Skip to content

chore(deps): update github actions - #90

Open
bootc-bot[bot] wants to merge 1 commit into
mainfrom
bootc-renovate/github-actions
Open

chore(deps): update github actions#90
bootc-bot[bot] wants to merge 1 commit into
mainfrom
bootc-renovate/github-actions

Conversation

@bootc-bot

@bootc-bot bootc-bot Bot commented Sep 6, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change
actions/create-github-app-token action minor v3.2.0 → v3.3.0
github/gh-aw uses-with minor v0.88.2 → v0.93.5
peter-evans/create-pull-request action major v7 → v8
ubuntu github-runner major 24.04 → 26.04

Release Notes

actions/create-github-app-token

v3.3.0

Compare Source

Features
Bug Fixes
  • deps: bump nested undici from 6.24.0 to 6.29.0 (#​403) (12461a3)
  • deps: bump the production-dependencies group across 1 directory with 3 updates (#​395) (a69c19d)
github/gh-aw

v0.93.5

Compare Source

🌟 Release Highlights

This release focuses on hardening: stronger static analysis linters, safer credential handling, and more robust diagnostics.

✨ What's New
  • Safe-output integration jobs can now use network credentials (#​71833).
  • Engine driver crashes are classified with secret-safe stderr diagnostics, making failures easier to triage (#​71883).
  • Pi CLI default updated to 1.4.0 (#​71899).
  • New and sharper custom linters: readerstringconv analyzer, parenthesized Flush discard detection, missing goroutine recovery through local closures, and closed detection gaps (#​71891, #​71896, #​71897, #​71880).
  • Secret-leak analysis now tracks credential handoffs through step outputs (#​71850).
🐛 Bug Fixes & Improvements
  • Fixed generated conclusion references and fetch warnings; Redis image pinned (#​71898).
  • Guarded indexing boundaries and prevented cron-step overflow (#​71889).
  • Refreshed Node image pins and enforced patched runtime dependencies (#​71879).
  • gh-aw-detection is no longer treated as experimental (#​71848).
  • Internal consolidation of permission scope expansion, GitHub Contents base64 decoding, and public API GET fallback transport (#​71888, #​71894, #​71893).
📚 Documentation
  • Documentation refreshed for recent features (#​71867).

Generated by 🚀 Release · copilot · auto · ~14 AIC · ⊞ 12.6K

What's Changed

Full Changelog: github/gh-aw@v0.93.4...v0.93.5

v0.93.4

Compare Source

🌟 Release Highlights

This release focuses on work-queue reliability, safer checkout credential handling, and a broad set of compiler and workflow fixes.

✨ What's New
  • Work queues: pools and workers now install on first use, with clearer diagnostics for missing pools and privacy-preserving GraphQL errors.
  • Safe outputs: standardized machine-readable error codes, add_comment constraints disclosed in the tool description, and visible staged-preview notices on PR and Claim guards.
  • Threat detection: matching-engine detection now inherits agent API targets, and validated status-only jobs are allowed after detection.
  • Environments: workflow environments now propagate to activation jobs.
  • Faster update: fewer network fetches, plus verbose request timings.
🐛 Bug Fixes & Improvements
  • Release checkouts no longer persist credentials; compiler-generated PR checkouts are narrowly exempted from artipacked warnings.
  • Compiler-generated constants are emitted as quoted strings, and schema-supported frontmatter shapes are accepted.
  • Copilot BYOK HTTP API targets are preserved.
  • Unmatched checkout.fetch refs no longer block other fetches.
  • Fixed prompt tool scanner false positives, mapdeletecheck with asymmetric parentheses, and empty repo-memory wiki note substitution.
  • Fixed missing embedded session-parser and grader runtime dependencies.
  • Workflow health checks now have a time budget and debug logging; log storage admission and observability audits are bounded.
  • Behavior-defined engine session capture is now protected.
📚 Documentation
  • MemoryOps pattern page streamlined and docs updated for recent features.

Generated by 🚀 Release · copilot · auto · ~14 AIC · ⊞ 12.6K

What's Changed

Full Changelog: github/gh-aw@v0.93.3...v0.93.4

v0.93.3

Compare Source

🌟 Release Highlights

This release tightens workflow quality checks and hardens threat detection.

✨ What's New
  • Workflow linting on by default – gh aw compile now lints workflows during compilation, surfacing problems earlier (#​71349).
  • Work-queue smoke workflows – New daily smoke workflows with Bash 3-compatible validation improve confidence in work-queue behavior (#​71363).
🐛 Bug Fixes & Improvements
  • Work-queue Claim settlement now verifies discussion cleanup effects (#​71361).
  • Threat detection is pinned to v0.5.3 for reproducible, safer runs (#​71501).
📚 Documentation
  • Clarified directory restrictions for reusable agentic workflows (#​71451).

Generated by 🚀 Release · copilot · auto · ~13 AIC · ⊞ 12.6K

What's Changed

Full Changelog: github/gh-aw@v0.93.2...v0.93.3

v0.93.2

Compare Source

🌟 Release Highlights

A reliability-focused release: Copilot CLI installs are more resilient, scanners and reports are more trustworthy, and Pi runs behave correctly on ARC/DinD runners.

🐛 Bug Fixes & Improvements
  • Copilot CLI install fallback — when the live compatibility matrix selects a release without a trusted checksum pin, setup now falls back to the bundled default (within the compatibility window), with checksum verification still required. (#​71339)
  • Pi on ARC/DinD — Pi streaming logs now go to the writable engine-log directory, fixing log, summary and session export on ARC/DinD runners. (#​71228)
  • Custom ledger safe outputs — custom ledger tool schemas now require a record, and invalid envelopes are rejected before queuing so agents can self-correct. (#​71240)
  • Grype scan completeness — empty or malformed Grype output is no longer cached as a zero-finding success, and per-image scan status is tracked. (#​71297)
  • Report formatting — bold labels in collapsible report summaries now render correctly instead of showing literal <b> tags. (#​71273)
  • Release notes — fixed apostrophe encoding guidance so highlights no longer publish u0027. (#​71272)
  • Conformance checks — removed false positives for PTI-005 and SEC-005. (#​71287, #​71286)
  • Windows CI — POSIX-only outcome API fixtures are skipped on Windows. (#​71247)
📚 Documentation

Generated by 🚀 Release · copilot · auto · ~18 AIC · ⊞ 12.6K

What's Changed

Full Changelog: github/gh-aw@v0.93.1...v0.93.2

v0.93.1

Compare Source

🌟 Release Highlights

v0.93.1 focuses on engine reliability, MCP trust configuration, and audit tooling, plus many CI and workflow stability fixes.

✨ What's New
  • Per-server custom CA trust for HTTP MCP servers — connect to MCP servers behind private PKI without weakening global trust (#​71229). Learn more
  • BM25 audit search — unified-session audit now supports search with automatic evidence grouping (#​70998). Learn more
  • Outcome evaluation moved into logs — the separate outcomes command is removed (#​71218).
  • Detection gates enforced for custom workflow jobs (#​70997) and hosted threat detection is isolated (#​71244).
  • Work-queue diagnostics included in health reports (#​70965).
  • MCP Gateway bumped to v0.4.37 (#​71219).
🐛 Bug Fixes & Improvements
  • Codex stages native TOML sub-agents with resolved models and fails closed before startup (#​70945); Copilot SDK refuses silent model substitution (#​70943).
  • Model-routing allowed-models now expands aliases (#​70942); Claude detection model aliases resolve before CLI launch (#​70861).
  • Pi main/sub-agent requests are attributed with x-awf-caller (#​71043).
  • CLI proxy and MCP gateway containers honor runner proxy settings (#​70347).
  • Scalar allowed-repos normalized in GitHub guard policies (#​70346); trusted-bot policy compilation covered and documented (#​70343).
  • Footer AIC costs show as rounded-up estimates (#​71193).
  • Dry-run telemetry disabled via documented opt-outs (#​71032).
  • Fixed Ollama CPU warm-up, Aider command replay, reviewer checkout after branch deletion, and unavailable prompt job output detection.
📚 Documentation

Daily documentation, glossary, and instruction syncs, plus an unbloated audit reference.

Generated by 🚀 Release · copilot · auto · ~13 AIC · ⊞ 12.4K

What's Changed

Full Changelog: github/gh-aw@v0.93.0...v0.93.1

v0.93.0

Compare Source

🌟 Release Highlights

v0.93.0 focuses on security hardening, safer dry-run compilation, and more reliable safe outputs and sub-agent model resolution.

⚠️ Breaking Changes
  • The missing-diagnostic safe-output tools are now named report_missing_tool and report_missing_data (#​70738). Update any workflows or prompts that use the old names. Learn more
  • Admission jobs are now opt-in through frontmatter or aw.json (#​70763).
✨ Whats New
  • Read-only health tool in the MCP server for checking server status (#​70527).
  • Artifact-first admission conclusion session delivery (#​70622) and routing analytics recorded in aw_session.jsonl, including model config, baseline estimate, upstream errors and harness identity (#​70672).
  • Claude inline sub-agents are registered and Claude/Codex sub-agent models resolve before engine startup (#​70671).
  • Shared /review alias for PR reviewer workflows (#​70863).
  • New Go linters (formatintitoa, osisnotexist) and a needs-consistency linter (#​70801, #​70546).
  • Firewall bumped to v0.28.70 and MCP Gateway to v0.4.36.
🔒 Security
  • Dry-run compilation is hardened against hosted execution effects, and dry-run workflows use a read-only cache (#​70851, #​70788).
  • Compiler bootstrap is hardened against compromised certificate authorities (#​70549).
  • OTLP token environment-file injection is prevented (#​70597).
  • Unsafe action pins are rejected (#​70616), and fixable Node image CVEs were cleared (#​70615).
  • Redaction must now succeed for all agent artifact uploads (#​70875).
🐛 Bug Fixes & Improvements
  • Safe outputs honor target repos in invocation context (#​70912) and fix discussion temporary IDs and missing terminal outputs (#​70696).
  • Copilot URL approvals follow the finalized runtime firewall policy (#​70750).
  • Runner-label indentation in custom jobs is fixed (#​70840).
  • Fixed webhook integer overflow in 32-bit builds (#​70775).
  • Better engine driver crash and secret-redaction failure classification (#​70605).
  • MCP log continuation cursors are preserved (#​70856); AIC telemetry attribution is corrected (#​70864).
  • Work queue replay prefers local Git lookups (#​70617).
📚 Documentation

Generated by 🚀 Release · copilot · auto · 14.9 AIC · ⊞ 12.4K

What's Changed

Full Changelog: github/gh-aw@v0.92.8...v0.93.0

v0.92.6

Compare Source

🌟 Release Highlights

v0.92.6 strengthens the work queue, episode-based log analysis, model-catalogue resilience, and static security linting.

⚠️ Breaking Changes
  • gh aw logs now requires canonical episode identity and reports coverage (#​70277). Update any tooling that relied on non-canonical episode identifiers.
✨ What is New
  • Episode analytics: bounded canonical episode retrieval, usage joined with recorded outcome accounting, and better unified-session episode lineage (#​70322, #​70281, #​70205).
  • Work queue: guarded clear/hard-reset commands, deterministic expiration of unclaimed entries, better diagnostics, and stronger delivery recovery (#​70022, #​70025, #​70027, #​69951, #​69790).
  • Security linting: new AST linters for checkout trust, prompt expressions, secret-leak taint analysis, and history-backed zizmor checks (#​70131, #​69813, #​70356).
  • Provenance & redaction: agent provenance tracking, coarse issue-body redaction, and early activation failure for stale provenance workflows (#​70032, #​70348).
  • Model resilience: consistent model alias resolution across engines, a Copilot SDK check against the live model catalogue, and a daily model-pin checker (#​69487, #​70320, #​70295).
  • Engines: OpenCode integration migrated to v2 (#​69950).
  • Pure graders: graders are now pure unified-session computations (#​70130).
🐛 Bug Fixes & Improvements
  • Custom safe-output jobs are gated on threat detection success; threat detection applies warn-mode policy when the detection engine fails (#​69995, #​70325).
  • Placeholder issue titles are rejected before consuming create_issue quota (#​69994).
  • Fixed empty configured_model for routed/fallback Copilot CLI runs (#​69966).
  • Fixed OTLP placeholder masks suppressing boolean job outputs (#​69996).
  • Safe-output footers include Work and Claim references (#​69865).
  • Fixed Goose release redirects, Crush stdin startup, and Aider discovery (#​70282, #​70214, #​70021).
  • Fixed PR lifecycle races and merged-base-ancestor detection (#​70141, #​69998).
📚 Documentation
  • Specified OIDC-based AW activation admission and aligned episode specs (#​70286, #​70279).
  • Documented claim delivery diagnostics (#​69987).

Generated by 🚀 Release · copilot · auto · 15.9 AIC · ⊞ 12.3K

What's Changed

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (in timezone UTC)

  • Branch creation
    • "on sunday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

@bootc-bot
bootc-bot Bot force-pushed the bootc-renovate/github-actions branch 18 times, most recently from 4874b8c to 214c620 Compare September 13, 2026 23:23
@bootc-bot
bootc-bot Bot force-pushed the bootc-renovate/github-actions branch 3 times, most recently from 20fccf9 to 299de22 Compare September 20, 2026 01:07
@bootc-bot
bootc-bot Bot force-pushed the bootc-renovate/github-actions branch 3 times, most recently from 60981b0 to 7381719 Compare October 4, 2026 00:13
@bootc-bot
bootc-bot Bot force-pushed the bootc-renovate/github-actions branch 2 times, most recently from 03ff2ec to df02191 Compare October 18, 2026 01:08
@bootc-bot
bootc-bot Bot force-pushed the bootc-renovate/github-actions branch 2 times, most recently from a96876a to 35efef3 Compare October 25, 2026 07:44
@bootc-bot
chore(deps): update github actions
48dea4f 
Signed-off-by: bootc-bot[bot] <225049296+bootc-bot[bot]@users.noreply.github.com>
Signed-off-by: bootc-bot[bot] <225049296+bootc-bot[bot]@users.noreply.github.com>
@bootc-bot
bootc-bot Bot force-pushed the bootc-renovate/github-actions branch from 35efef3 to 48dea4f Compare October 25, 2026 18:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants