Skip to content

chore(deps): update github actions - #90

Open
bootc-bot[bot] wants to merge 1 commit into
mainfrom
bootc-renovate/github-actions
Open

chore(deps): update github actions#90
bootc-bot[bot] wants to merge 1 commit into
mainfrom
bootc-renovate/github-actions

Conversation

@bootc-bot

@bootc-bot bootc-bot Bot commented Sep 6, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change
actions/create-github-app-token action minor v3.2.0 → v3.3.0
github/gh-aw uses-with minor v0.88.2 → v0.92.0
peter-evans/create-pull-request action major v7 → v8
ubuntu github-runner major 24.04 → 26.04

Release Notes

actions/create-github-app-token

v3.3.0

Compare Source

Features
Bug Fixes
  • deps: bump nested undici from 6.24.0 to 6.29.0 (#​403) (12461a3)
  • deps: bump the production-dependencies group across 1 directory with 3 updates (#​395) (a69c19d)
github/gh-aw

v0.92.0

Compare Source

🌟 Release Highlights

This release focuses on model routing correctness, more reliable work-queue and cross-repo workflows, and stronger safe-output integrity.

✨ What's New
  • Clearer Model Routing docs – the reference page is rewritten for workflow authors. Learn more
  • Claude on Copilot – Claude Code now receives a modelOverrides map for Copilot's dotted Claude model IDs.
  • Trusted dispatch for work queues, with fixes for history amplification.
  • Go Fan bounded-research A/B experiment added.
🐛 Bug Fixes & Improvements
  • An omitted allowed-models now means any model when merging imports.
  • Copilot now rejects silent substitution of the configured model.
  • The optional target repository defaults before MCP gateway startup.
  • Cross-repo PR patches work for environment-resolved targets.
  • Safe-output patch and bundle application is bound to validated bytes (security hardening).
  • Work queue honors the configured GitHub server host, and its reconciliation step summaries are collapsed.
  • The unified session summary renders at top level, and missing session parser dependencies are included.
  • gh-aw-node runtime packages are rebuilt on scheduled publishes.
📚 Documentation
  • Restored the factory policy admission invariant and trimmed the linter-factory pattern page.

Generated by 🚀 Release · copilot · auto · 13.9 AIC · ⊞ 11.7K

What's Changed

Full Changelog: github/gh-aw@v0.91.14...v0.92.0

v0.91.14

Compare Source

🌟 Release Highlights

This release tightens multi-repository checkout semantics and hardens OTLP credential handling, plus a CI stability fix.

⚠️ Breaking Changes
  • Multi-repository checkout now requires explicit multi: true (#​68816). Repository expressions no longer implicitly enable list expansion. If you relied on repository lists in a checkout entry, add multi: true to that entry. Entries without it keep ordinary single-repository behavior (LFS, submodules, current checkout, wiki), and literal repository lists in single mode are rejected at compile time.
✨ What's New
  • Per-entry opt-in for multi-repo checkout: predictable behavior, with expression results validated as exactly one owner/repo before checkout in both agent and safe-output jobs.
🐛 Bug Fixes & Improvements
  • Stronger OTLP credential protection (#​68811): GH_AW_OTLP_ALL_HEADERS is now excluded from agent and eval sandboxes (including multi-endpoint configs). Shared credential extraction now masks and redacts decoded Basic-auth passwords, repeated/percent-encoded headers, and JSON-escaped values in artifacts and step summaries. Recompile your workflows to pick up the change.
  • CI reliability (#​68807): the CLI's embedded session parser bundle now includes all runtime dependencies.

Generated by 🚀 Release · copilot · auto · 15.9 AIC · ⊞ 11.7K

What's Changed

Full Changelog: github/gh-aw@v0.91.13...v0.91.14

v0.91.13

Compare Source

🌟 Release Highlights

This release focuses on security hardening, better quota/API diagnostics, and smoother workflow generation.

✨ What's New
  • Dynamic repository checkouts: allowlisted dynamic repository checkout lists (#​68593).
  • Configurable add-comment link limits, with footer links excluded from the count (#​68723).
  • GitHub search quotas and MCP 429 retry hints now exposed for easier rate-limit troubleshooting (#​68728, #​68737).
  • AWF model inventories included in unified agent sessions (#​68600).
  • New linter: deferred-error-unchecked detects unchecked deferred errors (#​68780).
🐛 Bug Fixes & Improvements
  • OTLP credentials are masked and Grafana Cloud tokens redacted (#​68779).
  • Aider parser guarded against model inventory spoofing (#​68714).
  • Fixed explicit parent targeting for scheduled Issue Arborist links (#​68623).
  • Copilot SDK content-filter failures are now preserved (#​68624).
  • Staged safe-output handlers infer read permissions (#​68724).
  • Generated Go setup prefers the root go.mod (#​68718).
  • Serena Go container gets the runner toolchain PATH (#​68734).
  • Pre-agent workspace audits exclude the tool cache (#​68725).
  • Safe-output guidance is resilient to missing sandbox tools (#​68716).
  • Dependabot alerts remediated and dependencies updated (#​68774, #​68784).
📚 Documentation
  • MCP server CLI reference aligned with help output (#​68715), plus glossary and feature doc updates.

