Alex Waygood and GitHub
ea181cb604
Update undici to 6.29.0 ( #431 )
...
Update the locked `undici` dependency from `6.24.1` to `6.29.0` in
`package-lock.json`. This addresses Dependabot alert
[#64 ](https://github.com/astral-sh/ruff-action/security/dependabot/64 ),
among other alerts for this dependency. The checked-in action bundles
include the updated dependency.
2026-10-21 11:18:43 -07:00
Alex Waygood and GitHub
107126dd4d
Update @babel/core to 7.29.7 ( #433 )
...
Update the locked `@babel/core` dependency from `7.28.6` to `7.29.7` in
`package-lock.json`. This addresses Dependabot alert
[#36 ](https://github.com/astral-sh/ruff-action/security/dependabot/36 ).
The update also addresses alerts for
[browserslist](https://github.com/astral-sh/ruff-action/security/dependabot/57 )
and
[baseline-browser-mapping](https://github.com/astral-sh/ruff-action/security/dependabot/59 ).
2026-10-21 11:18:29 -07:00
Alex Waygood and GitHub
280e92ea43
Update brace-expansion dependencies ( #432 )
...
Update the locked `brace-expansion` dependencies to `1.1.21`, `2.1.7`,
and `5.0.12` in `package-lock.json`. This addresses Dependabot alerts
[#73 ](https://github.com/astral-sh/ruff-action/security/dependabot/73 ),
[#72 ](https://github.com/astral-sh/ruff-action/security/dependabot/72 ),
and
[#71 ](https://github.com/astral-sh/ruff-action/security/dependabot/71 ),
among other alerts for this dependency.
2026-10-21 11:18:16 -07:00
Alex Waygood and GitHub
be1f93951f
Update js-yaml dependencies ( #430 )
...
Update the locked `js-yaml` dependencies to `3.15.2` and `4.3.2` in
`package-lock.json`. This addresses Dependabot alerts
[#62 ](https://github.com/astral-sh/ruff-action/security/dependabot/62 )
and
[#61 ](https://github.com/astral-sh/ruff-action/security/dependabot/61 ),
among other alerts for this dependency.
2026-10-21 11:17:34 -07:00
Alex Waygood and GitHub
747ffb9220
Update handlebars to 4.7.10 ( #429 )
...
Update the locked `handlebars` dependency from `4.7.9` to `4.7.10` in
`package-lock.json`. This addresses Dependabot alerts
[#79 ](https://github.com/astral-sh/ruff-action/security/dependabot/79 ),
[#78 ](https://github.com/astral-sh/ruff-action/security/dependabot/78 ),
and
[#77 ](https://github.com/astral-sh/ruff-action/security/dependabot/77 ).
2026-10-21 11:17:02 -07:00
Kevin Stillhammer and GitHub
70c5336f5b
chore(deps): roll up dependency updates ( #428 )
...
## Summary
- Update CodeQL init, autobuild, and analyze to 4.37.6 (#417 , #418 ,
#419 ).
- Update actions/setup-node to 7.0.0 (#403 ).
- Update @actions/core to 3.0.1 (#405 ) and @types/node to 26.1.1 (#407 ).
- No changes needed for #354 , #317 , or #316 : their updates are already
represented on main.
- Exclude TypeScript #406 : TypeScript 7 breaks the current ts-jest,
which requires TypeScript <6.
## Validation
- `npm run all` passed: build, Biome, packaging, and all 99 tests across
7 suites.
- No generated bundle changes.
- `git diff --check` passed.
Refs: pi-session 01a15ec4-888a-73e1-9f84-da48940488a6
2026-10-21 14:13:48 +00:00
22ba4f8560
chore: update known checksums for 0.17.1 ( #427 )
...
chore: update known checksums for 0.17.1
Co-authored-by: eifinger <1481961+eifinger@users.noreply.github.com >
2026-10-16 09:13:49 +02:00
f2f46687ac
Verify npm dependency signatures before builds ( #426 )
...
## Summary
Supersedes #402 with its changes rebased onto current `main` and the
merge conflict resolved. The original PR is left unchanged.
- Run `npm audit signatures` after installation and before `npm run all`
in the test and checksum-update workflows.
- Preserve the current JSON checksum manifest path
(`src/download/checksum/known-checksums.json`).
- Verify registry signatures and available provenance attestations
without requiring every dependency to publish provenance.
Related: astral-sh/setup-uv#1027 adds the same verification; #401
separately hardens npm installation defaults.
