Skip to content

build(deps): Bump the actions group with 3 updates#98

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-8ae8a43f65
Open

build(deps): Bump the actions group with 3 updates#98
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-8ae8a43f65

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 22, 2026

Copy link
Copy Markdown
Contributor

Bumps the actions group with 3 updates: actions/create-github-app-token, actions/github-script and zmaril/housekeeping.

Updates actions/create-github-app-token from 1 to 3

Release notes

Sourced from actions/create-github-app-token's releases.

v3.0.0

3.0.0 (2026-03-14)

Bug Fixes

BREAKING CHANGES

  • Custom proxy handling has been removed. If you use HTTP_PROXY or HTTPS_PROXY, you must now also set NODE_USE_ENV_PROXY=1 on the action step.
  • Requires Actions Runner v2.327.1 or later if you are using a self-hosted runner.

v3.0.0-beta.6

3.0.0-beta.6 (2026-03-13)

Bug Fixes

  • deps: bump @​actions/core from 1.11.1 to 3.0.0 (#337) (b044133)
  • deps: bump minimatch from 9.0.5 to 9.0.9 (#335) (5cbc656)
  • deps: bump the production-dependencies group with 4 updates (#336) (6bda5bc)
  • deps: bump undici from 7.16.0 to 7.18.2 (#323) (b4f638f)

v3.0.0-beta.5

3.0.0-beta.5 (2026-03-13)

  • fix!: require NODE_USE_ENV_PROXY for proxy support (#342) (d53a1cd)

BREAKING CHANGES

  • Custom proxy handling has been removed. If you use HTTP_PROXY or HTTPS_PROXY, you must now also set NODE_USE_ENV_PROXY=1 on the action step.

v3.0.0-beta.4

3.0.0-beta.4 (2026-03-13)

Bug Fixes

  • deps: bump @​octokit/auth-app from 7.2.1 to 8.0.1 (#257) (bef1eaf)
  • deps: bump @​octokit/request from 9.2.3 to 10.0.2 (#256) (5d7307b)
  • deps: bump glob from 10.4.5 to 10.5.0 (#305) (5480f43)
  • deps: bump p-retry from 6.2.1 to 7.1.0 (#294) (dce3be8)

... (truncated)

Changelog

Sourced from actions/create-github-app-token's changelog.

Changelog

3.2.0 (2026-05-12)

Features

  • add support for enterprise-level GitHub Apps (#263) (952a2a7)
  • support full repository names in repositories input (#372) (85eb8dd)

Bug Fixes

  • deps: bump @​actions/core from 3.0.0 to 3.0.1 in the production-dependencies group (#364) (43e5c34)
  • validate private-key input (#376) (f24bbd8)
Commits
  • bcd2ba4 chore(main): release 3.2.0 (#370)
  • f24bbd8 fix: validate private-key input (#376)
  • 363531b docs: capitalize Git as a proper noun in README (#374)
  • fd28011 docs: update procedure to configure Git (#287)
  • 85eb8dd feat: support full repository names in repositories input (#372)
  • c9aabb8 build(deps-dev): bump yaml from 2.8.3 to 2.8.4 in the development-dependencie...
  • e02e816 build(deps-dev): bump undici from 7.24.6 to 8.2.0 (#366)
  • 8d835bf build(deps-dev): bump esbuild from 0.27.4 to 0.28.0 in the development-depend...
  • 952a2a7 feat: add support for enterprise-level GitHub Apps (#263)
  • 43e5c34 fix(deps): bump @​actions/core from 3.0.0 to 3.0.1 in the production-dependenc...
  • Additional commits viewable in compare view

Updates actions/github-script from 7 to 9

Release notes

Sourced from actions/github-script's releases.

v9.0.0

New features:

  • getOctokit factory function — Available directly in the script context. Create additional authenticated Octokit clients with different tokens for multi-token workflows, GitHub App tokens, and cross-org access. See Creating additional clients with getOctokit for details and examples.
  • Orchestration ID in user-agent — The ACTIONS_ORCHESTRATION_ID environment variable is automatically appended to the user-agent string for request tracing.

Breaking changes:

  • require('@actions/github') no longer works in scripts. The upgrade to @actions/github v9 (ESM-only) means require('@actions/github') will fail at runtime. If you previously used patterns like const { getOctokit } = require('@actions/github') to create secondary clients, use the new injected getOctokit function instead — it's available directly in the script context with no imports needed.
  • getOctokit is now an injected function parameter. Scripts that declare const getOctokit = ... or let getOctokit = ... will get a SyntaxError because JavaScript does not allow const/let redeclaration of function parameters. Use the injected getOctokit directly, or use var getOctokit = ... if you need to redeclare it.
  • If your script accesses other @actions/github internals beyond the standard github/octokit client, you may need to update those references for v9 compatibility.