Generated by 🚀 Release · copilot · auto · 14.4 AIC · ⊞ 11.7K

What's Changed

Full Changelog: github/gh-aw@v0.91.12...v0.91.13

v0.91.12

Compare Source

🌟 Release Highlights

This release hardens security for MCP and pull_request_target workflows, refines model routing, and adds Azure Entra OIDC support for Codex.

⚠️ Breaking Changes
  • Strict mode now rejects unsafe pull_request_target role configurations (#​68554). Review such workflows before recompiling.
  • Model routing policy simplified: models.allowed / models.blocked are now the only request policy, and allowed-models are optional router candidates (#​68495). Model-routed workflows that don't use GitHub Copilot inference now fail compilation (#​68080).
✨ What's New
  • Azure Entra OIDC support in native Codex (#​68457).
  • Operator-controlled MCP workflow capabilities (#​68548), with stricter MCP argument handling, destination validation, and rejection of CLI flags in positional inputs (#​68547, #​68541).
  • Routed smoke tests for AWF AI-credit steering notices (#​68062).
  • Persistent run provenance and corrected WIP attribution (#​68501).
🐛 Bug Fixes & Improvements
  • Model routing keeps the routed selection when a proxy failure follows it (#​68498).
  • Trusted base merges are excluded from unsigned PR bundle size checks (#​68459).
  • Work-queue fixes: abandoned worker reservations and reduced API amplification on unrelated issue closures (#​68526, #​68522).
  • Better secret-safe artifact redaction failure diagnostics (#​68523).
  • Fewer API reads under installation quota pressure, plus checkout-free timing summaries (#​68518, #​68516).
  • CI recovers from checkout cache misses (#​68521); concurrency audit handler discovery fixed (#​68528).
📚 Documentation
  • Streamlined CLI reference for audit, sessions and graders (#​68562).

Generated by 🚀 Release · copilot · auto · 14.5 AIC · ⊞ 11.7K

What's Changed

Full Changelog: github/gh-aw@v0.91.11...v0.91.12

v0.91.11

Compare Source

🌟 Release Highlights

This release focuses on reliability: sturdier safe outputs, better diagnostics, and fixes for Codex and Aider engines.

✨ What's New
  • Claude Haiku 5.5 pricing is now supported (#​68424).
  • Work-queue issues now show work titles and descriptions (#​68421), with unified Git ref resolution (#​68425).
  • push_to_pull_request_branch accepts numeric targets and gives clearer errors (#​68426).
  • Unified session audit reports now include AWF steering events (#​68428), with refined Claude-style step summaries (#​68322).
  • New codemod guides users who access safe-outputs files directly from post-steps (#​68409).
  • Better frontmatter diagnostics for schedule and engine typos (#​68411).
🐛 Bug Fixes & Improvements
  • Aider workflows no longer exit after discovery shell commands (#​68525).
  • Codex retains function-backed shell tools for GitHub inference (#​68473) and ignores custom-slug fallback warnings in model_not_supported_error detection (#​68427).
  • Safe-output PR/issue/commit links are preserved when the conclusion job rewrites the activation comment (#​68413); missing safe-output failures are more actionable (#​68414); pre-agent startup failures are distinguished from missing outputs (#​68467).
  • Completion comment failures no longer leave steering issues open (#​68423).
  • MCP Gateway toolTimeout is emitted as integer seconds (#​68410).
  • Hardened quoting in workflow generators (#​68430).
  • Firewall bumped to v0.28.56 (#​68336).
📚 Documentation
  • How to find and configure LINEAR_TEAM_ID (#​68468).
  • Codex bash allowlist and pull_request_target pitfalls (#​68408), and context-rebuild guard tuning (#​68460).

Generated by 🚀 Release · copilot · auto · 14.7 AIC · ⊞ 11.7K

What's Changed

Full Changelog: github/gh-aw@v0.91.10...v0.91.11

v0.91.10

Compare Source

🌟 Release Highlights

This release focuses on safer defaults, richer session provenance, and more reliable engines and smoke testing.