## Validation
Using Node 24.19.0 (matching `.nvmrc`) and npm 11.10.0:
- `npm ci --ignore-scripts` passed (reports existing dependency
vulnerabilities; dependency files are unchanged).
- `npm audit signatures` passed: 547 registry signatures and 97
attestations verified.
- `npm run all` passed: 7 suites, 99 tests; no generated or formatting
changes.
- `actionlint` passed.
- `zizmor` reports the same 26 low-severity findings on this branch and
`main`, with no new findings.
- `git diff --check` passed.
Refs: pi-session 01a1399e-1a99-7314-9573-9a982ea1bb3f
Co-authored-by: zaniebot <242828183+zaniebot@users.noreply.github.com >
2026-10-14 11:05:12 +02:00
a737711ea8
chore: update known checksums for 0.17.0 ( #425 )
...
chore: update known checksums for 0.17.0
Co-authored-by: eifinger <1481961+eifinger@users.noreply.github.com >
2026-10-10 06:50:00 +00:00
Charlie Marsh and GitHub
4307b3970e
Use macOS 15 runners for tests ( #424 )
...
We move the latest-version and specific-version test matrices from
`macos-14` to `macos-15` ahead of GitHub’s [October 5 brownout and
November 2, 2026
retirement](https://github.com/actions/runner-images/issues/13518 ).
2026-10-02 15:16:05 -05:00
8fc297008d
chore: update known checksums for 0.16.9/0.16.10 ( #423 )
...
chore: update known checksums for 0.16.10
Co-authored-by: eifinger <1481961+eifinger@users.noreply.github.com >
2026-10-02 08:47:15 +02:00
6776b96909
test: fix Windows path assertions ( #422 )
...
Amp-Thread-ID:
https://ampcode.com/threads/T-01a0af62-d8be-7209-b38b-950badf6ef76
Closes : #394
Co-authored-by: Amp <amp@ampcode.com >
2026-09-17 13:32:54 +00:00
cc56f639e4
chore: update known checksums for 0.16.8 ( #421 )
...
chore: update known checksums for 0.16.8
Co-authored-by: eifinger <1481961+eifinger@users.noreply.github.com >
2026-09-17 05:53:43 +00:00
3906fcf994
chore: update known checksums for 0.16.7 ( #420 )
...
chore: update known checksums for 0.16.7
Co-authored-by: eifinger <1481961+eifinger@users.noreply.github.com >
2026-09-11 06:31:56 +00:00
c890b57484
chore: update known checksums for 0.16.6 ( #416 )
...
chore: update known checksums for 0.16.6
Co-authored-by: eifinger <1481961+eifinger@users.noreply.github.com >
2026-09-04 07:37:34 +00:00
6f8f9a9d5f
chore(deps): bump release-drafter/release-drafter from 7.3.0 to 7.6.0 ( #404 )
...
Bumps
[release-drafter/release-drafter](https://github.com/release-drafter/release-drafter )
from 7.3.0 to 7.6.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/release-drafter/release-drafter/releases ">release-drafter/release-drafter's
releases</a>.</em></p>
<blockquote>
<h2>v7.6.0</h2>
<h1>What's Changed</h1>
<h2>New</h2>
<ul>
<li>feat: resolve release commitish refs to commit SHAs (<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1649 ">#1649</a>)
<a href="https://github.com/jetersen "><code>@jetersen</code></a></li>
<li>feat: add new contributors list (<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1645 ">#1645</a>)
<a href="https://github.com/jetersen "><code>@jetersen</code></a></li>
<li>feat: support pull request co-authors (<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1646 ">#1646</a>)
<a href="https://github.com/jetersen "><code>@jetersen</code></a></li>
<li>feat: support per-key merge strategies in <code>_extends</code> (<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1642 ">#1642</a>)
<a
href="https://github.com/ReneWerner87 "><code>@ReneWerner87</code></a>,
<a href="https://github.com/cchanche "><code>@cchanche</code></a>, <a
href="https://github.com/jetersen "><code>@jetersen</code></a></li>
</ul>
<h2>Bug Fixes</h2>
<ul>
<li>fix: .github in legacy <code>_extends</code> refs (<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1650 ">#1650</a>)
<a href="https://github.com/jetersen "><code>@jetersen</code></a></li>
<li>fix: normalize release target branch refs (<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1648 ">#1648</a>)
<a href="https://github.com/jetersen "><code>@jetersen</code></a></li>
<li>fix: duplicate and skipped release contributors (<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1644 ">#1644</a>)
<a href="https://github.com/jetersen "><code>@jetersen</code></a></li>
</ul>
<h2>Maintenance</h2>
<ul>
<li>chore(deps): update dependency typescript to 7.0.2 (<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1667 ">#1667</a>)
<a
href="https://github.com/apps/renovate "><code>@renovate[bot]</code></a></li>
<li>ci(deps): update github/codeql-action digest to 7188fc3 (<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1654 ">#1654</a>)
<a
href="https://github.com/apps/renovate "><code>@renovate[bot]</code></a></li>
<li>ci(deps): update actions/stale digest to 1e223db (<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1653 ">#1653</a>)
<a
href="https://github.com/apps/renovate "><code>@renovate[bot]</code></a></li>
<li>chore(deps): update dependency <code>@types/node</code> to 24.13.3
(<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1661 ">#1661</a>)
<a
href="https://github.com/apps/renovate "><code>@renovate[bot]</code></a></li>
<li>chore(deps): update vitest to 4.1.10 (<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1656 ">#1656</a>)
<a
href="https://github.com/apps/renovate "><code>@renovate[bot]</code></a></li>
<li>chore(deps): update graphql-codegen (<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1663 ">#1663</a>)
<a
href="https://github.com/apps/renovate "><code>@renovate[bot]</code></a></li>
<li>chore(deps): update dependency vite to 8.1.4 (<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1662 ">#1662</a>)
<a
href="https://github.com/apps/renovate "><code>@renovate[bot]</code></a>,
<a
href="https://github.com/apps/github-actions "><code>@github-actions[bot]</code></a></li>
<li>chore(deps): update dependency nock to 14.0.16 (<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1655 ">#1655</a>)
<a
href="https://github.com/apps/renovate "><code>@renovate[bot]</code></a></li>
<li>chore(deps): update dependency <code>@biomejs/biome</code> to 2.5.3
(<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1660 ">#1660</a>)
<a
href="https://github.com/apps/renovate "><code>@renovate[bot]</code></a></li>
<li>ci(deps): update actions/checkout action to v7.0.0 (<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1669 ">#1669</a>)
<a
href="https://github.com/apps/renovate "><code>@renovate[bot]</code></a></li>
<li>ci(deps): update actions/setup-node action to v7.0.0 (<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1670 ">#1670</a>)
<a
href="https://github.com/apps/renovate "><code>@renovate[bot]</code></a></li>
<li>chore: update generated GraphQL types (<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1641 ">#1641</a>)
<a
href="https://github.com/apps/github-actions "><code>@github-actions[bot]</code></a>,
<a href="https://github.com/jetersen "><code>@jetersen</code></a></li>
</ul>
<h2>Dependency Updates</h2>
<ul>
<li>fix(deps): update dependency graphql to 16.14.2 (<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1657 ">#1657</a>)
<a
href="https://github.com/apps/renovate "><code>@renovate[bot]</code></a>,
<a
href="https://github.com/apps/github-actions "><code>@github-actions[bot]</code></a></li>
<li>fix(deps): update dependency yaml to 2.9.0 (<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1666 ">#1666</a>)
<a
href="https://github.com/apps/renovate "><code>@renovate[bot]</code></a>,
<a
href="https://github.com/apps/github-actions "><code>@github-actions[bot]</code></a></li>
<li>fix(deps): update dependency semver to 7.8.5 (<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1659 ">#1659</a>)
<a
href="https://github.com/apps/renovate "><code>@renovate[bot]</code></a>,
<a
href="https://github.com/apps/github-actions "><code>@github-actions[bot]</code></a></li>
<li>fix(deps): update dependency ignore to 7.0.6 (<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1658 ">#1658</a>)
<a
href="https://github.com/apps/renovate "><code>@renovate[bot]</code></a>,
<a
href="https://github.com/apps/github-actions "><code>@github-actions[bot]</code></a></li>
<li>chore(deps): update dependency <code>@biomejs/biome</code> to 2.5.3
(<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1660 ">#1660</a>)
<a
href="https://github.com/apps/renovate "><code>@renovate[bot]</code></a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/ReneWerner87 "><code>@ReneWerner87</code></a>
made their first contribution in <a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1642 ">#1642</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/release-drafter/release-drafter/compare/v7.5.1...v7.6.0 ">https://github.com/release-drafter/release-drafter/compare/v7.5.1...v7.6.0 </a></p>
<h2>v7.5.1</h2>
<h1>What's Changed</h1>
<h2>Bug Fixes</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/release-drafter/release-drafter/commit/eada3c96a64734dd381cfbda23511034e328ddb0 "><code>eada3c9</code></a>
chore: release v7.6.0</li>
<li><a
href="https://github.com/release-drafter/release-drafter/commit/4621843980a0844866eefbe4d5f92e680fce5d81 "><code>4621843</code></a>
migrate biome config</li>
<li><a
href="https://github.com/release-drafter/release-drafter/commit/e9aeda788e59684f9fe90b4ca1a32f60f0b3bf29 "><code>e9aeda7</code></a>
chore(deps): update dependency typescript to 7.0.2 (<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1667 ">#1667</a>)</li>
<li><a
href="https://github.com/release-drafter/release-drafter/commit/c943e7c8b72b3d6c5fab33cfd024317893d5c320 "><code>c943e7c</code></a>
fix(deps): update dependency graphql to 16.14.2 (<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1657 ">#1657</a>)</li>
<li><a
href="https://github.com/release-drafter/release-drafter/commit/b9af92564053e016d0bf080da7c24704c159ee4e "><code>b9af925</code></a>
fix(deps): update dependency yaml to 2.9.0 (<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1666 ">#1666</a>)</li>
<li><a
href="https://github.com/release-drafter/release-drafter/commit/f4aa1589c4bd889abd152b42a03071c0695716b8 "><code>f4aa158</code></a>
ci(deps): update github/codeql-action digest to 7188fc3 (<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1654 ">#1654</a>)</li>
<li><a
href="https://github.com/release-drafter/release-drafter/commit/93973850c385e1ad1901d254003cf654b2fb7f4a "><code>9397385</code></a>
ci(deps): update actions/stale digest to 1e223db (<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1653 ">#1653</a>)</li>
<li><a
href="https://github.com/release-drafter/release-drafter/commit/5dd9f212bc0430df55c6f9b360720a2d08ddc157 "><code>5dd9f21</code></a>
chore(deps): update dependency <code>@types/node</code> to 24.13.3 (<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1661 ">#1661</a>)</li>
<li><a
href="https://github.com/release-drafter/release-drafter/commit/903a9a10909a48b47c20e26c545bac26676d69cd "><code>903a9a1</code></a>
chore(deps): update vitest to 4.1.10 (<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1656 ">#1656</a>)</li>
<li><a
href="https://github.com/release-drafter/release-drafter/commit/2796d1b6a0ad34872845939207b3af9aac1b346f "><code>2796d1b</code></a>
fix(deps): update dependency semver to 7.8.5 (<a
href="https://redirect.github.com/release-drafter/release-drafter/issues/1659 ">#1659</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/release-drafter/release-drafter/compare/c2e2804cc59f45f57076a99af580d0fedb697927...eada3c96a64734dd381cfbda23511034e328ddb0 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-03 16:43:22 +05:30
eifinger-bot and GitHub
127e6a115e
Use JSON for known checksums ( #415 )
...
Ports the hardening from astral-sh/setup-uv#1025 to ruff-action.\n\nThis
stores generated checksums as JSON data behind a small typed TypeScript
wrapper, preventing values sourced from release metadata from being
mixed into generated executable code. It also updates the checksum
workflow and packaged action artifacts, and adds a regression test for
code-like keys and escaped checksum values.\n\nTests: npm run build, npm
run check, npm test, npm run package
2026-08-28 16:15:05 -04:00
6d5deb5cee
chore: update known checksums for 0.16.4/0.16.5 ( #412 )
...
chore: update known checksums for 0.16.5
Co-authored-by: eifinger <1481961+eifinger@users.noreply.github.com >
2026-08-28 07:54:42 +00:00
46b5b9699e
Enforce the npm version floor with legacy clients ( #411 )
...
`devEngines` is ignored by npm releases such as `10.8.2`, so those
clients can install dependencies without applying the seven-day
`min-release-age` setting added in #401 . Declare the same minimum in
`engines.npm` and enable `engine-strict` to make that legacy installer
requirement fatal. Keep `devEngines` for its earlier checks on newer npm
versions, and pin the build and checksum workflows to Node.js `24.19.0`
so their bundled `npm` supports the policy.
Related: astral-sh/setup-uv#1026 and astral-sh/ruff#27844 enforce the
same legacy-aware `npm` version floor. astral-sh/ruff-action#400 covers
Dependabot's update cooldown, and astral-sh/ruff-action#402 separately
verifies registry signatures and available provenance.
---------
Co-authored-by: zaniebot <242828183+zaniebot@users.noreply.github.com >
2026-08-20 17:36:55 +02:00
848ccd1cb2
chore(deps): bump zizmorcore/zizmor-action from 0.5.6 to 0.6.0 ( #408 )
...
Bumps
[zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action )
from 0.5.6 to 0.6.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/zizmorcore/zizmor-action/releases ">zizmorcore/zizmor-action's
releases</a>.</em></p>
<blockquote>
<h2>v0.6.0</h2>
<p>zizmor 1.27.0 is now the default version used by the action.</p>
<h2>What's Changed</h2>
<ul>
<li>Fold Docker image pull output into a collapsed Actions log group by
<a href="https://github.com/woodruffw "><code>@woodruffw</code></a> with
<a href="https://github.com/Copilot "><code>@Copilot</code></a> in <a
href="https://redirect.github.com/zizmorcore/zizmor-action/pull/132 ">zizmorcore/zizmor-action#132</a></li>
<li>Readme: document missing inputs by <a
href="https://github.com/staabm "><code>@staabm</code></a> in <a
href="https://redirect.github.com/zizmorcore/zizmor-action/pull/130 ">zizmorcore/zizmor-action#130</a></li>
<li>ci: block version sync workflow on forks by <a
href="https://github.com/shaanmajid "><code>@shaanmajid</code></a> in <a
href="https://redirect.github.com/zizmorcore/zizmor-action/pull/129 ">zizmorcore/zizmor-action#129</a></li>
<li>Sync zizmor versions by <a
href="https://github.com/github-actions "><code>@github-actions</code></a>[bot]
in <a
href="https://redirect.github.com/zizmorcore/zizmor-action/pull/137 ">zizmorcore/zizmor-action#137</a></li>
<li>Add <code>collect</code> input by <a
href="https://github.com/woodruffw "><code>@woodruffw</code></a> in <a
href="https://redirect.github.com/zizmorcore/zizmor-action/pull/139 ">zizmorcore/zizmor-action#139</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/woodruffw "><code>@woodruffw</code></a>
with <a href="https://github.com/Copilot "><code>@Copilot</code></a>
made their first contribution in <a
href="https://redirect.github.com/zizmorcore/zizmor-action/pull/132 ">zizmorcore/zizmor-action#132</a></li>
<li><a href="https://github.com/staabm "><code>@staabm</code></a> made
their first contribution in <a
href="https://redirect.github.com/zizmorcore/zizmor-action/pull/130 ">zizmorcore/zizmor-action#130</a></li>
<li><a
href="https://github.com/shaanmajid "><code>@shaanmajid</code></a> made
their first contribution in <a
href="https://redirect.github.com/zizmorcore/zizmor-action/pull/129 ">zizmorcore/zizmor-action#129</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/zizmorcore/zizmor-action/compare/v0.5.7...v0.6.0 ">https://github.com/zizmorcore/zizmor-action/compare/v0.5.7...v0.6.0 </a></p>
<h2>v0.5.7</h2>
<p>1.26.1 is now available via the action
1.26.1 is now the default version of zizmor used by the action</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/zizmorcore/zizmor-action/commit/6599ee8b7a49aef6a770f63d261d214911a7ce02 "><code>6599ee8</code></a>
Add <code>collect</code> input (<a
href="https://redirect.github.com/zizmorcore/zizmor-action/issues/139 ">#139</a>)</li>
<li><a
href="https://github.com/zizmorcore/zizmor-action/commit/bec05c80b8586b8cbc030450e4fa4e82b83a9427 "><code>bec05c8</code></a>
Sync zizmor versions (<a
href="https://redirect.github.com/zizmorcore/zizmor-action/issues/137 ">#137</a>)</li>
<li><a
href="https://github.com/zizmorcore/zizmor-action/commit/cf5954948fbc9d5b9460b774e281e3387b989ea6 "><code>cf59549</code></a>
Add issue templates (<a
href="https://redirect.github.com/zizmorcore/zizmor-action/issues/135 ">#135</a>)</li>
<li><a
href="https://github.com/zizmorcore/zizmor-action/commit/f72bf176f67e8007f87b16d80f9880ece648aa65 "><code>f72bf17</code></a>
chore(deps): bump github/codeql-action/upload-sarif (<a
href="https://redirect.github.com/zizmorcore/zizmor-action/issues/134 ">#134</a>)</li>
<li><a
href="https://github.com/zizmorcore/zizmor-action/commit/b2a6fac1a76b42abf3794cd06cef23af2f13e590 "><code>b2a6fac</code></a>
ci: block version sync workflow on forks (<a