What's Changed

New Contributors

Full Changelog: actions/github-script@v8.0.0...v9.0.0

v8.0.0

What's Changed

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

Make sure your runner is updated to this version or newer to use this release.

New Contributors

Full Changelog: actions/github-script@v7.1.0...v8.0.0

v7.1.0

What's Changed

... (truncated)

Commits
  • 3a2844b Merge pull request #700 from actions/salmanmkc/expose-getoctokit + prepare re...
  • ca10bbd fix: use @​octokit/core/types import for v7 compatibility
  • 86e48e2 merge: incorporate main branch changes
  • c108472 chore: rebuild dist for v9 upgrade and getOctokit factory
  • afff112 Merge pull request #712 from actions/salmanmkc/deployment-false + fix user-ag...
  • ff8117e ci: fix user-agent test to handle orchestration ID
  • 81c6b78 ci: use deployment: false to suppress deployment noise from integration tests
  • 3953caf docs: update README examples from @​v8 to @​v9, add getOctokit docs and v9 brea...
  • c17d55b ci: add getOctokit integration test job
  • a047196 test: add getOctokit integration tests via callAsyncFunction
  • Additional commits viewable in compare view

Updates zmaril/housekeeping from 0.19.0 to 0.21.0

Release notes

Sourced from zmaril/housekeeping's releases.

v0.21.0

Adds the strict-status-checks check, and fixes three defects in v0.20.0 that surfaced while rolling it out across the fleet — two of which made v0.20.0's own housekeeper fix unsafe to run.

Fixed

  • fix ci-exists no longer overwrites existing CI: it wrote .github/workflows/ci.yml unconditionally, but ci-exists fails two different ways — no CI at all, or CI that exists and is merely missing a test/lint/fmt step for some language — and the scaffold only answers the first. On a repo whose CI simply lacked a rust step, the fix replaced the entire hand-written workflow with a generic stub. It now scaffolds only when there is no workflow at all, and otherwise prints the missing steps to add by hand.
  • lockfiles no longer demands a lockfile that cannot exist: a package declaring no dependencies has no lockfile to produce (bun deletes an empty one outright), so the only way to pass was to fabricate a foreign lockfile. Such a package is now skipped, and the skip is surfaced in the note rather than passing silently. An unparseable manifest still counts as having dependencies, so a broken file can't quietly downgrade the check.
  • lockfiles gained an ignore list: nested-aware detection started grading packages whose lockfiles are gitignored on purpose. A repo can now exempt those directories with [lockfiles] ignore = ["spike", "crates/demo"].
  • repo-meta ignores markers inside fenced code blocks: read_markers scanned the whole README and let later matches win, so a README documenting the marker syntax had its own fenced example parsed as the declaration — silently overriding the real markers above it. housekeeping's own README hit this, and housekeeper fix repo-meta would have pushed the doc placeholder over the repo's real description and topics.

New checks

  • strict-status-checks (required, fixable): the default branch must require branches be up to date before merging — GitHub's required_status_checks.strict, read from the ruleset or classic protection (OR-ing, like required-checks). With it on, a PR can only merge once its branch is current, so CI reruns against the true merged state and two individually-green PRs from stale bases can't silently break main. Also recommends the repo-level "Always suggest updating pull request branches" setting (allow_update_branch). The fix sets the strict policy on the default-branch ruleset and turns allow_update_branch on (needs admin; required status checks must exist first).

v0.20.0

First release cut since v0.19.0. It consolidates the batch of checks, commands, and verdict changes that landed on main after v0.19.0 (none of which were tagged individually) into a single release.

New checks

... (truncated)

Changelog

Sourced from zmaril/housekeeping's changelog.

v0.21.0 — 2026-07-18

Adds the strict-status-checks check, and fixes three defects in v0.20.0 that surfaced while rolling it out across the fleet — two of which made v0.20.0's own housekeeper fix unsafe to run.

Fixed

  • fix ci-exists no longer overwrites existing CI: it wrote .github/workflows/ci.yml unconditionally, but ci-exists fails two different ways — no CI at all, or CI that exists and is merely missing a test/lint/fmt step for some language — and the scaffold only answers the first. On a repo whose CI simply lacked a rust step, the fix replaced the entire hand-written workflow with a generic stub. It now scaffolds only when there is no workflow at all, and otherwise prints the missing steps to add by hand.
  • lockfiles no longer demands a lockfile that cannot exist: a package declaring no dependencies has no lockfile to produce (bun deletes an empty one outright), so the only way to pass was to fabricate a foreign lockfile. Such a package is now skipped, and the skip is surfaced in the note rather than passing silently. An unparseable manifest still counts as having dependencies, so a broken file can't quietly downgrade the check.
  • lockfiles gained an ignore list: nested-aware detection started grading packages whose lockfiles are gitignored on purpose. A repo can now exempt those directories with [lockfiles] ignore = ["spike", "crates/demo"].
  • repo-meta ignores markers inside fenced code blocks: read_markers scanned the whole README and let later matches win, so a README documenting the marker syntax had its own fenced example parsed as the declaration — silently overriding the real markers above it. housekeeping's own README hit this, and housekeeper fix repo-meta would have pushed the doc placeholder over the repo's real description and topics.

New checks

  • strict-status-checks (required, fixable): the default branch must require branches be up to date before merging — GitHub's required_status_checks.strict, read from the ruleset or classic protection (OR-ing, like required-checks). With it on, a PR can only merge once its branch is current, so CI reruns against the true merged state and two individually-green PRs from stale bases can't silently break main. Also recommends the repo-level "Always suggest updating pull request branches" setting (allow_update_branch). The fix sets the strict policy on the default-branch ruleset and turns allow_update_branch on (needs admin; required status checks must exist first).

v0.20.0 — 2026-07-18

First release cut since v0.19.0. It consolidates the batch of checks, commands, and verdict changes that landed on main after v0.19.0 (none of which were tagged individually) into a single release.

New checks

... (truncated)

Commits
  • e1a2ed8 chore(release): changelog for v0.21.0 (#99)
  • ca0056c fix: stop ci-exists clobbering CI and lockfiles demanding the impossible (#97)
  • 43a9036 feat(strict-status-checks): require branches up to date before merging (#98)
  • 193b8ca fix(repo-meta): ignore markers inside fenced code blocks (#95)
  • a40d99a chore(housekeeping): declare auto-merge enabled (#96)
  • 1d874fe fix: detection false positives (bun postinstall, ruby test signal) (#94)
  • 781790d chore(release): consolidate changelog for v0.20.0 (#93)
  • 4ce0dc2 feat(repo-meta): declare description + topics in the README and reconcile wit...
  • 9d5d4f1 feat: nested-aware ecosystem detection across all checks (#92)
  • 8e08d2e feat(scaffold): add --dependabot-automerge to housekeeper new (#89)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): Bump the actions group with 3 updates
5aeea4d 
Bumps the actions group with 3 updates: [actions/create-github-app-token](https://github.com/actions/create-github-app-token), [actions/github-script](https://github.com/actions/github-script) and [zmaril/housekeeping](https://github.com/zmaril/housekeeping).


Updates `actions/create-github-app-token` from 1 to 3
- [Release notes](https://github.com/actions/create-github-app-token/releases)
- [Changelog](https://github.com/actions/create-github-app-token/blob/main/CHANGELOG.md)
- [Commits](actions/create-github-app-token@v1...v3)

Updates `actions/github-script` from 7 to 9
- [Release notes](https://github.com/actions/github-script/releases)
- [Commits](actions/github-script@v7...v9)

Updates `zmaril/housekeeping` from 0.19.0 to 0.21.0
- [Release notes](https://github.com/zmaril/housekeeping/releases)
- [Changelog](https://github.com/zmaril/housekeeping/blob/main/CHANGELOG.md)
- [Commits](zmaril/housekeeping@v0.19.0...v0.21.0)

---
updated-dependencies:
- dependency-name: actions/create-github-app-token
  dependency-version: '3'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/github-script
  dependency-version: '9'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: zmaril/housekeeping
  dependency-version: 0.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jul 22, 2026
@dependabot
dependabot Bot requested a review from zmaril as a code owner July 22, 2026 16:24
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jul 22, 2026
@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Jul 22, 2026 •
edited
Loading

Copy link
Copy Markdown

Deploying with  Cloudflare Workers  Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status Name Latest Commit Preview URL Updated (UTC)
✅ Deployment successful!
View logs		 straitjacket 5aeea4d Commit Preview URL

Branch Preview URL		 Jul 22 2026, 04:25 PM

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@zmaril zmaril Awaiting requested review from zmaril zmaril is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants