triggerdotdev--trigger.dev

github-featured/triggerdotdev--trigger.dev

Author	SHA1	Message	Date
Chris Arderne	703a6dcb4c	chore(ci): optimise runners, distribute test shards (#4240 ) - Use bigger/smaller runners as recommended by warpbuild - Distribute test shards more evenly, move internal tests single big shard	2026-07-13 15:58:33 +01:00
Matt Aitken	6b0588bef1	chore: vouch brentshulman-silkline (#4216 ) Adds `brentshulman-silkline` to the list of vouched outside contributors so their PRs aren't auto-closed by the vouch check.	2026-07-09 21:02:09 +01:00
claude[bot]	105f48927d	fix(release): populate changelog and server-changes on release/dispatch (#4204 )	2026-07-09 17:46:39 +01:00
Chris Arderne	a3dca98d43	fix: run npm release jobs on ubuntu-latest (#4201 ) 🚀 Publish Trigger.dev Docker / typecheck (push) Failing after 4s Details 🚀 Publish Trigger.dev Docker / scan-webapp (push) Has been skipped Details 🚀 Publish Trigger.dev Docker / publish-webapp (push) Has been skipped Details 🚀 Publish Trigger.dev Docker / publish-worker-v4 (push) Has been skipped Details 🚀 Publish Trigger.dev Docker / units (push) Failing after 20s Details 🧭 Helm Chart Release / lint-and-test (push) Has been cancelled Details 🧭 Helm Chart Release / release (push) Has been cancelled Details 🚀 Publish Trigger.dev Docker / 📣 Dispatch main image (push) Has been cancelled Details Failed trying to run trust npm publish on warp runner: https://github.com/triggerdotdev/trigger.dev/actions/runs/29016820615/job/86113758922	2026-07-09 13:23:39 +00:00
nicktrn	a6bd370e42	chore: remove end-of-life v3 execution components (#4194 ) v3 (engine V1) is end-of-lifed and the v3 clusters are gone, so this removes the dead v3 execution code from the monorepo. It's the first pass of TRI-11824 - the webapp v3 code paths are deliberately left untouched and gated for a follow-up. ## Apps Deletes the three v3-only execution apps and their build wiring: - `apps/coordinator`, `apps/kubernetes-provider`, `apps/docker-provider` - `.github/workflows/publish-worker.yml` - it built only those three; the v4 worker publish is a separate workflow - Their references in `.changeset/config.json`, `.cursorignore`, `CHANGESETS.md`, `CONTRIBUTING.md`, `.server-changes/README.md` - `pnpm-lock.yaml` regenerated to prune the apps and their app-only dependencies (`socket.io`, `@kubernetes/client-node`, `p-queue`, `execa`, `prom-client`, `tinyexec`) ## Core Removes the helpers in `@trigger.dev/core` that only those apps used - `ProviderShell`, `SimpleLogger`, the `Exec`/process helpers, `isExecaChildProcess`, `getTextBody`, and `testDockerCheckpoint`. Each was verified to have no remaining consumers anywhere in the repo. Kept the helpers still used elsewhere: `ExponentialBackoff` (warm-start client), `HttpReply`/`getJsonBody` (serverOnly http server), `SimpleStructuredLogger` (widely used), and `ZodNamespace`/`ZodSocketConnection` (still referenced by legacy v3 webapp code, hence the follow-up pass). The `./v3/apps` and `./v3/serverOnly` export subpaths remain - only dead members were trimmed from their barrels, so no `package.json` exports changed. ## Verification `@trigger.dev/core` builds, and `typecheck` passes for core, supervisor, cli-v3, run-engine, redis-worker, and webapp. refs TRI-11824	2026-07-08 19:47:20 +02:00
Chris Arderne	018f445467	chore: switch runners to warpbuild (#4175 )	2026-07-07 11:24:17 +01:00
Chris Arderne	ef3eadab3c	chore: back to github runners (#4168 )	2026-07-06 16:22:31 +01:00
Daniel Sutton	092b9ef07a	fix(run-ops): DNS-safe, sortable base32hex run id (replace base62 KSUID) (#4154 ) ## Problem The run-ops split mints NEW-store run ids as 27-char base62 KSUIDs. The supervisor writes the run id into the Kubernetes pod name (`runner-<id>`), and pod names must be DNS-1123 labels (lowercase `[a-z0-9-]`) — so uppercase base62 ids make k8s reject the pod (422) and those runs never launch (they loop in `PENDING_EXECUTING` until the heartbeat-stall handler nacks them, forever). `.toLowerCase()` can't fix it: base62 has both `A`(10) and `a`(36) as distinct symbols, so folding collides distinct ids and destroys sort order. ## Fix: change the encoding, not the structure Mint a 26-char lowercase base32hex run id: ``` run_<24-char base32hex core><region char><version char> [ 6-byte ms timestamp ][ 9 CSPRNG bytes ] ``` - base32hex (RFC 4648 §7, alphabet `0-9a-v`): lowercase, order-preserving, DNS-safe; 15 bytes → exactly 24 chars, no padding. Hand-rolled encode/decode (no new dependency). - 48-bit ms timestamp in the leading bytes → plain string sort == creation order at millisecond resolution. - 72 bits CSPRNG entropy; PK unique constraint is the backstop (no retry loop). - region / version are raw positional chars (read via one `charAt` before decoding/routing), version = `"1"`. DNS-safe from birth and hyphen-free, so firekeeper is unchanged — `runner-<id>-attempt-N` → strip `runner-`, cut at first hyphen still recovers the exact id incl. region+version. ## Residency discriminator: length → version char `classifyKind`/`classifyResidency` (`runOpsResidency.ts`) previously distinguished NEW vs LEGACY by id length. That gets ambiguous with a third format. It now discriminates on the version char at a fixed position (`isRunOpsIdBody`: 26 chars, `[25] === "1"`, base32hex alphabet) → NEW; everything else → LEGACY. Total, never throws. The `Residency` (NEW/LEGACY) contract the routing store consumes is unchanged; the `"ksuid"` `ResidencyKind` label is retained only because it's the persisted `runOpsMintKsuid` feature-flag value. ## Scope / verification - Generator + discriminator in `@trigger.dev/core` isomorphic; mint path + all id-shape call sites swept (~40 webapp files); changeset added (`@trigger.dev/core` patch). - Core unit tests (encode/decode round-trip + property, generator shape, ms sort-order incl. intra-second, parse partitioned-vs-legacy, firekeeper round-trip): 24 pass. `@trigger.dev/core` builds; webapp typechecks; format/lint clean. ## Open decisions (flagged, not silently chosen) 1. Backward-compat: existing 27-char base62 KSUID runs now classify LEGACY. On test cloud these are the broken/looping runs that never completed, so this is acceptable — but worth a conscious call before prod. No transitional length-recognition added (keeps the discriminator clean). 2. Storage collation: the sort guarantee is byte-order — if the run-ops id column is `TEXT` with default locale collation it's silently not honored. Confirm whether `COLLATE "C"` / `BYTEA` is needed on the run-ops schema. 3. Region sourcing wiring — see `regionCharForRegion` / `REGION_CODES`. --- ## ⚠️ Required migration — deploy in lockstep This PR renames a persisted feature-flag key/value and an env var. These are not changed by the code alone and must be migrated when this deploys, or affected orgs silently fall back to `cuid` minting (no crash — `defaultValue: "cuid"`): 1. Env var (terraform): `RUN_OPS_MINT_KSUID_ENABLED` → `RUN_OPS_MINT_ENABLED` (carry the value over). 2. DB `organization.featureFlags`: migrate both the key and value together: - key `runOpsMintKsuid` → `runOpsMintKind` - value `"ksuid"` → `"runOpsId"` Until an org's flag row is migrated, its `runOpsMintKind` lookup misses and it mints `cuid` (legacy) — so no NEW-store ids for that org until the data lands. --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-05 10:05:54 +01:00
Chris Arderne	1f4369d092	chore: make AGENTS.md canonical, point CLAUDE.md at it with @AGENTS.md (#4142 ) Tested to confirm that Claude Code picks up the `@AGENTS.md` automatically with no agent turns.	2026-07-03 21:49:55 +01:00
Chris Arderne	2ad39443be	chore: update self-host image release references (#4136 ) ## Summary Stable v4 Docker image builds now also publish `v4` and `latest` tags, giving Docker-based self-hosters a maintained floating tag to use after a stable release. The Kubernetes guide now uses the current Helm chart line and current pinned examples, so new installs and upgrades resolve to the 4.5 chart line instead of the 4.0 line. ## Design The publish workflows add the floating tags only for stable `v4.x.x` image tags. Prerelease and `main` builds keep their existing tags.	2026-07-03 13:38:19 +01:00
Daniel Sutton	84588bd236	feat(run-ops): dedicated run-ops database package + docker service + migration runner (#4113 ) ## What The dedicated run-ops database foundation for the split: a standalone Prisma package plus the infra to run and migrate it. - `internal-packages/run-ops-database` — a new Prisma package (`@internal/run-ops-database`) whose schema mirrors the run-execution tables that will live on the dedicated DB, with its own generated client, migrations, and migration runner. - `prisma/schema.parity.test.ts` — a parity test that guards the run-ops schema against drift from the control-plane schema for the mirrored tables. - Docker — a Postgres 17 service (`docker/Dockerfile.postgres17`, `docker/docker-compose.yml`) so the dedicated DB is available locally under the run-ops compose profile. - Testcontainers — hetero fixtures (PG14 legacy + PG17 dedicated) so later PRs can exercise cross-database behaviour with real containers rather than mocks. ## Why This is the second PR in the run-ops split stack, stacked on the core primitives. It stands up the dedicated database and its tooling. There is no runtime wiring into the webapp here — the app does not read or write this DB yet; that arrives in later PRs. On its own this PR only adds a package, a docker service, and test fixtures. ## Tests Schema-parity test for the run-ops schema; hetero testcontainer fixture smoke test. ## Notes - Draft, stacked on #4112 (`runops/pr01-core-residency`). Review that one first; this diff is against it. - Server-change / changeset note to be added at stack-assembly time. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-03 12:05:20 +01:00
Eric Allam	eecb27c672	fix: deploy the dashboard agent one environment at a time (#4133 ) The dashboard agent deploy runs a matrix leg per environment (staging, prod). Running them in parallel deployed the same Trigger.dev project twice at once, and one leg failed to create the background worker while the other succeeded. `max-parallel: 1` runs the legs sequentially so a deploy never races itself. Also aligns the workflow's Node version to the repo standard (`22.23.1`, per `.nvmrc`). Verified: re-running the staging leg on its own (no parallel prod) deployed cleanly.	2026-07-03 10:57:28 +01:00
Eric Allam	ea9d6f7430	feat(webapp): pin the dashboard agent to a deployed version (#4128 ) ## Summary The dashboard agent runs as a `chat.agent` in its own Trigger.dev project, deployed separately from the app that starts its sessions. This adds independent, non-disruptive deploys for it: a new workflow deploys the agent with `--skip-promotion` (so a deploy never becomes the current version on its own), and the app pins its sessions to a chosen version. ## How it works `DASHBOARD_AGENT_VERSION` (unset by default) pins agent sessions to a specific deployed version; when unset, sessions run on the project environment's current version. The pin is passed on session start and head start and is forwarded to every continuation run, so a pinned session stays on its version for its whole life. Cutting over to a new build becomes a config change (set the version) rather than a redeploy, and rollback is flipping it back. The workflow (`dashboard-agent-deploy.yml`) runs a leg per environment (staging and prod), each gated by its own environment, and triggers on pushes to `main` that touch the agent or its store (also available via manual dispatch). Deploy versions are per-environment, so each environment pins to its own leg's version.	2026-07-03 10:19:38 +01:00
Chris Arderne	448443a024	chore: bump internal node to 22 and standardise (#4084 ) Bumps the internal/toolchain Node version to the latest 22.x LTS (`22.23.1`) and standardises it across the repo. Scope is the platform toolchain + the repo's own runtime images (all `20 → 22` upgrades, off the now-EOL node 20). ### Main changes - Node `20.20.2 → 22.23.1` across all CI workflows, `.nvmrc`, `CONTRIBUTING.md`, and the OSS `docker/Dockerfile` (digest-pinned). - `@types/node → 22.20.0` (root dep + pnpm `overrides`, so the whole workspace resolves to it); lockfile regenerated. - `sdk-compat` matrix: adds Node 24 + 26 (keeps 20, still in `engines`). - App runtime images → node 22 (were on EOL node 20): `apps/coordinator` → `node:22.23.1-bookworm-slim`; `apps/docker-provider` + `apps/kubernetes-provider` → `node:22-alpine` (reusing the exact digest `apps/supervisor` already runs, so all four worker images are now identical). Stage aliases renamed off `node-20`. ### Possible issues / test notes - `@types/node` 22.x can surface new TS errors — typecheck (now on 22) is the gate. - Smoke-test the v3 worker path — `coordinator` (`crictl`/CRI calls) and the docker/kubernetes providers (talking to their daemons) now run on node 22 (alpine/musl for the providers). Upgrade off EOL so low-risk, but it's deployed runtime code with its own `publish-worker.yml` pipeline.	2026-07-02 18:13:36 +01:00
Chris Arderne	cbd1060aeb	chore: move remaining ci to blacksmith (#4108 )	2026-07-02 14:10:53 +01:00
dependabot[bot]	3af1d22521	chore(deps): bump the github-actions group across 1 directory with 7 updates (#4097 ) Bumps the github-actions group with 7 updates in the / directory: \| Package \| From \| To \| \| --- \| --- \| --- \| \| [actions/checkout](https://github.com/actions/checkout) \| `6.0.2` \| `7.0.0` \| \| [changesets/action](https://github.com/changesets/action) \| `1.8.0` \| `1.9.0` \| \| [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) \| `1.0.133` \| `1.0.157` \| \| [actions/cache](https://github.com/actions/cache) \| `5.0.5` \| `6.1.0` \| \| [azure/setup-helm](https://github.com/azure/setup-helm) \| `5.0.0` \| `5.0.1` \| \| [softprops/action-gh-release](https://github.com/softprops/action-gh-release) \| `3.0.0` \| `3.0.1` \| \| [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) \| `0.5.6` \| `0.5.7` \| Updates `actions/checkout` from 6.0.2 to 7.0.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/releases">actions/checkout's releases</a>.</em></p> <blockquote> <h2>v7.0.0</h2> <h2>What's Changed</h2> <ul> <li>block checking out fork pr for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> <li>Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2458">actions/checkout#2458</a></li> <li>Bump flatted from 3.3.1 to 3.4.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2460">actions/checkout#2460</a></li> <li>Bump js-yaml from 4.1.0 to 4.2.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2461">actions/checkout#2461</a></li> <li>Bump <code>@actions/core</code> and <code>@actions/tool-cache</code> and Remove uuid by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2459">actions/checkout#2459</a></li> <li>upgrade module to esm and update dependencies by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2463">actions/checkout#2463</a></li> <li>Bump the minor-npm-dependencies group across 1 directory with 3 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2462">actions/checkout#2462</a></li> <li>getting ready for checkout v7 release by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2464">actions/checkout#2464</a></li> <li>update error wording by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2467">actions/checkout#2467</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6.0.3...v7.0.0">https://github.com/actions/checkout/compare/v6.0.3...v7.0.0</a></p> <h2>v6.0.3</h2> <h2>What's Changed</h2> <ul> <li>Update changelog by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2357">actions/checkout#2357</a></li> <li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> <li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li> <li>Update changelog for v6.0.3 by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2446">actions/checkout#2446</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/yaananth"><code>@yaananth</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6...v6.0.3">https://github.com/actions/checkout/compare/v6...v6.0.3</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2>v7.0.0</h2> <ul> <li>Block checking out fork PR for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> <li>Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2458">actions/checkout#2458</a></li> <li>Bump flatted from 3.3.1 to 3.4.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2460">actions/checkout#2460</a></li> <li>Bump js-yaml from 4.1.0 to 4.2.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2461">actions/checkout#2461</a></li> <li>Bump <code>@actions/core</code> and <code>@actions/tool-cache</code> and Remove uuid by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2459">actions/checkout#2459</a></li> <li>upgrade module to esm and update dependencies by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2463">actions/checkout#2463</a></li> <li>Bump the minor-npm-dependencies group across 1 directory with 3 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2462">actions/checkout#2462</a></li> </ul> <h2>v6.0.3</h2> <ul> <li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li> <li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> </ul> <h2>v6.0.2</h2> <ul> <li>Fix tag handling: preserve annotations and explicit fetch-tags by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li> </ul> <h2>v6.0.1</h2> <ul> <li>Add worktree support for persist-credentials includeIf by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li> </ul> <h2>v6.0.0</h2> <ul> <li>Persist creds to a separate file by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li> <li>Update README to include Node.js 24 support details and requirements by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li> </ul> <h2>v5.0.1</h2> <ul> <li>Port v6 cleanup to v5 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li> </ul> <h2>v5.0.0</h2> <ul> <li>Update actions checkout to use node 24 by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li> </ul> <h2>v4.3.1</h2> <ul> <li>Port v6 cleanup to v4 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li> </ul> <h2>v4.3.0</h2> <ul> <li>docs: update README.md by <a href="https://github.com/motss"><code>@motss</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li> <li>Add