href="https://redirect.github.com/zizmorcore/zizmor-action/issues/129 ">#129</a>)</li>
<li><a
href="https://github.com/zizmorcore/zizmor-action/commit/2d88f441dcd818e199d649f55e9a347196a52262 "><code>2d88f44</code></a>
Readme: document missing inputs (<a
href="https://redirect.github.com/zizmorcore/zizmor-action/issues/130 ">#130</a>)</li>
<li><a
href="https://github.com/zizmorcore/zizmor-action/commit/d81e2769a6bdcb1d076bf52b5e7e663c881f94e7 "><code>d81e276</code></a>
Fold Docker image pull output into a collapsed Actions log group (<a
href="https://redirect.github.com/zizmorcore/zizmor-action/issues/132 ">#132</a>)</li>
<li><a
href="https://github.com/zizmorcore/zizmor-action/commit/8c13c5382c13a16f7ece1f965891708b819d28b2 "><code>8c13c53</code></a>
chore(deps): bump the github-actions group with 2 updates (<a
href="https://redirect.github.com/zizmorcore/zizmor-action/issues/133 ">#133</a>)</li>
<li><a
href="https://github.com/zizmorcore/zizmor-action/commit/2f8e9c6f609a49998258063502592a555c964847 "><code>2f8e9c6</code></a>
README: bump versions (<a
href="https://redirect.github.com/zizmorcore/zizmor-action/issues/128 ">#128</a>)</li>
<li><a
href="https://github.com/zizmorcore/zizmor-action/commit/192e21d79ab29983730a13d1382995c2307fbcaa "><code>192e21d</code></a>
Sync zizmor versions (<a
href="https://redirect.github.com/zizmorcore/zizmor-action/issues/127 ">#127</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/zizmorcore/zizmor-action/compare/5f14fd08f7cf1cb1609c1e344975f152c7ee938d...6599ee8b7a49aef6a770f63d261d214911a7ce02 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-20 09:02:44 +02:00
1f30a84c67
Harden npm install defaults ( #401 )
...
CI already disables npm lifecycle scripts, but ordinary installs from
the repository still run them. Add `.npmrc` defaults that disable those
scripts and apply the same seven-day `min-release-age` policy used by
`setup-uv`. Require npm `11.10.0` or newer through `devEngines` so older
versions cannot silently ignore the age setting. Explicit project
commands such as `npm run package` remain available.
Co-authored-by: zaniebot <242828183+zaniebot@users.noreply.github.com >
2026-08-18 19:12:36 +02:00
d3ef2489b0
Add a 30-day Dependabot cooldown ( #400 )
...
The repository has no explicit Dependabot cooldown, so routine updates
do not follow the 30-day policy used by `setup-uv`. Add
`cooldown.default-days: 30` for npm and GitHub Actions while retaining
the daily schedule. Dependabot security updates remain outside the
cooldown.
Co-authored-by: zaniebot <242828183+zaniebot@users.noreply.github.com >
2026-08-18 19:08:54 +02:00
81a72f25c9
chore: update known checksums for 0.16.3 ( #399 )
...
chore: update known checksums for 0.16.3
Co-authored-by: eifinger <1481961+eifinger@users.noreply.github.com >
2026-08-14 05:36:13 +00:00
2ce112e5ca
chore: update known checksums for 0.16.2 ( #398 )
...
chore: update known checksums for 0.16.2
Co-authored-by: eifinger <1481961+eifinger@users.noreply.github.com >
2026-08-09 08:26:38 +00:00
28ec38735d
chore: update known checksums for 0.16.1 ( #397 )
...
chore: update known checksums for 0.16.1
Co-authored-by: eifinger <1481961+eifinger@users.noreply.github.com >
2026-07-31 09:11:18 +02:00
project516 and GitHub
2957f9e73d
docs: unify ruff-action versions in README ( #396 )
2026-07-24 18:20:31 +00:00
5b168050b9
chore: update known checksums for 0.16.0 ( #395 )
...
chore: update known checksums for 0.16.0
Co-authored-by: eifinger <1481961+eifinger@users.noreply.github.com >
2026-07-24 06:30:28 +00:00
3bb5cd7c3c
chore: update known checksums for 0.15.22 ( #393 )
...
chore: update known checksums for 0.15.22
Co-authored-by: eifinger <1481961+eifinger@users.noreply.github.com >
2026-07-17 06:19:01 +00:00
8d2a42ddf5
chore: update known checksums for 0.15.21 ( #391 )
...
chore: update known checksums for 0.15.21
Co-authored-by: eifinger <1481961+eifinger@users.noreply.github.com >
2026-07-13 09:04:22 +02:00
Kevin Stillhammer and GitHub
278981a28c
Add option to skip Astral mirror downloads ( #387 )
...
## Summary
- add `download-from-astral-mirror` input defaulting to `true`
- skip mirror URL rewriting and download directly from GitHub Releases
when disabled
- document the input and add unit coverage
Fixes #384
Refs: pi-session 019f31bc-bd1c-7276-9b4e-9734fa0aa367
## Testing
- npm run build
- npm run check
- npm run test:unit
2026-07-05 10:17:44 +00:00
Kevin Stillhammer and GitHub
c35f46c92b
chore: roll up Dependabot updates ( #386 )
...
## Summary
- roll up remaining open Dependabot npm updates for @octokit/core and
@octokit/plugin-rest-endpoint-methods
- roll up remaining GitHub Actions pin updates for CodeQL, zizmor,
release-drafter, setup-node, and create-pull-request
- regenerate bundled dist files
## Validation
- npm run all
Refs: pi-session 019f31b8-93d9-7f9b-b3e9-5aaac6bab959
2026-07-05 12:04:11 +02:00
somaz and GitHub
f3db229c84
feat: support uv.lock as version-file ( #379 )
...
Adds `uv.lock` as a supported `version-file` format, alongside the
existing
`pyproject.toml` and `requirements.txt`. A `uv.lock` pins the exact
resolved
ruff version, so reading it gives a reproducible install that matches
the
project's lockfile — the single source of truth — instead of the
lower-bound /
range typically declared in `pyproject.toml`.
The parser reads the `[[package]]` entry whose `name` is `ruff` and
returns its
`version`. If ruff is absent or the file cannot be parsed, the action
warns and
falls back to `latest` (same behaviour as the other formats).
Validation:
- `npm run all` — tsc typecheck clean, biome clean, dist rebuilt, jest
65/65 pass
- Added unit tests (`__tests__/version/file-parser.test.ts`) + a
`uv.lock` fixture
- Added an integration job (`test-default-version-from-uv-lock`) that
runs the
action against the fixture and asserts ruff 0.9.5 is installed
closes #375
2026-07-05 11:56:05 +02:00
Kevin Stillhammer and GitHub
270e80dfe7
Fix wildcard src input ( #368 )
...
Fixes : #355
2026-07-05 11:55:02 +02:00
Kevin Stillhammer and GitHub
5fedeebdb3
Add Dependabot rollup skill ( #385 )
...
## Summary
- add the dependabot-pr-rollup skill copied from setup-uv
- adapt the workflow notes for ruff-action's npm and GitHub Actions
Dependabot updates
## Testing
- npm run all
Refs: pi-session 019f317d-08f2-7aac-a6d5-56a44288d94c
2026-07-05 11:49:16 +02:00
99fe79f472
chore: update known checksums for 0.15.20 ( #383 )
...
chore: update known checksums for 0.15.20
Co-authored-by: eifinger <1481961+eifinger@users.noreply.github.com >
2026-06-26 08:39:54 +02:00
32ad1b993e
chore: update known checksums for 0.15.19 ( #382 )
...
chore: update known checksums for 0.15.19
Co-authored-by: eifinger <1481961+eifinger@users.noreply.github.com >
2026-06-24 07:16:05 +00:00
f78e087041
chore: update known checksums for 0.15.18 ( #381 )
...
chore: update known checksums for 0.15.18
Co-authored-by: eifinger <1481961+eifinger@users.noreply.github.com >
2026-06-19 05:45:18 +00:00
2f88679623
chore: update known checksums for 0.15.17 ( #380 )
...
chore: update known checksums for 0.15.17
Co-authored-by: eifinger <1481961+eifinger@users.noreply.github.com >
2026-06-12 05:57:40 +00:00
b79a7ac759
chore: update known checksums for 0.15.16 ( #378 )
...
chore: update known checksums for 0.15.16
Co-authored-by: eifinger <1481961+eifinger@users.noreply.github.com >
2026-06-05 06:27:01 +00:00
30c0929868
chore: update known checksums for 0.15.15 ( #377 )
...
chore: update known checksums for 0.15.15
Co-authored-by: eifinger <1481961+eifinger@users.noreply.github.com >
2026-05-29 09:11:56 +00:00
b4bf7655a0
chore: update known checksums for 0.15.14 ( #376 )
...
chore: update known checksums for 0.15.14
Co-authored-by: eifinger <1481961+eifinger@users.noreply.github.com >
2026-05-22 05:57:48 +00:00
Frederick Wagner and GitHub
7f78e88b21
Use v4.0.0 in README.md ( #371 )
...