✨ What's New
  • Read-only agent workflows default to no network access, tightening the default security posture (#​68047).
  • Richer unified agent sessions: plugin installations and privacy-preserving MCP configuration are now recorded (#​68054, #​68055), and execution provenance is preserved independently of safe-output footers (#​68077).
  • Explicit MCP protocol support with improved tool responsiveness (#​68051).
  • Work queue improvements: Issues are easier to scan, CLI flags are aligned and documented, and queued work is cancelled when a related Issue closes (#​68084, #​68050, #​68133).
  • Process-alignment fitness trajectory grader added (#​68048).
🐛 Bug Fixes & Improvements
  • The default Pi CLI is bumped to 1.2.0 so the pi engine starts again (#​68181).
  • Daily AI-credit accounting is clearer, excludes confirmed unstarted AI jobs, handles transient read failures safely, and no longer locks out after a cancelled re-run (#​68079, #​68056, #​68014).
  • Signed-delivery rebase stays attached for the git push fallback (#​68052).
  • Blocked workflow publication now aligns with configured tool contracts (#​68183).
  • Routed smoke tests: added Claude-main Copilot CLI, pi and SDK smokes, run on routing-related PRs, and scheduled-only for Copilot, SDK, Claude and Pi (#​68096, #​68095, #​68265, #​68237).

Generated by 🚀 Release · copilot · auto · 14.2 AIC · ⊞ 11.7K

What's Changed

Full Changelog: github/gh-aw@v0.91.9...v0.91.10

v0.91.9

Compare Source

🌟 Release Highlights

This release focuses on safer, more diagnosable workflow runs: stronger privacy-preserving failure reporting, tighter credential/network scoping, and improved NVX Copilot and model-routing support.

✨ What's New
  • In-place add-comment status updates: status comments can be replaced rather than appended, reducing noise (#​68013).
  • GitHub Apps can check out PR branches after reviews when allow-listed (#​68012).
  • Unified sessions record more context: skill installation, usage and conflicts, plus caller aw_context (#​68017, #​67910).
  • Claude model-routing smoke test and expanded Copilot routed smoke checks (#​67835, #​67837).
  • Compiler warnings surface in MCP dry-run results (#​67997).
  • NVX Copilot: automatic guest ABI selection, musl guest asset fixes, restricted guest output collection (#​67915, #​67914, #​67842, #​67834).
  • Logs storage bounded to 1 GB, preferring compact metadata artifacts (#​67854).
🔒 Security & Privacy
  • Copilot telemetry now requires opt-in during threat detection (#​67989).
  • Claude transport domains narrowed to least privilege (#​67811).
  • Selected Copilot assignment credentials are identified without exposing secrets (#​68005).
  • Privacy-preserving completion evidence added to failure reports (#​68003, #​68001, #​68000).
🐛 Bug Fixes & Improvements
  • Removed unsupported Copilot web-search; gh aw fix now converges (#​67993).
  • Wait for safe-output gateway tool readiness before agent startup (#​67807); clearer explanations for runs missing terminal safe outputs (#​67809).
  • Skipped threat detection is reported when the detector isn't installed (#​67810).
  • Fixed coverage tool advertisement and optional cache cold starts (#​68004).
  • Structured arguments now passed correctly to shared Go and Make MCP tools (#​67894).
  • Updated default pins for GitHub MCP, Playwright, Syft and Grype (#​67886).
📚 Documentation
  • Model routing docs explain Copilot CLI vs SDK mode, define allowed-models, and include compiling examples (#​67755).
  • Release credential changes now require security sign-off ([#

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (in timezone UTC)

  • Branch creation
    • "on sunday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

@bootc-bot
bootc-bot Bot force-pushed the bootc-renovate/github-actions branch 18 times, most recently from 4874b8c to 214c620 Compare September 13, 2026 23:23
@bootc-bot
bootc-bot Bot force-pushed the bootc-renovate/github-actions branch 3 times, most recently from 20fccf9 to 299de22 Compare September 20, 2026 01:07
@bootc-bot
bootc-bot Bot force-pushed the bootc-renovate/github-actions branch 3 times, most recently from 60981b0 to 7381719 Compare October 4, 2026 00:13
@bootc-bot
bootc-bot Bot force-pushed the bootc-renovate/github-actions branch from 7381719 to 03ff2ec Compare October 11, 2026 01:21
@bootc-bot
chore(deps): update github actions
df02191 
Signed-off-by: bootc-bot[bot] <225049296+bootc-bot[bot]@users.noreply.github.com>
Signed-off-by: bootc-bot[bot] <225049296+bootc-bot[bot]@users.noreply.github.com>
@bootc-bot
bootc-bot Bot force-pushed the bootc-renovate/github-actions branch from 03ff2ec to df02191 Compare October 18, 2026 01:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants