.github.com/actions/checkout/issues/2479">#2479</a>)</li> <li><a href="https://github.com/actions/checkout/commit/e8cb398be4a550817e382abf69e4c12c76fce1f2"><code>e8cb398</code></a> Bump docker/build-push-action from 6.5.0 to 7.2.0 (<a href="https://redirect.github.com/actions/checkout/issues/2478">#2478</a>)</li> <li>Additional commits viewable in <a href="https://github.com/actions/checkout/compare/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0...3d3c42e5aac5ba805825da76410c181273ba90b1">compare view</a></li> </ul> </details> <br /> Updates `docker/login-action` from 4.4.0 to 4.5.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/docker/login-action/releases">docker/login-action's releases</a>.</em></p> <blockquote> <h2>v4.5.2</h2> <ul> <li>Surface Docker Hub OIDC error responses by <a href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in <a href="https://redirect.github.com/docker/login-action/pull/1058">docker/login-action#1058</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/docker/login-action/compare/v4.5.1...v4.5.2">https://github.com/docker/login-action/compare/v4.5.1...v4.5.2</a></p> <h2>v4.5.1</h2> <ul> <li>Support <code>dhi.io</code> as Docker Hub OIDC registry by <a href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in <a href="https://redirect.github.com/docker/login-action/pull/1054">docker/login-action#1054</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/docker/login-action/compare/v4.5.0...v4.5.1">https://github.com/docker/login-action/compare/v4.5.0...v4.5.1</a></p> <h2>v4.5.0</h2> <ul> <li><a href="https://github.com/docker/login-action#docker-hub">Docker Hub OIDC</a> login support by <a href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in <a href="https://redirect.github.com/docker/login-action/pull/1048">docker/login-action#1048</a></li> <li>Bump <code>@​aws-sdk/client-ecr</code> and <code>@​aws-sdk/client-ecr-public</code> to 3.1091.0 in <a href="https://redirect.github.com/docker/login-action/pull/1037">docker/login-action#1037</a></li> <li>Bump <code>@​docker/actions-toolkit</code> from 0.92.0 to 0.94.0 in <a href="https://redirect.github.com/docker/login-action/pull/1044">docker/login-action#1044</a> <a href="https://redirect.github.com/docker/login-action/pull/1050">docker/login-action#1050</a></li> <li>Bump brace-expansion from 1.1.13 to 1.1.16 in <a href="https://redirect.github.com/docker/login-action/pull/1046">docker/login-action#1046</a></li> <li>Bump js-yaml from 5.2.0 to 5.2.1 in <a href="https://redirect.github.com/docker/login-action/pull/1038">docker/login-action#1038</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/docker/login-action/compare/v4.4.0...v4.5.0">https://github.com/docker/login-action/compare/v4.4.0...v4.5.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/docker/login-action/commit/371161bbe7024a29a25c5e19bfcbc0804fe9ad2c"><code>371161b</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/1058">#1058</a> from crazy-max/fix-dockerhub-oidc-error-handling</li> <li><a href="https://github.com/docker/login-action/commit/5dc73df38ebcfa6f96479901e253d172c3e35849"><code>5dc73df</code></a> chore: update generated content</li> <li><a href="https://github.com/docker/login-action/commit/2aa1edee0b06c23880529064a4f7d7d3d2f9bc87"><code>2aa1ede</code></a> surface Docker Hub OIDC error responses</li> <li><a href="https://github.com/docker/login-action/commit/abd2ef45e78c5afb21d64d4ca52ee8550d9572c7"><code>abd2ef4</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/1055">#1055</a> from crazy-max/test-registry-auth-oidc</li> <li><a href="https://github.com/docker/login-action/commit/d49d3a9839fef51322fa44989a44fdc43fccfc22"><code>d49d3a9</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/1054">#1054</a> from crazy-max/oidc-missing-dhi</li> <li><a href="https://github.com/docker/login-action/commit/b58b17c30b4db92a4ed049b213cae512b12e460b"><code>b58b17c</code></a> test: cover Docker Hub OIDC with registry-auth</li> <li><a href="https://github.com/docker/login-action/commit/be646c21cec26cea303e29290d5f6ba6fde8e606"><code>be646c2</code></a> chore: update generated content</li> <li><a href="https://github.com/docker/login-action/commit/d77c059cb9956cedaa427dc022d89f39acba678f"><code>d77c059</code></a> support dhi.io as Docker Hub OIDC registry</li> <li><a href="https://github.com/docker/login-action/commit/06fb636fac595d6fb4b28a5dfcb21a6f5091859c"><code>06fb636</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/1037">#1037</a> from docker/dependabot/npm_and_yarn/aws-sdk-dependen...</li> <li><a href="https://github.com/docker/login-action/commit/a8bc9539118a762b0e5788b53a50907977cc1b8d"><code>a8bc953</code></a> [dependabot skip] chore: update generated content</li> <li>Additional commits viewable in <a href="https://github.com/docker/login-action/compare/af1e73f918a031802d376d3c8bbc3fe56130a9b0...371161bbe7024a29a25c5e19bfcbc0804fe9ad2c">compare view</a></li> </ul> </details> <br /> Updates `actions/attest` from 4.1.1 to 4.2.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/attest/releases">actions/attest's releases</a>.</em></p> <blockquote> <h2>v4.2.0</h2> <h2>What's Changed</h2> <ul> <li>fix: split checksums on any line ending so LF files parse on Windows by <a href="https://github.com/bdehamer"><code>@​bdehamer</code></a> in <a href="https://redirect.github.com/actions/attest/pull/443">actions/attest#443</a></li> <li>Bump <code>@​actions/glob</code> from 0.6.1 to 0.7.0 in the npm-production group across 1 directory by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/attest/pull/435">actions/attest#435</a></li> <li>Bump csv-parse from 6.2.1 to 7.0.1 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/attest/pull/437">actions/attest#437</a></li> <li>Read subjects from GITHUB_ARTIFACTS_LIST by <a href="https://github.com/bdehamer"><code>@​bdehamer</code></a> in <a href="https://redirect.github.com/actions/attest/pull/447">actions/attest#447</a></li> <li>Support SHA-2 subject digests by <a href="https://github.com/bdehamer"><code>@​bdehamer</code></a> in <a href="https://redirect.github.com/actions/attest/pull/446">actions/attest#446</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/attest/compare/v4.1.1...v4.2.0">https://github.com/actions/attest/compare/v4.1.1...v4.2.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/attest/commit/f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6"><code>f7c74d2</code></a> feat: support SHA-2 subject digests (<a href="https://redirect.github.com/actions/attest/issues/446">#446</a>)</li> <li><a href="https://github.com/actions/attest/commit/88633d1756270d272f232bbaba8360d70e180b14"><code>88633d1</code></a> Bump js-yaml from 4.2.0 to 5.2.1 (<a href="https://redirect.github.com/actions/attest/issues/452">#452</a>)</li> <li><a href="https://github.com/actions/attest/commit/5dff8240ad7d3c21bf0f776b9ab04d47a3febba5"><code>5dff824</code></a> Bump the actions-minor group with 3 updates (<a href="https://redirect.github.com/actions/attest/issues/453">#453</a>)</li> <li><a href="https://github.com/actions/attest/commit/e67e5399f37b282b9382bd1b2d4ed66daf4e21b5"><code>e67e539</code></a> Bump the npm-development group across 1 directory with 2 updates (<a href="https://redirect.github.com/actions/attest/issues/448">#448</a>)</li> <li><a href="https://github.com/actions/attest/commit/95f61558e35f51e484fa916f9bf319b265996850"><code>95f6155</code></a> Bump <code>@​types/node</code> from 25.9.2 to 26.1.1 (<a href="https://redirect.github.com/actions/attest/issues/449">#449</a>)</li> <li><a href="https://github.com/actions/attest/commit/b644c729d1fae21e9635a15b38ce726b49c99e38"><code>b644c72</code></a> Read subjects from GITHUB_ARTIFACTS_LIST (<a href="https://redirect.github.com/actions/attest/issues/447">#447</a>)</li> <li><a href="https://github.com/actions/attest/commit/7d3af28c422bf02197a99f195b689b34377e11a2"><code>7d3af28</code></a> Bump csv-parse from 6.2.1 to 7.0.1 (<a href="https://redirect.github.com/actions/attest/issues/437">#437</a>)</li> <li><a href="https://github.com/actions/attest/commit/52cbb4d3ca5ac64fbabac3b5e172f4fb74c8f99e"><code>52cbb4d</code></a> Bump <code>@​actions/glob</code> from 0.6.1 to 0.7.0 in the npm-production group across 1 d...</li> <li><a href="https://github.com/actions/attest/commit/a5ce33e52236c69ed17d18f87d6ba1ae1ba781dd"><code>a5ce33e</code></a> ci: download rebuilt dist/ artifact outside the checkout workspace (<a href="https://redirect.github.com/actions/attest/issues/445">#445</a>)</li> <li><a href="https://github.com/actions/attest/commit/4c65731ec8848677473bd6f7fcef1e73c4cc79e0"><code>4c65731</code></a> ci: auto-rebuild dist/ for Dependabot production bumps (<a href="https://redirect.github.com/actions/attest/issues/444">#444</a>)</li> <li>Additional commits viewable in <a href="https://github.com/actions/attest/compare/a1948c3f048ba23858d222213b7c278aabede763...f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6">compare view</a></li> </ul> </details> <br /> Updates `aws-actions/configure-aws-credentials` from 6.2.2 to 6.2.3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/aws-actions/configure-aws-credentials/releases">aws-actions/configure-aws-credentials's releases</a>.</em></p> <blockquote> <h2>v6.2.3</h2> <h2><a href="https://github.com/aws-actions/configure-aws-credentials/compare/v6.2.2...v6.2.3">6.2.3</a> (2026-07-22)</h2> <h3>Bug Fixes</h3> <ul> <li>attach git credentials before Tag Major Version push (<a href="https://redirect.github.com/aws-actions/configure-aws-credentials/issues/1877">#1877</a>) (<a href="https://github.com/aws-actions/configure-aws-credentials/commit/9ae780b171afa8c5a3a6a2d154a765b709492482">9ae780b</a>)</li> <li>PackedPolicyTooLarge detection in STS tags (<a href="https://redirect.github.com/aws-actions/configure-aws-credentials/issues/1899">#1899</a>) (<a href="https://github.com/aws-actions/configure-aws-credentials/commit/fa8d6a57bbf44b34439fb080bbdadc7c92c285eb">fa8d6a5</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/aws-actions/configure-aws-credentials/blob/main/CHANGELOG.md">aws-actions/configure-aws-credentials's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <p>All notable changes to this project will be documented in this file. See <a href="https://github.com/conventional-changelog/standard-version">standard-version</a> for commit guidelines.</p> <h2><a href="https://github.com/aws-actions/configure-aws-credentials/compare/v6.2.2...v6.2.3">6.2.3</a> (2026-07-22)</h2> <h3>Bug Fixes</h3> <ul> <li>attach git credentials before Tag Major Version push (<a href="https://redirect.github.com/aws-actions/configure-aws-credentials/issues/1877">#1877</a>) (<a href="https://github.com/aws-actions/configure-aws-credentials/commit/9ae780b171afa8c5a3a6a2d154a765b709492482">9ae780b</a>)</li> <li>PackedPolicyTooLarge detection in STS tags (<a href="https://redirect.github.com/aws-actions/configure-aws-credentials/issues/1899">#1899</a>) (<a href="https://github.com/aws-actions/configure-aws-credentials/commit/fa8d6a57bbf44b34439fb080bbdadc7c92c285eb">fa8d6a5</a>)</li> </ul> <h2><a href="https://github.com/aws-actions/configure-aws-credentials/compare/v6.2.1...v6.2.2">6.2.2</a> (2026-07-07)</h2> <h3>Miscellaneous Chores</h3> <ul> <li>release 6.2.2 (<a href="https://github.com/aws-actions/configure-aws-credentials/commit/d01d678e65d6d2bd9d5ca7a95d6f07b00e25f2c2">d01d678</a>)</li> </ul> <h2><a href="https://github.com/aws-actions/configure-aws-credentials/compare/v6.2.0...v6.2.1">6.2.1</a> (2026-06-26)</h2> <h3>Bug Fixes</h3> <ul> <li>enforce allowed-account-ids on all auth paths (<a href="https://redirect.github.com/aws-actions/configure-aws-credentials/issues/1847">#1847</a>) (<a href="https://github.com/aws-actions/configure-aws-credentials/commit/4d281fbc56a82e63c3fc14f2cc22361f34c97493">4d281fb</a>)</li> </ul> <h2><a href="https://github.com/aws-actions/configure-aws-credentials/compare/v6.1.3...v6.2.0">6.2.0</a> (2026-06-01)</h2> <h3>Features</h3> <ul> <li>add additional session tags by default (<a href="https://redirect.github.com/aws-actions/configure-aws-credentials/issues/1775">#1775</a>) (<a href="https://github.com/aws-actions/configure-aws-credentials/commit/e0ba7685077379a14a82d01fefd511490344ebfc">e0ba768</a>)</li> <li>add more retry logic and better logging (<a href="https://redirect.github.com/aws-actions/configure-aws-credentials/issues/1764">#1764</a>) (<a href="https://github.com/aws-actions/configure-aws-credentials/commit/540d0c13aedb8d55501d220bd2f0b3cdedfe84e8">540d0c1</a>)</li> <li>add regex validation to role-session-name (<a href="https://redirect.github.com/aws-actions/configure-aws-credentials/issues/1765">#1765</a>) (<a href="https://github.com/aws-actions/configure-aws-credentials/commit/e35449909c6ede5083a48ba4b8bbfaaa1cf09ba1">e354499</a>)</li> <li>Allow custom session tags to be passed when assuming a role (<a href="https://redirect.github.com/aws-actions/configure-aws-credentials/issues/1759">#1759</a>) (<a href="https://github.com/aws-actions/configure-aws-credentials/commit/61f50f630f383628add73c1eab3f1935ba07da2b">61f50f6</a>)</li> <li>expose run id in STS client user-agent (<a href="https://redirect.github.com/aws-actions/configure-aws-credentials/issues/1774">#1774</a>) (<a href="https://github.com/aws-actions/configure-aws-credentials/commit/29d1be30273e7ef371d59fccf6ec54572c64ec89">29d1be3</a>)</li> <li>support custom STS endpoints (<a href="https://redirect.github.com/aws-actions/configure-aws-credentials/issues/1762">#1762</a>) (<a href="https://github.com/aws-actions/configure-aws-credentials/commit/8d52d05d7a4521fa52b39de50cb6114b12e5c332">8d52d05</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li>skip credential check on output-env-credentials: false (<a href="https://redirect.github.com/aws-actions/configure-aws-credentials/issues/1778">#1778</a>) (<a href="https://github.com/aws-actions/configure-aws-credentials/commit/58e7c47adf77846879008deadfeeef8a6969fe6c">58e7c47</a>)</li> <li>assumeRole failing from session tag size too large (<a href="https://redirect.github.com/aws-actions/configure-aws-credentials/issues/1808">#1808</a>) (<a href="https://github.com/aws-actions/configure-aws-credentials/commit/d6f5dc331b44474b19a52caaf85fa4d637b13c8e">d6f5dc3</a>)</li> </ul> <h2><a href="https://github.com/aws-actions/configure-aws-credentials/compare/v6.1.2...v6.1.3">6.1.3</a> (2026-05-28)</h2> <h3>Bug Fixes</h3> <ul> <li>fix: allow kubelet token symlink in <a href="https://redirect.github.com/aws-actions/configure-aws-credentials/issues/1805">#1805</a></li> </ul> <h2><a href="https://github.com/aws-actions/configure-aws-credentials/compare/v6.1.1...v6.1.2">6.1.2</a> (2026-05-26)</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/aws-actions/configure-aws-credentials/commit/e6de054238d6b7531b4efff3b6587d9aade6a06c"><code>e6de054</code></a> chore(main): release 6.2.3 (<a href="https://redirect.github.com/aws-actions/configure-aws-credentials/issues/1878">#1878</a>)</li> <li><a href="https://github.com/aws-actions/configure-aws-credentials/commit/ab3b2ba025afb33b6856abfc1626992c70909302"><code>ab3b2ba</code></a> chore: Update dist</li> <li><a href="https://github.com/aws-actions/configure-aws-credentials/commit/fa8d6a57bbf44b34439fb080bbdadc7c92c285eb"><code>fa8d6a5</code></a> fix: PackedPolicyTooLarge detection in STS tags (<a href="https://redirect.github.com/aws-actions/configure-aws-credentials/issues/1899">#1899</a>)</li> <li><a href="https://github.com/aws-actions/configure-aws-credentials/commit/42e118a65655a9bcd2929e1ab7c4588fdd3255d3"><code>42e118a</code></a> chore(deps-dev): bump markdownlint-cli from 0.49.0 to 0.49.1 (<a href="https://redirect.github.com/aws-actions/configure-aws-credentials/issues/1896">#1896</a>)</li> <li><a href="https://github.com/aws-actions/configure-aws-credentials/commit/d86ddfcecc93d50cd1d1ca675d859403357c3d89"><code>d86ddfc</code></a> chore: Update dist</li> <li><a href="https://github.com/aws-actions/configure-aws-credentials/commit/874aaac21e617e1544df3c6a9f043c9bc96adf70"><code>874aaac</code></a> chore(deps): bump <code>@​aws-sdk/client-sts</code> from 3.1086.0 to 3.1091.0 (<a href="https://redirect.github.com/aws-actions/configure-aws-credentials/issues/1892">#1892</a>)</li> <li><a href="https://github.com/aws-actions/configure-aws-credentials/commit/d4341b65accaa2ddbb952380d8ef12f95043d338"><code>d4341b6</code></a> chore: Update dist</li> <li><a href="https://github.com/aws-actions/configure-aws-credentials/commit/fe51823c9714409fc32ade60b0bb4e79890beff1"><code>fe51823</code></a> chore(deps-dev): bump <code>@​aws-sdk/credential-provider-env</code> (<a href="https://redirect.github.com/aws-actions/configure-aws-credentials/issues/1894">#1894</a>)</li> <li><a href="https://github.com/aws-actions/configure-aws-credentials/commit/a8be382115e1ad5c77c560af842deddb56cd375c"><code>a8be382</code></a> chore(deps-dev): bump <code>@​biomejs/biome</code> from 2.5.3 to 2.5.4 (<a href="https://redirect.github.com/aws-actions/configure-aws-credentials/issues/1893">#1893</a>)</li> <li><a href="https://github.com/aws-actions/configure-aws-credentials/commit/e000376c2c1f88ccef5f22a6bda02c24932d8ea5"><code>e000376</code></a> chore: Update dist</li> <li>Additional commits viewable in <a href="https://github.com/aws-actions/configure-aws-credentials/compare/517a711dbcd0e402f90c77e7e2f81e849156e31d...e6de054238d6b7531b4efff3b6587d9aade6a06c">compare view</a></li> </ul> </details> <br /> Updates `fluxcd/flux2/action` from 2.9.2 to 2.9.3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/fluxcd/flux2/releases">fluxcd/flux2/action's releases</a>.</em></p> <blockquote> <h2>v2.9.3</h2> <h2>Highlights</h2> <p>Flux v2.9.3 is a patch release. It fixes empty lines vanishing from rendered Helm chart manifests, HelmReleases being marked as tested when their Helm test hooks never ran, and <code>spec.images</code> entries that set only some image fields discarding the remaining fields already declared for the same image in the <code>kustomization.yaml</code>. The latter affects both kustomize-controller and the <code>flux build|diff kustomization</code> commands. Users are encouraged to upgrade for the best experience.</p> <p>ℹ️ Please follow the <a href="https://github.com/fluxcd/flux2/discussions/5572">Upgrade Procedure for Flux v2.7+</a> for a smooth upgrade from Flux v2.6 to the latest version.</p> <p>Fixes:</p> <ul> <li>Fix empty lines vanishing from rendered chart manifests (helm-controller)</li> <li>Fix <code>HasBeenTested</code> for all corner cases, where a release could be marked as tested although its Helm test hooks never ran (helm-controller)</li> <li>Fix a <code>spec.images</code> entry setting only some of the image fields discarding the remaining fields already declared for the same image in the <code>kustomization.yaml</code> at <code>spec.path</code>, e.g. overriding only <code>newName</code> produced an untagged image reference (kustomize-controller, flux CLI)</li> </ul> <p>Improvements:</p> <ul> <li>Update fluxcd/pkg dependencies</li> <li>Include source-watcher in the OCI flux-manifests artifact</li> </ul> <h2>Components changelog</h2> <ul> <li>kustomize-controller <a href="https://github.com/fluxcd/kustomize-controller/blob/v1.9.4/CHANGELOG.md">v1.9.4</a></li> <li>helm-controller <a href="https://github.com/fluxcd/helm-controller/blob/v1.6.3/CHANGELOG.md">v1.6.3</a></li> </ul> <h2>CLI changelog</h2> <ul> <li>[release/v2.9.x] Include source-watcher to oci flux-manifests by <a href="https://github.com/fluxcdbot"><code>@​fluxcdbot</code></a> in <a href="https://redirect.github.com/fluxcd/flux2/pull/5996">fluxcd/flux2#5996</a></li> <li>Update fluxcd/pkg dependencies by <a href="https://github.com/fluxcdbot"><code>@​fluxcdbot</code></a> in <a href="https://redirect.github.com/fluxcd/flux2/pull/6006">fluxcd/flux2#6006</a></li> <li>Update toolkit components by <a href="https://github.com/fluxcdbot"><code>@​fluxcdbot</code></a> in <a href="https://redirect.github.com/fluxcd/flux2/pull/6011">fluxcd/flux2#6011</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/fluxcd/flux2/compare/v2.9.2...v2.9.3">https://github.com/fluxcd/flux2/compare/v2.9.2...v2.9.3</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/fluxcd/flux2/commit/16602fa989daa99762f1c6d1186ae2ad1c735815"><code>16602fa</code></a> Merge pull request <a href="https://redirect.github.com/fluxcd/flux2/issues/6011">#6011</a> from fluxcd/update-components-release/v2.9.x</li> <li><a href="https://github.com/fluxcd/flux2/commit/62059b85b70fc44661dc0785d7cff458a4babd3e"><code>62059b8</code></a> Update toolkit components</li> <li><a href="https://github.com/fluxcd/flux2/commit/fe6d94c898fc1519ebe796b3febbbd90b02ba393"><code>fe6d94c</code></a> Merge pull request <a href="https://redirect.github.com/fluxcd/flux2/issues/6006">#6006</a> from fluxcd/update-pkg-deps/release/v2.9.x</li> <li><a href="https://github.com/fluxcd/flux2/commit/8d305b5fb80a3f2365aebde5c6157dc5b48d00aa"><code>8d305b5</code></a> Update fluxcd/pkg dependencies</li> <li><a href="https://github.com/fluxcd/flux2/commit/282aee38f43e39bb7b8261d1fe71dfcbca7fd177"><code>282aee3</code></a> Merge pull request <a href="https://redirect.github.com/fluxcd/flux2/issues/5996">#5996</a> from fluxcd/backport-5995-to-release/v2.9.x</li> <li><a href="https://github.com/fluxcd/flux2/commit/9cd1567708f57997cb949834b21f6c8913af098a"><code>9cd1567</code></a> Include source-watcher to oci flux-manifests</li> <li>See full diff in <a href="https://github.com/fluxcd/flux2/compare/6a650dba1b4ae9945185c4bb3cc3f386aaf71b3d...16602fa989daa99762f1c6d1186ae2ad1c735815">compare view</a></li> </ul> </details> <br /> Updates `linear/linear-release-action` from 0.14.5 to 0.15.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/linear/linear-release-action/releases">linear/linear-release-action's releases</a>.</em></p> <blockquote> <h2>v0.15.0</h2> <h2>What's Changed</h2> <ul> <li>Release v0.15.0 by <a href="https://github.com/RomainCscn"><code>@​RomainCscn</code></a> in <a href="https://redirect.github.com/linear/linear-release-action/pull/55">linear/linear-release-action#55</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/linear/linear-release-action/compare/v0.14.6...v0.15.0">https://github.com/linear/linear-release-action/compare/v0.14.6...v0.15.0</a></p> <h2>v0.14.6</h2> <h2>What's Changed</h2> <ul> <li>Fix release PR body wording for drifted CLI version by <a href="https://github.com/RomainCscn"><code>@​RomainCscn</code></a> in <a href="https://redirect.github.com/linear/linear-release-action/pull/53">linear/linear-release-action#53</a></li> <li>Release v0.14.6 by <a href="https://github.com/RomainCscn"><code>@​RomainCscn</code></a> in <a href="https://redirect.github.com/linear/linear-release-action/pull/54">linear/linear-release-action#54</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/linear/linear-release-action/compare/v0.14.5...v0.14.6">https://github.com/linear/linear-release-action/compare/v0.14.5...v0.14.6</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/linear/linear-release-action/commit/af56a9a388625921f3757a2f988e4d7aca958377"><code>af56a9a</code></a> Release v0.15.0 (<a href="https://redirect.github.com/linear/linear-release-action/issues/55">#55</a>)</li> <li><a href="https://github.com/linear/linear-release-action/commit/3858a5d7892435dc63302ac76b0cdb587435caa9"><code>3858a5d</code></a> Release v0.14.6 (<a href="https://redirect.github.com/linear/linear-release-action/issues/54">#54</a>)</li> <li><a href="https://github.com/linear/linear-release-action/commit/ef0819652ce938d9c5e5371b575045c88bf30887"><code>ef08196</code></a> Fix release PR body wording for drifted CLI version (<a href="https://redirect.github.com/linear/linear-release-action/issues/53">#53</a>)</li> <li>See full diff in <a href="https://github.com/linear/linear-release-action/compare/c0cb8354a362c24c6d3e0948f37fd66d07588e3f...af56a9a388625921f3757a2f988e4d7aca958377">compare view</a></li> </ul> </details> <br /> Updates `ossf/scorecard-action` from 2.4.3 to 2.4.4 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/ossf/scorecard-action/releases">ossf/scorecard-action's releases</a>.</em></p> <blockquote> <h2>v2.4.4</h2> <h2>What's Changed</h2> <p>This update bumps the Scorecard version to the v5.5.0 release. For a complete list of changes, please refer to the <a href="https://github.com/ossf/scorecard/releases/tag/v5.4.0">Scorecard v5.4.0 release notes</a> and the <a href="https://github.com/ossf/scorecard/releases/tag/v5.5.0">Scorecard v5.5.0 release notes</a>.</p> <ul> <li>log POST failures instead of failing entire action by <a href="https://github.com/spencerschrock"><code>@​spencerschrock</code></a> in <a href="https://redirect.github.com/ossf/scorecard-action/pull/1625">ossf/scorecard-action#1625</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/ossf/scorecard-action/compare/v2.4.3...v2.4.4">https://github.com/ossf/scorecard-action/compare/v2.4.3...v2.4.4</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ossf/scorecard-action/commit/2d1146689b8cda280b9bc96326124645441f03bc"><code>2d11466</code></a> Bump action tag for v2.4.4 release (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1688">#1688</a>)</li> <li><a href="https://github.com/ossf/scorecard-action/commit/1bd3285473b114fb77ed934c4ba0aea31aa0f866"><code>1bd3285</code></a> 🌱 Bump the docker-images group across 1 directory with 2 updates (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1">#1</a>...</li> <li><a href="https://github.com/ossf/scorecard-action/commit/913edce4c1ce57261797e2ddcb74e493d9ce9700"><code>913edce</code></a> 🌱 Bump github.com/containerd/containerd from 1.7.32 to 1.7.33 (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1671">#1671</a>)</li> <li><a href="https://github.com/ossf/scorecard-action/commit/0957b8f1c327cafd868bd6bdb7e441c016628783"><code>0957b8f</code></a> 🌱 Bump golang.org/x/net from 0.56.0 to 0.57.0 (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1680">#1680</a>)</li> <li><a href="https://github.com/ossf/scorecard-action/commit/f0061eb3ff8c4d311e47276c8bcc96e96ed5dc32"><code>f0061eb</code></a> 🌱 Bump google.golang.org/grpc from 1.81.1 to 1.82.1 (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1687">#1687</a>)</li> <li><a href="https://github.com/ossf/scorecard-action/commit/20ee7324026c52f8d0c4b372a7bf382a01b72ff9"><code>20ee732</code></a> 🌱 Bump github.com/sigstore/cosign/v2 from 2.6.3 to 2.6.4 (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1685">#1685</a>)</li> <li><a href="https://github.com/ossf/scorecard-action/commit/9f295ef01b1f77f15b1647c790db825d9577a441"><code>9f295ef</code></a> 🌱 Bump the github-actions group with 6 updates (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1686">#1686</a>)</li> <li><a href="https://github.com/ossf/scorecard-action/commit/69bf556cea38c0fbe034b2ce923253eca7c4d651"><code>69bf556</code></a> 🌱 Bump github.com/sigstore/sigstore-go from 1.1.4 to 1.2.0 (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1681">#1681</a>)</li> <li><a href="https://github.com/ossf/scorecard-action/commit/94e8b9600123b21167ebf56077904fc6ca421a95"><code>94e8b96</code></a> 🌱 Bump github.com/sigstore/rekor from 1.5.0 to 1.5.2 (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1673">#1673</a>)</li> <li><a href="https://github.com/ossf/scorecard-action/commit/c7a1b37bbc88c32d53056d9071ce2ba0df381dfb"><code>c7a1b37</code></a> 🌱 Bump github.com/sigstore/fulcio from 1.8.5 to 1.8.6 (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1675">#1675</a>)</li> <li>Additional commits viewable in <a href="https://github.com/ossf/scorecard-action/compare/4eaacf0543bb3f2c246792bd56e8cdeffafb205a...2d1146689b8cda280b9bc96326124645441f03bc">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action/upload-sarif` from 4.37.0 to 4.37.3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/upload-sarif's releases</a>.</em></p> <blockquote> <h2>v4.37.3</h2> <p>No user facing changes.</p> <h2>v4.37.2</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> <h2>v4.37.1</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/upload-sarif's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.37.5 - 03 Aug 2026</h2> <ul> <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li> </ul> <h2>4.37.4 - 29 Jul 2026</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li> </ul> <h2>4.37.3 - 22 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.37.2 - 21 Jul 2026</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> <h2>4.37.1 - 16 Jul 2026</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li> </ul> <h2>4.37.0 - 08 Jul 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li> <li>In addition to the existing input format, the <code>config-file</code> input for the <code>codeql-action/init</code> step will soon support a new <code>[owner/]repo[@ref][:path]</code> format. All components except the repository name are optional. If omitted, <code>owner</code> defaults to the same owner as the repository the analysis is running for, <code>ref</code> to <code>main</code>, and <code>path</code> to <code>.github/codeql-action.yaml</code>. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li> </ul> <h2>4.36.3 - 01 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.36.2 - 04 Jun 2026</h2> <ul> <li>Cache CodeQL CLI version information across Actions steps. <a href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li> <li>Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. <a href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li> </ul> <h2>4.36.1 - 02 Jun 2026</h2> <p>No user facing changes.</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81"><code>e4fba86</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4031">#4031</a> from github/update-v4.37.3-72f6a9da0</li> <li><a href="https://github.com/github/codeql-action/commit/fb50ab5d62a274adf3ef3e22cfe750ae87a0ede7"><code>fb50ab5</code></a> Update changelog for v4.37.3</li> <li><a href="https://github.com/github/codeql-action/commit/72f6a9da0def52d9193d6a758f0378b65091f8d1"><code>72f6a9d</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4030">#4030</a> from github/mbg/fix/no-proxy</li> <li><a href="https://github.com/github/codeql-action/commit/3b5ee58597653d9cc6785f3f1277f796d81f3646"><code>3b5ee58</code></a> Use default <code>request</code> options instead of <code>undefined</code></li> <li><a href="https://github.com/github/codeql-action/commit/bfb6be4b5ecd3650f02f530571453e8c64ef0778"><code>bfb6be4</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4028">#4028</a> from github/mergeback/v4.37.2-to-main-e0647621</li> <li><a href="https://github.com/github/codeql-action/commit/526ab84f9858816d9cf5f7b9df4dd5e2235f0eba"><code>526ab84</code></a> Rebuild</li> <li><a href="https://github.com/github/codeql-action/commit/d6217b9b8c14166e4851db94c11155d03bd13c07"><code>d6217b9</code></a> Update changelog and version after v4.37.2</li> <li><a href="https://github.com/github/codeql-action/commit/e0647621c2984b5ed2f768cb892365bf2a616ad1"><code>e064762</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4027">#4027</a> from github/update-v4.37.2-385bcdc5a</li> <li><a href="https://github.com/github/codeql-action/commit/e0faed839190caa67a5cd42f1cc16246028ca3df"><code>e0faed8</code></a> Add a couple of change notes</li> <li><a href="https://github.com/github/codeql-action/commit/73aad0eaa9df172668665a150d17b8bc5a650c20"><code>73aad0e</code></a> Update changelog for v4.37.2</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/99df26d4f13ea111d4ec1a7dddef6063f76b97e9...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action/init` from 4.37.0 to 4.37.3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/init's releases</a>.</em></p> <blockquote> <h2>v4.37.3</h2> <p>No user facing changes.</p> <h2>v4.37.2</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> <h2>v4.37.1</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/init's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.37.5 - 03 Aug 2026</h2> <ul> <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li> </ul> <h2>4.37.4 - 29 Jul 2026</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li> </ul> <h2>4.37.3 - 22 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.37.2 - 21 Jul 2026</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> <h2>4.37.1 - 16 Jul 2026</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li> </ul> <h2>4.37.0 - 08 Jul 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li> <li>In addition to the existing input format, the <code>config-file</code> input for the <code>codeql-action/init</code> step will soon support a new <code>[owner/]repo[@ref][:path]</code> format. All components except the repository name are optional. If omitted, <code>owner</code> defaults to the same owner as the repository the analysis is running for, <code>ref</code> to <code>main</code>, and <code>path</code> to <code>.github/codeql-action.yaml</code>. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li> </ul> <h2>4.36.3 - 01 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.36.2 - 04 Jun 2026</h2> <ul> <li>Cache CodeQL CLI version information across Actions steps. <a href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li> <li>Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. <a href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li> </ul> <h2>4.36.1 - 02 Jun 2026</h2> <p>No user facing changes.</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81"><code>e4fba86</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4031">#4031</a> from github/update-v4.37.3-72f6a9da0</li> <li><a href="https://github.com/github/codeql-action/commit/fb50ab5d62a274adf3ef3e22cfe750ae87a0ede7"><code>fb50ab5</code></a> Update changelog for v4.37.3</li> <li><a href="https://github.com/github/codeql-action/commit/72f6a9da0def52d9193d6a758f0378b65091f8d1"><code>72f6a9d</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4030">#4030</a> from github/mbg/fix/no-proxy</li> <li><a href="https://github.com/github/codeql-action/commit/3b5ee58597653d9cc6785f3f1277f796d81f3646"><code>3b5ee58</code></a> Use default <code>request</code> options instead of <code>undefined</code></li> <li><a href="https://github.com/github/codeql-action/commit/bfb6be4b5ecd3650f02f530571453e8c64ef0778"><code>bfb6be4</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4028">#4028</a> from github/mergeback/v4.37.2-to-main-e0647621</li> <li><a href="https://github.com/github/codeql-action/commit/526ab84f9858816d9cf5f7b9df4dd5e2235f0eba"><code>526ab84</code></a> Rebuild</li> <li><a href="https://github.com/github/codeql-action/commit/d6217b9b8c14166e4851db94c11155d03bd13c07"><code>d6217b9</code></a> Update changelog and version after v4.37.2</li> <li><a href="https://github.com/github/codeql-action/commit/e0647621c2984b5ed2f768cb892365bf2a616ad1"><code>e064762</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4027">#4027</a> from github/update-v4.37.2-385bcdc5a</li> <li><a href="https://github.com/github/codeql-action/commit/e0faed839190caa67a5cd42f1cc16246028ca3df"><code>e0faed8</code></a> Add a couple of change notes</li> <li><a href="https://github.com/github/codeql-action/commit/73aad0eaa9df172668665a150d17b8bc5a650c20"><code>73aad0e</code></a> Update changelog for v4.37.2</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/99df26d4f13ea111d4ec1a7dddef6063f76b97e9...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action/analyze` from 4.37.0 to 4.37.3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/analyze's releases</a>.</em></p> <blockquote> <h2>v4.37.3</h2> <p>No user facing changes.</p> <h2>v4.37.2</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> <h2>v4.37.1</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/analyze's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.37.5 - 03 Aug 2026</h2> <ul> <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li> </ul> <h2>4.37.4 - 29 Jul 2026</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li> </ul> <h2>4.37.3 - 22 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.37.2 - 21 Jul 2026</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> <h2>4.37.1 - 16 Jul 2026</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/co... _Description has been truncated_ Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-04 11:24:49 +00:00
Ethan	1f946bb50b	ci(.github): retry Go module downloads (#27816) ... Closes CODAGT-878 Closes https://github.com/coder/internal/issues/1621 The Go module proxy failure in the linked issue is outside our control, but `lint` and `test-e2e` currently download modules during their `make` targets without any retry. Other CI jobs already wrap `go mod download` with `./.github/scripts/retry.sh`, so this just copies that precedent to both affected jobs.	2026-08-04 14:23:48 +10:00
Michael Suchacz	6e5f02bfbe	fix: bound golangci-lint memory to stop lint OOM kills (#27637) ... ## Summary Reduce peak memory during linting so cold-cache runs do not exhaust memory on high-core development hosts or leave CI runners with little headroom. ## Problem `golangci-lint` v1 sizes its default concurrency from available CPUs, not the cgroup memory limit. On a 96-CPU development host capped at 32 GiB, a cold-cache full lint run peaked at about 33.9 GB and reached the cgroup limit. The CI workflow also used bare `make -j`, which allows every lint target to run concurrently. ## Fix Make the supported `make lint/go` path cap `golangci-lint` at the lower of detected CPUs and eight workers, preserving lower concurrency on smaller hosts. Preserve an inherited `GOMEMLIMIT`, use a configurable 8 GiB fallback when it is unset, and bound CI's parallel lint targets to the runner CPU count. In the same high-core cold-cache reproduction, peak memory for the full lint target fell to about 10.1 GB. Raw `golangci-lint run` invocations remain unchanged. A `golangci-lint` v2 migration remains separate because it does not size concurrency from the memory limit and requires broader configuration migration work. > Mux prepared and updated this PR on Mike's behalf.	2026-08-03 19:49:22 +02:00
Michael Suchacz	bc9c7855d9	fix: build actionlint from source to avoid the shellcheck deadlock (#27679)	2026-07-31 02:42:49 +02:00
Bobby Ho	d210b311dc	ci(.github): retry build-tool downloads in Windows signing jobs (#27664) ... ## Problem The Windows code-signing path downloads two build tools with bare `wget` and no retry, in both `ci.yaml` (`build` job) and `release.yaml` (`release` job): - `rcodesign` from GitHub releases - `jsign-6.0.jar` from GitHub releases A single transient network failure on either fetch fails the whole job. In `ci.yaml` that turns `main` red via the `required` aggregator; in `release.yaml` it fails a release. This has happened. `Install rcodesign` failed on **2026-02-25** (in the since-deleted `build-dylib` job), **2026-03-04**, and **2026-04-30**. ## Root cause Two parts, one structural and one local. **Structural:** GitHub Actions has no per-step retry. This repo already knows toolchain provisioning is network-flaky and has `.github/scripts/retry.sh` (3 attempts, 2s/4s/8s backoff), applied in roughly 20 places. But `retry.sh` is a shell wrapper, so it can only wrap `run:` steps. These four downloads are `run:` steps that were simply never wrapped. **Local:** the failing step's body, under `set -euo pipefail`, is exactly three commands: ```sh wget -O /tmp/rcodesign.tar.gz https://github.com/indygreg/apple-platform-rs/releases/download/apple-codesign%2F0.22.0/... sudo tar -xzf /tmp/rcodesign.tar.gz -C /usr/bin --strip-components=1 ... rm /tmp/rcodesign.tar.gz ``` `tar` and `rm` operate on a file that was just written, so they are deterministic. The only nondeterministic command in the step is the network fetch, and a truncated download surfaces as a `tar` failure whose cause is still the network. ### How we know Enumerated failed runs through the GitHub Actions API and extracted, per run, every failed job together with the names of its failed steps. | Scan | Scope | Runs | |---|---|---| | `ci.yaml`, `main` | 2025-08-01 to 2026-07-29 | 934 | | `ci.yaml`, all branches | most recent failures | 150 | | `release.yaml` | all recorded failures | 22 | The 934 is effectively the complete set; the API reports 923 failed `main` runs over that period and the scans overlap slightly. `Install rcodesign` appears **3 times on 3 separate dates**. Being spread across dates rather than clustered, these behave as **independent** events. That distinction is what selects the remedy, and it is why this change is retry rather than removal. For contrast, the `Setup Java` failures in the same jobs are **4 failures inside a single 90-minute window** on 2026-05-28, all from an `api.azul.com` edge failure. That is a correlated outage, where every attempt shares the same degraded dependency and retry provably cannot help. **That defect is not addressed here** and needs a different fix; see "Not addressed" below. ### Limits of the evidence Stating these plainly so a reviewer can weigh them: - **Cause is not directly confirmed.** Logs for all three `rcodesign` failures are past GitHub's 90-day retention. The inference from the step body above is strong but circumstantial. - **Step-level attribution only reaches back about five months.** GitHub prunes per-step detail from the jobs API while keeping job-level conclusions. Probed directly: runs from 2026-03-01 onward return populated `steps` arrays; runs from 2026-02-05 and earlier return empty ones. So the true count over the full period could be higher; it cannot be lower. - **Impact is small.** This whole class of failure is 10 of 800 attributed non-`required` job failures, about **1.25%** of measured `main` CI failure volume. This is not a significant reliability improvement and should not be reviewed as one. The Postgres-backed Go tests alone are over 40%. ## Solution Wrap all four downloads in the existing retry helper: ```yaml - ./.github/scripts/retry.sh -- wget -O /tmp/rcodesign.tar.gz https://... ``` Four lines changed, one per site: `ci.yaml:1287`, `ci.yaml:1321`, `release.yaml:199`, `release.yaml:225`. **How it works.** `retry.sh` runs the command, and on non-zero exit sleeps 2s, 4s, then 8s before re-attempting, up to 3 attempts, then fails with the original command in the error message. On success the first time, behavior is unchanged. **Why it works for these failures.** They are independent events, so each attempt is a fresh trial with an independent chance of success. A GitHub releases CDN blip on one run says nothing about the next 2 seconds. This is exactly the regime retry is for. **Why retry rather than deletion.** These artifacts genuinely are not present on the runner, so the network call is unavoidable. It can only be made survivable. (Where a dependency *is* avoidable, deletion is the better answer, which is the shape the `setup-java` fix will take.) **Why `wget -O` is safe to retry.** `-O` truncates its output file on each attempt, so a partial download from a failed attempt is overwritten rather than appended to. No corruption path. ## Risks Low, and worth naming precisely. | Risk | Assessment | |---|---| | Behavior change on the success path | None. `retry.sh` execs the command directly; a first-attempt success is identical to today. | | A persistently broken URL now takes longer to fail | Yes, by up to 14s of backoff, then it fails exactly as it does today. Negligible against a job that takes tens of minutes. | | `retry.sh` mangling `wget`'s own flags | `retry.sh` parses its own options with `getopt`, so this was the main correctness concern. Verified explicitly, both argument orders used in these workflows. See Verification. | | Relative path `./.github/scripts/retry.sh` resolving wrongly | These steps set no `working-directory`, so cwd is the repo root. Deliberately **excluded** the third `wget` at `release.yaml:713` (`publish-homebrew`), which runs after `cd "$temp_dir"` where a repo-relative path would break. | | Retry masking a real regression | Bounded to 3 attempts over 14s. This is not job-level auto-retry, which would hide regressions and is explicitly not proposed. | ### Verification gap a reviewer should know about **The changed steps do not run on PR CI.** `ci.yaml`'s `build` job is gated on `github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release/')`, and `release.yaml` runs only on release. So these four steps will execute for the first time on merge to `main`. Verification below is therefore local plus static analysis, not a live run of the modified steps. ## Verification `retry.sh` argument passing, using a stub that prints what it received, for both argument orders present in these workflows: ``` --- form A: -O before URL (rcodesign style) --- argc=3 arg1=[-O] arg2=[/tmp/rcodesign.tar.gz] arg3=[https://github.com/indygreg/apple-platform-rs/releases/download/apple-codesign%2F0.22.0/apple-codesign-0.22.0-x86_64-unknown-linux-musl.tar.gz] --- form B: URL before -O (jsign style) --- argc=3 arg1=[https://github.com/ebourg/jsign/releases/download/6.0/jsign-6.0.jar] arg2=[-O] arg3=[/tmp/jsign-6.0.jar] ``` Order preserved and the `%2F` encoding in the rcodesign URL intact, which was the specific failure mode to rule out. `make lint/actions` (actionlint plus zizmor security audit): ``` ✓ lint/actions/actionlint No findings to report. Good job! (29 ignored, 102 suppressed) ``` `make pre-commit-light`: ``` ✓ fmt/shfmt ✓ lint/markdown ✓ lint/actions/actionlint ✓ fmt/terraform ✓ lint/shellcheck ✓ lint/helm ✓ fmt/markdown ✓ lint/bootstrap ✓ lint/emdash ✓ lint/migrations ✓ lint/typos ✓ lint/mise-versions ✓ pre-commit-light passed (14s) ``` ## Not addressed Deliberately out of scope, listed so the remaining exposure is visible: - **`actions/setup-java` with `distribution: "zulu"`** in both files. This resolves a JDK from `api.azul.com` and downloads it from `cdn.azul.com` on **every** run, confirmed from a successful `main` build's log, because a `Java_Zulu_jdk` tool-cache lookup can never hit the runner's cache. This is the correlated-outage defect from 2026-05-28 and retry cannot fix it. The probe on this branch ([run 30492093096](https://github.com/coder/coder/actions/runs/30492093096)) has now answered what the fix should be. `depot-ubuntu-22.04-8` ships: ``` RESULT: java found at /usr/bin/java OpenJDK Runtime Environment Temurin-11.0.31+11 (build 11.0.31+11) JAVA_HOME=/usr/lib/jvm/temurin-11-jdk-amd64 JAVA_HOME_8_X64 / _11_X64 / _17_X64 / _21_X64 / _25_X64 (all present) tool cache: Java_Temurin-Hotspot_jdk ``` So the job downloads **Zulu 11.0.32+9 over two third-party hosts while Temurin 11.0.31+11 is already on the runner's `PATH`**. The follow-up PR will point `JAVA_HOME` at `$JAVA_HOME_11_X64` and drop the action, which removes both Azul hosts while keeping the Java 11 pin rather than inheriting whatever the image default becomes. - **`storybook`'s `pnpm/action-setup`**, the last direct use in the repo and the same unguarded `registry.npmjs.org` dependency originally reported on the issue. Note `cache: true` does **not** mitigate it: per the action's own `action.yml`, `cache` caches "the pnpm store directory", not the pnpm binary. ## Scope This PR is now a **single commit** (`673162b84e`) containing only the four-line retry change. A throwaway probe workflow briefly lived on this branch to answer the JDK question above. It has served its purpose and the commit was dropped, so nothing diagnostic remains here to review. Its result is quoted in "Not addressed" and will be carried into the follow-up PR. Refs coder/internal#929	2026-07-29 17:05:22 -07:00
Bobby HoandClaude Opus 5	4e512f786f	fix: prefetch outdated Coder CLI in e2e setup instead of in the test (#27629) ... ## Summary `e2e/tests/outdatedCLI.spec.ts` has a 30 second budget in which it must create a template and workspace, start an agent, download an 84 MiB release binary from GitHub, and then exercise the actual thing under test: whether a `v2.8.0` client can still SSH into a workspace served by HEAD. In the run that filed this ticket, `install.sh` spent **20.04 seconds** of that budget on an HTTP request the test does not need, leaving 5.4 seconds for the download. The SSH flow never executed. Worth being precise about the shape, because it changes the fix. The stall is not in the code under test and it is not an SSH problem. `install.sh` resolves the latest stable release version **unconditionally**, even when `--version 2.8.0` is passed explicitly, and on the pinned path that value feeds nothing but a cosmetic post-install advisory string. Two thirds of the test's budget went to producing one sentence of console output that the test discards. Refs: https://github.com/coder/internal/issues/1571 ## Problem ### What the test is for This is a backward-compatibility test, and `v2.8.0` is the compatibility floor it enforces rather than a "supported version" in the release-channel sense. The pin traces to one code comment, `we no longer support versions prior to Tailnet v2 API support`, citing 059e533544; that commit first shipped in v2.8.0, so the pin sits exactly on the boundary it names. Worth stating plainly: this is the oldest client expected to still interoperate, not a version that receives patches. Release support is mainline / stable / n-2 / ESR, all far newer. The test's value is that it runs the *real* historical binary, compiled in Feb 2024, against a current server: `codersdk` REST compatibility, tailnet coordination v2, DERP negotiation, `coder ssh --stdio` as an SSH transport, and the agent accepting a session. Nobody gets to assert what that old client sends over the wire, which is exactly why the binary has to be downloaded rather than faked. The structural defect is that the download shares a timeout with the assertion: ```text ┌─────────────────────────────────────────────────────────────────┐ │ ONE 30-second Playwright test budget │ ├──────────────────────────────┬──────────────────────────────────┤ │ What we want to measure │ Incidental setup │ │ (deterministic, local) │ (network, non-deterministic) │ │ │ │ │ • template + workspace │ • HTTP HEAD to github.com │ │ • agent connect │ • 84 MiB download from │ │ • coder ssh --stdio │ GitHub release CDN │ │ • SSH handshake + exec │ • tar extraction │ │ • workspace stop │ │ └──────────────────────────────┴──────────────────────────────────┘ ~7-14 s, stable 0 s (cached) .. ∞ (unbounded) ``` A test that asserts protocol compatibility should not be able to fail because `github.com` was slow. ### The evidence CI runs Playwright with `DEBUG: pw:api`, and `downloadCoderVersion` passes `TRACE=1` to `install.sh`, which makes it `set -x`. The job log therefore stamps every phase. Reconstructed from [job 80049661296](https://github.com/coder/coder/actions/runs/27124540074/job/80049661296), `t=` relative to test start: ```text t=+0.000 08:17:44.671 browserContext.newPage <- test starts t=+0.882 08:17:45.553 login complete t=+4.228 08:17:48.899 workspace create submitted t=+4.519 08:17:49.190 agent-status-ready visible <- startAgent returns t=+4.526 08:17:49.197 install.sh: parse_arg --version 2.8.0 ... <- downloadCoderVersion t=+4.531 08:17:49.202 curl -sSLI https://github.com/coder/coder/releases/latest : : 20.042 SECONDS OF NOTHING : (agent logs keepalives; the page sits idle) : t=+24.573 08:18:09.244 response= 200 .../releases/tag/v2.33.6 <- probe returns t=+24.575 08:18:09.246 STABLE_VERSION=2.33.6 <- feeds a log line t=+24.582 08:18:09.253 curl -#fL -o .../coder_2.8.0_linux_amd64.tar.gz.incomplete : 5.4 s of an 84 MiB download t=+30.000 08:18:14.671 Playwright kills the test ``` Three observations rule out the originally suspected cause (slow SSH readiness or general runner slowness): - **The SSH flow never started.** `sshIntoWorkspace` is called after `downloadCoderVersion` returns, and it never returned. There is no `coder ssh --stdio` process in the log. - **The agent was healthy.** `agent-status-ready` resolved in 88 ms, and through the entire 20 second stall the agent logs a live DERP connection, successful STUN, and a completed wireguard handshake. - **The runner was fast, not slow.** Login plus template plus workspace plus agent took 4.5 seconds. ### Where the 20 seconds goes ```text install.sh main() ... L431 STABLE_VERSION=$(echo_latest_stable_version) <- ALWAYS runs | +-- echo_latest_stable_version() (install.sh:94) curl -sSLI https://github.com/coder/coder/releases/latest # no --connect-timeout # no --max-time # non-200 => exit 1 (hard failure) L454-461 the only consumers when --version is pinned: if VERSION == STABLE_VERSION: STABLE=1 L148 advisory="To install our stable release (v${STABLE_VERSION}), ..." L159 "Coder ${channel}release v${VERSION} installed. ${advisory}" ``` That is the whole dependency chain. `-sSLI` also follows redirects and `/releases/latest` *is* a redirect, so this is at minimum two round-trips to `github.com` with no timeout ceiling on either. ### Why 30 seconds and not 60 `test.setTimeout(60_000)` used to be on this test. #16236 removed it, and that removal was deliberate: it was itself a flake fix (coder/internal#204, #279) whose thesis was that `go run` compiling inside a resource-constrained test run was the problem. Having pre-built the binary, it consistently stripped the allowances that existed to absorb compile time: | File | Change in #16236 | Was that allowance really compile time? | |---|---|---| | `app.spec.ts` | `setTimeout(75_000)` removed, click timeout `60_000` -> `10_000` | Yes | | `webTerminal.spec.ts` | `setTimeout(75_000)` removed | Yes | | `helpers.ts` | agent-ready wait `45_000` -> `15_000` | Yes | | `outdatedCLI.spec.ts` | `setTimeout(60_000)` removed | **No: also an 84 MiB download** | | `outdatedAgent.spec.ts` | timeout untouched, 60 s survives | n/a | The reasoning was sound and the sweep internally consistent. It had one blind spot: for `app.spec.ts` and `webTerminal.spec.ts` that budget genuinely was the compiler's, but here it covered compile time **plus** a release download, and only the compile half went away. With 60 seconds, the failing run above would have finished in roughly 31 to 43 seconds and passed. ### Budget arithmetic At `t=+24.58` the test still had to do: | Remaining work | Realistic cost | |---|---:| | Download 84 MiB tarball | 2 - 8 s | | `tar` extract | 0.3 - 1 s | | `coder ssh --stdio` cold start | 0.5 - 2 s | | Tailnet dial + SSH handshake | 1 - 3 s | | `stopWorkspace` | 2 - 4 s | | **Needed** | **~6 - 18 s** | | **Available** | **5.42 s** | ## Fix Move the download into the existing `testsSetup` Playwright project, where it gets a 300 second budget and where a failure is attributed to the download rather than to SSH. ```mermaid flowchart TB subgraph BEFORE["BEFORE: one budget, two concerns"] direction TB T1["tests project, timeout 30s"] T1A["outdatedCLI.spec.ts<br/>login / template / workspace / agent<br/><b>downloadCoderVersion &lt;- NETWORK</b><br/>sshIntoWorkspace / exec / stopWorkspace"] T1 --> T1A end subgraph AFTER["AFTER: network work has its own clock"] direction TB S2["testsSetup project, timeout 300s"] S2A["downloadCoderVersions.spec.ts<br/>stable-version probe + 84 MiB + retries<br/>all live HERE"] T2["tests project, timeout 60s"] T2A["outdatedCLI.spec.ts<br/>downloadCoderVersion = cache hit, ~300ms<br/>SSH path gets the whole budget"] S2 --> S2A S2A -- "dependencies" --> T2 T2 --> T2A end BEFORE ~~~ AFTER style T1A fill:#ffe5e5,stroke:#cc0000,stroke-width:2px style S2A fill:#e5ffe5,stroke:#007700,stroke-width:2px style T2A fill:#e5ffe5,stroke:#007700,stroke-width:2px ``` ### Why it works `downloadCoderVersion` was already idempotent and cache-checking: it spawns `<binaryPath> version` first and returns early on exit 0. So the test keeps its existing call and that call simply becomes a no-op costing a few hundred milliseconds. **No test logic changes.** ```mermaid sequenceDiagram autonumber participant S as testsSetup:<br/>downloadCoderVersions participant IS as install.sh participant GH as github.com participant T as tests:<br/>outdatedCLI participant CD as coderd + agent Note over S: budget 300s S->>IS: downloadCoderVersion(v2.8.0) IS->>GH: stable-version probe (unbounded) IS->>GH: fetch 84 MiB asset GH-->>IS: /tmp/coder-e2e-cache/bin/coder-e2e-2.8.0 IS-->>S: binaryPath Note over T: budget 60s, local only T->>T: downloadCoderVersion(v2.8.0) Note right of T: spawn "<bin> version" -> exit 0<br/>returns early, ~300ms, no network T->>CD: coder ssh --stdio, handshake, exec "exit 0" CD-->>T: exit code 0 ``` ### Why the prefetch is non-fatal The obvious implementation raises on failure. That would be wrong here, and I verified why rather than assuming: `tests` declares `dependencies: ["testsSetup"]`, and a failing setup project stops dependent tests from **running at all**. Adding a deliberately-throwing setup spec produced: ```text ✓ 1 [testsSetup] › addUsersAndLicense.spec.ts › setup deployment (11.7s) ✓ 2 [testsSetup] › downloadCoderVersions.spec.ts › download outdated CLI (353ms) ✘ 3 [testsSetup] › zzTempFail.spec.ts › temporary blast radius probe (0ms) 1 failed 1 did not run <- outdatedCLI never ran 2 passed ``` So raising would convert a one-test flake into a whole-suite outage on any GitHub hiccup. Instead the prefetch logs a warning and returns, and the test's own `downloadCoderVersion` call fetches inline as it does today. The failure path is therefore no worse than the status quo, and the success path removes the network from the test entirely. Of the three policies available (fail hard, fall back inline, or skip the test), this is the only one that cannot regress anything: it never blocks the suite, and it never silently drops coverage the way an auto-skip would. ### Restoring the 60 second budget This is the second half of the change, and it exists for the fallback path above. It cannot reintroduce what #16236 fixed: the timeout value has no causal relationship to how the binary is produced, `coderBinary` stays pre-built, `go run` stays gone, and only `outdatedCLI.spec.ts` is touched. It does give back a bounded sliver of the CI-latency goal, and the bound is small. A passing run is unaffected. The cost lands only when this one test hangs, and then it is +30 s once: `--workers 1` so there is no fan-out, `CODER_E2E_TEST_RETRIES` is unset in CI so `retries` is 0 and nothing multiplies it, and the job budget is `timeout-minutes: 20`. ## Measurements Four scenarios, locally on darwin/arm64 against a freshly built `site/e2e/bin/coder`: | Scenario | setup spec | `outdatedCLI` | `install.sh` inside the test? | Result | |---|---:|---:|---|---| | Cold, empty cache | 5.7 s | 10.0 s | **no**, ran in setup | ✓ passed | | Warm cache | 340 ms | 11.9 s | **no**, 0 invocations | ✓ passed | | Prefetch fails, cache empty | 1 ms | 15.4 s | yes, inline fallback | ✓ passed | | Setup spec throws | n/a | did not run | n/a | blast radius above | The cold run is the load-bearing one: `install.sh` is invoked from the setup spec and the test runs local-only in 10.0 s, so the 84 MiB download and the 20 s probe are no longer on the assertion's clock. For context on what "local only" costs, eight consecutive `main` runs where the CI cache already made `install.sh` a no-op: | Job | duration | |---|---:| | 90382498172 | 11.7 s | | 90352398170 | 12.1 s | | 90335547858 | 8.1 s | | 90317232684 | 13.7 s | | 90297156949 | 8.4 s | | 90280065546 | 6.9 s | | 90265047082 | 6.9 s | | 90250803989 | 6.6 s | 6.6 to 13.7 seconds. This change makes that the only path rather than the lucky one. Also checked: the test name is byte identical (`ssh with client v2.8.0`) so flake tracking keeps matching it, `outdatedAgent` remains skipped, and `webTerminal`, `auditLogs`, and `updateTemplate` still pass, so the added setup dependency disturbs nothing. The full 60-test suite was not run locally because the premium tests need `CODER_E2E_LICENSE`. ## Also in this change The pinned versions move to `site/e2e/constants.ts` as `oldestSupportedCLIVersion` and `oldestSupportedAgentVersion`, so the setup spec and the tests share one source of truth, and the comments explaining *why* those particular versions travel with them. The CI cache key follows them there: it previously hashed the two spec files, and now hashes `constants.ts`, so it still invalidates exactly when a pinned version changes. ## Not addressed here The 20 second probe is relocated, not removed. `install.sh` still resolves the latest stable version on every pinned install, with no `--connect-timeout` or `--max-time`, and still treats a non-200 as fatal, so a GitHub hiccup can fail an install whose target tarball is already cached locally. That is a user-facing bug in its own right and wants its own PR, since fixing it means deciding what a pinned install should print when we no longer look up what "stable" currently is. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-29 16:26:13 -07:00
Cian Johnston	dc1d6c3f3a	ci: explicitly specify bash in mise tools installation (#27666) ... Should hopefully fix [this issue](https://github.com/coder/coder/actions/runs/30412236628/job/90710968864?pr=27628)	2026-07-29 21:48:41 +00:00
Andrew Aquino	5699f1cdfb	fix: retry and cache e2e Coder release downloads to reduce test-e2e ssh flake (#27470) ... closes DEVEX-651 ## Summary Fixes coder/internal#218 (`flake: e2e-test / test ssh`). Despite the title, the `ssh with client v2.8.0` / `ssh with agent v2.12.1` cases (`site/e2e/tests/outdatedCLI.spec.ts`, `outdatedAgent.spec.ts`) are not failing because of a bug in SSH. They fail during **setup**, in `downloadCoderVersion()`, which runs `install.sh` to fetch an old Coder release from GitHub. Transient GitHub errors (HTTP 403/503, surfacing as nonzero `curl` exit codes such as 22 or 1) make `install.sh` fail and take the whole ssh test down with it. This is an external-download flake, confirmed by the recurring `install.sh failed with code {22,1}` evidence in the issue thread and Ethan's note ("Networking issues again"). ## Changes 1. **Retry-with-backoff** (`site/e2e/helpers.ts`): `downloadCoderVersion()` now retries `install.sh` up to 5 times with exponential backoff and jitter (~1s, 2s, 4s, 8s). A single transient download failure no longer fails the test. `install.sh` already reuses completed binaries and resumes partial downloads (`curl -C -`), so retries are cheap. 2. **Cross-run cache** (`.github/workflows/ci.yaml`): the `test-e2e` job now persists `/tmp/coder-e2e-cache` with `actions/cache`, so most runs skip the GitHub download entirely. The key is derived from the spec files that pin the downloaded versions, so it invalidates when those versions change. Saves are restricted to `main` (`restore` runs everywhere), matching the existing cache-poisoning convention used for the Vale and golangci-lint caches. Before this change, neither retry, mirror, nor cross-run caching protected this path; the only caching was within a single run. ## Testing - `biome check e2e/helpers.ts` passes. - `tsc --noEmit` introduces no new errors. - CI `test-e2e` exercises the changed path. <details> <summary>Investigation notes</summary> - The failure always originates in `downloadCoderVersion` -> `install.sh` -> `fetch()` (`curl -#fL ... https://github.com/coder/coder/releases/download/vX.Y.Z/...`). - `curl` exit 22 = server returned an HTTP error (403 seen in logs); exit 1 = other transient failure. GitHub also returned 503s across the workflow in some occurrences. - `/tmp/coder-e2e-cache` was not persisted by any `actions/cache` step in `ci.yaml`, so every fresh job re-downloaded from GitHub and was exposed to the flake. - Retry addresses transient failures; the cache removes the dependency on GitHub for most runs. Combined, they target the root cause at two layers. </details> --- This PR was generated by Coder Agents on behalf of @aqandrew.	2026-07-27 09:40:43 -07:00
McKayla はな	630a68c173	chore: enable pixel auto review (#27439)	2026-07-22 19:56:39 -06:00
dependabot[bot]	850c6a712d	ci: bump the github-actions group with 6 updates (#27373) ... Bumps the github-actions group with 6 updates: | Package | From | To | | --- | --- | --- | | [actions/setup-java](https://github.com/actions/setup-java) | `5.5.0` | `5.6.0` | | [fluxcd/flux2/action](https://github.com/fluxcd/flux2) | `2.9.1` | `2.9.2` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.36.3` | `4.37.0` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.36.3` | `4.37.0` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.36.3` | `4.37.0` | | [actions/stale](https://github.com/actions/stale) | `10.3.0` | `10.4.0` | Updates `actions/setup-java` from 5.5.0 to 5.6.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/setup-java/releases">actions/setup-java's releases</a>.</em></p> <blockquote> <h2>v5.6.0</h2> <h2>What's Changed</h2> <ul> <li>Backport to v5: Add Maven compiler problem matcher for javac diagnostics by <a href="https://github.com/brunoborges"><code>@​brunoborges</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/1087">actions/setup-java#1087</a></li> <li>feat: expose cache-primary-key output (<a href="https://redirect.github.com/actions/setup-java/issues/597">#597</a>) [v5 backport] by <a href="https://github.com/brunoborges"><code>@​brunoborges</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/1089">actions/setup-java#1089</a></li> <li>dist: Cover Tencent Kona JDK 25 (<a href="https://redirect.github.com/actions/setup-java/issues/1108">#1108</a>) [v5 backport] by <a href="https://github.com/brunoborges"><code>@​brunoborges</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/1110">actions/setup-java#1110</a></li> <li>Backport <a href="https://redirect.github.com/actions/setup-java/issues/1111">#1111</a>: Preserve Maven toolchains across repeated setup-java runs (<a href="https://redirect.github.com/actions/setup-java/issues/1099">#1099</a>) by <a href="https://github.com/brunoborges"><code>@​brunoborges</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/1113">actions/setup-java#1113</a></li> <li>Backport <a href="https://redirect.github.com/actions/setup-java/issues/1097">#1097</a>/<a href="https://redirect.github.com/actions/setup-java/issues/1098">#1098</a> to v5: cache Maven and Gradle wrapper distributions separately by <a href="https://github.com/brunoborges"><code>@​brunoborges</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/1122">actions/setup-java#1122</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-java/compare/v5...v5.6.0">https://github.com/actions/setup-java/compare/v5...v5.6.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/setup-java/commit/03ad4de0992f5dab5e18fcb136590ce7c4a0ac95"><code>03ad4de</code></a> Backport <a href="https://redirect.github.com/actions/setup-java/issues/1097">#1097</a>/<a href="https://redirect.github.com/actions/setup-java/issues/1098">#1098</a>: cache Maven and Gradle wrapper distributions separately...</li> <li><a href="https://github.com/actions/setup-java/commit/d229d2e858d9137cc0b3f118fa5184b9f0a44ac4"><code>d229d2e</code></a> Backport <a href="https://redirect.github.com/actions/setup-java/issues/1111">#1111</a>: Preserve Maven toolchains across repeated setup-java runs (<a href="https://redirect.github.com/actions/setup-java/issues/1">#1</a>...</li> <li><a href="https://github.com/actions/setup-java/commit/bbf0f6967066506f72571a96d5d6c67ca42ab460"><code>bbf0f69</code></a> dist: Cover Tencent Kona JDK 25 (<a href="https://redirect.github.com/actions/setup-java/issues/1110">#1110</a>)</li> <li><a href="https://github.com/actions/setup-java/commit/513edc4f8710565e4ad696f3b7d8e3bda584a46c"><code>513edc4</code></a> feat: expose cache-primary-key output (<a href="https://redirect.github.com/actions/setup-java/issues/597">#597</a>) [v5 backport] (<a href="https://redirect.github.com/actions/setup-java/issues/1089">#1089</a>)</li> <li><a href="https://github.com/actions/setup-java/commit/62df799a9c6e3022bb466697c66c36e9a2dbf347"><code>62df799</code></a> Add Maven compiler problem matcher for javac diagnostics (<a href="https://redirect.github.com/actions/setup-java/issues/1087">#1087</a>)</li> <li><a href="https://github.com/actions/setup-java/commit/176156a187714aaf460b0a3c8f21e8b4f784b978"><code>176156a</code></a> chore: bump version to 5.6.0 for v5 release line</li> <li><a href="https://github.com/actions/setup-java/commit/bf7b8deac240b9cee05eb15ccdb1d2f424a54b9f"><code>bf7b8de</code></a> build: rebuild dist for backported changes (<a href="https://redirect.github.com/actions/setup-java/issues/1079">#1079</a>, <a href="https://redirect.github.com/actions/setup-java/issues/1083">#1083</a>, <a href="https://redirect.github.com/actions/setup-java/issues/1084">#1084</a>)</li> <li><a href="https://github.com/actions/setup-java/commit/0173e6dd1b6e53ac3f6d68d220fa24cce79ae77c"><code>0173e6d</code></a> Infer distribution from asdf .tool-versions vendor prefix (<a href="https://redirect.github.com/actions/setup-java/issues/1084">#1084</a>)</li> <li><a href="https://github.com/actions/setup-java/commit/f45cd82b67042e9e5c24cef950ea0c61736241c6"><code>f45cd82</code></a> Rename jdkFile input to jdk-file with deprecated alias (<a href="https://redirect.github.com/actions/setup-java/issues/1083">#1083</a>)</li> <li><a href="https://github.com/actions/setup-java/commit/e2863ad49937c063e5a23922d1971a105f4f0140"><code>e2863ad</code></a> Map Zulu x86 architecture to i686 for Azul Metadata API (<a href="https://redirect.github.com/actions/setup-java/issues/1079">#1079</a>)</li> <li>Additional commits viewable in <a href="https://github.com/actions/setup-java/compare/0f481fcb613427c0f801b606911222b5b6f3083a...03ad4de0992f5dab5e18fcb136590ce7c4a0ac95">compare view</a></li> </ul> </details> <br /> Updates `fluxcd/flux2/action` from 2.9.1 to 2.9.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/fluxcd/flux2/releases">fluxcd/flux2/action's releases</a>.</em></p> <blockquote> <h2>v2.9.2</h2> <h2>Highlights</h2> <p>Flux v2.9.2 is a patch release. The main fix addresses a regression introduced in v2.9.1 where a Kustomization with <code>openapi.path</code> pointing to a URL failed to reconcile with <code>failed to read OpenAPI schema</code>. This release also corrects several CRD field descriptions that contained inaccurate or leaked content. Users are encouraged to upgrade for the best experience.</p> <p>ℹ️ Please follow the <a href="https://github.com/fluxcd/flux2/discussions/5572">Upgrade Procedure for Flux v2.7+</a> for a smooth upgrade from Flux v2.6 to the latest version.</p> <p>Fixes:</p> <ul> <li>Fix a regression where a Kustomization with <code>openapi.path</code> pointing to a URL failed to reconcile with <code>failed to read OpenAPI schema</code> (kustomize-controller)</li> <li>Fix the <code>HelmChart</code> CRD description for <code>.status.url</code>, which pointed users at <code>BucketStatus.Artifact</code> instead of <code>HelmChartStatus.Artifact</code> (source-controller)</li> <li>Fix the <code>ImageRepository</code> CRD description for <code>.status.observedExclusionList</code>, which referred to <code>spec.lastScanResult</code> instead of <code>status.lastScanResult</code> (image-reflector-controller)</li> <li>Fix the <code>ImageUpdateAutomation</code> CRD description for <code>.status.observedSourceRevision</code>, which had a stray Go struct declaration leaking into it (image-automation-controller)</li> </ul> <p>Improvements:</p> <ul> <li>Update fluxcd/pkg dependencies</li> </ul> <h2>Components changelog</h2> <ul> <li>source-controller <a href="https://github.com/fluxcd/source-controller/blob/v1.9.3/CHANGELOG.md">v1.9.3</a></li> <li>kustomize-controller <a href="https://github.com/fluxcd/kustomize-controller/blob/v1.9.3/CHANGELOG.md">v1.9.3</a></li> <li>helm-controller <a href="https://github.com/fluxcd/helm-controller/blob/v1.6.2/CHANGELOG.md">v1.6.2</a></li> <li>notification-controller <a href="https://github.com/fluxcd/notification-controller/blob/v1.9.2/CHANGELOG.md">v1.9.2</a></li> <li>image-reflector-controller <a href="https://github.com/fluxcd/image-reflector-controller/blob/v1.2.3/CHANGELOG.md">v1.2.3</a></li> <li>image-automation-controller <a href="https://github.com/fluxcd/image-automation-controller/blob/v1.2.3/CHANGELOG.md">v1.2.3</a></li> <li>source-watcher <a href="https://github.com/fluxcd/source-watcher/blob/v2.2.2/CHANGELOG.md">v2.2.2</a></li> </ul> <h2>CLI changelog</h2> <ul> <li>Update fluxcd/pkg dependencies by <a href="https://github.com/fluxcdbot"><code>@​fluxcdbot</code></a> in <a href="https://redirect.github.com/fluxcd/flux2/pull/5984">fluxcd/flux2#5984</a></li> <li>Update fluxcd/pkg dependencies by <a href="https://github.com/fluxcdbot"><code>@​fluxcdbot</code></a> in <a href="https://redirect.github.com/fluxcd/flux2/pull/5990">fluxcd/flux2#5990</a></li> <li>Update toolkit components by <a href="https://github.com/fluxcdbot"><code>@​fluxcdbot</code></a> in <a href="https://redirect.github.com/fluxcd/flux2/pull/5994">fluxcd/flux2#5994</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/fluxcd/flux2/compare/v2.9.1...v2.9.2">https://github.com/fluxcd/flux2/compare/v2.9.1...v2.9.2</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/fluxcd/flux2/commit/6a650dba1b4ae9945185c4bb3cc3f386aaf71b3d"><code>6a650db</code></a> Merge pull request <a href="https://redirect.github.com/fluxcd/flux2/issues/5994">#5994</a> from fluxcd/update-components-release/v2.9.x</li> <li><a href="https://github.com/fluxcd/flux2/commit/00b96327ed5c15ba20196e0005627eb837051986"><code>00b9632</code></a> Update toolkit components</li> <li><a href="https://github.com/fluxcd/flux2/commit/dc8430cb71860755d1b90dab23a784fc36eea9ad"><code>dc8430c</code></a> Merge pull request <a href="https://redirect.github.com/fluxcd/flux2/issues/5990">#5990</a> from fluxcd/update-pkg-deps/release/v2.9.x</li> <li><a href="https://github.com/fluxcd/flux2/commit/c21de821a91ceea8df417bdb7075e9e2476ca854"><code>c21de82</code></a> Update fluxcd/pkg dependencies</li> <li><a href="https://github.com/fluxcd/flux2/commit/fa3c7b8a0702424a0ccf4ef8f1f7c95b4b1efd2e"><code>fa3c7b8</code></a> Merge pull request <a href="https://redirect.github.com/fluxcd/flux2/issues/5984">#5984</a> from fluxcd/update-pkg-deps/release/v2.9.x</li> <li><a href="https://github.com/fluxcd/flux2/commit/de86a518c2b29e47418492f3b3075f8191b6cb20"><code>de86a51</code></a> Update fluxcd/pkg dependencies</li> <li>See full diff in <a href="https://github.com/fluxcd/flux2/compare/f05a280b876a3a1d35a76a91f701e605777853aa...6a650dba1b4ae9945185c4bb3cc3f386aaf71b3d">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action/upload-sarif` from 4.36.3 to 4.37.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/upload-sarif's releases</a>.</em></p> <blockquote> <h2>v4.37.0</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li> <li>In addition to the existing input format, the <code>config-file</code> input for the <code>codeql-action/init</code> step will soon support a new <code>[owner/]repo[@ref][:path]</code> format. All components except the repository name are optional. If omitted, <code>owner</code> defaults to the same owner as the repository the analysis is running for, <code>ref</code> to <code>main</code>, and <code>path</code> to <code>.github/codeql-action.yaml</code>. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/upload-sarif's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.37.1 - 16 Jul 2026</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li> </ul> <h2>4.37.0 - 08 Jul 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li> <li>In addition to the existing input format, the <code>config-file</code> input for the <code>codeql-action/init</code> step will soon support a new <code>[owner/]repo[@ref][:path]</code> format. All components except the repository name are optional. If omitted, <code>owner</code> defaults to the same owner as the repository the analysis is running for, <code>ref</code> to <code>main</code>, and <code>path</code> to <code>.github/codeql-action.yaml</code>. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li> </ul> <h2>4.36.3 - 01 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.36.2 - 04 Jun 2026</h2> <ul> <li>Cache CodeQL CLI version information across Actions steps. <a href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li> <li>Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. <a href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li> </ul> <h2>4.36.1 - 02 Jun 2026</h2> <p>No user facing changes.</p> <h2>4.36.0 - 22 May 2026</h2> <ul> <li><em>Breaking change</em>: Bump the minimum required CodeQL bundle version to 2.19.4. <a href="https://redirect.github.com/github/codeql-action/pull/3894">#3894</a></li> <li>Add support for SHA-256 Git object IDs. <a href="https://redirect.github.com/github/codeql-action/pull/3893">#3893</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5">2.25.5</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3926">#3926</a></li> </ul> <h2>4.35.5 - 15 May 2026</h2> <ul> <li>We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3899">#3899</a></li> <li>For performance and accuracy reasons, <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a> will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. <a href="https://redirect.github.com/github/codeql-action/pull/3791">#3791</a></li> <li>If multiple inputs are provided for the GitHub-internal <code>analysis-kinds</code> input, only <code>code-scanning</code> will be enabled. The <code>analysis-kinds</code> input is experimental, for GitHub-internal use only, and may change without notice at any time. <a href="https://redirect.github.com/github/codeql-action/pull/3892">#3892</a></li> <li>Added an experimental change which, when running a Code Scanning analysis for a PR with <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a> enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. <a href="https://redirect.github.com/github/codeql-action/pull/3880">#3880</a></li> </ul> <h2>4.35.4 - 07 May 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4">2.25.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3881">#3881</a></li> </ul> <h2>4.35.3 - 01 May 2026</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/99df26d4f13ea111d4ec1a7dddef6063f76b97e9"><code>99df26d</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3996">#3996</a> from github/update-v4.37.0-c7c896d71</li> <li><a href="https://github.com/github/codeql-action/commit/31c27074fda95256cda077009907f8a6022dd7c0"><code>31c2707</code></a> Add changenote for <a href="https://redirect.github.com/github/codeql-action/issues/3973">#3973</a></li> <li><a href="https://github.com/github/codeql-action/commit/72df2181aac054d1f4b44264399d2aac12cf11c6"><code>72df218</code></a> Update changelog for v4.37.0</li> <li><a href="https://github.com/github/codeql-action/commit/c7c896d71b3055d36f2aff93b16bcc6c69923b91"><code>c7c896d</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3995">#3995</a> from github/update-bundle/codeql-bundle-v2.26.0</li> <li><a href="https://github.com/github/codeql-action/commit/3f34ff0ea3f5153c96071437b7cbf71ea3757146"><code>3f34ff0</code></a> Add changelog note</li> <li><a href="https://github.com/github/codeql-action/commit/43bec09f1dc368b430cab4b5d69799bc904079d1"><code>43bec09</code></a> Update default bundle to codeql-bundle-v2.26.0</li> <li><a href="https://github.com/github/codeql-action/commit/f58f0d11ebf5dedd870fab2f999275f7602cfa46"><code>f58f0d1</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3973">#3973</a> from github/mbg/repo-props/config-file-shorthands</li> <li><a href="https://github.com/github/codeql-action/commit/7dc37cbb5b3e37f0e1cd1f18b61e0ea849898fb8"><code>7dc37cb</code></a> Merge remote-tracking branch 'origin/main' into mbg/repo-props/config-file-sh...</li> <li><a href="https://github.com/github/codeql-action/commit/8e22350a7e28c34c82a5a499fc241923301c2c4f"><code>8e22350</code></a> Thread <code>ActionState</code> to <code>initConfig</code></li> <li><a href="https://github.com/github/codeql-action/commit/69c9e8c7d918cf2fee13b8b72fdde15883ff155b"><code>69c9e8c</code></a> Mark some <code>status-report</code> imports as <code>type</code>-only to avoid circular dependencies</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/54f647b7e1bb85c95cddabcd46b0c578ec92bc1a...99df26d4f13ea111d4ec1a7dddef6063f76b97e9">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action/init` from 4.36.3 to 4.37.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/init's releases</a>.</em></p> <blockquote> <h2>v4.37.0</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li> <li>In addition to the existing input format, the <code>config-file</code> input for the <code>codeql-action/init</code> step will soon support a new <code>[owner/]repo[@ref][:path]</code> format. All components except the repository name are optional. If omitted, <code>owner</code> defaults to the same owner as the repository the analysis is running for, <code>ref</code> to <code>main</code>, and <code>path</code> to <code>.github/codeql-action.yaml</code>. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/init's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.37.1 - 16 Jul 2026</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li> </ul> <h2>4.37.0 - 08 Jul 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li> <li>In addition to the existing input format, the <code>config-file</code> input for the <code>codeql-action/init</code> step will soon support a new <code>[owner/]repo[@ref][:path]</code> format. All components except the repository name are optional. If omitted, <code>owner</code> defaults to the same owner as the repository the analysis is running for, <code>ref</code> to <code>main</code>, and <code>path</code> to <code>.github/codeql-action.yaml</code>. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li> </ul> <h2>4.36.3 - 01 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.36.2 - 04 Jun 2026</h2> <ul> <li>Cache CodeQL CLI version information across Actions steps. <a href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li> <li>Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. <a href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li> </ul> <h2>4.36.1 - 02 Jun 2026</h2> <p>No user facing changes.</p> <h2>4.36.0 - 22 May 2026</h2> <ul> <li><em>Breaking change</em>: Bump the minimum required CodeQL bundle version to 2.19.4. <a href="https://redirect.github.com/github/codeql-action/pull/3894">#3894</a></li> <li>Add support for SHA-256 Git object IDs. <a href="https://redirect.github.com/github/codeql-action/pull/3893">#3893</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5">2.25.5</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3926">#3926</a></li> </ul> <h2>4.35.5 - 15 May 2026</h2> <ul> <li>We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3899">#3899</a></li> <li>For performance and accuracy reasons, <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a> will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. <a href="https://redirect.github.com/github/codeql-action/pull/3791">#3791</a></li> <li>If multiple inputs are provided for the GitHub-internal <code>analysis-kinds</code> input, only <code>code-scanning</code> will be enabled. The <code>analysis-kinds</code> input is experimental, for GitHub-internal use only, and may change without notice at any time. <a href="https://redirect.github.com/github/codeql-action/pull/3892">#3892</a></li> <li>Added an experimental change which, when running a Code Scanning analysis for a PR with <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a> enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. <a href="https://redirect.github.com/github/codeql-action/pull/3880">#3880</a></li> </ul> <h2>4.35.4 - 07 May 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4">2.25.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3881">#3881</a></li> </ul> <h2>4.35.3 - 01 May 2026</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/99df26d4f13ea111d4ec1a7dddef6063f76b97e9"><code>99df26d</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3996">#3996</a> from github/update-v4.37.0-c7c896d71</li> <li><a href="https://github.com/github/codeql-action/commit/31c27074fda95256cda077009907f8a6022dd7c0"><code>31c2707</code></a> Add changenote for <a href="https://redirect.github.com/github/codeql-action/issues/3973">#3973</a></li> <li><a href="https://github.com/github/codeql-action/commit/72df2181aac054d1f4b44264399d2aac12cf11c6"><code>72df218</code></a> Update changelog for v4.37.0</li> <li><a href="https://github.com/github/codeql-action/commit/c7c896d71b3055d36f2aff93b16bcc6c69923b91"><code>c7c896d</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3995">#3995</a> from github/update-bundle/codeql-bundle-v2.26.0</li> <li><a href="https://github.com/github/codeql-action/commit/3f34ff0ea3f5153c96071437b7cbf71ea3757146"><code>3f34ff0</code></a> Add changelog note</li> <li><a href="https://github.com/github/codeql-action/commit/43bec09f1dc368b430cab4b5d69799bc904079d1"><code>43bec09</code></a> Update default bundle to codeql-bundle-v2.26.0</li> <li><a href="https://github.com/github/codeql-action/commit/f58f0d11ebf5dedd870fab2f999275f7602cfa46"><code>f58f0d1</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3973">#3973</a> from github/mbg/repo-props/config-file-shorthands</li> <li><a href="https://github.com/github/codeql-action/commit/7dc37cbb5b3e37f0e1cd1f18b61e0ea849898fb8"><code>7dc37cb</code></a> Merge remote-tracking branch 'origin/main' into mbg/repo-props/config-file-sh...</li> <li><a href="https://github.com/github/codeql-action/commit/8e22350a7e28c34c82a5a499fc241923301c2c4f"><code>8e22350</code></a> Thread <code>ActionState</code> to <code>initConfig</code></li> <li><a href="https://github.com/github/codeql-action/commit/69c9e8c7d918cf2fee13b8b72fdde15883ff155b"><code>69c9e8c</code></a> Mark some <code>status-report</code> imports as <code>type</code>-only to avoid circular dependencies</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/54f647b7e1bb85c95cddabcd46b0c578ec92bc1a...99df26d4f13ea111d4ec1a7dddef6063f76b97e9">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action/analyze` from 4.36.3 to 4.37.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/analyze's releases</a>.</em></p> <blockquote> <h2>v4.37.0</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li> <li>In addition to the existing input format, the <code>config-file</code> input for the <code>codeql-action/init</code> step will soon support a new <code>[owner/]repo[@ref][:path]</code> format. All components except the repository name are optional. If omitted, <code>owner</code> defaults to the same owner as the repository the analysis is running for, <code>ref</code> to <code>main</code>, and <code>path</code> to <code>.github/codeql-action.yaml</code>. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/analyze's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.37.1 - 16 Jul 2026</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li> </ul> <h2>4.37.0 - 08 Jul 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li> <li>In addition to the existing input format, the <code>config-file</code> input for the <code>codeql-action/init</code> step will soon support a new <code>[owner/]repo[@ref][:path]</code> format. All components except the repository name are optional. If omitted, <code>owner</code> defaults to the same owner as the repository the analysis is running for, <code>ref</code> to <code>main</code>, and <code>path</code> to <code>.github/codeql-action.yaml</code>. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li> </ul> <h2>4.36.3 - 01 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.36.2 - 04 Jun 2026</h2> <ul> <li>Cache CodeQL CLI version information across Actions steps. <a href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li> <li>Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. <a href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li> </ul> <h2>4.36.1 - 02 Jun 2026</h2> <p>No user facing changes.</p> <h2>4.36.0 - 22 May 2026</h2> <ul> <li><em>Breaking change</em>: Bump the minimum required CodeQL bundle version to 2.19.4. <a href="https://redirect.github.com/github/codeql-action/pull/3894">#3894</a></li> <li>Add support for SHA-256 Git object IDs. <a href="https://redirect.github.com/github/codeql-action/pull/3893">#3893</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5">2.25.5</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3926">#3926</a></li> </ul> <h2>4.35.5 - 15 May 2026</h2> <ul> <li>We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3899">#3899</a></li> <li>For performance and accuracy reasons, <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a> will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. <a href="https://redirect.github.com/github/codeql-action/pull/3791">#3791</a></li> <li>If multiple inputs are provided for the GitHub-internal <code>analysis-kinds</code> input, only <code>code-scanning</code> will be enabled. The <code>analysis-kinds</code> input is experimental, for GitHub-internal use only, and may change without notice at any time. <a href="https://redirect.github.com/github/codeql-action/pull/3892">#3892</a></li> <li>Added an experimental change which, when running a Code Scanning analysis for a PR with <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a> enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. <a href="https://redirect.github.com/github/codeql-action/pull/3880">#3880</a></li> </ul> <h2>4.35.4 - 07 May 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4">2.25.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3881">#3881</a></li> </ul> <h2>4.35.3 - 01 May 2026</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/99df26d4f13ea111d4ec1a7dddef6063f76b97e9"><code>99df26d</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3996">#3996</a> from github/update-v4.37.0-c7c896d71</li> <li><a href="https://github.com/github/codeql-action/commit/31c27074fda95256cda077009907f8a6022dd7c0"><code>31c2707</code></a> Add changenote for <a href="https://redirect.github.com/github/codeql-action/issues/3973">#3973</a></li> <li><a href="https://github.com/github/codeql-action/commit/72df2181aac054d1f4b44264399d2aac12cf11c6"><code>72df218</code></a> Update changelog for v4.37.0</li> <li><a href="https://github.com/github/codeql-action/commit/c7c896d71b3055d36f2aff93b16bcc6c69923b91"><code>c7c896d</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3995">#3995</a> from github/update-bundle/codeql-bundle-v2.26.0</li> <li><a href="https://github.com/github/codeql-action/commit/3f34ff0ea3f5153c96071437b7cbf71ea3757146"><code>3f34ff0</code></a> Add changelog note</li> <li><a href="https://github.com/github/codeql-action/commit/43bec09f1dc368b430cab4b5d69799bc904079d1"><code>43bec09</code></a> Update default bundle to codeql-bundle-v2.26.0</li> <li><a href="https://github.com/github/codeql-action/commit/f58f0d11ebf5dedd870fab2f999275f7602cfa46"><code>f58f0d1</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3973">#3973</a> from github/mbg/repo-props/config-file-shorthands</li> <li><a href="https://github.com/github/codeql-action/commit/7dc37cbb5b3e37f0e1cd1f18b61e0ea849898fb8"><code>7dc37cb</code></a> Merge remote-tracking branch 'origin/main' into mbg/repo-props/config-file-sh...</li> <li><a href="https://github.com/github/codeql-action/commit/8e22350a7e28c34c82a5a499fc241923301c2c4f"><code>8e22350</code></a> Thread <code>ActionState</code> to <code>initConfig</code></li> <li><a href="https://github.com/github/codeql-action/commit/69c9e8c7d918cf2fee13b8b72fdde15883ff155b"><code>69c9e8c</code></a> Mark some <code>status-report</code> imports as <code>type</code>-only to avoid circular dependencies</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/54f647b7e1bb85c95cddabcd46b0c578ec92bc1a...99df26d4f13ea111d4ec1a7dddef6063f76b97e9">compare view</a></li> </ul> </details> <br /> Updates `actions/stale` from 10.3.0 to 10.4.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/stale/releases">actions/stale's releases</a>.</em></p> <blockquote> <h2>v10.4.0</h2> <h2>What's Changed</h2> <h3>Bug Fix</h3> <ul> <li>Fixed <code>only-issue-types</code> validation by <a href="https://github.com/trueberryless"><code>@​trueberryless</code></a> in <a href="https://redirect.github.com/actions/stale/pull/1338">actions/stale#1338</a></li> </ul> <h3>Dependency Updates</h3> <ul> <li>Bump undici to 6.27.0 via override, clean up stale license files, and version to 10.4.0. by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/actions/stale/pull/1342">actions/stale#1342</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/trueberryless"><code>@​trueberryless</code></a> made their first contribution in <a href="https://redirect.github.com/actions/stale/pull/1338">actions/stale#1338</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/stale/compare/v10.3.0...v10.4.0">https://github.com/actions/stale/compare/v10.3.0...v10.4.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/stale/commit/1e223db275d687790206a7acac4d1a11bd6fe629"><code>1e223db</code></a> Bump undici to 6.27.0 via override, clean up stale license files, and version...</li> <li><a href="https://github.com/actions/stale/commit/9461cb10066d1553762bac6a02599ab8c26b14dd"><code>9461cb1</code></a> fix: <code>only-issue-types</code> does not affect PRs (<a href="https://redirect.github.com/actions/stale/issues/1338">#1338</a>)</li> <li>See full diff in <a href="https://github.com/actions/stale/compare/eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899...1e223db275d687790206a7acac4d1a11bd6fe629">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-21 11:26:17 +00:00
Faur Ioan-Aurel	0caaac5d27	fix: prebuild coderd before Playwright startup for e2e tests (#27136) ... The test-e2e job could flake while Playwright waited for its webServer to become ready. CI already built site/e2e/bin/coder, but that binary was built before pnpm build and without the embed tag, so Playwright ignored it and started coderd with go run -tags embed instead. That put Go compilation, including frontend asset embedding, inside Playwright's webServer timeout. Local runs had a similar ordering trap. pnpm playwright:test invoked Playwright directly, and Playwright starts webServer before globalSetup, so the existing preflight build could not guarantee a binary existed before webServer startup. Build the E2E coder binary with the embed tag and make it depend on site/out/index.html. In CI, build the frontend first, then build the E2E binary, then run Playwright. For local runs, have pnpm playwright:test and pnpm playwright:test-ui run make site/e2e/bin/coder before invoking Playwright. Playwright now starts the prebuilt site/e2e/bin/coder binary and waits on the public /healthz endpoint instead of an authenticated API endpoint. This keeps compilation outside the webServer readiness timeout and makes the readiness probe quieter and more direct. I moved to /healtz because the existing endpoint was returning 401, which still means “server is up,” but it is a strange readiness signal. /healthz is explicitly public and returns 200 OK once the HTTP server is accepting requests. Caveat: running pnpm exec playwright test --config=e2e/playwright.config.ts directly bypasses the package script and therefore bypasses the prebuild. Use pnpm playwright:test or make test-e2e for the supported local flow. Because the site package scripts now call make, add make to knip's ignored system binaries. Tests: - pnpm lint:types - pnpm exec playwright test --config=e2e/playwright.config.ts --list - PATH="/opt/homebrew/opt/make/libexec/gnubin:/opt/homebrew/opt/gnu-getopt/bin:$PATH" make gen/mark-fresh - PATH="/opt/homebrew/opt/make/libexec/gnubin:/opt/homebrew/opt/gnu-getopt/bin:$PATH" pnpm playwright:test --list <!-- If you have used AI to produce some or all of this PR, please ensure you have read our [AI Contribution guidelines](https://coder.com/docs/about/contributing/AI_CONTRIBUTING) before submitting. -->	2026-07-15 21:21:59 +03:00
Ethan	304f127d34	ci(.github): remove the go-cache action (#27250) ... Closes https://github.com/coder/internal/issues/1619 Closes ENG-3039 Closes https://github.com/coder/internal/issues/1002 Closes ENG-3018 The `test-go-pg` Go cache grew until the post-job save could no longer complete within the job timeout, cancelling the job on every `main` run. Depot runners already provide remote Go build caching via [`GOCACHEPROG`](https://depot.dev/docs/cache/integrations/gocache), which writes every object it serves into `GOCACHE` and never evicts, so persisting `GOCACHE` with `actions/cache` on top just carries an ever-growing directory forward. #20510 removed the custom build cache steps for exactly this reason, and the `go-cache` action introduced in #25727 unintentionally reinstated them. The action is now removed entirely, along with its module cache persistence: a full cache miss plus cold `go mod download` on a Depot runner takes about 10 seconds, faster than any warm `actions/cache` restore of the module cache was. `setup-go-paths` is kept, as it points `GOCACHE` and friends at the Windows RAM disk, but its now-unused caching-related outputs are removed.	2026-07-15 18:35:18 +10:00
dependabot[bot]	8c1d8ff149	ci: bump the github-actions group across 1 directory with 26 updates (#27228) ... Bumps the github-actions group with 26 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `6.0.2` | `7.0.0` | | [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.17.0` | `2.20.0` | | [dorny/paths-filter](https://github.com/dorny/paths-filter) | `4.0.1` | `4.0.2` | | [tj-actions/changed-files](https://github.com/tj-actions/changed-files) | `47.0.5` | `47.0.6` | | [actions/cache/restore](https://github.com/actions/cache) | `5.0.5` | `6.1.0` | | [actions/cache/save](https://github.com/actions/cache) | `5.0.5` | `6.1.0` | | [docker/login-action](https://github.com/docker/login-action) | `4.1.0` | `4.4.0` | | [actions/setup-java](https://github.com/actions/setup-java) | `5.2.0` | `5.5.0` | | [actions/attest](https://github.com/actions/attest) | `4.1.0` | `4.1.1` | | [actions/create-github-app-token](https://github.com/actions/create-github-app-token) | `3.1.1` | `3.2.0` | | [dependabot/fetch-metadata](https://github.com/dependabot/fetch-metadata) | `3.0.0` | `3.1.0` | | [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) | `6.1.0` | `6.2.2` | | [fluxcd/flux2/action](https://github.com/fluxcd/flux2) | `2.8.5` | `2.9.1` | | [depot/build-push-action](https://github.com/depot/build-push-action) | `1.17.0` | `1.18.0` | | [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `4.0.0` | `4.2.0` | | [linear/linear-release-action](https://github.com/linear/linear-release-action) | `0.7.0` | `0.14.5` | | [toshimaru/auto-author-assign](https://github.com/toshimaru/auto-author-assign) | `3.0.1` | `3.0.3` | | [benc-uk/workflow-dispatch](https://github.com/benc-uk/workflow-dispatch) | `1.3.1` | `1.3.2` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.35.1` | `4.36.3` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.35.1` | `4.36.3` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.35.1` | `4.36.3` | | [actions/stale](https://github.com/actions/stale) | `10.2.0` | `10.3.0` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `4.2.1` | `8.0.1` | | [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) | `7.0.8` | `8.1.1` | | [actions/cache](https://github.com/actions/cache) | `5.0.5` | `6.1.0` | | [umbrelladocs/action-linkspector](https://github.com/umbrelladocs/action-linkspector) | `1.5.2` | `1.5.4` | Updates `actions/checkout` from 6.0.2 to 7.0.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/releases">actions/checkout's releases</a>.</em></p> <blockquote> <h2>v7.0.0</h2> <h2>What's Changed</h2> <ul> <li>block checking out fork pr for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> <li>Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2458">actions/checkout#2458</a></li> <li>Bump flatted from 3.3.1 to 3.4.2 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2460">actions/checkout#2460</a></li> <li>Bump js-yaml from 4.1.0 to 4.2.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2461">actions/checkout#2461</a></li> <li>Bump <code>@​actions/core</code> and <code>@​actions/tool-cache</code> and Remove uuid by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2459">actions/checkout#2459</a></li> <li>upgrade module to esm and update dependencies by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2463">actions/checkout#2463</a></li> <li>Bump the minor-npm-dependencies group across 1 directory with 3 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2462">actions/checkout#2462</a></li> <li>getting ready for checkout v7 release by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2464">actions/checkout#2464</a></li> <li>update error wording by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2467">actions/checkout#2467</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6.0.3...v7.0.0">https://github.com/actions/checkout/compare/v6.0.3...v7.0.0</a></p> <h2>v6.0.3</h2> <h2>What's Changed</h2> <ul> <li>Update changelog by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2357">actions/checkout#2357</a></li> <li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> <li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li> <li>Update changelog for v6.0.3 by <a href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2446">actions/checkout#2446</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/yaananth"><code>@​yaananth</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6...v6.0.3">https://github.com/actions/checkout/compare/v6...v6.0.3</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2>v7.0.0</h2> <ul> <li>Block checking out fork PR for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> <li>Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2458">actions/checkout#2458</a></li> <li>Bump flatted from 3.3.1 to 3.4.2 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2460">actions/checkout#2460</a></li> <li>Bump js-yaml from 4.1.0 to 4.2.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2461">actions/checkout#2461</a></li> <li>Bump <code>@​actions/core</code> and <code>@​actions/tool-cache</code> and Remove uuid by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2459">actions/checkout#2459</a></li> <li>upgrade module to esm and update dependencies by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2463">actions/checkout#2463</a></li> <li>Bump the minor-npm-dependencies group across 1 directory with 3 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2462">actions/checkout#2462</a></li> </ul> <h2>v6.0.3</h2> <ul> <li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li> <li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> </ul> <h2>v6.0.2</h2> <ul> <li>Fix tag handling: preserve annotations and explicit fetch-tags by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li> </ul> <h2>v6.0.1</h2> <ul> <li>Add worktree support for persist-credentials includeIf by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li> </ul> <h2>v6.0.0</h2> <ul> <li>Persist creds to a separate file by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li> <li>Update README to include Node.js 24 support details and requirements by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li> </ul> <h2>v5.0.1</h2> <ul> <li>Port v6 cleanup to v5 by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li> </ul> <h2>v5.0.0</h2> <ul> <li>Update actions checkout to use node 24 by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li> </ul> <h2>v4.3.1</h2> <ul> <li>Port v6 cleanup to v4 by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li> </ul> <h2>v4.3.0</h2> <ul> <li>docs: update README.md by <a href="https://github.com/motss"><code>@​motss</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li> <li>Add internal repos for checking out multiple repositories by <a href="https://github.com/mouismail"><code>@​mouismail</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li> <li>Documentation update - add recommended permissions to Readme by <a href="https://github.com/benwells"><code>@​benwells</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li> <li>Adjust positioning of user email note and permissions heading by <a href="https://github.com/joshmgross"><code>@​joshmgross</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li> <li>Update README.md by <a href="https://github.com/nebuk89"><code>@​nebuk89</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li> <li>Update CODEOWNERS for actions by <a href="https://github.com/TingluoHuang"><code>@​TingluoHuang</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li> <li>Update package dependencies by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li> </ul> <h2>v4.2.2</h2> <ul> <li><code>url-helper.ts</code> now leverages well-known environment variables by <a href="https://github.com/jww3"><code>@​jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li> <li>Expand unit test coverage for <code>isGhes</code> by <a href="https://github.com/jww3"><code>@​jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li> </ul> <h2>v4.2.1</h2> <ul> <li>Check out other refs/* by commit if provided, fall back to ref by <a href="https://github.com/orhantoy"><code>@​orhantoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/checkout/commit/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0"><code>9c091bb</code></a> update error wording (<a href="https://redirect.github.com/actions/checkout/issues/2467">#2467</a>)</li> <li><a href="https://github.com/actions/checkout/commit/1044a6dea927916f2c38ba5aeffbc0a847b1221a"><code>1044a6d</code></a> getting ready for checkout v7 release (<a href="https://redirect.github.com/actions/checkout/issues/2464">#2464</a>)</li> <li><a href="https://github.com/actions/checkout/commit/f0282184c7ce73ab54c7e4ab5a617122602e575f"><code>f028218</code></a> Bump the minor-npm-dependencies group across 1 directory with 3 updates (<a href="https://redirect.github.com/actions/checkout/issues/2462">#2462</a>)</li> <li><a href="https://github.com/actions/checkout/commit/d914b262ffc244530a203ab40decab34c3abf34d"><code>d914b26</code></a> upgrade module to esm and update dependencies (<a href="https://redirect.github.com/actions/checkout/issues/2463">#2463</a>)</li> <li><a href="https://github.com/actions/checkout/commit/537c7ef99cef6e5ddb5e7ff5d16d14510503801d"><code>537c7ef</code></a> Bump <code>@​actions/core</code> and <code>@​actions/tool-cache</code> and Remove uuid (<a href="https://redirect.github.com/actions/checkout/issues/2459">#2459</a>)</li> <li><a href="https://github.com/actions/checkout/commit/130a169078a413d3a5246a393625e8e742f387f6"><code>130a169</code></a> Bump js-yaml from 4.1.0 to 4.2.0 (<a href="https://redirect.github.com/actions/checkout/issues/2461">#2461</a>)</li> <li><a href="https://github.com/actions/checkout/commit/7d09575332117a40b46e5e020664df234cd416f3"><code>7d09575</code></a> Bump flatted from 3.3.1 to 3.4.2 (<a href="https://redirect.github.com/actions/checkout/issues/2460">#2460</a>)</li> <li><a href="https://github.com/actions/checkout/commit/0f9f3aa320cb53abeb534aeb54048075d9697a0e"><code>0f9f3aa</code></a> Bump actions/publish-immutable-action (<a href="https://redirect.github.com/actions/checkout/issues/2458">#2458</a>)</li> <li><a href="https://github.com/actions/checkout/commit/f9e715a95fcd1f9253f77dd28f11e88d2d6460c7"><code>f9e715a</code></a> block checking out fork pr for pull_request_target and workflow_run (<a href="https://redirect.github.com/actions/checkout/issues/2454">#2454</a>)</li> <li><a href="https://github.com/actions/checkout/commit/df4cb1c069e1874edd31b4311f1884172cec0e10"><code>df4cb1c</code></a> Update changelog for v6.0.3 (<a href="https://redirect.github.com/actions/checkout/issues/2446">#2446</a>)</li> <li>Additional commits viewable in <a href="https://github.com/actions/checkout/compare/v6.0.2...9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0">compare view</a></li> </ul> </details> <br /> Updates `step-security/harden-runner` from 2.17.0 to 2.20.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/step-security/harden-runner/releases">step-security/harden-runner's releases</a>.</em></p> <blockquote> <h2>v2.20.0</h2> <h2>What's Changed</h2> <ul> <li>Support for block policy for MacOS and Windows GitHub-hosted runners</li> <li>Support for Bitrise MacOS GitHub Actions runners</li> <li>HTTPS monitoring support for Bun for Linux runners (enterprise tier)</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/step-security/harden-runner/compare/v2.19.4...v2.20.0">https://github.com/step-security/harden-runner/compare/v2.19.4...v2.20.0</a></p> <h2>v2.19.4</h2> <h2>What's Changed</h2> <ul> <li>Improvements for HTTPS Monitoring for the Enterprise tier of Harden Runner</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/step-security/harden-runner/compare/v2.19.3...v2.19.4">https://github.com/step-security/harden-runner/compare/v2.19.3...v2.19.4</a></p> <h2>v2.19.3</h2> <h2>What's Changed</h2> <ul> <li>Default to audit mode when api-key missing with use-policy-store by <a href="https://github.com/varunsh-coder"><code>@​varunsh-coder</code></a> in <a href="https://redirect.github.com/step-security/harden-runner/pull/665">step-security/harden-runner#665</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/step-security/harden-runner/compare/v2.19.2...v2.19.3">https://github.com/step-security/harden-runner/compare/v2.19.2...v2.19.3</a></p> <h2>v2.19.2</h2> <h2>What's Changed</h2> <ul> <li>Update the Harden Runner agent for enterprise tier to use go 1.26 and fix minor bugs.</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/step-security/harden-runner/compare/v2.19.1...v2.19.2">https://github.com/step-security/harden-runner/compare/v2.19.1...v2.19.2</a></p> <h2>v2.19.1</h2> <h2>What's Changed</h2> <ul> <li>fix: detect ubuntu-slim runners early and bail out by <a href="https://github.com/devantler"><code>@​devantler</code></a> in <a href="https://redirect.github.com/step-security/harden-runner/pull/657">step-security/harden-runner#657</a></li> </ul> <p>What the fix changes</p> <ul> <li>Harden-Runner will detect <code>ubuntu-slim</code> runners and exit cleanly with an informational log message, instead of post harden runner step failing on chown: invalid user: 'undefined'.</li> </ul> <p>What the fix does not do</p> <ul> <li>Jobs running on <code>ubuntu-slim</code> will not be monitored by Harden-Runner. The agent relies on kernel-level features (that require elevated capabilities).</li> <li>Per GitHub's docs on <a href="https://docs.github.com/en/actions/reference/runners/github-hosted-runners#single-cpu-runners">single-CPU runners</a>: &quot;The container for ubuntu-slim runners runs in unprivileged mode. This means that some operations requiring elevated privileges such as mounting file systems, using Docker-in-Docker, or accessing low-level kernel features are not supported.&quot; Those low-level kernel features are what the agent needs, so monitoring inside the unprivileged container is not feasible today.</li> </ul> <p>For StepSecurity enterprise customers If your security posture requires that workflows are always monitored, you can block the use of <code>ubuntu-slim</code> via workflow run policies see the <a href="https://docs.stepsecurity.io/workflow-run-policies/policies#runner-label-policy">Runner Label Policy</a> docs. This lets you enforce that jobs only run on monitored runner types.</p> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/devantler"><code>@​devantler</code></a> made their first contribution in <a href="https://redirect.github.com/step-security/harden-runner/pull/657">step-security/harden-runner#657</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/step-security/harden-runner/compare/v2.19.0...v2.19.1">https://github.com/step-security/harden-runner/compare/v2.19.0...v2.19.1</a></p> <h2>v2.19.0</h2> <h2>What's Changed</h2> <h3>New Runner Support</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/step-security/harden-runner/commit/bf7454d06d71f1098171f2acdf0cd4708d7b5920"><code>bf7454d</code></a> Merge pull request <a href="https://redirect.github.com/step-security/harden-runner/issues/673">#673</a> from step-security/fix/aggregate-error-startup-hang</li> <li><a href="https://github.com/step-security/harden-runner/commit/1188420976b49762617c32cc010cba50a9fd7a71"><code>1188420</code></a> Update non-TLS agent to v0.16.2</li> <li><a href="https://github.com/step-security/harden-runner/commit/162cfeac170141192dc6d57ade86ddf59448ad96"><code>162cfea</code></a> Update non-TLS agent to v0.16.1</li> <li><a href="https://github.com/step-security/harden-runner/commit/eb9e1f4943b602b6f338f6f79468e812c2c6b320"><code>eb9e1f4</code></a> Bring macOS runner updates from PR 674</li> <li><a href="https://github.com/step-security/harden-runner/commit/1a10b01783c147498a6dee4fa4e7122325762720"><code>1a10b01</code></a> Update Windows agent to v1.0.7</li> <li><a href="https://github.com/step-security/harden-runner/commit/8b4a105ef5119b20c97c1566b0275b9399ae188d"><code>8b4a105</code></a> Apply npm audit fixes with release-age cooldown</li> <li><a href="https://github.com/step-security/harden-runner/commit/3626e0327723bef1c4e6b01750518eccd380a5df"><code>3626e03</code></a> Default TLS status check failures to enabled</li> <li><a href="https://github.com/step-security/harden-runner/commit/100e08b39cfd419c292df7becc379b0305ac0628"><code>100e08b</code></a> Update agent-ebpf to v1.8.12</li> <li><a href="https://github.com/step-security/harden-runner/commit/774f75f2c6334606d2d3d910a663f93c9ea49b3b"><code>774f75f</code></a> Update agent to v1.8.9</li> <li><a href="https://github.com/step-security/harden-runner/commit/f312657a64c745fae39c2c66cc7c7f7bc4c804d8"><code>f312657</code></a> Extend missing-agent-dir guard to Linux and macOS cleanup paths</li> <li>Additional commits viewable in <a href="https://github.com/step-security/harden-runner/compare/f808768d1510423e83855289c910610ca9b43176...bf7454d06d71f1098171f2acdf0cd4708d7b5920">compare view</a></li> </ul> </details> <br /> Updates `dorny/paths-filter` from 4.0.1 to 4.0.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/dorny/paths-filter/releases">dorny/paths-filter's releases</a>.</em></p> <blockquote> <h2>v4.0.2</h2> <h2>What's Changed</h2> <ul> <li>fix warning message by <a href="https://github.com/cgundy"><code>@​cgundy</code></a> in <a href="https://redirect.github.com/dorny/paths-filter/pull/282">dorny/paths-filter#282</a></li> <li>chore: fix GitHub spelling in logs by <a href="https://github.com/squat"><code>@​squat</code></a> in <a href="https://redirect.github.com/dorny/paths-filter/pull/278">dorny/paths-filter#278</a></li> <li>fix: use rev-parse instead of branch --show-current for older git compat by <a href="https://github.com/saschabratton"><code>@​saschabratton</code></a> in <a href="https://redirect.github.com/dorny/paths-filter/pull/303">dorny/paths-filter#303</a></li> <li>fix: work around git dubious ownership errors in container jobs by <a href="https://github.com/saschabratton"><code>@​saschabratton</code></a> in <a href="https://redirect.github.com/dorny/paths-filter/pull/317">dorny/paths-filter#317</a></li> <li>docs: update changelog for v4.0.2 by <a href="https://github.com/saschabratton"><code>@​saschabratton</code></a> in <a href="https://redirect.github.com/dorny/paths-filter/pull/318">dorny/paths-filter#318</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/cgundy"><code>@​cgundy</code></a> made their first contribution in <a href="https://redirect.github.com/dorny/paths-filter/pull/282">dorny/paths-filter#282</a></li> <li><a href="https://github.com/squat"><code>@​squat</code></a> made their first contribution in <a href="https://redirect.github.com/dorny/paths-filter/pull/278">dorny/paths-filter#278</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/dorny/paths-filter/compare/v4.0.1...v4.0.2">https://github.com/dorny/paths-filter/compare/v4.0.1...v4.0.2</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/dorny/paths-filter/blob/master/CHANGELOG.md">dorny/paths-filter's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2>v4.0.2</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/317">Work around git dubious ownership errors in container jobs</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/303">Use rev-parse instead of branch --show-current for older git compat</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/282">Fix warning message</a></li> </ul> <h2>v4.0.1</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/255">Support merge queue</a></li> </ul> <h2>v4.0.0</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/294">Update action runtime to node24</a></li> </ul> <h2>v3.0.3</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/279">Add missing predicate-quantifier</a></li> </ul> <h2>v3.0.2</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/224">Add config parameter for predicate quantifier</a></li> </ul> <h2>v3.0.1</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/133">Compare base and ref when token is empty</a></li> </ul> <h2>v3.0.0</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/210">Update to Node.js 20</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/215">Update all dependencies</a></li> </ul> <h2>v2.11.1</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/167">Update @​actions/core to v1.10.0 - Fixes warning about deprecated set-output</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/168">Document need for pull-requests: read permission</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/164">Updating to actions/checkout@v3</a></li> </ul> <h2>v2.11.0</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/157">Set list-files input parameter as not required</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/161">Update Node.js</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/162">Fix incorrect handling of Unicode characters in exec()</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/163">Use Octokit pagination</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/160">Updates real world links</a></li> </ul> <h2>v2.10.2</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/91">Fix getLocalRef() returns wrong ref</a></li> </ul> <h2>v2.10.1</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/85">Improve robustness of change detection</a></li> </ul> <h2>v2.10.0</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/82">Add ref input parameter</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/83">Fix change detection in PR when pullRequest.changed_files is incorrect</a></li> </ul> <h2>v2.9.3</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/78">Fix change detection when base is a tag</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/dorny/paths-filter/commit/7b450fff21473bca461d4b92ce414b9d0420d706"><code>7b450ff</code></a> docs: update changelog for v4.0.2 (<a href="https://redirect.github.com/dorny/paths-filter/issues/318">#318</a>)</li> <li><a href="https://github.com/dorny/paths-filter/commit/928037783a71f24983ea250c6e55290c1b2de54f"><code>9280377</code></a> fix: work around git dubious ownership errors in container jobs (<a href="https://redirect.github.com/dorny/paths-filter/issues/317">#317</a>)</li> <li><a href="https://github.com/dorny/paths-filter/commit/f3ceefdc7ef57bc2d8560787d4b6c33e44044cec"><code>f3ceefd</code></a> fix: use rev-parse instead of branch --show-current for older git compat (<a href="https://redirect.github.com/dorny/paths-filter/issues/303">#303</a>)</li> <li><a href="https://github.com/dorny/paths-filter/commit/61f87a10cd2c304679af17bb73ef192addf33c1c"><code>61f87a1</code></a> chore: fix GitHub spelling in logs (<a href="https://redirect.github.com/dorny/paths-filter/issues/278">#278</a>)</li> <li><a href="https://github.com/dorny/paths-filter/commit/b82ff81ffbe6fb4b636bb5b47e37fd8d12b32632"><code>b82ff81</code></a> fix warning message (<a href="https://redirect.github.com/dorny/paths-filter/issues/282">#282</a>)</li> <li>See full diff in <a href="https://github.com/dorny/paths-filter/compare/fbd0ab8f3e69293af611ebaee6363fc25e6d187d...7b450fff21473bca461d4b92ce414b9d0420d706">compare view</a></li> </ul> </details> <br /> Updates `tj-actions/changed-files` from 47.0.5 to 47.0.6 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/tj-actions/changed-files/releases">tj-actions/changed-files's releases</a>.</em></p> <blockquote> <h2>v47.0.6</h2> <h2>What's Changed</h2> <ul> <li>Upgraded to v47.0.5 by <a href="https://github.com/github-actions"><code>@​github-actions</code></a>[bot] in <a href="https://redirect.github.com/tj-actions/changed-files/pull/2816">tj-actions/changed-files#2816</a></li> <li>Updated README.md by <a href="https://github.com/github-actions"><code>@​github-actions</code></a>[bot] in <a href="https://redirect.github.com/tj-actions/changed-files/pull/2817">tj-actions/changed-files#2817</a></li> <li>chore(deps): bump actions/setup-node from 6.2.0 to 6.3.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/tj-actions/changed-files/pull/2818">tj-actions/changed-files#2818</a></li> <li>chore(deps-dev): bump <code>@​types/node</code> from 25.3.3 to 25.3.5 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/tj-actions/changed-files/pull/2820">tj-actions/changed-files#2820</a></li> <li>chore(deps): bump github/codeql-action from 4.32.5 to 4.32.6 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/tj-actions/changed-files/pull/2819">tj-actions/changed-files#2819</a></li> <li>chore(deps-dev): bump <code>@​types/node</code> from 25.3.5 to 25.5.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/tj-actions/changed-files/pull/2825">tj-actions/changed-files#2825</a></li> <li>chore(deps): bump actions/download-artifact from 8.0.0 to 8.0.1 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/tj-actions/changed-files/pull/2824">tj-actions/changed-files#2824</a></li> <li>chore(deps): bump github/codeql-action from 4.32.6 to 4.35.1 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/tj-actions/changed-files/pull/2834">tj-actions/changed-files#2834</a></li> <li>chore(deps-dev): bump eslint-plugin-jest from 29.15.0 to 29.15.1 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/tj-actions/changed-files/pull/2831">tj-actions/changed-files#2831</a></li> <li>chore(deps): bump yaml from 2.8.2 to 2.8.3 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/tj-actions/changed-files/pull/2830">tj-actions/changed-files#2830</a></li> <li>chore(deps): bump nrwl/nx-set-shas from 4.4.0 to 5.0.1 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/tj-actions/changed-files/pull/2829">tj-actions/changed-files#2829</a></li> <li>chore(deps-dev): bump jest from 30.2.0 to 30.3.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/tj-actions/changed-files/pull/2822">tj-actions/changed-files#2822</a></li> <li>chore(deps): bump github/codeql-action from 4.35.1 to 4.35.2 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/tj-actions/changed-files/pull/2849">tj-actions/changed-files#2849</a></li> <li>chore(deps-dev): bump prettier from 3.8.1 to 3.8.3 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/tj-actions/changed-files/pull/2848">tj-actions/changed-files#2848</a></li> <li>chore(deps-dev): bump <code>@​types/node</code> from 25.5.0 to 25.6.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/tj-actions/changed-files/pull/2846">tj-actions/changed-files#2846</a></li> <li>chore(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/tj-actions/changed-files/pull/2844">tj-actions/changed-files#2844</a></li> <li>chore(deps): bump peter-evans/create-pull-request from 8.1.0 to 8.1.1 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/tj-actions/changed-files/pull/2843">tj-actions/changed-files#2843</a></li> <li>chore(deps): bump lodash from 4.17.23 to 4.18.1 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/tj-actions/changed-files/pull/2837">tj-actions/changed-files#2837</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/tj-actions/changed-files/compare/v47.0.5...v47.0.6">https://github.com/tj-actions/changed-files/compare/v47.0.5...v47.0.6</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/tj-actions/changed-files/blob/main/HISTORY.md">tj-actions/changed-files's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h1><a href="https://github.com/tj-actions/changed-files/compare/v47.0.5...v47.0.6">47.0.6</a> - (2026-04-18)</h1> <h2><!-- raw HTML omitted -->🔄 Update</h2> <ul> <li>Updated README.md (<a href="https://redirect.github.com/tj-actions/changed-files/issues/2817">#2817</a>)</li> </ul> <p>Co-authored-by: github-actions[bot] &lt;41898282+github-actions[bot]<a href="https://github.com/users"><code>@​users</code></a>.noreply.github.com&gt; Co-authored-by: Tonye Jack <a href="mailto:jtonye@ymail.com">jtonye@ymail.com</a> (<a href="https://github.com/tj-actions/changed-files/commit/c23d52ba6ff8c67273c61e097615eafe88cb8650">c23d52b</a>) - (github-actions[bot])</p> <h2><!-- raw HTML omitted -->⚙️ Miscellaneous Tasks</h2> <ul> <li><strong>deps:</strong> Bump lodash from 4.17.23 to 4.18.1 (<a href="https://redirect.github.com/tj-actions/changed-files/issues/2837">#2837</a>) (<a href="https://github.com/tj-actions/changed-files/commit/9426d40962ed5378910ee2e21d5f8c6fcbf2dd96">9426d40</a>) - (dependabot[bot])</li> <li><strong>deps:</strong> Bump peter-evans/create-pull-request from 8.1.0 to 8.1.1 (<a href="https://redirect.github.com/tj-actions/changed-files/issues/2843">#2843</a>) (<a href="https://github.com/tj-actions/changed-files/commit/32de080616d8c84d89622770d26b0857f4ce8b49">32de080</a>) - (dependabot[bot])</li> <li><strong>deps:</strong> Bump actions/upload-artifact from 7.0.0 to 7.0.1 (<a href="https://redirect.github.com/tj-actions/changed-files/issues/2844">#2844</a>) (<a href="https://github.com/tj-actions/changed-files/commit/2487d125c6ecf3457228762d50599297a8c80310">2487d12</a>) - (dependabot[bot])</li> <li><strong>deps-dev:</strong> Bump <code>@​types/node</code> from 25.5.0 to 25.6.0 (<a href="https://redirect.github.com/tj-actions/changed-files/issues/2846">#2846</a>) (<a href="https://github.com/tj-actions/changed-files/commit/cef85a3eab76d9db9f294de4915d6a31b1dcbfda">cef85a3</a>) - (dependabot[bot])</li> <li><strong>deps-dev:</strong> Bump prettier from 3.8.1 to 3.8.3 (<a href="https://redirect.github.com/tj-actions/changed-files/issues/2848">#2848</a>) (<a href="https://github.com/tj-actions/changed-files/commit/7b082dee30a6f42592f70940c0f0a26a72af452c">7b082de</a>) - (dependabot[bot])</li> <li><strong>deps:</strong> Bump github/codeql-action from 4.35.1 to 4.35.2 (<a href="https://redirect.github.com/tj-actions/changed-files/issues/2849">#2849</a>) (<a href="https://github.com/tj-actions/changed-files/commit/07224cab5986b4ce28c5080f4a804e5573422714">07224ca</a>) - (dependabot[bot])</li> <li><strong>deps-dev:</strong> Bump jest from 30.2.0 to 30.3.0 (<a href="https://redirect.github.com/tj-actions/changed-files/issues/2822">#2822</a>) (<a href="https://github.com/tj-actions/changed-files/commit/2bb135777322059ee3a3c9239999b159ff49febc">2bb1357</a>) - (dependabot[bot])</li> <li><strong>deps:</strong> Bump nrwl/nx-set-shas from 4.4.0 to 5.0.1 (<a href="https://redirect.github.com/tj-actions/changed-files/issues/2829">#2829</a>) (<a href="https://github.com/tj-actions/changed-files/commit/cc98117d3993777f3babaccc496514b4a65652a9">cc98117</a>) - (dependabot[bot])</li> <li><strong>deps:</strong> Bump yaml from 2.8.2 to 2.8.3 (<a href="https://redirect.github.com/tj-actions/changed-files/issues/2830">#2830</a>) (<a href="https://github.com/tj-actions/changed-files/commit/786e4213eac60d6e2b4492135b46644269fac3db">786e421</a>) - (dependabot[bot])</li> <li><strong>deps-dev:</strong> Bump eslint-plugin-jest from 29.15.0 to 29.15.1 (<a href="https://redirect.github.com/tj-actions/changed-files/issues/2831">#2831</a>) (<a href="https://github.com/tj-actions/changed-files/commit/726b41bbed783a50de97829de6d977cd665831f7">726b41b</a>) - (dependabot[bot])</li> <li><strong>deps:</strong> Bump github/codeql-action from 4.32.6 to 4.35.1 (<a href="https://redirect.github.com/tj-actions/changed-files/issues/2834">#2834</a>) (<a href="https://github.com/tj-actions/changed-files/commit/2c3585e584822ed39e27c6c471225dde37991778">2c3585e</a>) - (dependabot[bot])</li> <li><strong>deps:</strong> Bump actions/download-artifact from 8.0.0 to 8.0.1 (<a href="https://redirect.github.com/tj-actions/changed-files/issues/2824">#2824</a>) (<a href="https://github.com/tj-actions/changed-files/commit/3d37a7ff08a7ce64b4cab9669eac39b0709cdac9">3d37a7f</a>) - (dependabot[bot])</li> <li><strong>deps-dev:</strong> Bump <code>@​types/node</code> from 25.3.5 to 25.5.0 (<a href="https://redirect.github.com/tj-actions/changed-files/issues/2825">#2825</a>) (<a href="https://github.com/tj-actions/changed-files/commit/445b0eb32849cdd5b22a390bf0568af00ed4ca34">445b0eb</a>) - (dependabot[bot])</li> <li><strong>deps:</strong> Bump github/codeql-action from 4.32.5 to 4.32.6 (<a href="https://redirect.github.com/tj-actions/changed-files/issues/2819">#2819</a>) (<a href="https://github.com/tj-actions/changed-files/commit/4f892cd56345d721bac7139000c4b4a22c8f138f">4f892cd</a>) - (dependabot[bot])</li> <li><strong>deps-dev:</strong> Bump <code>@​types/node</code> from 25.3.3 to 25.3.5 (<a href="https://redirect.github.com/tj-actions/changed-files/issues/2820">#2820</a>) (<a href="https://github.com/tj-actions/changed-files/commit/611865116d9f223a0ca640071aec29292c81978f">6118651</a>) - (dependabot[bot])</li> <li><strong>deps:</strong> Bump actions/setup-node from 6.2.0 to 6.3.0 (<a href="https://redirect.github.com/tj-actions/changed-files/issues/2818">#2818</a>) (<a href="https://github.com/tj-actions/changed-files/commit/e517d7a5ca34a5d08bbe5c949e59381bd6d7cce2">e517d7a</a>) - (dependabot[bot])</li> </ul> <h2><!-- raw HTML omitted -->⬆️ Upgrades</h2> <ul> <li>Upgraded to v47.0.5 (<a href="https://redirect.github.com/tj-actions/changed-files/issues/2816">#2816</a>)</li> </ul> <p>Co-authored-by: github-actions[bot] &lt;41898282+github-actions[bot]<a href="https://github.com/users"><code>@​users</code></a>.noreply.github.com&gt; Co-authored-by: Tonye Jack <a href="mailto:jtonye@ymail.com">jtonye@ymail.com</a> (<a href="https://github.com/tj-actions/changed-files/commit/4750530ff4e020eafc769c56c2fa8376ca8ad8e9">4750530</a>) - (github-actions[bot])</p> <h1><a href="https://github.com/tj-actions/changed-files/compare/v47.0.4...v47.0.5">47.0.5</a> - (2026-03-03)</h1> <h2><!-- raw HTML omitted -->🔄 Update</h2> <ul> <li>Updated README.md (<a href="https://redirect.github.com/tj-actions/changed-files/issues/2805">#2805</a>)</li> </ul> <p>Co-authored-by: github-actions[bot] &lt;41898282+github-actions[bot]<a href="https://github.com/users"><code>@​users</code></a>.noreply.github.com&gt; (<a href="https://github.com/tj-actions/changed-files/commit/35dace0375d89e25e78db5f0a44127b61f4e5c20">35dace0</a>) - (github-actions[bot])</p> <ul> <li>Updated README.md (<a href="https://redirect.github.com/tj-actions/changed-files/issues/2803">#2803</a>)</li> </ul> <p>Co-authored-by: github-actions[bot] &lt;41898282+github-actions[bot]<a href="https://github.com/users"><code>@​users</code></a>.noreply.github.com&gt; Co-authored-by: Tonye Jack <a href="mailto:jtonye@ymail.com">jtonye@ymail.com</a> (<a href="https://github.com/tj-actions/changed-files/commit/9ee99eb5bda5d6a67fedcd50ecd24fb10add2f41">9ee99eb</a>) - (github-actions[bot])</p> <h2><!-- raw HTML omitted -->⚙️ Miscellaneous Tasks</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/tj-actions/changed-files/commit/9426d40962ed5378910ee2e21d5f8c6fcbf2dd96"><code>9426d40</code></a> chore(deps): bump lodash from 4.17.23 to 4.18.1 (<a href="https://redirect.github.com/tj-actions/changed-files/issues/2837">#2837</a>)</li> <li><a href="https://github.com/tj-actions/changed-files/commit/32de080616d8c84d89622770d26b0857f4ce8b49"><code>32de080</code></a> chore(deps): bump peter-evans/create-pull-request from 8.1.0 to 8.1.1 (<a href="https://redirect.github.com/tj-actions/changed-files/issues/2843">#2843</a>)</li> <li><a href="https://github.com/tj-actions/changed-files/commit/2487d125c6ecf3457228762d50599297a8c80310"><code>2487d12</code></a> chore(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (<a href="https://redirect.github.com/tj-actions/changed-files/issues/2844">#2844</a>)</li> <li><a href="https://github.com/tj-actions/changed-files/commit/cef85a3eab76d9db9f294de4915d6a31b1dcbfda"><code>cef85a3</code></a> chore(deps-dev): bump <code>@​types/node</code> from 25.5.0 to 25.6.0 (<a href="https://redirect.github.com/tj-actions/changed-files/issues/2846">#2846</a>)</li> <li><a href="https://github.com/tj-actions/changed-files/commit/7b082dee30a6f42592f70940c0f0a26a72af452c"><code>7b082de</code></a> chore(deps-dev): bump prettier from 3.8.1 to 3.8.3 (<a href="https://redirect.github.com/tj-actions/changed-files/issues/2848">#2848</a>)</li> <li><a href="https://github.com/tj-actions/changed-files/commit/07224cab5986b4ce28c5080f4a804e5573422714"><code>07224ca</code></a> chore(deps): bump github/codeql-action from 4.35.1 to 4.35.2 (<a href="https://redirect.github.com/tj-actions/changed-files/issues/2849">#2849</a>)</li> <li><a href="https://github.com/tj-actions/changed-files/commit/2bb135777322059ee3a3c9239999b159ff49febc"><code>2bb1357</code></a> chore(deps-dev): bump jest from 30.2.0 to 30.3.0 (<a href="https://redirect.github.com/tj-actions/changed-files/issues/2822">#2822</a>)</li> <li><a href="https://github.com/tj-actions/changed-files/commit/cc98117d3993777f3babaccc496514b4a65652a9"><code>cc98117</code></a> chore(deps): bump nrwl/nx-set-shas from 4.4.0 to 5.0.1 (<a href="https://redirect.github.com/tj-actions/changed-files/issues/2829">#2829</a>)</li> <li><a href="https://github.com/tj-actions/changed-files/commit/786e4213eac60d6e2b4492135b46644269fac3db"><code>786e421</code></a> chore(deps): bump yaml from 2.8.2 to 2.8.3 (<a href="https://redirect.github.com/tj-actions/changed-files/issues/2830">#2830</a>)</li> <li><a href="https://github.com/tj-actions/changed-files/commit/726b41bbed783a50de97829de6d977cd665831f7"><code>726b41b</code></a> chore(deps-dev): bump eslint-plugin-jest from 29.15.0 to 29.15.1 (<a href="https://redirect.github.com/tj-actions/changed-files/issues/2831">#2831</a>)</li> <li>Additional commits viewable in <a href="https://github.com/tj-actions/changed-files/compare/22103cc46bda19c2b464ffe86db46df6922fd323...9426d40962ed5378910ee2e21d5f8c6fcbf2dd96">compare view</a></li> </ul> </details> <br /> Updates `actions/cache/restore` from 5.0.5 to 6.1.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/cache/releases">actions/cache/restore's releases</a>.</em></p> <blockquote> <h2>v6.1.0</h2> <h2>What's Changed</h2> <ul> <li>Bump <code>@​actions/cache</code> to v6.1.0 - handle read-only cache access by <a href="https://github.com/jasongin"><code>@​jasongin</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1768">actions/cache#1768</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v6...v6.1.0">https://github.com/actions/cache/compare/v6...v6.1.0</a></p> <h2>v6.0.0</h2> <h2>What's Changed</h2> <ul> <li>Update packages, migrate to ESM by <a href="https://github.com/Samirat"><code>@​Samirat</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1760">actions/cache#1760</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v5...v6.0.0">https://github.com/actions/cache/compare/v5...v6.0.0</a></p> <h2>v5.1.0</h2> <h2>What's Changed</h2> <ul> <li>Bump <code>@​actions/cache</code> to v5.1.0 - handle read-only cache access by <a href="https://github.com/jasongin"><code>@​jasongin</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1775">actions/cache#1775</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v5...v5.1.0">https://github.com/actions/cache/compare/v5...v5.1.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/cache/blob/main/RELEASES.md">actions/cache/restore's changelog</a>.</em></p> <blockquote> <h1>Releases</h1> <h2>How to prepare a release</h2> <blockquote> <p>[!NOTE] Relevant for maintainers with write access only.</p> </blockquote> <ol> <li>Switch to a new branch from <code>main</code>.</li> <li>Run <code>npm test</code> to ensure all tests are passing.</li> <li>Update the version in <a href="https://github.com/actions/cache/blob/main/package.json"><code>https://github.com/actions/cache/blob/main/package.json</code></a>.</li> <li>Run <code>npm run build</code> to update the compiled files.</li> <li>Update this <a href="https://github.com/actions/cache/blob/main/RELEASES.md"><code>https://github.com/actions/cache/blob/main/RELEASES.md</code></a> with the new version and changes in the <code>## Changelog</code> section.</li> <li>Run <code>licensed cache</code> to update the license report.</li> <li>Run <code>licensed status</code> and resolve any warnings by updating the <a href="https://github.com/actions/cache/blob/main/.licensed.yml"><code>https://github.com/actions/cache/blob/main/.licensed.yml</code></a> file with the exceptions.</li> <li>Commit your changes and push your branch upstream.</li> <li>Open a pull request against <code>main</code> and get it reviewed and merged.</li> <li>Draft a new release <a href="https://github.com/actions/cache/releases">https://github.com/actions/cache/releases</a> use the same version number used in <code>package.json</code> <ol> <li>Create a new tag with the version number.</li> <li>Auto generate release notes and update them to match the changes you made in <code>RELEASES.md</code>.</li> <li>Toggle the set as the latest release option.</li> <li>Publish the release.</li> </ol> </li> <li>Navigate to <a href="https://github.com/actions/cache/actions/workflows/release-new-action-version.yml">https://github.com/actions/cache/actions/workflows/release-new-action-version.yml</a> <ol> <li>There should be a workflow run queued with the same version number.</li> <li>Approve the run to publish the new version and update the major tags for this action.</li> </ol> </li> </ol> <h2>Changelog</h2> <h3>6.1.0</h3> <ul> <li>Bump <code>@actions/cache</code> to v6.1.0 to pick up <a href="https://redirect.github.com/actions/toolkit/pull/2435">actions/toolkit#2435 Handle cache write error due to read-only token</a></li> <li>Switch redundant &quot;Cache save failed&quot; warning to debug log in save-only</li> </ul> <h3>6.0.0</h3> <ul> <li>Updated <code>@actions/cache</code> to ^6.0.1, <code>@actions/core</code> to ^3.0.1, <code>@actions/exec</code> to ^3.0.0, <code>@actions/io</code> to ^3.0.2</li> <li>Migrated to ESM module system</li> <li>Upgraded Jest to v30 and test infrastructure to be ESM compatible</li> </ul> <h3>5.0.4</h3> <ul> <li>Bump <code>minimatch</code> to v3.1.5 (fixes ReDoS via globstar patterns)</li> <li>Bump <code>undici</code> to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)</li> <li>Bump <code>fast-xml-parser</code> to v5.5.6</li> </ul> <h3>5.0.3</h3> <ul> <li>Bump <code>@actions/cache</code> to v5.0.5 (Resolves: <a href="https://github.com/actions/cache/security/dependabot/33">https://github.com/actions/cache/security/dependabot/33</a>)</li> <li>Bump <code>@actions/core</code> to v2.0.3</li> </ul> <h3>5.0.2</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/cache/commit/55cc8345863c7cc4c66a329aec7e433d2d1c52a9"><code>55cc834</code></a> Merge pull request <a href="https://redirect.github.com/actions/cache/issues/1768">#1768</a> from jasongin/readonly-cache</li> <li><a href="https://github.com/actions/cache/commit/d8cd72f230726cdf4457ebb61ec1b593a8d12337"><code>d8cd72f</code></a> Bump <code>@​actions/cache</code> to v6.1.0 - handle cache write error due to RO token</li> <li><a href="https://github.com/actions/cache/commit/2c8a9bd7457de244a408f35966fab2fb45fda9c8"><code>2c8a9bd</code></a> Merge pull request <a href="https://redirect.github.com/actions/cache/issues/1760">#1760</a> from actions/samirat/esm_migration_and_package_update</li> <li><a href="https://github.com/actions/cache/commit/e9b91fdc3fea7d79165fceb79042ef45c2d51023"><code>e9b91fd</code></a> Prettier fixes</li> <li><a href="https://github.com/actions/cache/commit/e4884b8ff7f92ef6b52c79eda480bbc86e685adb"><code>e4884b8</code></a> Rebuild dist</li> <li><a href="https://github.com/actions/cache/commit/10baf0191a3c426ea0fa4a3253a5c04233b6e18f"><code>10baf01</code></a> Fixed licenses</li> <li><a href="https://github.com/actions/cache/commit/e39b386c9004d72a15d864ade8c0b3a702d47a37"><code>e39b386</code></a> Fix test mock return order</li> <li><a href="https://github.com/actions/cache/commit/b6928203372a8571ff984c0c883ef3a1adfb0c06"><code>b692820</code></a> PR feedback</li> <li><a href="https://github.com/actions/cache/commit/60749128a44d25d3c520a489e576380cf00ff3f1"><code>6074912</code></a> Rebuild dist bundles as ESM to match type:module</li> <li><a href="https://github.com/actions/cache/commit/5a912e8b4af820fa082a0e75cfd2c782f8fbfe0e"><code>5a912e8</code></a> Fix lint and jest issues</li> <li>Additional commits viewable in <a href="https://github.com/actions/cache/compare/27d5ce7f107fe9357f9df03efb73ab90386fccae...55cc8345863c7cc4c66a329aec7e433d2d1c52a9">compare view</a></li> </ul> </details> <br /> Updates `actions/cache/save` from 5.0.5 to 6.1.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/cache/releases">actions/cache/save's releases</a>.</em></p> <blockquote> <h2>v6.1.0</h2> <h2>What's Changed</h2> <ul> <li>Bump <code>@​actions/cache</code> to v6.1.0 - handle read-only cache access by <a href="https://github.com/jasongin"><code>@​jasongin</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1768">actions/cache#1768</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v6...v6.1.0">https://github.com/actions/cache/compare/v6...v6.1.0</a></p> <h2>v6.0.0</h2> <h2>What's Changed</h2> <ul> <li>Update packages, migrate to ESM by <a href="https://github.com/Samirat"><code>@​Samirat</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1760">actions/cache#1760</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v5...v6.0.0">https://github.com/actions/cache/compare/v5...v6.0.0</a></p> <h2>v5.1.0</h2> <h2>What's Changed</h2> <ul> <li>Bump <code>@​actions/cache</code> to v5.1.0 - handle read-only cache access by <a href="https://github.com/jasongin"><code>@​jasongin</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1775">actions/cache#1775</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v5...v5.1.0">https://github.com/actions/cache/compare/v5...v5.1.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/cache/blob/main/RELEASES.md">actions/cache/save's changelog</a>.</em></p> <blockquote> <h1>Releases</h1> <h2>How to prepare a release</h2> <blockquote> <p>[!NOTE] Relevant for maintainers with write access only.</p> </blockquote> <ol> <li>Switch to a new branch from <code>main</code>.</li> <li>Run <code>npm test</code> to ensure all tests are passing.</li> <li>Update the version in <a href="https://github.com/actions/cache/blob/main/package.json"><code>https://github.com/actions/cache/blob/main/package.json</code></a>.</li> <li>Run <code>npm run build</code> to update the compiled files.</li> <li>Update this <a href="https://github.com/actions/cache/blob/main/RELEASES.md"><code>https://github.com/actions/cache/blob/main/RELEASES.md</code></a> with the new version and changes in the <code>## Changelog</code> section.</li> <li>Run <code>licensed cache</code> to update the license report.</li> <li>Run <code>licensed status</code> and resolve any warnings by updating the <a href="https://github.com/actions/cache/blob/main/.licensed.yml"><code>https://github.com/actions/cache/blob/main/.licensed.yml</code></a> file with the exceptions.</li> <li>Commit your changes and push your branch upstream.</li> <li>Open a pull request against <code>main</code> and get it reviewed and merged.</li> <li>Draft a new release <a href="https://github.com/actions/cache/releases">https://github.com/actions/cache/releases</a> use the same version number used in <code>package.json</code> <ol> <li>Create a new tag with the version number.</li> <li>Auto generate release notes and update them to match the changes you made in <code>RELEASES.md</code>.</li> <li>Toggle the set as the latest release option.</li> <li>Publish the release.</li> </ol> </li> <li>Navigate to <a href="https://github.com/actions/cache/actions/workflows/release-new-action-version.yml">https://github.com/actions/cache/actions/workflows/release-new-action-version.yml</a> <ol> <li>There should be a workflow run queued with the same version number.</li> <li>Approve the run to publish the new version and update the major tags for this action.</li> </ol> </li> </ol> <h2>Changelog</h2> <h3>6.1.0</h3> <ul> <li>Bump <code>@actions/cache</code> to v6.1.0 to pick up <a href="https://redirect.github.com/actions/toolkit/pull/2435">actions/toolkit#2435 Handle cache write error due to read-only token</a></li> <li>Switch redundant &quot;Cache save failed&quot; warning to debug log in save-only</li> </ul> <h3>6.0.0</h3> <ul> <li>Updated <code>@actions/cache</code> to ^6.0.1, <code>@actions/core</code> to ^3.0.1, <code>@actions/exec</code> to ^3.0.0, <code>@actions/io</code> to ^3.0.2</li> <li>Migrated to ESM module system</li> <li>Upgraded Jest to v30 and test infrastructure to be ESM compatible</li> </ul> <h3>5.0.4</h3> <ul> <li>Bump <code>minimatch</code> to v3.1.5 (fixes ReDoS via globstar patterns)</li> <li>Bump <code>undici</code> to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)</li> <li>Bump <code>fast-xml-parser</code> to v5.5.6</li> </ul> <h3>5.0.3</h3> <ul> <li>Bump <code>@actions/cache</code> to v5.0.5 (Resolves: <a href="https://github.com/actions/cache/security/dependabot/33">https://github.com/actions/cache/security/dependabot/33</a>)</li> <li>Bump <code>@actions/core</code> to v2.0.3</li> </ul> <h3>5.0.2</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/cache/commit/55cc8345863c7cc4c66a329aec7e433d2d1c52a9"><code>55cc834</code></a> Merge pull request <a href="https://redirect.github.com/actions/cache/issues/1768">#1768</a> from jasongin/readonly-cache</li> <li><a href="https://github.com/actions/cache/commit/d8cd72f230726cdf4457ebb61ec1b593a8d12337"><code>d8cd72f</code></a> Bump <code>@​actions/cache</code> to v6.1.0 - handle cache write error due to RO token</li> <li><a href="https://github.com/actions/cache/commit/2c8a9bd7457de244a408f35966fab2fb45fda9c8"><code>2c8a9bd</code></a> Merge pull request <a href="https://redirect.github.com/actions/cache/issues/1760">#1760</a> from actions/samirat/esm_migration_and_package_update</li> <li><a href="https://github.com/actions/cache/commit/e9b91fdc3fea7d79165fceb79042ef45c2d51023"><code>e9b91fd</code></a> Prettier fixes</li> <li><a href="https://github.com/actions/cache/commit/e4884b8ff7f92ef6b52c79eda480bbc86e685adb"><code>e4884b8</code></a> Rebuild dist</li> <li><a href="https://github.com/actions/cache/commit/10baf0191a3c426ea0fa4a3253a5c04233b6e18f"><code>10baf01</code></a> Fixed licenses</li> <li><a href="https://github.com/actions/cache/commit/e39b386c9004d72a15d864ade8c0b3a702d47a37"><code>e39b386</code></a> Fix test mock return order</li> <li><a href="https://github.com/actions/cache/commit/b6928203372a8571ff984c0c883ef3a1adfb0c06"><code>b692820</code></a> PR feedback</li> <li><a href="https://github.com/actions/cache/commit/60749128a44d25d3c520a489e576380cf00ff3f1"><code>6074912</code></a> Rebuild dist bundles as ESM to match type:module</li> <li><a href="https://github.com/actions/cache/commit/5a912e8b4af820fa082a0e75cfd2c782f8fbfe0e"><code>5a912e8</code></a> Fix lint and jest issues</li> <li>Additional commits viewable in <a href="https://github.com/actions/cache/compare/27d5ce7f107fe9357f9df03efb73ab90386fccae...55cc8345863c7cc4c66a329aec7e433d2d1c52a9">compare view</a></li> </ul> </details> <br /> Updates `docker/login-action` from 4.1.0 to 4.4.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/docker/login-action/releases">docker/login-action's releases</a>.</em></p> <blockquote> <h2>v4.4.0</h2> <ul> <li>Skip empty <code>registry-auth</code> secret mask by <a href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in <a href="https://redirect.github.com/docker/login-action/pull/1035">docker/login-action#1035</a></li> <li>Bump <code>@​aws-sdk/client-ecr</code> and <code>@​aws-sdk/client-ecr-public</code> to 3.1077.0 <a href="https://redirect.github.com/docker/login-action/pull/1034">docker/login-action#1034</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/docker/login-action/compare/v4.3.0...v4.4.0">https://github.com/docker/login-action/compare/v4.3.0...v4.4.0</a></p> <h2>v4.3.0</h2> <ul> <li>Preserve names in esbuild bundle by <a href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in <a href="https://redirect.github.com/docker/login-action/pull/1022">docker/login-action#1022</a></li> <li>Bump <code>@​aws-sdk/client-ecr</code> and <code>@​aws-sdk/client-ecr-public</code> to 3.1076.0 <a href="https://redirect.github.com/docker/login-action/pull/999">docker/login-action#999</a> <a href="https://redirect.github.com/docker/login-action/pull/1030">docker/login-action#1030</a></li> <li>Bump <code>@​docker/actions-toolkit</code> from 0.90.0 to 0.92.0 in <a href="https://redirect.github.com/docker/login-action/pull/1004">docker/login-action#1004</a> <a href="https://redirect.github.com/docker/login-action/pull/1027">docker/login-action#1027</a></li> <li>Bump <code>@​sigstore/core</code> from 3.1.0 to 3.2.1 in <a href="https://redirect.github.com/docker/login-action/pull/1023">docker/login-action#1023</a></li> <li>Bump <code>@​sigstore/verify</code> from 3.1.0 to 3.1.1 in <a href="https://redirect.github.com/docker/login-action/pull/1029">docker/login-action#1029</a></li> <li>Bump http-proxy-agent and https-proxy-agent to 9.1.0 in <a href="https://redirect.github.com/docker/login-action/pull/1017">docker/login-action#1017</a></li> <li>Bump js-yaml from 4.1.1 to 5.2.0 in <a href="https://redirect.github.com/docker/login-action/pull/1028">docker/login-action#1028</a></li> <li>Bump sigstore from 4.1.0 to 4.1.1 in <a href="https://redirect.github.com/docker/login-action/pull/1031">docker/login-action#1031</a></li> <li>Bump tmp from 0.2.5 to 0.2.7 in <a href="https://redirect.github.com/docker/login-action/pull/1002">docker/login-action#1002</a></li> <li>Bump undici from 6.24.1 to 6.27.0 in <a href="https://redirect.github.com/docker/login-action/pull/1020">docker/login-action#1020</a></li> <li>Bump vite from 7.3.3 to 7.3.6 in <a href="https://redirect.github.com/docker/login-action/pull/1019">docker/login-action#1019</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/docker/login-action/compare/v4.2.0...v4.3.0">https://github.com/docker/login-action/compare/v4.2.0...v4.3.0</a></p> <h2>v4.2.0</h2> <ul> <li>Bump <code>@​actions/core</code> from 3.0.0 to 3.0.1 in <a href="https://redirect.github.com/docker/login-action/pull/976">docker/login-action#976</a></li> <li>Bump <code>@​aws-sdk/client-ecr</code> and <code>@​aws-sdk/client-ecr-public</code> to 3.1050.0 in <a href="https://redirect.github.com/docker/login-action/pull/960">docker/login-action#960</a></li> <li>Bump <code>@​docker/actions-toolkit</code> from 0.86.0 to 0.90.0 in <a href="https://redirect.github.com/docker/login-action/pull/970">docker/login-action#970</a></li> <li>Bump brace-expansion from 2.0.1 to 5.0.6 in <a href="https://redirect.github.com/docker/login-action/pull/993">docker/login-action#993</a></li> <li>Bump fast-xml-builder from 1.1.4 to 1.2.0 in <a href="https://redirect.github.com/docker/login-action/pull/985">docker/login-action#985</a></li> <li>Bump fast-xml-parser from 5.3.6 to 5.8.0 in <a href="https://redirect.github.com/docker/login-action/pull/963">docker/login-action#963</a></li> <li>Bump http-proxy-agent and https-proxy-agent to 9.0.0 in <a href="https://redirect.github.com/docker/login-action/pull/961">docker/login-action#961</a></li> <li>Bump postcss from 8.5.6 to 8.5.10 in <a href="https://redirect.github.com/docker/login-action/pull/979">docker/login-action#979</a></li> <li>Bump tar from 6.2.1 to 7.5.15 in <a href="https://redirect.github.com/docker/login-action/pull/991">docker/login-action#991</a></li> <li>Bump vite from 7.3.1 to 7.3.3 in <a href="https://redirect.github.com/docker/login-action/pull/986">docker/login-action#986</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/docker/login-action/compare/v4.1.0...v4.2.0">https://github.com/docker/login-action/compare/v4.1.0...v4.2.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/docker/login-action/commit/af1e73f918a031802d376d3c8bbc3fe56130a9b0"><code>af1e73f</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/1034">#1034</a> from docker/dependabot/npm_and_yarn/aws-sdk-dependen...</li> <li><a href="https://github.com/docker/login-action/commit/da722bde43bacb027adfc67d42dbaa4c0f9e550b"><code>da722bd</code></a> [dependabot skip] chore: update generated content</li> <li><a href="https://github.com/docker/login-action/commit/2916ad60bd5cb72f07aa54c69fdcc61749c09b7a"><code>2916ad6</code></a> build(deps): bump the aws-sdk-dependencies group across 1 directory with 2 up...</li> <li><a href="https://github.com/docker/login-action/commit/ca0a662f786e4cfddce972005bd68f3dafc3a903"><code>ca0a662</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/1035">#1035</a> from crazy-max/fix-registry-auth-empty-mask</li> <li><a href="https://github.com/docker/login-action/commit/c455755a579833bf0d2e4e54e3beb413ef10cc80"><code>c455755</code></a> chore: update generated content</li> <li><a href="https://github.com/docker/login-action/commit/48351901f89581a7c12870c787d3f06d1f498438"><code>4835190</code></a> skip empty registry-auth secret mask</li> <li><a href="https://github.com/docker/login-action/commit/992421c6e6806a7f6df609d1bfff374f9eca3004"><code>992421c</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/1033">#1033</a> from docker/dependabot/github_actions/docker/bake-ac...</li> <li><a href="https://github.com/docker/... _Description has been truncated_ Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-14 11:31:45 +00:00
Jakub Domeracki	28447f16ea	ci(.github/workflows): update checkout to v7 (#26909) ... Update GitHub Actions workflows to use `actions/checkout` v7.0.0 pinned to `9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0`, following the GitHub Actions checkout hardening changes announced in: - https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ - https://github.blog/changelog/2026-06-18-control-who-and-what-triggers-github-actions-workflows/ Audited the existing `pull_request_target` workflows and did not add any `allow-unsafe-pr-checkout` opt-outs, since these workflows do not intentionally check out fork PR head code. Generated by Coder Agents. <details> <summary>Plan notes</summary> - Update all `.github/workflows` `actions/checkout` references to v7.0.0 using the pinned SHA. - Preserve SHA pinning, including the newly added MCP registry workflow. - Validate that old checkout pins are removed and no unsafe checkout opt-outs are introduced. </details>	2026-07-01 10:17:35 +02:00
McKayla はな	1302e78283	ci: remove chromatic (#26777)	2026-06-29 08:57:07 -06:00
Danny Kopping	9f211ce5ae	fix: use HEAD instead of fetching base branch for emdash linter (#26733) ... ## Problem The `lint/emdash` check fails on Graphite-stacked PRs. See [this failed run](https://github.com/coder/coder/actions/runs/28225390084/job/83616080375?pr=26650): ``` Base ref origin/graphite-base/26650 not found locally, fetching graphite-base/26650... ERROR: could not fetch base ref origin/graphite-base/26650. ERROR: could not determine base ref. make: *** [Makefile:768: lint/emdash] Error 1 ``` `scripts/check_emdash.sh` resolved its diff base by fetching `origin/$GITHUB_BASE_REF` and computing a merge-base. Graphite sets `GITHUB_BASE_REF` to a `graphite-base/<n>` ref that is ephemeral (it is not reliably present on origin), so the fetch fails and the check errors out instead of running. ## Fix `actions/checkout` checks out the PR **merge commit** (`refs/pull/<n>/merge`), whose **first parent (`HEAD^1`) is the exact base commit GitHub merged against**. Diffing `HEAD^1` against the checkout yields every change the PR makes against its base branch, for normal and Graphite-stacked PRs alike. No base-branch fetch, no merge-base computation, no `gh`-based deepen dance. - `scripts/check_emdash.sh`: use `HEAD^1` (the PR base commit) as the diff base in CI. Drops `resolve_merge_base` and `fetch_base_ref`. Emits a clear error if `HEAD^1` is missing (checkout too shallow). - `.github/workflows/ci.yaml`: bump the `lint` job checkout to `fetch-depth: 2` so `HEAD^1` is present with no runtime fetch. Local dev behavior (merge-base against `origin/main`) is unchanged. ## Verification - `make lint/emdash`, `make lint/shellcheck`, `make lint/actions/actionlint` pass. - Simulated the CI path with `GITHUB_BASE_REF` set: the check resolves to `HEAD^1` without fetching and still flags an added line containing an emdash. <details> <summary>Why the merge commit's first parent</summary> For a `pull_request` checkout of `refs/pull/<n>/merge`: - `HEAD` = GitHub's synthetic PR merge commit - `HEAD^1` = the exact base commit used for the merge - `HEAD^2` = the PR head commit `git diff HEAD^1 HEAD` is the full-tree diff from the base snapshot to the merged result, i.e. all of the PR's changes against its base. This is immutable and always local (given depth >= 2), unlike base branch refs which are mutable and, for Graphite stacks, ephemeral. </details> --- This PR was generated by Coder Agents on behalf of @dannykopping.	2026-06-26 12:34:49 +00:00
Nick Vigilante	b95f2531b5	feat: populate docs prose style guide as a landing page plus subpages (#26632) ... Replace the `docs/.style/style-guide.md` scaffold with the populated prose style guide, structured as a `README.md` landing page plus one subpage per topic so GitHub auto-renders the landing when readers open the style-guide folder. ## Layout ```text docs/.style/ style-guide/ README.md (landing: intro, section list, editing conventions, Vale enforcement) audience-and-scope.md (one audience, one outcome, declared up front; canonical personas) voice-and-tone.md word-choice.md accessibility-and-inclusion.md (new) capitalization-and-punctuation.md formatting.md (text formatting + block elements + screenshots sparingly) numbers-units-and-dates.md editor-setup.md (placeholder) ``` Every repo reference to the old path is rewired to the new path: `AGENTS.md` (and its `CLAUDE.md` / `.cursorrules` symlinks), `.claude/docs/DOCS_STYLE_GUIDE.md`, `docs/about/contributing/documentation.md`, `docs/.style/README.md`, `docs/.style/styles/Coder/README.md`, and a comment in `.github/workflows/ci.yaml`. The touched paragraph in each of those files is reformatted to one sentence per line per the touch-paragraph rule (refer to [Conventions the guide dogfoods](#conventions-the-guide-dogfoods)). ## What each page covers - **Audience and scope** (new): every page targets **one audience working toward one outcome**; the **install-vs-deploy Coder example** (workspace user vs platform engineer); pick one audience per page (write two pages and cross-link rather than tagging sections); pick one outcome per page (`Configure SSO with Okta` is one outcome, `Configure SSO` is not); declare audience and scope up front (the H1 names the outcome; the first paragraph names the audience); **canonical Coder personas** inlined as four primary (Dave the Developer, Ada the Infrastructure Admin, Perry the Platform Engineer, Steven the Sponsor) and six secondary (Melissa the Machine Learner, Tommy the Tester, Caitlin the Citizen Developer, Felipe the FinOps, Sergio the Security Officer, Tara the Team Leader), each with a `Coder surface:` line covering the relevant CLI/workspace/template/RBAC surfaces. - **Voice and tone**: address the reader directly, avoid first-person singular, reserve first-person plural for **Coder Technologies the company** (with an explicit ban on `we` for the product itself and on combined `you and the docs`), active voice, present tense with a **conditional/predictive `will` exception** (`If you do X, Y will happen`), **no sentence-ending prepositions** with a clunky-exception note. - **Word choice**: Coder product and feature names with the **Coder CLI always in backticks (`coder`)** rule, brand names with a parallel **Terraform CLI in backticks (`terraform`)** rule, **Dev Container** terminology (proper-noun specification vs lowercase instance, parallel to Coder / workspace), **phrasal verbs and their noun forms generalized as a table** (set up/setup, log in/login, sign in/sign-in, log out/logout, back up/backup, roll out/rollout, start up/startup, shut down/shutdown, with the `Quickstart` exception), `refer to` / `check out` / `visit` over `see`, `Learn more` versus `Next steps` with an **ableism rationale** (`steps` as a physical-mobility metaphor), `tutorial` versus `walkthrough` with an **ableism rationale**, **`select` over `click`**, **`Don&#39;t assume simplicity or difficulty`** (covers both `simple`/`easy` and `complex`/`non-trivial`), **`Avoid weasel words`** (vague attributions in the Wikipedia sense like `many believe`, `experts agree`, `studies show`), plain language for product actions with an **industry-term exception scope** for the Linux `kill` command, the `SIGKILL` signal, and the `disabled` config flag state. - **Accessibility and inclusion** (new): WCAG 2.1 Level AA as the minimum target with AAA as a stretch goal; heading structure (one H1 per page, no skipped levels, **substantive content between headings**); inclusive pronouns; inclusive-language substitutions including a **dedicated `sanity check` row** with `smoke testing` / `confidence testing` / `acceptance testing` alternatives; descriptive link text; alt text and decorative-image conventions; **plain English for international readers** (no idioms; common Latin abbreviations `e.g.`, `i.e.`, `etc.`, `vs.`, and `et al.` allowed, less common ones not); page descriptions in `docs/manifest.json` (the docs site does not yet support YAML front matter); reading level; color contrast deferred to the docs site theme. - **Capitalization and punctuation**: sentence-case headings, no gerund-leading headings with **documented exceptions** (`Pricing`, `Billing`, `Logging`, `String formatting`, etc.), **trailing heading punctuation in three tiers** (periods and exclamation marks forbidden at error severity, question marks allowed sparingly at suggestion severity, characters inside backticks exempt for both), no em or en-dashes with a **corrected example** showing parenthetical em-dash use rather than series-joining, Oxford comma, US-style quotation, semicolons sparingly, rare exclamation marks, numeric ranges. - **Formatting**: text formatting (bold for UI with **explicit greater-than separator rule for navigation paths**, italics for emphasis, code font for identifiers presented as a **bulleted list**) and block elements (code blocks with language fences plus **link to the Prism supported-languages reference**, callouts with tightened scenarios, tabs with the actual `` syntax and a **macOS/Linux/Windows example**, lists with a **five-item prose-list cap rule** and an **explicit terminal-punctuation rule** (complete sentences end in periods, phrases completing a lead-in paragraph end in periods, single-word labels carry no terminal punctuation, no mixing styles in one list), tables with a **narrow-table guideline** that reconsiders the structure when many columns are needed, links including the rule that **non-docs codebase links also use relative paths**, images, **screenshots sparingly** with a maintenance-burden rationale and an adapted quote from Lorna Jane Mitchell&#39;s `Short tech writing style guide for developers`), with cross-references to the accessibility page for link text and alt text. - **Numbers, units, and dates**: digits everywhere preference, non-breaking space between number and unit with **separate pre-render (Markdown source) and post-render (visible output) demonstrations** plus a **window-shrink tip** for confirming the rule visually, `Month Day, Year` date format, 12-hour time with AM/PM, ordinals exception. - **Editor setup**: placeholder. ## Conventions the guide dogfoods - **One sentence per line**. Source lines follow a one-sentence-per-line policy: each sentence sits on its own Markdown source line, sentences are not split across lines, and lines do not wrap to a fixed column width. The same convention applies corpus-wide through an **incremental touch-paragraph rule**: when a contributor edits any line inside a paragraph, the whole paragraph is reformatted to one sentence per line as part of the same edit. Bullet items, numbered list entries, and blockquote lines are each their own paragraph for the rule. Headings, fenced code blocks, and tables are out of scope. `markdownlint`&#39;s `MD013` is already disabled, so the convention is editorial. - **No navigational `see`**. Replaced with **refer to** (formal default), **check out** (informal/tutorials), or **visit** (external URLs). `See` is reserved for the observational meaning. - **HTML entities for em-dashes inside demos**. The em-dash demo encodes `—` / `–` so the source stays ASCII while the rendered output still shows the character. - **No semicolons in body prose**. Body prose prefers two sentences over a semicolon. Semicolons survive only in heading and rule labels where they act as separators. - **Common Latin abbreviations allowed in own prose**. `e.g.`, `i.e.`, `etc.`, `vs.`, and `et al.` (citation contexts) are fine. Less common Latin abbreviations (`a priori`, `q.v.`, `viz.`, `n.b.`, `cf.`, `ibid.`) are not. The rule covers punctuation too: prefer parentheses around `e.g.` and `i.e.` clauses, one period when `etc.` ends a sentence, both periods when `etc.` ends a parenthetical that ends a sentence. - **No idioms or industry-jargon idioms**. `deep dive`, `paved path`, etc. are rewritten in plain language. ## Rule conventions Each rule pairs a rationale with **Do** / **Don&#39;t** blockquoted examples and a parenthetical noting the Vale rule that enforces (or will enforce) the policy. Documentation-only rules are explicitly labeled as such. Substitution rules use tables. ## Out of scope - Wiring any new Vale rule. Per-rule PRs land separately per the rule-authoring doctrine in `docs/.style/README.md`. - Editor setup page population. - Redirecting `docs/about/contributing/documentation.md` to the populated guide (needs a coordinated `coder.com` PR after merge). - Trimming the `Writing Style` block in `.claude/docs/DOCS_STYLE_GUIDE.md` and removing the `currently a scaffold` framing in the agent docs. - A separate demo PR for the callout types rendered against an existing docs page. - Sweeping navigational `see` out of other docs files. The new rule only dogfoods on the style guide itself; a corpus-wide sweep is a separate ticket. ## Validation - `make fmt/markdown`: clean. - `make lint/markdown`: 0 errors across 494 files. - `./scripts/check_emdash.sh`: clean. - Pre-commit-light: passes (fmt + lint + emdash + shellcheck + typos + actionlint + migrations + helm). - Dogfood scan: no first-person singular in own prose, no idioms, only the five allowed Latin abbreviations in own prose, no `walkthrough` or `Next steps` outside rule definitions and examples, no navigational `see`, no `click` outside rule definitions and examples, no semicolons in body prose. <details> <summary>CI flake note: <code>check-docs</code> (linkspector)</summary> The `check-docs` job can fail intermittently on pre-existing external links in `docs/about/contributing/documentation.md` (lines 29 and 30): Merriam-Webster occasionally returns HTTP 403 to GitHub Actions runners and Chicago Manual of Style can time out at 30s. Neither link is touched by this PR. `docs/.style/` itself is in `.github/.linkspector.yml` `excludedDirs`, and linkspector annotations confirm zero broken links from the new pages. </details> Resolves DOCS-434. --- *Filed via [Coder Agents](https://coder.com/docs/ai-coder/agents) on Nick&#39;s behalf.*	2026-06-25 21:11:39 +00:00
Nick Vigilante	6acf32701e	fix: preserve Vale severity in CI annotations and add three-severity demo (#26587) ... Closes DOCS-426. Follow-up to [#26586](https://github.com/coder/coder/pull/26586) (DOCS-425, strip), which merged first. ## Problem The Vale problem matcher at `.github/vale-problem-matcher.json` hard-codes `"severity": "warning"`. Every Vale finding renders as a GitHub `warning` annotation, regardless of Vale's actual severity. Nick observed this on PR [#25501](https://github.com/coder/coder/pull/25501): error-level findings from `Coder.BrandNames` appear as warnings. This collapsed the doctrine's three-severity ladder (`error` / `warning` / `suggestion`) into a single advisory channel for the reader of a PR diff. This PR restores the ladder visually so contributors and reviewers see each rule's intended severity. ## Root cause GitHub Actions problem matchers expect either a regex capture group for severity or a hard-coded severity. Vale's `--output=line` format produces `path:line:col:rule:message` with severity stripped, so the matcher had no severity to capture and fell back on the hard-coded value. ## Fix ### Commit 1: severity rendering Switch the Vale prose lint step to `vale --output=JSON` and pipe through `jq` to emit GitHub workflow commands directly. Drop the problem matcher file. | Vale severity | GitHub workflow command | |---|---| | `suggestion` | `::notice::` | | `warning` | `::warning::` | | `error` | `::error::` | Message bodies are URL-encoded for `%`, `\r`, and `\n` per the GitHub Actions workflow command spec. The Vale step stays advisory (`continue-on-error: true`, `vale --no-exit`); rendering becomes correct but the step never fails the job. ### Commit 2: three-severity demo Three throwaway `Coder.Demo*` rules at `level: suggestion`, `level: warning`, and `level: error`, plus a `docs/.style/_vale-annotation-demo.md` file that triggers each rule exactly once. Together with the rendering fix above, this PR's CI surfaces three GitHub annotations in three distinct severities (notice, warning, error). Use the Files Changed view to inspect rendering. The demo files live permanently in `docs/.style/`, which is excluded from coder.com. They re-trigger annotations only on PRs that touch the demo file itself, so they don't pollute CI on day-to-day PRs. ## Sample output <img width="1443" height="1293" alt="image" src="https://github.com/user-attachments/assets/fb337315-7b55-40b3-9983-828b2d5399fc" /> <img width="1443" height="1293" alt="image" src="https://github.com/user-attachments/assets/b02d575d-5905-4c6d-b145-ad5df6e04f11" /> ## Out of scope Blocking merge on `error`-level findings is the natural next step but is sequenced as the **final** step of the prose-style rollout. It was prototyped in this PR (commit 3, since backed out) and verified end-to-end against the demo doc. The work moved to [DOCS-433](https://linear.app/codercom/issue/DOCS-433/block-merge-on-vale-error-level-findings-final-step-of-prose-style) so the corpus of enabled rules is broad enough by the time the gate lands that it catches real violations rather than novelty failures from a single rule. ## Expected CI state on this PR `lint-docs` passes. The three demo annotations render at lines 17 / 19 / 21 of `docs/.style/_vale-annotation-demo.md` as `::notice::`, `::warning::`, and `::error::` respectively. The `::error::` annotation does not fail the job because the Vale step is still advisory under this PR. Local verification of the rendering pipeline: ``` $ printf '%s\n' 'docs/.style/_vale-annotation-demo.md' \ | xargs -d '\n' vale --no-exit --output=JSON \ | jq -r '...' ::notice file=docs/.style/_vale-annotation-demo.md,line=17,col=3,title=Coder.DemoSuggestion::[Demo] Suggestion-level Vale annotation. ::warning file=docs/.style/_vale-annotation-demo.md,line=19,col=3,title=Coder.DemoWarning::[Demo] Warning-level Vale annotation. ::error file=docs/.style/_vale-annotation-demo.md,line=21,col=3,title=Coder.DemoError::[Demo] Error-level Vale annotation. ``` <details> <summary>Decision log</summary> - **Workflow commands vs custom Vale template + updated matcher**: chose workflow commands because the transform is a 10-line jq pipeline with no extra files to maintain, and it bypasses GitHub Actions problem-matcher limitations entirely. The custom-template option would have kept the matcher infrastructure but required an additional Go template file under `.github/`. - **Throwaway demo rules vs reusing existing rules**: chose throwaway because we wanted each severity to fire deterministically from a single unambiguous marker. Reusing existing rules would couple the demo to corpus content and obscure the signal. - **Demo persists vs drops before merge**: persists. The merge-gate constraint that originally forced the demo to drop is gone (deferred to DOCS-433). The four demo files live in `docs/.style/`, excluded from coder.com, and only annotate PRs that touch them. They double as a permanent canary so a future regression in severity rendering surfaces immediately on whichever PR introduces it, and as the verification artifact DOCS-433 uses when re-installing the merge gate. - **`docs/.style/_vale-annotation-demo.md` filename**: underscore prefix follows Coder convention for files that exist outside the normal docs taxonomy. Not surfaced on coder.com/docs because `docs/.style/` is excluded from the manifest, deploy workflow, and docs preview. - **Merge-block deferred to DOCS-433**: the rendering fix and the merge gate are independent changes. Shipping the rendering first lets contributors see the three-severity ladder while the rule catalogue is still small and the false-positive policy hasn't been stress-tested yet. The gate lands as the final step of the rollout, after the catalogue is broad enough that the gate covers real prose-style policy rather than one rule's enforcement. </details> --- *Filed via [Coder Agents](https://coder.com/docs/ai-coder/agents) on Nick's behalf.*	2026-06-23 12:55:15 -04:00
Nick Vigilante	ee3572ab9a	feat: wire Vale prose linter into docs CI (#25467) ... Wires Vale into docs CI as an advisory (non-blocking) prose-lint step. Closes [DOCS-40](https://linear.app/codercom/issue/DOCS-40). > **Integration update (rebased onto `main`).** Since this branch was opened, `main` consolidated docs linting into the **required** `lint-docs` job in `ci.yaml` and removed the standalone `docs-ci.yaml` ([#25608](https://github.com/coder/coder/pull/25608)). This PR adds Vale to that `lint-docs` job instead of resurrecting `docs-ci.yaml`, and the `docs/.style/` scaffold defers to the merged [#25466](https://github.com/coder/coder/pull/25466) (DOCS-180). Vale stays advisory. > **Post-review refactor.** Following the Coder Agents review, Vale is now invoked through `mise exec "aqua:errata-ai/vale"` (the same pattern as `actionlint`/`zizmor`) instead of a bespoke `curl`/`tar` download. This removed the GNU-only `grep -oP` version extraction and `uname`/arch mapping that broke on macOS BSD grep, and the prose step now skips paths a PR deletes. See the resolved review threads for CRF-17/19/20/21/22. A sample of what this check does is as follows: <img width="1443" height="1293" alt="image" src="https://github.com/user-attachments/assets/cf68dbf9-d9df-49ba-8dbf-200875bc289e" /> ## What changes - `.vale.ini` at the repo root: Google base + Coder (custom, empty in v1) + curated write-good. `alex` rules are pulled in a la carte. Inline comments justify every enable/disable. - `mise.toml`: pin Vale `3.7.1` via aqua. `mise.lock`: lock that pin across all platforms so `mise install --locked` (used by `build_image`) resolves it. - `Makefile`: a `docs/.style/.vale-synced` sentinel that gates `vale sync`, and a `lint/prose` target that runs `vale --no-exit`. Both invoke Vale via `mise exec "aqua:errata-ai/vale" -- vale ...`, so mise owns the version and the OS/arch download (no hand-rolled install path). - `.github/workflows/ci.yaml`: append Vale steps to the existing required `lint-docs` job: `Detect changed Markdown`, `Restore Vale styles`, `Prepare Vale styles` (`make docs/.style/.vale-synced`), `Vale prose lint`, and a default-branch-only `Save Vale styles`. They lint only changed Markdown under `docs/` that still exists on disk, with a problem matcher for inline PR annotations. - `.github/vale-problem-matcher.json`: parses `vale --output=line` so alerts surface as annotations on the Files Changed tab. - `.gitignore` and the workflow cache `path:`: use `docs/.style/styles/*` plus a `!docs/.style/styles/Coder` negation so adding a package does not require parallel edits. - `.markdownlint-cli2.jsonc`: ignore the synced styles so `make lint/markdown` does not lint upstream READMEs. Scaffold prose under `docs/.style/` and `.claude/docs/DOCS_STYLE_GUIDE.md` / `AGENTS.md` come from the merged DOCS-180; this PR no longer touches them. Net diff against `main` is the 8 Vale-wiring files only. ## Severity policy (v1) Rule severity reflects two things together: the rule's false-positive rate against real Coder docs and the gravity of the rule. Low FPs plus high gravity argues for `error`; lower gravity or more judgment calls argue for `warning` or `suggestion`. v1 lands most rules at `warning` and the wordiness rules at `suggestion`. A rule promotes to `error` only when (a) its false-positive rate against real content is effectively zero and (b) the existing-content violation count for that rule is also zero. Vale exits non-zero only on error-level alerts regardless of `MinAlertLevel`; the Makefile and CI invoke Vale with `--no-exit` so the baseline error count from un-overridden Google rules does not fail the build while real failures (bad config, missing files) still propagate. ## CI integration Vale runs as steps appended to the required `lint-docs` job in `ci.yaml`, gated on changed Markdown: 1. **`Detect changed Markdown`** (`tj-actions/changed-files`) scopes to changed `**.md`; the prose step re-filters to `docs/` (the `docs/**.md` glob silently skips dot-prefixed dirs and would miss `docs/.style/style-guide.md`). 2. **`Restore Vale styles`** (`actions/cache/restore`), keyed off `hashFiles('.vale.ini', 'mise.toml', 'docs/.style/styles/Coder/**')`. mise manages the Vale binary, so only the synced styles are cached. 3. **`Prepare Vale styles`** runs `make docs/.style/.vale-synced` (`mise exec ... vale sync`). 4. **`Vale prose lint`** filters the changed set to `docs/` paths still present on disk, then runs `mise exec ... vale --no-exit --output=line`, emitting inline annotations via the problem matcher. 5. **`Save Vale styles`** writes the cache, gated to `refs/heads/main` only so PR runs cannot poison the cache other branches restore from (the zizmor `cache-poisoning` concern). **Every Vale step is `continue-on-error: true`.** This is a deliberate change from the original standalone-workflow design: now that Vale lives inside the *required* `lint-docs` job, a transient `vale sync` network failure (or first-use `mise` install blip) would otherwise block merges. `continue-on-error` keeps Vale advisory, so only the markdownlint / table-formatter checks above (`pnpm check-docs`) remain merge-blocking. `vale --no-exit` additionally keeps the baseline error count from un-overridden Google rules from failing the step. ## Verification - `actionlint` clean on `ci.yaml` (local + `make lint/actions/actionlint`); `zizmor --persona regular` reports no findings. - `make lint/prose` on the full `docs/` corpus: ~406 errors, ~5,346 warnings, ~7,928 suggestions across 461 files, exit 0 (`--no-exit`), Vale `3.7.1` installed by mise. - Net diff vs `main` is the 8 Vale-wiring files only; the `docs/.style/` scaffold already matches `main`. <details> <summary>Implementation plan and decision log</summary> ### Why this rule set The Vale evaluation against the full docs corpus (measured 2026-05-18) produced ~43,940 raw violations across six candidate base styles. The selection here drops Microsoft and RedHat (overlap with Google, and RedHat's Spacing rule hammers technical IDs), and proselint (Annotations rule treats `> [!NOTE]` admonitions as TODO markers). Within the kept styles: - **Google** is the base. Disables: `EmDash` (conflicts with `make lint/emdash`), `Latin` (i.e./e.g. are fine for our audience), `Spacing` (4,500 errors on `codersdk.SomeType` patterns in the auto-generated API reference). Softened: `Parens` to `suggestion`, `WordList` to `warning`. - **write-good** is the base, with `Passive` and `E-Prime` off. `TooWordy` and `ThereIs` are suggestions; `Weasel` is a warning. - **alex** is cherry-picked (not in `BasedOnStyles`): `Ablist`, `Condescending`, `LGBTQ`, `ProfanityLikely`, `Race`, `Suicide` at warning. The `ProfanityMaybe`/`ProfanityUnlikely` rules trip on `execute`, `kill`, `failed`, and `attack`, which read as technical vocabulary in our context. - **Coder** is in `BasedOnStyles` but the directory is empty in v1. Rules land through the per-rule tickets in the [Docs style guide](https://linear.app/codercom/project/docs-style-guide-7828445b9afc) project. ### Why `mise exec` instead of a download block Vale is pinned in `mise.toml` like `actionlint` and `zizmor`, so invoking it via `mise exec "aqua:errata-ai/vale" -- vale ...` makes the pin the single source of truth and lets mise handle the OS/arch-specific download. This replaced an earlier ~30-line `curl`/`tar` block whose GNU-only `grep -oP ...\K` version extraction returned empty on macOS BSD grep. Note: the bare `vale` short name in `mise exec` ignores the pin and resolves to the latest release, so the full aqua key is required. ### Why `vale sync` instead of vendoring The three style packages weigh ~272 KB combined, so vendoring is cheap. But Vale's ecosystem treats `Packages = ` + `vale sync` as canonical, the upstream LICENSE files are not in the package tarballs (would need to be added manually), and the CI cache makes the sync nearly free after the first run. Sticking with the canonical pattern keeps the repo lean and the upgrade path obvious. ### Why `lint/prose` is not in `lint:` or `lint-light:` Vale on the full docs corpus takes ~20s on cold caches. Forcing every pre-commit through that would be aggressive for a feature that ships as warnings. `make lint/typos` follows the same pattern (it is in `lint-light` but not `lint`; CI invokes it directly). v1 keeps Vale opt-in locally and CI-only by default; promote to `lint:` once the rule set stabilizes. ### Exit-code handling Two mechanisms combine, and the choice changed when the step moved into the required `lint-docs` job: - `vale --no-exit` suppresses Vale's non-zero exit on alerts, so the baseline error-level violations from un-overridden Google rules do not fail the step while the cleanup PRs land. Real failures (config invalid, file missing) still exit non-zero. - `continue-on-error: true` on every Vale step. Because the steps now run inside the *required* `lint-docs` job, a `vale sync` download/network blip must not block merges. The original (standalone, non-required) design rejected `continue-on-error` for showing a misleading yellow badge; in a required job that tradeoff flips, and advisory-yellow is strictly preferable to merge-blocking-red on an infrastructure flake. `|| true` in the Makefile was also rejected: it swallows missing-config failures indiscriminately. ### Pre-mortem - **Generated docs noise**: `docs/reference/` is dominated by auto-generated content (clidocgen, apidocgen, auditdocgen, metricsdocgen). The architectural decision is to fix the generators, not exclude paths in Vale. Google.Spacing is the only rule silenced specifically to defer the generator fix; everything else surfaces as warnings. - **First-run cost**: `mise` installs the pinned Vale (a single small binary) and `vale sync` pulls the style packages on a cold run. The Actions cache keyed off `hashFiles('.vale.ini', 'mise.toml', 'docs/.style/styles/Coder/**')` makes subsequent runs near-instant; the `Coder/**` hash is defense-in-depth against [actions/toolkit#713](https://github.com/actions/toolkit/issues/713) so a future cache release that regresses path-negation cannot serve a stale `Coder/` from cache. - **Required-job blast radius**: moving Vale into the required `lint-docs` job means any Vale step failure would gate merges. Mitigated by `continue-on-error` on all Vale steps plus a clean skip when no changed `docs/` Markdown remains on disk, so only `pnpm check-docs` stays blocking. - **Cross-platform install**: handled by mise (aqua backend) rather than a hand-rolled `uname`/arch map, which removes the macOS BSD-grep break the review flagged. - **Deleted files**: `all_changed_files` is ACMRD and lists paths a PR removes; the prose step filters to files still present on disk so Vale does not error on a missing file. - **Local-vs-CI parity**: CI lints changed files only; local `make lint/prose` lints the full tree. This mirrors `make lint/markdown` (full tree) vs the changed-files CI step. Acceptable for v1. </details> --- *Filed via [Coder Agents](https://coder.com/docs/ai-coder/agents) on Nick's behalf.*	2026-06-22 14:14:31 -04:00
McKayla はな	3e68dd304a	ci: set up pixel (#26324) ... IT'S FINALLY HERE	2026-06-16 14:43:54 -06:00
Spike Curtis	792afc0842	ci: capture PostgreSQL logs in the gen job (#26340) ... Adds a `test-postgres-docker-logs` Make target that dumps the test PostgreSQL container's logs via `docker logs`. The container already logs every statement to stderr (`log_statement=all`, no `logging_collector`), so Docker captures them and no volume mounting or reconfiguration is needed. The CI `gen` job now starts the container with `make test-postgres-docker` before `make gen`, collects the logs at the end (always, even on failure), and uploads them as the `gen-postgres-logs` artifact to help debug generation issues that depend on the database. Refs: https://github.com/coder/internal/issues/1568 <sub>Opened by Coder Agents on behalf of @spikecurtis.</sub>	2026-06-15 16:23:36 -04:00
Dean Sheather	6c230d6e0f	chore(.github): remove fly.io workspace-proxy deployment (#25126) ... Removes the fly.io-based workspace-proxy deployment from CI. The dogfood workspace proxies in Paris (`cdg`), Sydney (`syd`), and Johannesburg (`jnb`) are no longer deployed via fly.io, and the São Paulo proxy session-token secret was already unreferenced in `deploy.yaml`. ## Changes - Deleted `.github/fly-wsproxies/{paris,sydney,jnb}-coder.toml`. - Removed the `deploy-wsproxies` job from `.github/workflows/deploy.yaml`, along with its `workflow_call.secrets` block declaring the five `FLY_*` inputs. - Removed the matching `secrets:` pass-through from the `deploy` job in `.github/workflows/ci.yaml`. The Kubernetes/EKS dogfood deploy job and `should_deploy.sh` logic are unchanged. ## Repository secrets that can now be deleted Once this lands, the following GitHub Actions repository secrets are no longer referenced anywhere in this repo and are safe to remove: - `FLY_API_TOKEN` - `FLY_PARIS_CODER_PROXY_SESSION_TOKEN` - `FLY_SYDNEY_CODER_PROXY_SESSION_TOKEN` - `FLY_JNB_CODER_PROXY_SESSION_TOKEN` - `FLY_SAO_PAULO_CODER_PROXY_SESSION_TOKEN` (was already passed through but unused inside `deploy.yaml`) Worth double-checking they aren't referenced by any other repos / org workflows before deleting from the org/repo settings. ## Out of scope (intentionally left alone) - `site/static/icon/fly.io.svg` — region icon, used at runtime for any user-deployed workspace proxy that picks the fly.io icon. - `docs/install/other/index.md` — unofficial "Run Coder on Fly.io" community install entry, unrelated to our CI. - `site/src/testHelpers/entities.ts` `*.fly.dev.coder.com` strings — UI test fixtures. ## Validation - `python3 -c "yaml.safe_load(...)"` on both edited workflows. - `make pre-commit` ran via the git hook on commit (actionlint, shellcheck, typos, helm, markdown, etc. all green). - Repo-wide grep confirms no remaining `FLY_`, `flyctl`, `fly.toml`, or `fly-wsproxies` references in `.github/` or `scripts/`.	2026-06-03 21:22:41 +10:00
Thomas Kosiewski	fe257666d7	ci: refactor CI to use mise for shared tool setup (#25727)	2026-06-01 15:55:19 +02:00
Garrett Delfosse	5991a2c8b0	ci: trigger CI on release branch creation (#25744) ... GitHub Actions does not reliably trigger the push-based CI workflow when a new branch is created at a commit that already has a workflow run from another branch (e.g. `main`). This meant cutting a release branch produced no CI run on it, so `should_deploy.sh` never got to approve the deploy from the release branch. Adds the `create` event trigger to `ci.yaml` with a condition on the `changes` job to only proceed for release branch creations. All other jobs depend on `changes`, so non-release branch creations are a no-op. > Generated with [Coder Agents](https://coder.com/agents) by @f0ssel	2026-05-27 14:46:18 -04:00
Ethan	f422ac89cc	ci: extract go-test-failure-report composite action (#25670) ... The Go test jobs in `ci.yaml` each had ~30 lines of inline shell that wrapped `gotestsum` with a PATH shim to capture JSON, then ran `gotestsummary` and `upload-artifact` to publish a failure report. Three jobs carried three near-identical copies. This change replaces the three inline blocks with a single composite action at `.github/actions/go-test-failure-report/` that runs the same `gotestsummary` invocation, writes the same markdown to `GITHUB_STEP_SUMMARY`, and uploads the same NDJSON artifact. The PATH shim is gone; gotestsum's native `GOTESTSUM_JSONFILE` env variable is used instead, plumbed through the `test-go-pg` composite. `test-go-pg` gains three optional inputs: - `gotestsum-json-file` — explicit JSON file path (or `default` for `${RUNNER_TEMP}/go-test.json`) - `run-regex` — passed to `go test -run` - `test-shuffle` — passed to `go test -shuffle` All three have safe defaults so existing callers are unaffected. No observable change in CI behavior: the three existing test-go-pg jobs continue to emit the same JSON, render the same failure summary, and upload the same artifact. Stacked under #25667, which uses the new composite and inputs to power a new flake-detector workflow.	2026-05-28 00:16:46 +10:00
Ethan	e99f7171e4	ci: require docs lint when docs change (#25608) ... Move docs linting into the required CI umbrella and reuse the existing `changes` job so docs lint runs when docs or CI files change, plus on `main` as a backstop. This is motivated by the docs lint failures on #25601. That PR touched `.claude/docs/TESTING.md`; the standalone `Docs CI` workflow picked it up because `docs-ci.yaml` used broad `**.md` matching, but local `pnpm lint-docs` and `make lint` did not catch the same file because they only scanned `docs/**` plus root `*.md`. The first failed Docs CI run reported markdownlint errors in `.claude/docs/TESTING.md` (`MD040` and `MD031`), and the next run reported a markdown table formatter failure in the same file. That mismatch is why this PR exists: prevent unrelated PRs from being surprised by stale `.claude/docs/**` lint drift only after they happen to touch one of those files. The local docs scripts now include `.claude/docs/**`, and the old standalone `Docs CI` workflow is removed so we do not maintain separate path-filter logic outside the required CI workflow. > Generated by mux, but reviewed by a human	2026-05-27 12:30:05 +10:00
Thomas KosiewskiandClaude Opus 4.7	5f9b3220b5	chore: install dogfood image tooling via mise.toml (#25282) ... This PR replaces the hand-rolled `curl | tar | go install | cargo install` chains in the dogfood Ubuntu 22.04 and 26.04 Dockerfiles with a single `mise install` driven by a new repo-root `mise.toml`. The previous Dockerfiles installed ~25 CLIs across three multi-stage builds with versions hardcoded inline. Version bumps were scattered across the Dockerfiles, the root `mise.toml` (added in #24618 but otherwise unused at runtime), and CI's setup actions; build-time network failures came from a dozen distinct endpoints; and `mise` itself sat in the image with no manifest to install from. The new flow: - The repo's `mise.toml` is the single source of truth for image tool versions. The Dockerfiles `COPY` it to `/etc/mise/config.toml` and run a single `mise install` as the `coder` user. - Tools are installed into `/opt/mise/data` rather than the default `/home/coder/.local/share/mise`, so they live in the image (not on the persistent home volume) and reach every workspace on recreate. - Build context moves to the repo root so the Dockerfile can `COPY mise.toml`; an allowlist `.dockerignore` keeps the transferred context to ~24 kB. - Optional `--secret id=github_token` plumbing through the Makefile and `.github/workflows/dogfood.yaml` lifts aqua's GitHub API quota from 60/hr unauthenticated to 1000/hr with `secrets.GITHUB_TOKEN`. - `MISE_TRUSTED_CONFIG_PATHS=/home/coder:/etc/mise` is set as an ENV so users who clone the coder repo into their workspace home aren't prompted to `mise trust`. Net diff for the two Ubuntu Dockerfiles: -399 / +244 lines (~200 lines shorter each). The `FROM rust-utils`, `FROM go`, and `FROM proto` multi-stage builds are gone; so are the NVM/Node block, the bulk binary-install block (golangci-lint, helm, kubectx, syft, cosign, bun), the gh `.deb`/lazygit/doctl tarball installs, the gofmt `update-alternatives` line, and the `yq`→`yq4` rename (`scripts/lib.sh:267-275` already auto-detects either name). Both images were built and smoke-tested with Apple's `container` CLI on macOS — every migrated tool resolves to the expected pinned version including outside the cloned coder repo (e.g. `gh` from `/home/coder`, matching the workspace startup script in `dogfood/coder/main.tf`), `sqlc` runs (proving `CGO_ENABLED=1` was honoured at install), `yq --version` reports v4 for `scripts/lib.sh`'s detection, and `gofmt` resolves via the mise shim. Follow-ups (out of scope here): - Commit a multi-platform `mise.lock` so `gh = "latest"` and the other floating versions resolve deterministically across rebuilds and dev machines. - Migrate CI's `setup-go` / `setup-node` actions to consume `mise.toml` so image and CI versions stop being able to drift. --------- Signed-off-by: Thomas Kosiewski <tk@coder.com> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-15 11:36:22 +02:00
Michael Suchacz	bb8c40e764	feat: stream go test failure summary and drop raw json artifact (#25146) ... This follows up on https://github.com/coder/coder/actions/runs/25684936801/job/75406131184?pr=25139 by replacing the large raw Go test JSON artifact with inline structured summaries and a compact failures-only artifact. ## What changed - Added `scripts/gotestsummary`, a streaming Go tool that reads gotestsum JSON and renders failed tests as Markdown. - Updated the three Go test jobs to publish per-test `<details>` sections in the job summary. - Removed upload of the raw `go-test.json` artifact. - Added upload of `go-test-failures-*.ndjson` with compact failure records for deeper inspection. - Deleted the old bash and `jq` summary script. ## Why - The previous raw artifact was about 35 MB compressed and 445 MB raw in the linked run. - Passing-test output made the artifact noisy and slow to inspect. - The old summary truncated output to 600 characters. - The new path keeps streaming, bounded output and writes structured diagnostics for only final failed tests. ## Validation - `gofmt -w scripts/gotestsummary` - `gofmt -l scripts/gotestsummary` - `go test ./scripts/gotestsummary/...` - `go vet ./scripts/gotestsummary/...` - `grep -rn 'go-test-failure-summary.sh' . || true` - `grep -rn 'go-test-failure-summary.sh\|go-test.json\|go-test-json-' .claude .agents docs AGENTS.md || true` - `make lint/agents` - `make lint/emdash` - `make lint/markdown` - `make lint/shellcheck` - `git diff --check origin/main..HEAD` > This PR was prepared by Mux working on Mike's behalf.	2026-05-12 00:08:37 +02:00
Michael Suchacz	85792d08bc	feat: add harness engineering layer for agent workflows (#24791) ... This PR adds an opinionated harness-engineering layer for agent-driven workflows: a small set of agent-readable docs, mechanical structure checks, structured CI failure summaries, an architecture-lint umbrella, and per-worktree dev-server isolation. The goal is to make local dev, tests, and CI mechanically inspectable by agents without changing app runtime behavior. ## What landed **Agent docs and navigation** - `.claude/docs/OBSERVABILITY.md`, `.claude/docs/DEV_ISOLATION.md`, `.claude/docs/AGENT_FAILURES.md`: task-oriented guides for logs, tracing, Prometheus, dev-server isolation, and a seeded failure catalog. - `AGENTS.md`: added an `Agent navigation` block, then trimmed the file from 375 to 229 lines by migrating duplicated detail into `WORKFLOWS.md`, `GO.md`, `TESTING.md`, and `DATABASE.md`. The user-managed custom-instructions block is preserved. - `.agents/docs`: symlink mirror of `.claude/docs` for agent runtimes that look under `.agents`. **Mechanical checks** - `scripts/check_agents_structure.sh`: validates `@...` references in tracked `AGENTS.md` files and warns when root grows past 600 lines. Wired as `make lint/agents` and into `make lint`. - `scripts/audit-agent-readiness.sh`: report-first audit of harness readiness. Currently `10 ok, 0 warn, 0 fail`. - `scripts/check_architecture.sh` / `make lint/architecture`: umbrella architecture-lint target. Consolidates the existing `check_enterprise_imports.sh` and `check_codersdk_imports.sh` so they run exactly once via the umbrella. Slot is open for new high-confidence rules. **Structured CI failure summaries** - `scripts/playwright-failure-summary.sh`: parses `site/test-results/results.json` and writes Markdown to `$GITHUB_STEP_SUMMARY` on failure. Wired into the `test-e2e` matrix job. - `scripts/go-test-failure-summary.sh`: parses `go test -json` line-delimited output the same way. Wired into `test-go-pg`, `test-go-pg-17`, and `test-go-race-pg` by injecting `gotestsum --jsonfile` in the workflow without touching `Makefile`. JSON also uploaded as a CI artifact on failure. - `site/e2e/playwright.config.ts`: enables `screenshot: only-on-failure`, `trace: retain-on-failure`, JSON reporter, and HTML reporter alongside existing reporters. - `.github/workflows/ci.yaml`: failure artifact uploads for Playwright now use `if: failure()` and predictable names (`playwright-artifacts-<variant>-<sha>`). **Per-worktree dev-server isolation** (`scripts/develop/main.go`) - Deterministic FNV-64a hash of the worktree path produces a port offset in `[0, 1000)` (50 buckets, step 20 to avoid API/proxy overlap across adjacent buckets). - Offset is applied only to defaults; both env vars (`CODER_DEV_PORT`, `CODER_DEV_WEB_PORT`, `CODER_DEV_PROXY_PORT`, `CODER_DEV_PROMETHEUS_PORT`) and CLI flags retain priority. - Hardcoded ports `9090` (embedded Prometheus UI) and `12345` (Delve) are unchanged by design. - Startup banner shows each port's source: `default`, `offset`, or `explicit`. - Unit tests in `scripts/develop/main_test.go` cover determinism, bounds, no-overlap across the four ports, and explicit-skip behavior. - State (`.coderv2/`) was already worktree-isolated via `os.Getwd()`, so no state-dir changes were needed. ## Validation `make lint/agents`, `make lint/architecture`, `make lint/emdash`, `bash scripts/audit-agent-readiness.sh` (10 ok, 0 warn, 0 fail), `shellcheck` on all 5 new scripts, `go test ./scripts/develop/...`, and `js-yaml` parse of `ci.yaml` all pass. Synthetic fixtures verify both failure-summary scripts handle empty/missing input (silent exit 0), ANSI-stripped output, and parent/subtest formatting. ## Known follow-ups (deferred) - Frontend Storybook/Vitest failure summary: lowest-leverage slice of the failure-summary work. Skipping until observed pain. - Architecture lint currently only delegates to existing import checks; new rules (`InTx` outer-store detection, swagger-annotation lint) plug in as needed. - 50 port-offset buckets means two worktree paths can occasionally collide. The DEV_ISOLATION doc tells users to set the relevant env var when this happens. > Mux opened this PR on Mike's behalf.	2026-05-11 17:27:29 +02:00
3 people	edd5d83280	ci: bump the github-actions group with 12 updates (#24558) ... Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Lukasz <CommanderK5@users.noreply.github.com> Co-authored-by: blink-so[bot] <211532188+blink-so[bot]@users.noreply.github.com>	2026-04-23 10:31:55 +05:00
Paweł Banaszewski	e00e85765b	chore: move aibridge library code into coder repo (#24190) ... This PR merges code from `coder/aibridge` repository into `coder/coder`. It was split into 4 PRs for easier review but stacked PRs will need to be merged into this PR so all checks pass. * https://github.com/coder/coder/pull/24190 -> raw code copy (this PR, before merging PRs on top of it, it was just 1 commit: https://github.com/coder/coder/commit/70d33f33200c7e77df910957595715f81f9bec24) * https://github.com/coder/coder/pull/24570 -> update imports in `coder/coder` to use copied code * https://github.com/coder/coder/pull/24586 -> linter fixes and CI integration (also added README.md) * https://github.com/coder/coder/pull/24571 -> added exclude to scripts/check_emdash.sh check Original PR message (before PR squash): Moves coder/aibridge code into coder/coder repository. Omitted files: - `go.mod`, `go.sum`, `.gitignore`, `.github/workflows/ci.yml,` `Makefile`, `LICENSE`, `README.md` (modified README.md is added later) - `.github`, `example`, `buildinfo,` `scripts` directories Simple verification script (will list omitted files) ``` tmp=$(mktemp -d) echo "$tmp" git clone --depth=1 https://github.com/coder/aibridge "$tmp/aibridge" git clone --depth=1 --branch pb/aibridge-code-move https://github.com/coder/coder "$tmp/coder" diff -rq --exclude=.git "$tmp/aibridge" "$tmp/coder/aibridge" # rm -rf "$tmp" ```	2026-04-22 17:01:01 +02:00
Kayla はな	d23a6959fc	chore: upgrade to ubuntu 26.04 (#24267)	2026-04-15 15:02:47 -06:00
Ethan	155e98914d	ci: broaden workflow path filter and fix zizmor lint findings (#24323) ... ## What The `lint-actions` CI job only ran when `.github/workflows/ci.yaml` or `.github/actions/**` changed. New workflow files like `backport.yaml` and `cherry-pick.yaml` were never linted by zizmor, allowing several findings to land undetected. ## Changes **`.github/workflows/ci.yaml`** — Broaden the `ci` path filter from `".github/workflows/ci.yaml"` to `".github/workflows/**"` so `lint-actions` runs when any workflow file changes. **`.github/workflows/backport.yaml`**: - Move permissions from workflow-level to job-level (`detect` → `contents: read`, `backport` → `contents: write` + `pull-requests: write`) — fixes `excessive-permissions` - Replace `${{ matrix.branch }}` in `run:` block with `$BRANCH` env var — fixes `template-injection` - Add `persist-credentials: false` to both checkouts — fixes `artipacked` **`.github/workflows/cherry-pick.yaml`** — Add `persist-credentials: false` to checkout — fixes `artipacked` **`.github/zizmor.yml`** — Ignore `dangerous-triggers` for `backport.yaml` and `cherry-pick.yaml`. Both use `pull_request_target` intentionally — they only run post-merge (`merged == true`) and don't check out or execute untrusted PR code.	2026-04-14 16:34:12 +10:00
Ethan	47a12d26bc	ci: fix texlive.svg viewBox and add icon paths to CI go filter (#24322) ... ## What Fixes the `TestSVGIconAttributes/texlive.svg` CI failure introduced by #24312. Two changes: 1. **Fix `texlive.svg` viewBox**: Changed from `0 0 1024 1024` to `0 0 256 256` (wrapping content in `<g transform="scale(0.25)">` to preserve rendering). Also cleaned up non-standard attributes (`version`, `style`, `preserveAspectRatio`) to match other icons. 2. **Add icon/theme paths to CI go filter**: Added `site/static/icon/**` and `site/src/theme/**` to the `go` path filter in `ci.yaml` so Go tests (`test-go-pg`, `test-go-pg-17`, `test-go-race-pg`) run when icons or theme config change. This is why the failure wasn't caught on the PR — only `site/` files were modified, so Go tests were skipped entirely. Closes https://github.com/coder/internal/issues/1468	2026-04-14 16:12:30 +10:00
dependabot[bot]	6c47e9ea23	ci: bump the github-actions group with 3 updates (#24085) ... Bumps the github-actions group with 3 updates: [step-security/harden-runner](https://github.com/step-security/harden-runner), [dependabot/fetch-metadata](https://github.com/dependabot/fetch-metadata) and [github/codeql-action](https://github.com/github/codeql-action). Updates `step-security/harden-runner` from 2.16.0 to 2.16.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/step-security/harden-runner/releases">step-security/harden-runner's releases</a>.</em></p> <blockquote> <h2>v2.16.1</h2> <h2>What's Changed</h2> <p>Enterprise tier: Added support for direct IP addresses in the allow list Community tier: Migrated Harden Runner telemetry to a new endpoint</p> <p><strong>Full Changelog</strong>: <a href="https://github.com/step-security/harden-runner/compare/v2.16.0...v2.16.1">https://github.com/step-security/harden-runner/compare/v2.16.0...v2.16.1</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/step-security/harden-runner/commit/fe104658747b27e96e4f7e80cd0a94068e53901d"><code>fe10465</code></a> v2.16.1 (<a href="https://redirect.github.com/step-security/harden-runner/issues/654">#654</a>)</li> <li>See full diff in <a href="https://github.com/step-security/harden-runner/compare/fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594...fe104658747b27e96e4f7e80cd0a94068e53901d">compare view</a></li> </ul> </details> <br /> Updates `dependabot/fetch-metadata` from 2.5.0 to 3.0.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/dependabot/fetch-metadata/releases">dependabot/fetch-metadata's releases</a>.</em></p> <blockquote> <h2>v3.0.0</h2> <p>The breaking change is requiring Node.js version v24 as the Actions runtime.</p> <h2>What's Changed</h2> <ul> <li>feat: Parse versions from metadata links by <a href="https://github.com/ppkarwasz"><code>@​ppkarwasz</code></a> in <a href="https://redirect.github.com/dependabot/fetch-metadata/pull/632">dependabot/fetch-metadata#632</a></li> <li>Upgrade actions core and actions github packages by <a href="https://github.com/truggeri"><code>@​truggeri</code></a> in <a href="https://redirect.github.com/dependabot/fetch-metadata/pull/649">dependabot/fetch-metadata#649</a></li> <li>docs: Add notes for using <code>alert-lookup</code> with App Token by <a href="https://github.com/sue445"><code>@​sue445</code></a> in <a href="https://redirect.github.com/dependabot/fetch-metadata/pull/656">dependabot/fetch-metadata#656</a></li> <li>feat!: update Node.js version to v24 by <a href="https://github.com/sturman"><code>@​sturman</code></a> in <a href="https://redirect.github.com/dependabot/fetch-metadata/pull/671">dependabot/fetch-metadata#671</a></li> <li>Switch build tooling from ncc to esbuild by <a href="https://github.com/truggeri"><code>@​truggeri</code></a> in <a href="https://redirect.github.com/dependabot/fetch-metadata/pull/676">dependabot/fetch-metadata#676</a></li> <li>Add --legal-comments=none to esbuild build commands by <a href="https://github.com/jeffwidman"><code>@​jeffwidman</code></a> in <a href="https://redirect.github.com/dependabot/fetch-metadata/pull/679">dependabot/fetch-metadata#679</a></li> <li>Bump tsconfig target from es2022 to es2024 by <a href="https://github.com/jeffwidman"><code>@​jeffwidman</code></a> in <a href="https://redirect.github.com/dependabot/fetch-metadata/pull/680">dependabot/fetch-metadata#680</a></li> <li>Remove vestigial outDir from tsconfig.json by <a href="https://github.com/jeffwidman"><code>@​jeffwidman</code></a> in <a href="https://redirect.github.com/dependabot/fetch-metadata/pull/681">dependabot/fetch-metadata#681</a></li> <li>Switch tsconfig module resolution to bundler by <a href="https://github.com/jeffwidman"><code>@​jeffwidman</code></a> in <a href="https://redirect.github.com/dependabot/fetch-metadata/pull/682">dependabot/fetch-metadata#682</a></li> <li>Remove skipLibCheck from tsconfig.json by <a href="https://github.com/jeffwidman"><code>@​jeffwidman</code></a> in <a href="https://redirect.github.com/dependabot/fetch-metadata/pull/683">dependabot/fetch-metadata#683</a></li> <li>Add typecheck step to CI by <a href="https://github.com/jeffwidman"><code>@​jeffwidman</code></a> in <a href="https://redirect.github.com/dependabot/fetch-metadata/pull/685">dependabot/fetch-metadata#685</a></li> <li>Enable noImplicitAny in tsconfig.json by <a href="https://github.com/jeffwidman"><code>@​jeffwidman</code></a> in <a href="https://redirect.github.com/dependabot/fetch-metadata/pull/684">dependabot/fetch-metadata#684</a></li> <li>Upgrade <code>@​actions/core</code> to ^3.0.0 by <a href="https://github.com/truggeri"><code>@​truggeri</code></a> in <a href="https://redirect.github.com/dependabot/fetch-metadata/pull/677">dependabot/fetch-metadata#677</a></li> <li>Upgrade <code>@​actions/github</code> to ^9.0.0 and <code>@​octokit/request-error</code> to ^7.1.0 by <a href="https://github.com/truggeri"><code>@​truggeri</code></a> in <a href="https://redirect.github.com/dependabot/fetch-metadata/pull/678">dependabot/fetch-metadata#678</a></li> <li>Bump qs from 6.14.0 to 6.14.1 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/dependabot/fetch-metadata/pull/651">dependabot/fetch-metadata#651</a></li> <li>Bump hono from 4.11.1 to 4.11.4 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/dependabot/fetch-metadata/pull/652">dependabot/fetch-metadata#652</a></li> <li>Bump hono from 4.11.4 to 4.11.7 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/dependabot/fetch-metadata/pull/653">dependabot/fetch-metadata#653</a></li> <li>Bump hono from 4.11.7 to 4.12.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/dependabot/fetch-metadata/pull/657">dependabot/fetch-metadata#657</a></li> <li>Bump qs from 6.14.1 to 6.14.2 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/dependabot/fetch-metadata/pull/655">dependabot/fetch-metadata#655</a></li> <li>Bump <code>@​modelcontextprotocol/sdk</code> from 1.25.1 to 1.26.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/dependabot/fetch-metadata/pull/654">dependabot/fetch-metadata#654</a></li> <li>Bump <code>@​hono/node-server</code> from 1.19.9 to 1.19.10 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/dependabot/fetch-metadata/pull/665">dependabot/fetch-metadata#665</a></li> <li>Bump hono from 4.12.2 to 4.12.5 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/dependabot/fetch-metadata/pull/664">dependabot/fetch-metadata#664</a></li> <li>Bump minimatch from 3.1.2 to 3.1.5 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/dependabot/fetch-metadata/pull/667">dependabot/fetch-metadata#667</a></li> <li>Bump hono from 4.12.5 to 4.12.7 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/dependabot/fetch-metadata/pull/668">dependabot/fetch-metadata#668</a></li> <li>Bump actions/create-github-app-token from 2.2.1 to 3.0.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/dependabot/fetch-metadata/pull/669">dependabot/fetch-metadata#669</a></li> <li>Bump flatted from 3.3.3 to 3.4.2 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/dependabot/fetch-metadata/pull/670">dependabot/fetch-metadata#670</a></li> <li>build(deps-dev): bump picomatch from 2.3.1 to 2.3.2 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/dependabot/fetch-metadata/pull/674">dependabot/fetch-metadata#674</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/ppkarwasz"><code>@​ppkarwasz</code></a> made their first contribution in <a href="https://redirect.github.com/dependabot/fetch-metadata/pull/632">dependabot/fetch-metadata#632</a></li> <li><a href="https://github.com/truggeri"><code>@​truggeri</code></a> made their first contribution in <a href="https://redirect.github.com/dependabot/fetch-metadata/pull/649">dependabot/fetch-metadata#649</a></li> <li><a href="https://github.com/sue445"><code>@​sue445</code></a> made their first contribution in <a href="https://redirect.github.com/dependabot/fetch-metadata/pull/656">dependabot/fetch-metadata#656</a></li> <li><a href="https://github.com/sturman"><code>@​sturman</code></a> made their first contribution in <a href="https://redirect.github.com/dependabot/fetch-metadata/pull/671">dependabot/fetch-metadata#671</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/dependabot/fetch-metadata/compare/v2...v3.0.0">https://github.com/dependabot/fetch-metadata/compare/v2...v3.0.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/dependabot/fetch-metadata/commit/ffa630c65fa7e0ecfa0625b5ceda64399aea1b36"><code>ffa630c</code></a> v3.0.0 (<a href="https://redirect.github.com/dependabot/fetch-metadata/issues/686">#686</a>)</li> <li><a href="https://github.com/dependabot/fetch-metadata/commit/ec8fff2ea0f40ccdbdcd1fea69759029f2990807"><code>ec8fff2</code></a> Merge pull request <a href="https://redirect.github.com/dependabot/fetch-metadata/issues/674">#674</a> from dependabot/dependabot/npm_and_yarn/picomatch-2.3.2</li> <li><a href="https://github.com/dependabot/fetch-metadata/commit/caf48bddf9ab5175bbd568425ea999bab03f1147"><code>caf48bd</code></a> build(deps-dev): bump picomatch from 2.3.1 to 2.3.2</li> <li><a href="https://github.com/dependabot/fetch-metadata/commit/13d82742f9de94226254782b8662a39878795272"><code>13d8274</code></a> Upgrade <code>@​actions/github</code> to ^9.0.0 and <code>@​octokit/request-error</code> to ^7.1.0 (<a href="https://redirect.github.com/dependabot/fetch-metadata/issues/678">#678</a>)</li> <li><a href="https://github.com/dependabot/fetch-metadata/commit/b60309944845001ba168d4947b0c43c4bc94be74"><code>b603099</code></a> Upgrade <code>@​actions/core</code> from ^1.11.1 to ^3.0.0 (<a href="https://redirect.github.com/dependabot/fetch-metadata/issues/677">#677</a>)</li> <li><a href="https://github.com/dependabot/fetch-metadata/commit/c5dc5b174070a3760ba36f0638aa6be896c4c7c9"><code>c5dc5b1</code></a> Enable noImplicitAny in tsconfig.json (<a href="https://redirect.github.com/dependabot/fetch-metadata/issues/684">#684</a>)</li> <li><a href="https://github.com/dependabot/fetch-metadata/commit/a183f3c7985054f86eba6dd1ad07cde0067cc4f7"><code>a183f3c</code></a> Add typecheck step to CI (<a href="https://redirect.github.com/dependabot/fetch-metadata/issues/685">#685</a>)</li> <li><a href="https://github.com/dependabot/fetch-metadata/commit/5e175645c2bdda348d0b48d730d38c537356a153"><code>5e17564</code></a> Remove skipLibCheck from tsconfig.json (<a href="https://redirect.github.com/dependabot/fetch-metadata/issues/683">#683</a>)</li> <li><a href="https://github.com/dependabot/fetch-metadata/commit/bb56eeb32acd8595e47fb3529ce5816589d912fe"><code>bb56eeb</code></a> Switch tsconfig module resolution to bundler (<a href="https://redirect.github.com/dependabot/fetch-metadata/issues/682">#682</a>)</li> <li><a href="https://github.com/dependabot/fetch-metadata/commit/3632e3d8b773dac47f843a97c7536d0ce4e73de4"><code>3632e3d</code></a> Remove vestigial outDir from tsconfig.json (<a href="https://redirect.github.com/dependabot/fetch-metadata/issues/681">#681</a>)</li> <li>Additional commits viewable in <a href="https://github.com/dependabot/fetch-metadata/compare/21025c705c08248db411dc16f3619e6b5f9ea21a...ffa630c65fa7e0ecfa0625b5ceda64399aea1b36">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action` from 4.31.9 to 4.35.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action's releases</a>.</em></p> <blockquote> <h2>v4.35.1</h2> <ul> <li>Fix incorrect minimum required Git version for <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a>: it should have been 2.36.0, not 2.11.0. <a href="https://redirect.github.com/github/codeql-action/pull/3781">#3781</a></li> </ul> <h2>v4.35.0</h2> <ul> <li>Reduced the minimum Git version required for <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a> from 2.38.0 to 2.11.0. <a href="https://redirect.github.com/github/codeql-action/pull/3767">#3767</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.1">2.25.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3773">#3773</a></li> </ul> <h2>v4.34.1</h2> <ul> <li>Downgrade default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.3">2.24.3</a> due to issues with a small percentage of Actions and JavaScript analyses. <a href="https://redirect.github.com/github/codeql-action/pull/3762">#3762</a></li> </ul> <h2>v4.34.0</h2> <ul> <li>Added an experimental change which disables TRAP caching when <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a> is enabled, since improved incremental analysis supersedes TRAP caching. This will improve performance and reduce Actions cache usage. We expect to roll this change out to everyone in March. <a href="https://redirect.github.com/github/codeql-action/pull/3569">#3569</a></li> <li>We are rolling out improved incremental analysis to C/C++ analyses that use build mode <code>none</code>. We expect this rollout to be complete by the end of April 2026. <a href="https://redirect.github.com/github/codeql-action/pull/3584">#3584</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.0">2.25.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3585">#3585</a></li> </ul> <h2>v4.33.0</h2> <ul> <li> <p>Upcoming change: Starting April 2026, the CodeQL Action will skip collecting file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses. Pull request analyses will log a warning about this upcoming change. <a href="https://redirect.github.com/github/codeql-action/pull/3562">#3562</a></p> <p>To opt out of this change:</p> <ul> <li><strong>Repositories owned by an organization:</strong> Create a custom repository property with the name <code>github-codeql-file-coverage-on-prs</code> and the type &quot;True/false&quot;, then set this property to <code>true</code> in the repository's settings. For more information, see <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">Managing custom properties for repositories in your organization</a>. Alternatively, if you are using an advanced setup workflow, you can set the <code>CODEQL_ACTION_FILE_COVERAGE_ON_PRS</code> environment variable to <code>true</code> in your workflow.</li> <li><strong>User-owned repositories using default setup:</strong> Switch to an advanced setup workflow and set the <code>CODEQL_ACTION_FILE_COVERAGE_ON_PRS</code> environment variable to <code>true</code> in your workflow.</li> <li><strong>User-owned repositories using advanced setup:</strong> Set the <code>CODEQL_ACTION_FILE_COVERAGE_ON_PRS</code> environment variable to <code>true</code> in your workflow.</li> </ul> </li> <li> <p>Fixed <a href="https://redirect.github.com/github/codeql-action/issues/3555">a bug</a> which caused the CodeQL Action to fail loading repository properties if a &quot;Multi select&quot; repository property was configured for the repository. <a href="https://redirect.github.com/github/codeql-action/pull/3557">#3557</a></p> </li> <li> <p>The CodeQL Action now loads <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">custom repository properties</a> on GitHub Enterprise Server, enabling the customization of features such as <code>github-codeql-disable-overlay</code> that was previously only available on GitHub.com. <a href="https://redirect.github.com/github/codeql-action/pull/3559">#3559</a></p> </li> <li> <p>Once <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">private package registries</a> can be configured with OIDC-based authentication for organizations, the CodeQL Action will now be able to accept such configurations. <a href="https://redirect.github.com/github/codeql-action/pull/3563">#3563</a></p> </li> <li> <p>Fixed the retry mechanism for database uploads. Previously this would fail with the error &quot;Response body object should not be disturbed or locked&quot;. <a href="https://redirect.github.com/github/codeql-action/pull/3564">#3564</a></p> </li> <li> <p>A warning is now emitted if the CodeQL Action detects a repository property whose name suggests that it relates to the CodeQL Action, but which is not one of the properties recognised by the current version of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3570">#3570</a></p> </li> </ul> <h2>v4.32.6</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.3">2.24.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3548">#3548</a></li> </ul> <h2>v4.32.5</h2> <ul> <li>Repositories owned by an organization can now set up the <code>github-codeql-disable-overlay</code> custom repository property to disable <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis for CodeQL</a>. First, create a custom repository property with the name <code>github-codeql-disable-overlay</code> and the type &quot;True/false&quot; in the organization's settings. Then in the repository's settings, set this property to <code>true</code> to disable improved incremental analysis. For more information, see <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">Managing custom properties for repositories in your organization</a>. This feature is not yet available on GitHub Enterprise Server. <a href="https://redirect.github.com/github/codeql-action/pull/3507">#3507</a></li> <li>Added an experimental change so that when <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a> fails on a runner — potentially due to insufficient disk space — the failure is recorded in the Actions cache so that subsequent runs will automatically skip improved incremental analysis until something changes (e.g. a larger runner is provisioned or a new CodeQL version is released). We expect to roll this change out to everyone in March. <a href="https://redirect.github.com/github/codeql-action/pull/3487">#3487</a></li> <li>The minimum memory check for improved incremental analysis is now skipped for CodeQL 2.24.3 and later, which has reduced peak RAM usage. <a href="https://redirect.github.com/github/codeql-action/pull/3515">#3515</a></li> <li>Reduced log levels for best-effort private package registry connection check failures to reduce noise from workflow annotations. <a href="https://redirect.github.com/github/codeql-action/pull/3516">#3516</a></li> <li>Added an experimental change which lowers the minimum disk space requirement for <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a>, enabling it to run on standard GitHub Actions runners. We expect to roll this change out to everyone in March. <a href="https://redirect.github.com/github/codeql-action/pull/3498">#3498</a></li> <li>Added an experimental change which allows the <code>start-proxy</code> action to resolve the CodeQL CLI version from feature flags instead of using the linked CLI bundle version. We expect to roll this change out to everyone in March. <a href="https://redirect.github.com/github/codeql-action/pull/3512">#3512</a></li> <li>The previously experimental changes from versions 4.32.3, 4.32.4, 3.32.3 and 3.32.4 are now enabled by default. <a href="https://redirect.github.com/github/codeql-action/pull/3503">#3503</a>, <a href="https://redirect.github.com/github/codeql-action/pull/3504">#3504</a></li> </ul> <h2>v4.32.4</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.2">2.24.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3493">#3493</a></li> <li>Added an experimental change which improves how certificates are generated for the authentication proxy that is used by the CodeQL Action in Default Setup when <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">private package registries are configured</a>. This is expected to generate more widely compatible certificates and should have no impact on analyses which are working correctly already. We expect to roll this change out to everyone in February. <a href="https://redirect.github.com/github/codeql-action/pull/3473">#3473</a></li> <li>When the CodeQL Action is run <a href="https://docs.github.com/en/code-security/how-tos/scan-code-for-vulnerabilities/troubleshooting/troubleshooting-analysis-errors/logs-not-detailed-enough#creating-codeql-debugging-artifacts-for-codeql-default-setup">with debugging enabled in Default Setup</a> and <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">private package registries are configured</a>, the &quot;Setup proxy for registries&quot; step will output additional diagnostic information that can be used for troubleshooting. <a href="https://redirect.github.com/github/codeql-action/pull/3486">#3486</a></li> <li>Added a setting which allows the CodeQL Action to enable network debugging for Java programs. This will help GitHub staff support customers with troubleshooting issues in GitHub-managed CodeQL workflows, such as Default Setup. This setting can only be enabled by GitHub staff. <a href="https://redirect.github.com/github/codeql-action/pull/3485">#3485</a></li> <li>Added a setting which enables GitHub-managed workflows, such as Default Setup, to use a <a href="https://github.com/dsp-testing/codeql-cli-nightlies">nightly CodeQL CLI release</a> instead of the latest, stable release that is used by default. This will help GitHub staff support customers whose analyses for a given repository or organization require early access to a change in an upcoming CodeQL CLI release. This setting can only be enabled by GitHub staff. <a href="https://redirect.github.com/github/codeql-action/pull/3484">#3484</a></li> </ul> <h2>v4.32.3</h2> <ul> <li>Added experimental support for testing connections to <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">private package registries</a>. This feature is not currently enabled for any analysis. In the future, it may be enabled by default for Default Setup. <a href="https://redirect.github.com/github/codeql-action/pull/3466">#3466</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <ul> <li>The undocumented TRAP cache cleanup feature that could be enabled using the <code>CODEQL_ACTION_CLEANUP_TRAP_CACHES</code> environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the <code>trap-caching: false</code> input to the <code>init</code> Action. <a href="https://redirect.github.com/github/codeql-action/pull/3795">#3795</a></li> <li>The Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. <a href="https://redirect.github.com/github/codeql-action/pull/3789">#3789</a></li> <li>Python analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. <a href="https://redirect.github.com/github/codeql-action/pull/3794">#3794</a></li> </ul> <h2>4.35.1 - 27 Mar 2026</h2> <ul> <li>Fix incorrect minimum required Git version for <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a>: it should have been 2.36.0, not 2.11.0. <a href="https://redirect.github.com/github/codeql-action/pull/3781">#3781</a></li> </ul> <h2>4.35.0 - 27 Mar 2026</h2> <ul> <li>Reduced the minimum Git version required for <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a> from 2.38.0 to 2.11.0. <a href="https://redirect.github.com/github/codeql-action/pull/3767">#3767</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.1">2.25.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3773">#3773</a></li> </ul> <h2>4.34.1 - 20 Mar 2026</h2> <ul> <li>Downgrade default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.3">2.24.3</a> due to issues with a small percentage of Actions and JavaScript analyses. <a href="https://redirect.github.com/github/codeql-action/pull/3762">#3762</a></li> </ul> <h2>4.34.0 - 20 Mar 2026</h2> <ul> <li>Added an experimental change which disables TRAP caching when <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a> is enabled, since improved incremental analysis supersedes TRAP caching. This will improve performance and reduce Actions cache usage. We expect to roll this change out to everyone in March. <a href="https://redirect.github.com/github/codeql-action/pull/3569">#3569</a></li> <li>We are rolling out improved incremental analysis to C/C++ analyses that use build mode <code>none</code>. We expect this rollout to be complete by the end of April 2026. <a href="https://redirect.github.com/github/codeql-action/pull/3584">#3584</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.0">2.25.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3585">#3585</a></li> </ul> <h2>4.33.0 - 16 Mar 2026</h2> <ul> <li> <p>Upcoming change: Starting April 2026, the CodeQL Action will skip collecting file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses. Pull request analyses will log a warning about this upcoming change. <a href="https://redirect.github.com/github/codeql-action/pull/3562">#3562</a></p> <p>To opt out of this change:</p> <ul> <li><strong>Repositories owned by an organization:</strong> Create a custom repository property with the name <code>github-codeql-file-coverage-on-prs</code> and the type &quot;True/false&quot;, then set this property to <code>true</code> in the repository's settings. For more information, see <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">Managing custom properties for repositories in your organization</a>. Alternatively, if you are using an advanced setup workflow, you can set the <code>CODEQL_ACTION_FILE_COVERAGE_ON_PRS</code> environment variable to <code>true</code> in your workflow.</li> <li><strong>User-owned repositories using default setup:</strong> Switch to an advanced setup workflow and set the <code>CODEQL_ACTION_FILE_COVERAGE_ON_PRS</code> environment variable to <code>true</code> in your workflow.</li> <li><strong>User-owned repositories using advanced setup:</strong> Set the <code>CODEQL_ACTION_FILE_COVERAGE_ON_PRS</code> environment variable to <code>true</code> in your workflow.</li> </ul> </li> <li> <p>Fixed <a href="https://redirect.github.com/github/codeql-action/issues/3555">a bug</a> which caused the CodeQL Action to fail loading repository properties if a &quot;Multi select&quot; repository property was configured for the repository. <a href="https://redirect.github.com/github/codeql-action/pull/3557">#3557</a></p> </li> <li> <p>The CodeQL Action now loads <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">custom repository properties</a> on GitHub Enterprise Server, enabling the customization of features such as <code>github-codeql-disable-overlay</code> that was previously only available on GitHub.com. <a href="https://redirect.github.com/github/codeql-action/pull/3559">#3559</a></p> </li> <li> <p>Once <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">private package registries</a> can be configured with OIDC-based authentication for organizations, the CodeQL Action will now be able to accept such configurations. <a href="https://redirect.github.com/github/codeql-action/pull/3563">#3563</a></p> </li> <li> <p>Fixed the retry mechanism for database uploads. Previously this would fail with the error &quot;Response body object should not be disturbed or locked&quot;. <a href="https://redirect.github.com/github/codeql-action/pull/3564">#3564</a></p> </li> <li> <p>A warning is now emitted if the CodeQL Action detects a repository property whose name suggests that it relates to the CodeQL Action, but which is not one of the properties recognised by the current version of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3570">#3570</a></p> </li> </ul> <h2>4.32.6 - 05 Mar 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.3">2.24.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3548">#3548</a></li> </ul> <h2>4.32.5 - 02 Mar 2026</h2> <ul> <li>Repositories owned by an organization can now set up the <code>github-codeql-disable-overlay</code> custom repository property to disable <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis for CodeQL</a>. First, create a custom repository property with the name <code>github-codeql-disable-overlay</code> and the type &quot;True/false&quot; in the organization's settings. Then in the repository's settings, set this property to <code>true</code> to disable improved incremental analysis. For more information, see <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">Managing custom properties for repositories in your organization</a>. This feature is not yet available on GitHub Enterprise Server. <a href="https://redirect.github.com/github/codeql-action/pull/3507">#3507</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/c10b8064de6f491fea524254123dbe5e09572f13"><code>c10b806</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3782">#3782</a> from github/update-v4.35.1-d6d1743b8</li> <li><a href="https://github.com/github/codeql-action/commit/c5ffd0683786820677d054e3505e1c5bb4b8c227"><code>c5ffd06</code></a> Update changelog for v4.35.1</li> <li><a href="https://github.com/github/codeql-action/commit/d6d1743b8ec7ecd94f78ad1ce4cb3d8d2ba58001"><code>d6d1743</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3781">#3781</a> from github/henrymercer/update-git-minimum-version</li> <li><a href="https://github.com/github/codeql-action/commit/65d2efa7333ad65f97cc54be40f4cd18630f884c"><code>65d2efa</code></a> Add changelog note</li> <li><a href="https://github.com/github/codeql-action/commit/2437b20ab31021229573a66717323dd5c6ce9319"><code>2437b20</code></a> Update minimum git version for overlay to 2.36.0</li> <li><a href="https://github.com/github/codeql-action/commit/ea5f71947c021286c99f61cc426a10d715fe4434"><code>ea5f719</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3775">#3775</a> from github/dependabot/npm_and_yarn/node-forge-1.4.0</li> <li><a href="https://github.com/github/codeql-action/commit/45ceeea896ba2293e10982f871198d1950ee13d6"><code>45ceeea</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3777">#3777</a> from github/mergeback/v4.35.0-to-main-b8bb9f28</li> <li><a href="https://github.com/github/codeql-action/commit/24448c98434f429f901d27db7ddae55eec5cc1c4"><code>24448c9</code></a> Rebuild</li> <li><a href="https://github.com/github/codeql-action/commit/7c510606312e5c68ac8b27c009e5254f226f5dfa"><code>7c51060</code></a> Update changelog and version after v4.35.0</li> <li><a href="https://github.com/github/codeql-action/commit/b8bb9f28b8d3f992092362369c57161b755dea45"><code>b8bb9f2</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3776">#3776</a> from github/update-v4.35.0-0078ad667</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/5d4e8d1aca955e8d8589aabd499c5cae939e33c7...c10b8064de6f491fea524254123dbe5e09572f13">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-04-07 11:24:29 +00:00
dependabot[bot]	da50a34414	ci: bump the github-actions group with 2 updates (#23958) ... Bumps the github-actions group with 2 updates: [azure/setup-helm](https://github.com/azure/setup-helm) and [chromaui/action](https://github.com/chromaui/action). Updates `azure/setup-helm` from 4.3.1 to 5.0.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/azure/setup-helm/releases">azure/setup-helm's releases</a>.</em></p> <blockquote> <h2>v5.0.0</h2> <h3>Changed</h3> <ul> <li><a href="https://redirect.github.com/azure/setup-helm/issues/259">#259</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/259">Update Node.js runtime from node20 to node24</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/263">#263</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/263">Bump undici</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/257">#257</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/257">Bump undici and <code>@​actions/http-client</code></a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/256">#256</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/256">Bump minimatch</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/248">#248</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/248">Bump the actions group with 2 updates</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/247">#247</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/247">Bump the actions group with 3 updates</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/246">#246</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/246">Bump <code>@​types/node</code> from 25.0.2 to 25.0.3 in the actions group</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/245">#245</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/245">Bump the actions group with 3 updates</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/243">#243</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/243">Bump the actions group with 2 updates</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/240">#240</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/240">Bump prettier from 3.6.2 to 3.7.3 in the actions group</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/229">#229</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/229">Bump the actions group across 1 directory with 3 updates</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/231">#231</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/231">Bump js-yaml from 3.14.1 to 3.14.2</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/234">#234</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/234">Bump glob from 10.4.5 to 10.5.0</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/225">#225</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/225">Fix build error</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/222">#222</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/222">Bump <code>@​types/node</code> from 24.7.2 to 24.8.1 in the actions group</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/220">#220</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/220">Bump the actions group across 1 directory with 4 updates</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/216">#216</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/216">Bump the actions group across 1 directory with 4 updates</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/213">#213</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/213">Bump the actions group with 2 updates</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/211">#211</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/211">Bump undici</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/212">#212</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/212">Bump jest from 30.0.5 to 30.1.2 in the actions group</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/210">#210</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/210">Bump <code>@​types/node</code> from 24.2.1 to 24.3.0 in the actions group</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/Azure/setup-helm/blob/main/CHANGELOG.md">azure/setup-helm's changelog</a>.</em></p> <blockquote> <h1>Change Log</h1> <h2>[5.0.0] - 2026-03-23</h2> <h3>Changed</h3> <ul> <li><a href="https://redirect.github.com/azure/setup-helm/issues/259">#259</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/259">Update Node.js runtime from node20 to node24</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/263">#263</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/263">Bump undici</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/257">#257</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/257">Bump undici and <code>@​actions/http-client</code></a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/256">#256</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/256">Bump minimatch</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/248">#248</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/248">Bump the actions group with 2 updates</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/247">#247</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/247">Bump the actions group with 3 updates</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/246">#246</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/246">Bump <code>@​types/node</code> from 25.0.2 to 25.0.3 in the actions group</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/245">#245</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/245">Bump the actions group with 3 updates</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/243">#243</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/243">Bump the actions group with 2 updates</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/240">#240</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/240">Bump prettier from 3.6.2 to 3.7.3 in the actions group</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/229">#229</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/229">Bump the actions group across 1 directory with 3 updates</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/231">#231</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/231">Bump js-yaml from 3.14.1 to 3.14.2</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/234">#234</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/234">Bump glob from 10.4.5 to 10.5.0</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/225">#225</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/225">Fix build error</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/222">#222</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/222">Bump <code>@​types/node</code> from 24.7.2 to 24.8.1 in the actions group</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/220">#220</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/220">Bump the actions group across 1 directory with 4 updates</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/216">#216</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/216">Bump the actions group across 1 directory with 4 updates</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/213">#213</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/213">Bump the actions group with 2 updates</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/211">#211</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/211">Bump undici</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/212">#212</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/212">Bump jest from 30.0.5 to 30.1.2 in the actions group</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/210">#210</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/210">Bump <code>@​types/node</code> from 24.2.1 to 24.3.0 in the actions group</a></li> </ul> <h2>[4.3.1] - 2025-08-12</h2> <h3>Changed</h3> <ul> <li><a href="https://redirect.github.com/azure/setup-helm/issues/167">#167</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/167">Pinning Action Dependencies for Security and Reliability</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/181">#181</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/181">Fix types, and update node version.</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/191">#191</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/191">chore(tests): Mock arch to make tests pass on arm host</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/192">#192</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/192">chore: remove unnecessary prebuild script</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/203">#203</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/203">Update helm version retrieval to use JSON output for latest version</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/207">#207</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/207">ci(workflows): update helm version to v3.18.4 and add matrix for tests</a></li> </ul> <h3>Added</h3> <ul> <li><a href="https://redirect.github.com/azure/setup-helm/issues/197">#197</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/197">Add pre-commit hook</a></li> </ul> <h2>[4.3.0] - 2025-02-15</h2> <ul> <li><a href="https://redirect.github.com/azure/setup-helm/issues/152">#152</a> feat: log when restoring from cache</li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/157">#157</a> Dependencies Update</li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/137">#137</a> Add dependabot</li> </ul> <h2>[4.2.0] - 2024-04-15</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/Azure/setup-helm/commit/dda3372f752e03dde6b3237bc9431cdc2f7a02a2"><code>dda3372</code></a> build</li> <li><a href="https://github.com/Azure/setup-helm/commit/3894c84c36e1df49b57e75c2c2c70dc6cf18c2bb"><code>3894c84</code></a> chore(release): v5.0.0 (<a href="https://redirect.github.com/azure/setup-helm/issues/265">#265</a>)</li> <li><a href="https://github.com/Azure/setup-helm/commit/ca66f3880d072ee3ace311d70cd267faa2ce7c73"><code>ca66f38</code></a> Update Node.js runtime from node20 to node24 (<a href="https://redirect.github.com/azure/setup-helm/issues/259">#259</a>)</li> <li><a href="https://github.com/Azure/setup-helm/commit/316ed5ab42b09c96cccd063ecc054a7c0f1dc207"><code>316ed5a</code></a> Bump undici (<a href="https://redirect.github.com/azure/setup-helm/issues/263">#263</a>)</li> <li><a href="https://github.com/Azure/setup-helm/commit/bc9bc0ca28599851490e89b2629b3e181c4d1209"><code>bc9bc0c</code></a> Bump undici and <code>@​actions/http-client</code> (<a href="https://redirect.github.com/azure/setup-helm/issues/257">#257</a>)</li> <li><a href="https://github.com/Azure/setup-helm/commit/16e3094bcbb6e98d8a39a05e244dd020c0a68a74"><code>16e3094</code></a> Bump minimatch (<a href="https://redirect.github.com/azure/setup-helm/issues/256">#256</a>)</li> <li><a href="https://github.com/Azure/setup-helm/commit/6e427537330e9c850849a06695599f9d298c46cc"><code>6e42753</code></a> Bump actions/stale in /.github/workflows in the actions group (<a href="https://redirect.github.com/azure/setup-helm/issues/255">#255</a>)</li> <li><a href="https://github.com/Azure/setup-helm/commit/9651d9df522c20a9f1fef182b439689e91e24103"><code>9651d9d</code></a> Bump actions/checkout in /.github/workflows in the actions group (<a href="https://redirect.github.com/azure/setup-helm/issues/251">#251</a>)</li> <li><a href="https://github.com/Azure/setup-helm/commit/658bff9449986fae55b983dd9dbb242943fb9513"><code>658bff9</code></a> Bump the actions group with 2 updates (<a href="https://redirect.github.com/azure/setup-helm/issues/248">#248</a>)</li> <li><a href="https://github.com/Azure/setup-helm/commit/331c81409ca70b46d873b7b6655b7ed3e9d7c2b6"><code>331c814</code></a> Bump the actions group with 3 updates (<a href="https://redirect.github.com/azure/setup-helm/issues/247">#247</a>)</li> <li>Additional commits viewable in <a href="https://github.com/azure/setup-helm/compare/1a275c3b69536ee54be43f2070a358922e12c8d4...dda3372f752e03dde6b3237bc9431cdc2f7a02a2">compare view</a></li> </ul> </details> <br /> Updates `chromaui/action` from 13.3.5 to 16.0.0 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/chromaui/action/blob/main/CHANGELOG.md">chromaui/action's changelog</a>.</em></p> <blockquote> <h1>v16.0.0 (Mon Mar 23 2026)</h1> <h4>💥 Breaking Change</h4> <ul> <li>Drop support for Node 18 and update GitHub Action to Node 24 <a href="https://redirect.github.com/chromaui/chromatic-cli/pull/1251">#1251</a> (<a href="https://github.com/codykaup"><code>@​codykaup</code></a>)</li> </ul> <h4>Authors: 1</h4> <ul> <li>Cody Kaup (<a href="https://github.com/codykaup"><code>@​codykaup</code></a>)</li> </ul> <hr /> <h1>v15.3.1 (Mon Mar 23 2026)</h1> <h4>🐛 Bug Fix</h4> <ul> <li>Properly timeout process tree in shell commands <a href="https://redirect.github.com/chromaui/chromatic-cli/pull/1254">#1254</a> (<a href="https://github.com/codykaup"><code>@​codykaup</code></a>)</li> </ul> <h4>Authors: 1</h4> <ul> <li>Cody Kaup (<a href="https://github.com/codykaup"><code>@​codykaup</code></a>)</li> </ul> <hr /> <h1>v15.3.0 (Mon Mar 16 2026)</h1> <h4>🚀 Enhancement</h4> <ul> <li>Integrate manifest generation script <a href="https://redirect.github.com/chromaui/chromatic-cli/pull/1244">#1244</a> (<a href="https://github.com/codykaup"><code>@​codykaup</code></a>)</li> </ul> <h4>Authors: 1</h4> <ul> <li>Cody Kaup (<a href="https://github.com/codykaup"><code>@​codykaup</code></a>)</li> </ul> <hr /> <h1>v15.2.0 (Mon Feb 23 2026)</h1> <h4>🚀 Enhancement</h4> <ul> <li>❇️ Add input parameter chromaticSha. <a href="https://redirect.github.com/chromaui/chromatic-cli/pull/1241">#1241</a> (<a href="https://github.com/jwir3"><code>@​jwir3</code></a>)</li> </ul> <h4>Authors: 1</h4> <ul> <li>Scott Johnson (<a href="https://github.com/jwir3"><code>@​jwir3</code></a>)</li> </ul> <hr /> <h1>v15.1.1 (Tue Feb 17 2026)</h1> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/chromaui/action/commit/f191a0224b10e1a38b2091cefb7b7a2337009116"><code>f191a02</code></a> v16.0.0</li> <li><a href="https://github.com/chromaui/action/commit/eea1606238fd97a70b5af723d103953d1f40967b"><code>eea1606</code></a> v15.3.1</li> <li><a href="https://github.com/chromaui/action/commit/0794e6939fe40ce46a88963f818092afc427da5b"><code>0794e69</code></a> v15.3.0</li> <li><a href="https://github.com/chromaui/action/commit/5ec258af08deb3e8c36653bd618cb7fe52090031"><code>5ec258a</code></a> v15.2.0</li> <li><a href="https://github.com/chromaui/action/commit/93712e37669f856c4828136f9cb535dbfa60b50c"><code>93712e3</code></a> v15.1.1</li> <li><a href="https://github.com/chromaui/action/commit/a8ce9c58f59be5cc7090cadfc8f130fb08fcf0c3"><code>a8ce9c5</code></a> v15.1.0</li> <li><a href="https://github.com/chromaui/action/commit/f1f9e3277eb1eaa8cba4c6bcebc9809291ee29ea"><code>f1f9e32</code></a> v15.0.0</li> <li><a href="https://github.com/chromaui/action/commit/9f1ad414f2e282aeff674364a9098b328382103f"><code>9f1ad41</code></a> v14.0.0</li> <li>See full diff in <a href="https://github.com/chromaui/action/compare/07791f8243f4cb2698bf4d00426baf4b2d1cb7e0...f191a0224b10e1a38b2091cefb7b7a2337009116">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-04-02 08:26:36 +00:00
dependabot[bot]	2875053b83	ci: bump the github-actions group with 4 updates (#23789) ... Bumps the github-actions group with 4 updates: [actions/cache](https://github.com/actions/cache), [fluxcd/flux2](https://github.com/fluxcd/flux2), [Mattraks/delete-workflow-runs](https://github.com/mattraks/delete-workflow-runs) and [umbrelladocs/action-linkspector](https://github.com/umbrelladocs/action-linkspector). Updates `actions/cache` from 5.0.3 to 5.0.4 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/cache/releases">actions/cache's releases</a>.</em></p> <blockquote> <h2>v5.0.4</h2> <h2>What's Changed</h2> <ul> <li>Add release instructions and update maintainer docs by <a href="https://github.com/Link"><code>@​Link</code></a>- in <a href="https://redirect.github.com/actions/cache/pull/1696">actions/cache#1696</a></li> <li>Potential fix for code scanning alert no. 52: Workflow does not contain permissions by <a href="https://github.com/Link"><code>@​Link</code></a>- in <a href="https://redirect.github.com/actions/cache/pull/1697">actions/cache#1697</a></li> <li>Fix workflow permissions and cleanup workflow names / formatting by <a href="https://github.com/Link"><code>@​Link</code></a>- in <a href="https://redirect.github.com/actions/cache/pull/1699">actions/cache#1699</a></li> <li>docs: Update examples to use the latest version by <a href="https://github.com/XZTDean"><code>@​XZTDean</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1690">actions/cache#1690</a></li> <li>Fix proxy integration tests by <a href="https://github.com/Link"><code>@​Link</code></a>- in <a href="https://redirect.github.com/actions/cache/pull/1701">actions/cache#1701</a></li> <li>Fix cache key in examples.md for bun.lock by <a href="https://github.com/RyPeck"><code>@​RyPeck</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1722">actions/cache#1722</a></li> <li>Update dependencies &amp; patch security vulnerabilities by <a href="https://github.com/Link"><code>@​Link</code></a>- in <a href="https://redirect.github.com/actions/cache/pull/1738">actions/cache#1738</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/XZTDean"><code>@​XZTDean</code></a> made their first contribution in <a href="https://redirect.github.com/actions/cache/pull/1690">actions/cache#1690</a></li> <li><a href="https://github.com/RyPeck"><code>@​RyPeck</code></a> made their first contribution in <a href="https://redirect.github.com/actions/cache/pull/1722">actions/cache#1722</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v5...v5.0.4">https://github.com/actions/cache/compare/v5...v5.0.4</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/cache/blob/main/RELEASES.md">actions/cache's changelog</a>.</em></p> <blockquote> <h1>Releases</h1> <h2>How to prepare a release</h2> <blockquote> <p>[!NOTE]<br /> Relevant for maintainers with write access only.</p> </blockquote> <ol> <li>Switch to a new branch from <code>main</code>.</li> <li>Run <code>npm test</code> to ensure all tests are passing.</li> <li>Update the version in <a href="https://github.com/actions/cache/blob/main/package.json"><code>https://github.com/actions/cache/blob/main/package.json</code></a>.</li> <li>Run <code>npm run build</code> to update the compiled files.</li> <li>Update this <a href="https://github.com/actions/cache/blob/main/RELEASES.md"><code>https://github.com/actions/cache/blob/main/RELEASES.md</code></a> with the new version and changes in the <code>## Changelog</code> section.</li> <li>Run <code>licensed cache</code> to update the license report.</li> <li>Run <code>licensed status</code> and resolve any warnings by updating the <a href="https://github.com/actions/cache/blob/main/.licensed.yml"><code>https://github.com/actions/cache/blob/main/.licensed.yml</code></a> file with the exceptions.</li> <li>Commit your changes and push your branch upstream.</li> <li>Open a pull request against <code>main</code> and get it reviewed and merged.</li> <li>Draft a new release <a href="https://github.com/actions/cache/releases">https://github.com/actions/cache/releases</a> use the same version number used in <code>package.json</code> <ol> <li>Create a new tag with the version number.</li> <li>Auto generate release notes and update them to match the changes you made in <code>RELEASES.md</code>.</li> <li>Toggle the set as the latest release option.</li> <li>Publish the release.</li> </ol> </li> <li>Navigate to <a href="https://github.com/actions/cache/actions/workflows/release-new-action-version.yml">https://github.com/actions/cache/actions/workflows/release-new-action-version.yml</a> <ol> <li>There should be a workflow run queued with the same version number.</li> <li>Approve the run to publish the new version and update the major tags for this action.</li> </ol> </li> </ol> <h2>Changelog</h2> <h3>5.0.4</h3> <ul> <li>Bump <code>minimatch</code> to v3.1.5 (fixes ReDoS via globstar patterns)</li> <li>Bump <code>undici</code> to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)</li> <li>Bump <code>fast-xml-parser</code> to v5.5.6</li> </ul> <h3>5.0.3</h3> <ul> <li>Bump <code>@actions/cache</code> to v5.0.5 (Resolves: <a href="https://github.com/actions/cache/security/dependabot/33">https://github.com/actions/cache/security/dependabot/33</a>)</li> <li>Bump <code>@actions/core</code> to v2.0.3</li> </ul> <h3>5.0.2</h3> <ul> <li>Bump <code>@actions/cache</code> to v5.0.3 <a href="https://redirect.github.com/actions/cache/pull/1692">#1692</a></li> </ul> <h3>5.0.1</h3> <ul> <li>Update <code>@azure/storage-blob</code> to <code>^12.29.1</code> via <code>@actions/cache@5.0.1</code> <a href="https://redirect.github.com/actions/cache/pull/1685">#1685</a></li> </ul> <h3>5.0.0</h3> <blockquote> <p>[!IMPORTANT] <code>actions/cache@v5</code> runs on the Node.js 24 runtime and requires a minimum Actions Runner version of <code>2.327.1</code>.</p> </blockquote> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/cache/commit/668228422ae6a00e4ad889ee87cd7109ec5666a7"><code>6682284</code></a> Merge pull request <a href="https://redirect.github.com/actions/cache/issues/1738">#1738</a> from actions/prepare-v5.0.4</li> <li><a href="https://github.com/actions/cache/commit/e34039626f957d3e3e50843d15c1b20547fc90e2"><code>e340396</code></a> Update RELEASES</li> <li><a href="https://github.com/actions/cache/commit/8a671105293e81530f1af99863cdf94550aba1a6"><code>8a67110</code></a> Add licenses</li> <li><a href="https://github.com/actions/cache/commit/1865903e1b0cb750dda9bc5c58be03424cc62830"><code>1865903</code></a> Update dependencies &amp; patch security vulnerabilities</li> <li><a href="https://github.com/actions/cache/commit/565629816435f6c0b50676926c9b05c254113c0c"><code>5656298</code></a> Merge pull request <a href="https://redirect.github.com/actions/cache/issues/1722">#1722</a> from RyPeck/patch-1</li> <li><a href="https://github.com/actions/cache/commit/4e380d19e192ace8e86f23f32ca6fdec98a673c6"><code>4e380d1</code></a> Fix cache key in examples.md for bun.lock</li> <li><a href="https://github.com/actions/cache/commit/b7e8d49f17405cc70c1c120101943203c98d3a4b"><code>b7e8d49</code></a> Merge pull request <a href="https://redirect.github.com/actions/cache/issues/1701">#1701</a> from actions/Link-/fix-proxy-integration-tests</li> <li><a href="https://github.com/actions/cache/commit/984a21b1cb176a0936f4edafb42be88978f93ef1"><code>984a21b</code></a> Add traffic sanity check step</li> <li><a href="https://github.com/actions/cache/commit/acf2f1f76affe1ef80eee8e56dfddd3b3e5f0fba"><code>acf2f1f</code></a> Fix resolution</li> <li><a href="https://github.com/actions/cache/commit/95a07c51324af6001b4d6ab8dff29f4dfadc2531"><code>95a07c5</code></a> Add wait for proxy</li> <li>Additional commits viewable in <a href="https://github.com/actions/cache/compare/cdf6c1fa76f9f475f3d7449005a359c84ca0f306...668228422ae6a00e4ad889ee87cd7109ec5666a7">compare view</a></li> </ul> </details> <br /> Updates `fluxcd/flux2` from 2.7.5 to 2.8.3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/fluxcd/flux2/releases">fluxcd/flux2's releases</a>.</em></p> <blockquote> <h2>v2.8.3</h2> <h2>Highlights</h2> <p>Flux v2.8.3 is a patch release that fixes a regression in helm-controller. Users are encouraged to upgrade for the best experience.</p> <p>ℹ️ Please follow the <a href="https://github.com/fluxcd/flux2/discussions/5572">Upgrade Procedure for Flux v2.7+</a> for a smooth upgrade from Flux v2.6 to the latest version.</p> <p>Fixes:</p> <ul> <li>Fix templating errors for charts that include <code>---</code> in the content, e.g. YAML separators, embedded scripts, CAs inside ConfigMaps (helm-controller)</li> </ul> <h2>Components changelog</h2> <ul> <li>helm-controller <a href="https://github.com/fluxcd/helm-controller/blob/v1.5.3/CHANGELOG.md">v1.5.3</a></li> </ul> <h2>CLI changelog</h2> <ul> <li>[release/v2.8.x] Add target branch name to update branch by <a href="https://github.com/fluxcdbot"><code>@​fluxcdbot</code></a> in <a href="https://redirect.github.com/fluxcd/flux2/pull/5774">fluxcd/flux2#5774</a></li> <li>Update toolkit components by <a href="https://github.com/fluxcdbot"><code>@​fluxcdbot</code></a> in <a href="https://redirect.github.com/fluxcd/flux2/pull/5779">fluxcd/flux2#5779</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/fluxcd/flux2/compare/v2.8.2...v2.8.3">https://github.com/fluxcd/flux2/compare/v2.8.2...v2.8.3</a></p> <h2>v2.8.2</h2> <h2>Highlights</h2> <p>Flux v2.8.2 is a patch release that comes with various fixes. Users are encouraged to upgrade for the best experience.</p> <p>ℹ️ Please follow the <a href="https://github.com/fluxcd/flux2/discussions/5572">Upgrade Procedure for Flux v2.7+</a> for a smooth upgrade from Flux v2.6 to the latest version.</p> <p>Fixes:</p> <ul> <li>Fix enqueuing new reconciliation requests for events on source Flux objects when they are already reconciling the revision present in the watch event (kustomize-controller, helm-controller)</li> <li>Fix the Go templates bug of YAML separator <code>---</code> getting concatenated to <code>apiVersion:</code> by updating to Helm 4.1.3 (helm-controller)</li> <li>Fix canceled HelmReleases getting stuck when they don't have a retry strategy configured by introducing a new feature gate <code>DefaultToRetryOnFailure</code> that improves the experience when the <code>CancelHealthCheckOnNewRevision</code> is enabled (helm-controller)</li> <li>Fix the auth scope for Azure Container Registry to use the ACR-specific scope (source-controller, image-reflector-controller)</li> <li>Fix potential Denial of Service (DoS) during TLS handshakes (CVE-2026-27138) by building all controllers with Go 1.26.1</li> </ul> <h2>Components changelog</h2> <ul> <li>source-controller <a href="https://github.com/fluxcd/source-controller/blob/v1.8.1/CHANGELOG.md">v1.8.1</a></li> <li>kustomize-controller <a href="https://github.com/fluxcd/kustomize-controller/blob/v1.8.2/CHANGELOG.md">v1.8.2</a></li> <li>notification-controller <a href="https://github.com/fluxcd/notification-controller/blob/v1.8.2/CHANGELOG.md">v1.8.2</a></li> <li>helm-controller <a href="https://github.com/fluxcd/helm-controller/blob/v1.5.2/CHANGELOG.md">v1.5.2</a></li> <li>image-reflector-controller <a href="https://github.com/fluxcd/image-reflector-controller/blob/v1.1.1/CHANGELOG.md">v1.1.1</a></li> <li>image-automation-controller <a href="https://github.com/fluxcd/image-automation-controller/blob/v1.1.1/CHANGELOG.md">v1.1.1</a></li> <li>source-watcher <a href="https://github.com/fluxcd/source-watcher/blob/v2.1.1/CHANGELOG.md">v2.1.1</a></li> </ul> <h2>CLI changelog</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/fluxcd/flux2/commit/871be9b40d53627786d3a3835a3ddba1e3234bd2"><code>871be9b</code></a> Merge pull request <a href="https://redirect.github.com/fluxcd/flux2/issues/5779">#5779</a> from fluxcd/update-components-release/v2.8.x</li> <li><a href="https://github.com/fluxcd/flux2/commit/f7a168935dd2d777109ea189e0ef094695caeea7"><code>f7a1689</code></a> Update toolkit components</li> <li><a href="https://github.com/fluxcd/flux2/commit/bf67d7799d07eff26891a8b373601f1f07ee4411"><code>bf67d77</code></a> Merge pull request <a href="https://redirect.github.com/fluxcd/flux2/issues/5774">#5774</a> from fluxcd/backport-5773-to-release/v2.8.x</li> <li><a href="https://github.com/fluxcd/flux2/commit/5cb2208cb7dda2abc7d4bdc971458981c6be8323"><code>5cb2208</code></a> Add target branch name to update branch</li> <li><a href="https://github.com/fluxcd/flux2/commit/bfa461ed2153ae5e0cca6bce08e0845268fb3088"><code>bfa461e</code></a> Merge pull request <a href="https://redirect.github.com/fluxcd/flux2/issues/5771">#5771</a> from fluxcd/update-pkg-deps/release/v2.8.x</li> <li><a href="https://github.com/fluxcd/flux2/commit/f11a921e0cdc6c681a157c7a4777150463eaeec8"><code>f11a921</code></a> Update fluxcd/pkg dependencies</li> <li><a href="https://github.com/fluxcd/flux2/commit/b248efab1d786a27ccddf4b341a1034d67c14b3b"><code>b248efa</code></a> Merge pull request <a href="https://redirect.github.com/fluxcd/flux2/issues/5770">#5770</a> from fluxcd/backport-5769-to-release/v2.8.x</li> <li><a href="https://github.com/fluxcd/flux2/commit/4d5e044eb9067a15d1099cb9bc81147b5d4daf37"><code>4d5e044</code></a> Update toolkit components</li> <li><a href="https://github.com/fluxcd/flux2/commit/3c8917ca28a93d6ab4b97379c0c81a4144e9f7d6"><code>3c8917c</code></a> Merge pull request <a href="https://redirect.github.com/fluxcd/flux2/issues/5767">#5767</a> from fluxcd/update-pkg-deps/release/v2.8.x</li> <li><a href="https://github.com/fluxcd/flux2/commit/c1f11bcf3d6433dbbb81835eb9f8016c3067d7ef"><code>c1f11bc</code></a> Update fluxcd/pkg dependencies</li> <li>Additional commits viewable in <a href="https://github.com/fluxcd/flux2/compare/8454b02a32e48d775b9f563cb51fdcb1787b5b93...871be9b40d53627786d3a3835a3ddba1e3234bd2">compare view</a></li> </ul> </details> <br /> Updates `Mattraks/delete-workflow-runs` from 5bf9a1dac5c4d041c029f0a8370ddf0c5cb5aeb7 to b3018382ca039b53d238908238bd35d1fb14f8ee <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/mattraks/delete-workflow-runs/compare/5bf9a1dac5c4d041c029f0a8370ddf0c5cb5aeb7...5bf9a1dac5c4d041c029f0a8370ddf0c5cb5aeb7">compare view</a></li> </ul> </details> <br /> Updates `umbrelladocs/action-linkspector` from 1.4.0 to 1.4.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/umbrelladocs/action-linkspector/releases">umbrelladocs/action-linkspector's releases</a>.</em></p> <blockquote> <h2>Release v1.4.1</h2> <p>v1.4.1: PR <a href="https://redirect.github.com/umbrelladocs/action-linkspector/issues/52">#52</a> - chore: update actions/checkout to v5 across all workflows</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/UmbrellaDocs/action-linkspector/commit/37c85bcde51b30bf929936502bac6bfb7e8f0a4d"><code>37c85bc</code></a> Merge pull request <a href="https://redirect.github.com/umbrelladocs/action-linkspector/issues/52">#52</a> from UmbrellaDocs/action-v5</li> <li><a href="https://github.com/UmbrellaDocs/action-linkspector/commit/badbe56d6b5b23e1b01e0a48b02c8c42c734488c"><code>badbe56</code></a> chore: update actions/checkout to v5 across all workflows</li> <li><a href="https://github.com/UmbrellaDocs/action-linkspector/commit/e0578c9289f053a6b2ab5ff03a1ec3d507bbb790"><code>e0578c9</code></a> Merge pull request <a href="https://redirect.github.com/umbrelladocs/action-linkspector/issues/51">#51</a> from UmbrellaDocs/caching-fix-50</li> <li><a href="https://github.com/UmbrellaDocs/action-linkspector/commit/5ede5ac56a1421d000b3c6188c227bee606869ac"><code>5ede5ac</code></a> feat: enhance reviewdog setup with caching and version management</li> <li><a href="https://github.com/UmbrellaDocs/action-linkspector/commit/a73cfa2d0f04a59ec1ab98c0f00fdd36ff5a84a1"><code>a73cfa2</code></a> Merge pull request <a href="https://redirect.github.com/umbrelladocs/action-linkspector/issues/49">#49</a> from Goooler/node24</li> <li><a href="https://github.com/UmbrellaDocs/action-linkspector/commit/aee511ae2bf96aa01d6d77ae1c775f2f18909d49"><code>aee511a</code></a> Update action runtime to node 24</li> <li>See full diff in <a href="https://github.com/umbrelladocs/action-linkspector/compare/652f85bc57bb1e7d4327260decc10aa68f7694c3...37c85bcde51b30bf929936502bac6bfb7e8f0a4d">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-03-30 12:05:40 +00:00
Atif Ali	56171306ff	ci: fix SLSA predicate schema in attestation steps (#23768) ... Follow-up to #23763. The custom predicate uses the **SLSA v0.2 schema** (`invocation`, `configSource`, `metadata`) but declares `predicate-type` as v1. GitHub's attestation API rejects the mismatch: ``` Error: Failed to persist attestation: Invalid Argument - predicate is not of type slsa1.ProvenancePredicate ``` This was masked before #23763 because the steps failed earlier on missing `subject-digest`. Now that digests are provided, this is the next error. ## Fix Remove the custom `predicate-type` and `predicate` inputs. Without them, `actions/attest@v4` auto-generates a correct SLSA v1 predicate from the GitHub Actions OIDC token — which is what `gh attestation verify` expects. - `ci.yaml`: 3 attestation steps (main, latest, version-specific) - `release.yaml`: 3 attestation steps (base, main, latest) <details> <summary>Verification (source code trace of actions/attest@v4)</summary> 1. **`detect.ts`**: No `predicate-type`/`predicate` → returns `'provenance'` (not `'custom'`) 2. **`main.ts`**: `getPredicateForType('provenance')` → `generateProvenancePredicate()` 3. **`@actions/toolkit/.../provenance.ts`**: `buildSLSAProvenancePredicate()` fetches OIDC claims, builds correct v1 predicate with `buildDefinition`/`runDetails` </details> > 🤖 This PR was created with the help of Coder Agents, and needs a human review. 🧑💻	2026-03-30 15:07:13 +05:00
Atif Ali	bc5e4b5d54	ci: fix broken GitHub attestations and update SBOM tooling (#23763) ... ## Problem GitHub SLSA provenance attestations have been silently failing on **every release** since they were introduced. Confirmed across all 10+ release runs checked (v2.29.2 through v2.31.6). The `actions/attest` action requires `subject-digest` (a `sha256:...` hash) to identify the artifact being attested, but the workflow only provided `subject-name` (the image tag like `ghcr.io/coder/coder:v2.31.6`). This caused every attestation step to error with: ``` Error: One of subject-path, subject-digest, or subject-checksums must be provided ``` The failures were masked by `continue-on-error: true` and only surfaced as `##[warning]` annotations that nobody noticed. Enterprise customers doing `gh attestation verify` would find no provenance records for any of our Docker images. > [!NOTE] > The cosign SBOM attestation (separate step) has been working correctly the entire time — it uses a different mechanism (`cosign attest --type spdxjson`) that does not require the same inputs. This fix is specifically for the GitHub-native SLSA provenance attestations. ## Fix **Add `subject-digest` to all `actions/attest` steps** (release.yaml + ci.yaml): - Base image: capture digest from `depot/build-push-action` output - Main image: resolve digest via `docker buildx imagetools inspect --raw` after push - Latest image: same approach - Use `subject-name` without tag per the [actions/attest docs](https://github.com/actions/attest#container-image) **Update `anchore/sbom-action`** from v0.18.0 to v0.24.0 (node24 support, ahead of the [June 2 deadline](https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/)). All changes remain non-blocking for the release process (`continue-on-error: true` preserved). > 🤖 This PR was created with the help of Coder Agents, and is reviewed by a human.	2026-03-30 13:15:13 +05:00
Cian Johnston	fb5c3b5800	ci: restore depot runners (#23611) ... This commit reverts the previous changes to CI jobs affected by disk space issues on depot runners.	2026-03-25 16:08:11 +00:00
Mathias Fredriksson	e463adf6cb	feat: enable React profiling build for dogfood (#23354)	2026-03-24 18:46:11 +00:00
Cian Johnston	32acc73047	ci: bump runner sizes (#23514) ... Bumps the runners changed in 5544a60b6e to larger sizes.	2026-03-24 18:38:03 +00:00
Cian Johnston	5544a60b6e	ci: yeet depot runners in favour of GitHub runners (#23508) ... Depot runners are running out of disk space and blocking builds. Temporarily switch the build and release jobs from depot runners to GitHub-hosted runners: - `ci.yaml` build job: `depot-ubuntu-22.04-8` → `ubuntu-latest` - `release.yaml` check-perms + release jobs: `depot-ubuntu-22.04-8` → `ubuntu-latest` **This is intended to be reverted once depot resolves their disk space issues.** > 🤖 This PR was created with the help of Coder Agents, and will be reviewed by my human. 🧑‍💻	2026-03-24 17:19:38 +00:00
Cian Johnston	cbd56d33d4	ci: disable go cache for build jobs to prevent disk space exhaustion (#23484) ... Disables Go cache for the setup-go step to workaround depot runner disk space issues.	2026-03-24 11:17:39 +00:00