This change should reduce confusion from `@4` not working.
2026-05-20 13:18:52 +02:00
8c228c72ff
chore: update known checksums for 0.15.13 ( #372 )
...
chore: update known checksums for 0.15.13
Co-authored-by: eifinger <1481961+eifinger@users.noreply.github.com >
2026-05-15 06:36:00 +00:00
Zanie Blue and GitHub
248b6d6da3
Update the release process to match setup-uv ( #364 )
2026-04-27 10:31:05 -05:00
ecaa98070e
chore: update known checksums for 0.15.12 ( #365 )
...
chore: update known checksums for 0.15.12
Co-authored-by: eifinger <1481961+eifinger@users.noreply.github.com >
2026-04-25 07:00:01 +00:00
a9cfed68e4
chore: update known checksums for 0.15.11 ( #360 )
...
chore: update known checksums for 0.15.11
Co-authored-by: eifinger <1481961+eifinger@users.noreply.github.com >
2026-04-17 07:31:01 +00:00
Kevin Stillhammer and GitHub
eb44a0e99b
Draft commitish releases ( #359 )
2026-04-16 20:31:36 +02:00
2915b93f0d
Bump zizmorcore/zizmor-action from 0.5.2 to 0.5.3 ( #356 )
...
Bumps
[zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action )
from 0.5.2 to 0.5.3.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/zizmorcore/zizmor-action/releases ">zizmorcore/zizmor-action's
releases</a>.</em></p>
<blockquote>
<h2>v0.5.3</h2>
<ul>
<li><code>1.24.0</code> and <code>1.24.1</code> are now available via
the action</li>
<li><code>1.24.1</code> is now the default version of zizmor used by the
action</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/zizmorcore/zizmor-action/commit/b1d7e1fb5de872772f31590499237e7cce841e8e "><code>b1d7e1f</code></a>
Sync zizmor versions (<a
href="https://redirect.github.com/zizmorcore/zizmor-action/issues/102 ">#102</a>)</li>
<li><a
href="https://github.com/zizmorcore/zizmor-action/commit/a195b57475917ddcb70845e5ffe1c3a15dbbdedc "><code>a195b57</code></a>
Sync zizmor versions (<a
href="https://redirect.github.com/zizmorcore/zizmor-action/issues/100 ">#100</a>)</li>
<li><a
href="https://github.com/zizmorcore/zizmor-action/commit/629d5d01fe5939a6aeae25c1bd1acd2cfa28e9b2 "><code>629d5d0</code></a>
chore(deps): bump github/codeql-action in the github-actions group (<a
href="https://redirect.github.com/zizmorcore/zizmor-action/issues/99 ">#99</a>)</li>
<li><a
href="https://github.com/zizmorcore/zizmor-action/commit/453d591467e8199b1d5c6883b6ec5c22a12aac72 "><code>453d591</code></a>
chore(deps): bump the github-actions group with 2 updates (<a
href="https://redirect.github.com/zizmorcore/zizmor-action/issues/98 ">#98</a>)</li>
<li><a
href="https://github.com/zizmorcore/zizmor-action/commit/ea2c18b942410df0b22bed3b94c361c407518d45 "><code>ea2c18b</code></a>
Bump pins (<a
href="https://redirect.github.com/zizmorcore/zizmor-action/issues/97 ">#97</a>)</li>
<li>See full diff in <a
href="https://github.com/zizmorcore/zizmor-action/compare/71321a20a9ded102f6e9ce5718a2fcec2c4f70d8...b1d7e1fb5de872772f31590499237e7cce841e8e ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-14 07:51:55 +02:00
Kevin Stillhammer and GitHub
0ce1b0bf8b
refactor version resolving ( #353 )
2026-04-12 13:44:40 +02:00
Kevin Stillhammer and GitHub
9b8caf6c41
Add manifest-file input ( #352 )
2026-04-11 19:14:05 +02:00