internal repos for checking out multiple repositories by <a href="https://github.com/mouismail"><code>@mouismail</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li> <li>Documentation update - add recommended permissions to Readme by <a href="https://github.com/benwells"><code>@benwells</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li> <li>Adjust positioning of user email note and permissions heading by <a href="https://github.com/joshmgross"><code>@joshmgross</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li> <li>Update README.md by <a href="https://github.com/nebuk89"><code>@nebuk89</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li> <li>Update CODEOWNERS for actions by <a href="https://github.com/TingluoHuang"><code>@TingluoHuang</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li> <li>Update package dependencies by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li> </ul> <h2>v4.2.2</h2> <ul> <li><code>url-helper.ts</code> now leverages well-known environment variables by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li> <li>Expand unit test coverage for <code>isGhes</code> by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li> </ul> <h2>v4.2.1</h2> <ul> <li>Check out other refs/* by commit if provided, fall back to ref by <a href="https://github.com/orhantoy"><code>@orhantoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/checkout/commit/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0"><code>9c091bb</code></a> update error wording (<a href="https://redirect.github.com/actions/checkout/issues/2467">#2467</a>)</li> <li><a href="https://github.com/actions/checkout/commit/1044a6dea927916f2c38ba5aeffbc0a847b1221a"><code>1044a6d</code></a> getting ready for checkout v7 release (<a href="https://redirect.github.com/actions/checkout/issues/2464">#2464</a>)</li> <li><a href="https://github.com/actions/checkout/commit/f0282184c7ce73ab54c7e4ab5a617122602e575f"><code>f028218</code></a> Bump the minor-npm-dependencies group across 1 directory with 3 updates (<a href="https://redirect.github.com/actions/checkout/issues/2462">#2462</a>)</li> <li><a href="https://github.com/actions/checkout/commit/d914b262ffc244530a203ab40decab34c3abf34d"><code>d914b26</code></a> upgrade module to esm and update dependencies (<a href="https://redirect.github.com/actions/checkout/issues/2463">#2463</a>)</li> <li><a href="https://github.com/actions/checkout/commit/537c7ef99cef6e5ddb5e7ff5d16d14510503801d"><code>537c7ef</code></a> Bump <code>@actions/core</code> and <code>@actions/tool-cache</code> and Remove uuid (<a href="https://redirect.github.com/actions/checkout/issues/2459">#2459</a>)</li> <li><a href="https://github.com/actions/checkout/commit/130a169078a413d3a5246a393625e8e742f387f6"><code>130a169</code></a> Bump js-yaml from 4.1.0 to 4.2.0 (<a href="https://redirect.github.com/actions/checkout/issues/2461">#2461</a>)</li> <li><a href="https://github.com/actions/checkout/commit/7d09575332117a40b46e5e020664df234cd416f3"><code>7d09575</code></a> Bump flatted from 3.3.1 to 3.4.2 (<a href="https://redirect.github.com/actions/checkout/issues/2460">#2460</a>)</li> <li><a href="https://github.com/actions/checkout/commit/0f9f3aa320cb53abeb534aeb54048075d9697a0e"><code>0f9f3aa</code></a> Bump actions/publish-immutable-action (<a href="https://redirect.github.com/actions/checkout/issues/2458">#2458</a>)</li> <li><a href="https://github.com/actions/checkout/commit/f9e715a95fcd1f9253f77dd28f11e88d2d6460c7"><code>f9e715a</code></a> block checking out fork pr for pull_request_target and workflow_run (<a href="https://redirect.github.com/actions/checkout/issues/2454">#2454</a>)</li> <li><a href="https://github.com/actions/checkout/commit/df4cb1c069e1874edd31b4311f1884172cec0e10"><code>df4cb1c</code></a> Update changelog for v6.0.3 (<a href="https://redirect.github.com/actions/checkout/issues/2446">#2446</a>)</li> <li>Additional commits viewable in <a href="https://github.com/actions/checkout/compare/de0fac2e4500dabe0009e67214ff5f5447ce83dd...9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0">compare view</a></li> </ul> </details> <br /> Updates `changesets/action` from 1.8.0 to 1.9.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/changesets/action/releases">changesets/action's releases</a>.</em></p> <blockquote> <h2>v1.9.0</h2> <h3>Minor Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/changesets/action/pull/636">#636</a> <a href="https://github.com/changesets/action/commit/b072bccc4c664a373c42168eed9139dce1e003b1"><code>b072bcc</code></a> Thanks <a href="https://github.com/bluwy"><code>@bluwy</code></a>! - Add a new <code>@changesets/action/pr-comment</code> sub-action to comment on PRs</p> </li> <li> <p><a href="https://redirect.github.com/changesets/action/pull/625">#625</a> <a href="https://github.com/changesets/action/commit/8795eee5eee884e887d352ac673a515ffe35aaa6"><code>8795eee</code></a> Thanks <a href="https://github.com/bluwy"><code>@bluwy</code></a>! - Add a new <code>@changesets/action/pr-status</code> sub-action to generate the changeset status comment for PRs as an alternative to the <a href="https://github.com/apps/changeset-bot">Changesets Bot</a>.</p> </li> </ul> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/changesets/action/pull/535">#535</a> <a href="https://github.com/changesets/action/commit/34f64f6e2e1e47ddc183f174aa27c197aa47f520"><code>34f64f6</code></a> Thanks <a href="https://github.com/Andarist"><code>@Andarist</code></a>! - Fixed an issue with GitHub releases not being created for successfully published packages when <em>some</em> packages failed to be published to the registry.</p> </li> <li> <p><a href="https://redirect.github.com/changesets/action/pull/632">#632</a> <a href="https://github.com/changesets/action/commit/1d54b9e660e435237accbcae0b4581af3be641b4"><code>1d54b9e</code></a> Thanks <a href="https://github.com/bluwy"><code>@bluwy</code></a>! - Simplify internal implementation to get changelog entries for a package version</p> </li> <li> <p><a href="https://redirect.github.com/changesets/action/pull/629">#629</a> <a href="https://github.com/changesets/action/commit/e0c90aa7fbd0cc26931a679c5abe9bbc0deb0b50"><code>e0c90aa</code></a> Thanks <a href="https://github.com/bluwy"><code>@bluwy</code></a>! - Fix custom version and publish command argument parsing</p> </li> <li> <p><a href="https://redirect.github.com/changesets/action/pull/645">#645</a> <a href="https://github.com/changesets/action/commit/f9585d966a9c7d2f668b97199990de6f885823cf"><code>f9585d9</code></a> Thanks <a href="https://github.com/Andarist"><code>@Andarist</code></a>! - Improved force-push handling when using <code>commitMode: "github-api"</code> so updating an existing branch no longer temporarily resets the target branch to the base commit, avoiding cases where GitHub closes open pull requests during the update. This should remove a possibility of a GitHub state race that caused the force-pushed PRs not being reopened.</p> </li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/changesets/action/blob/main/CHANGELOG.md">changesets/action's changelog</a>.</em></p> <blockquote> <h1><code>@changesets/action</code></h1> <h2>2.0.0-next.3</h2> <h3>Major Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/changesets/action/pull/680">#680</a> <a href="https://github.com/changesets/action/commit/ca57073900dc678254406a052a03c0c8824e319d"><code>ca57073</code></a> Thanks <a href="https://github.com/bluwy"><code>@bluwy</code></a>! - Add a new <code>push-git-tags</code> option that complements <code>create-github-releases</code> to control specifically if git tags should be created but not GitHub releases.</p> <p>If <code>create-github-releases</code> was previously set to <code>false</code>, which also indirectly disabled git tag creation, git tags will now be created instead by default. If this is not desired, set <code>push-git-tags</code> to <code>false</code> explicitly.</p> </li> <li> <p><a href="https://redirect.github.com/changesets/action/pull/681">#681</a> <a href="https://github.com/changesets/action/commit/73591071e61c7f61cf322dd7a6341dc29a8e1d4e"><code>7359107</code></a> Thanks <a href="https://github.com/bluwy"><code>@bluwy</code></a>! - Rename the root action inputs and outputs to better match the sub-actions' conventions.</p> <p>Inputs:</p> <ul> <li><code>version</code> -> <code>version-script</code></li> <li><code>publish</code> -> <code>publish-script</code></li> <li><code>commit</code> -> <code>commit-message</code></li> <li><code>title</code> -> <code>pr-title</code></li> <li><code>branch</code> -> <code>pr-base-branch</code></li> </ul> <p>Outputs:</p> <ul> <li><code>pull-request-number</code> -> <code>pr-number</code></li> </ul> </li> <li> <p><a href="https://redirect.github.com/changesets/action/pull/674">#674</a> <a href="https://github.com/changesets/action/commit/164652bdd60525670d95291addb8c6f92833ac60"><code>164652b</code></a> Thanks <a href="https://github.com/bluwy"><code>@bluwy</code></a>! - Remove support for passing custom GitHub token through the GITHUB_TOKEN environment variable. It should be passed to the <code>github-token</code> input instead.</p> </li> <li> <p><a href="https://redirect.github.com/changesets/action/pull/673">#673</a> <a href="https://github.com/changesets/action/commit/823cf741ca57c5e22652123d3a847dfafcd77ca0"><code>823cf74</code></a> Thanks <a href="https://github.com/bluwy"><code>@bluwy</code></a>! - Update to Changesets v3 packages</p> </li> <li> <p><a href="https://redirect.github.com/changesets/action/pull/668">#668</a> <a href="https://github.com/changesets/action/commit/0eae789230defbc4ad287e9b476aba7e842e34e0"><code>0eae789</code></a> Thanks <a href="https://github.com/bluwy"><code>@bluwy</code></a>! - Rename the input and output names to kebab-case instead of camelCase to match the official GitHub actions pattern</p> </li> </ul> <h3>Minor Changes</h3> <ul> <li><a href="https://redirect.github.com/changesets/action/pull/678">#678</a> <a href="https://github.com/changesets/action/commit/f71ae043ed5deb17952900091e009a60edef9507"><code>f71ae04</code></a> Thanks <a href="https://github.com/Andarist"><code>@Andarist</code></a>! - Published packages detection done through stdout parsing was replaced with one based on the shared output file using <code>CHANGESETS_OUTPUT</code> environment variable. When using custom scripts this environment variable should always be passed down to the Changesets CLI invocations.</li> </ul> <h2>2.0.0-next.2</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/changesets/action/pull/670">#670</a> <a href="https://github.com/changesets/action/commit/5a8b9b721bf683e3bf9bd72ea92a685dc024147b"><code>5a8b9b7</code></a> Thanks <a href="https://github.com/Andarist"><code>@Andarist</code></a>! - Authenticate git CLI pushes with the configured GitHub token using Git extra headers instead of writing to a global <code>.netrc</code> file.</p> </li> <li> <p><a href="https://redirect.github.com/changesets/action/pull/670">#670</a> <a href="https://github.com/changesets/action/commit/5a8b9b721bf683e3bf9bd72ea92a685dc024147b"><code>5a8b9b7</code></a> Thanks <a href="https://github.com/Andarist"><code>@Andarist</code></a>! - Derive the Git server URL from the GitHub Actions context when configuring git CLI authentication to support GitHub Enterprise Server setups.</p> </li> </ul> <h2>2.0.0-next.1</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/changesets/action/pull/663">#663</a> <a href="https://github.com/changesets/action/commit/ccb38113eaaa4a13eb6aabe09520e49cc8519b84"><code>ccb3811</code></a> Thanks <a href="https://github.com/Andarist"><code>@Andarist</code></a>! - Fix the computed publish plan path passed internally to <code>changeset pack</code> by the <code>/pack</code> subaction.</p> </li> <li> <p><a href="https://redirect.github.com/changesets/action/pull/662">#662</a> <a href="https://github.com/changesets/action/commit/5c88881fff1f0d8b055d4a2d3a74a8ce843db6f3"><code>5c88881</code></a> Thanks <a href="https://github.com/Andarist"><code>@Andarist</code></a>! - Fixed usage of <code>--from-publish-plan</code> flag used by the <code>/pack</code> subaction</p> </li> <li> <p><a href="https://redirect.github.com/changesets/action/pull/666">#666</a> <a href="https://github.com/changesets/action/commit/dc29b738b532d9e95f46b9bf493e2e3fdf48a7ed"><code>dc29b73</code></a> Thanks <a href="https://github.com/Andarist"><code>@Andarist</code></a>! - Fix the <code>/version</code> subaction to not crash on missing <code>pr-base-branch</code> input. This input is meant to be optional.</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/changesets/action/commit/a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d"><code>a45c4d5</code></a> v1.9.0</li> <li><a href="https://github.com/changesets/action/commit/b459b1eaa0a3889b4eea8af244304a64da6331ce"><code>b459b1e</code></a> Version Packages (<a href="https://redirect.github.com/changesets/action/issues/637">#637</a>)</li> <li><a href="https://github.com/changesets/action/commit/f9585d966a9c7d2f668b97199990de6f885823cf"><code>f9585d9</code></a> Update <code>@changesets/ghcommit</code> (<a href="https://redirect.github.com/changesets/action/issues/645">#645</a>)</li> <li><a href="https://github.com/changesets/action/commit/020e8cc600a1e7e7b8b843654902f043f32387ea"><code>020e8cc</code></a> Use internal bot for versioning (<a href="https://redirect.github.com/changesets/action/issues/643">#643</a>)</li> <li><a href="https://github.com/changesets/action/commit/b072bccc4c664a373c42168eed9139dce1e003b1"><code>b072bcc</code></a> Add simple PR comment sub-action (<a href="https://redirect.github.com/changesets/action/issues/636">#636</a>)</li> <li><a href="https://github.com/changesets/action/commit/8795eee5eee884e887d352ac673a515ffe35aaa6"><code>8795eee</code></a> Comment changeset status in PRs (<a href="https://redirect.github.com/changesets/action/issues/625">#625</a>)</li> <li><a href="https://github.com/changesets/action/commit/34f64f6e2e1e47ddc183f174aa27c197aa47f520"><code>34f64f6</code></a> Fixed an issue with GitHub releases not being created for successfully publis...</li> <li><a href="https://github.com/changesets/action/commit/1d54b9e660e435237accbcae0b4581af3be641b4"><code>1d54b9e</code></a> Simplify getChangelogEntry (<a href="https://redirect.github.com/changesets/action/issues/632">#632</a>)</li> <li><a href="https://github.com/changesets/action/commit/031358f743b5a6199bd7a39bdc8b469280983df9"><code>031358f</code></a> Update to typescript v6 (<a href="https://redirect.github.com/changesets/action/issues/633">#633</a>)</li> <li><a href="https://github.com/changesets/action/commit/a0c05f7a4b1df776543903d7dca8e39cd787b30a"><code>a0c05f7</code></a> Bump <code>@changesets/changelog-github</code> from 0.5.2 to 0.7.0 (<a href="https://redirect.github.com/changesets/action/issues/620">#620</a>)</li> <li>Additional commits viewable in <a href="https://github.com/changesets/action/compare/63a615b9cd06ba9a3e6d13796c7fbcb080a60a0b...a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d">compare view</a></li> </ul> </details> <br /> Updates `anthropics/claude-code-action` from 1.0.133 to 1.0.157 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/anthropics/claude-code-action/releases">anthropics/claude-code-action's releases</a>.</em></p> <blockquote> <h2>v1.0.157</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.157">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.157</a></p> <h2>v1.0.156</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.156">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.156</a></p> <h2>v1.0.155</h2> <h2>What's Changed</h2> <ul> <li>fix: filter PR reviews and inline review comments to trigger time by <a href="https://github.com/EffortlessSteven"><code>@EffortlessSteven</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1385">anthropics/claude-code-action#1385</a></li> <li>test: cover format-turns content-type fallbacks and system_other handling by <a href="https://github.com/farmer-data"><code>@farmer-data</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1421">anthropics/claude-code-action#1421</a></li> <li>fix: allow @ in branch names (valid per git-check-ref-format) by <a href="https://github.com/bellalMohamed"><code>@bellalMohamed</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1411">anthropics/claude-code-action#1411</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/EffortlessSteven"><code>@EffortlessSteven</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1385">anthropics/claude-code-action#1385</a></li> <li><a href="https://github.com/farmer-data"><code>@farmer-data</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1421">anthropics/claude-code-action#1421</a></li> <li><a href="https://github.com/bellalMohamed"><code>@bellalMohamed</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1411">anthropics/claude-code-action#1411</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.155">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.155</a></p> <h2>v1.0.154</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.154">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.154</a></p> <h2>v1.0.153</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.153">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.153</a></p> <h2>v1.0.152</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.152">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.152</a></p> <h2>v1.0.151</h2> <h2>What's Changed</h2> <ul> <li>fix: skip workflow validation token exchange failures by <a href="https://github.com/Ryanoonan"><code>@Ryanoonan</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1417">anthropics/claude-code-action#1417</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/Ryanoonan"><code>@Ryanoonan</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1417">anthropics/claude-code-action#1417</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.151">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.151</a></p> <h2>v1.0.150</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.150">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.150</a></p> <h2>v1.0.149</h2> <h2>What's Changed</h2> <ul> <li>fix(parse-sdk-options): prevent shell-quote from collapsing unquoted Bash(X:*) rules to bare Bash by <a href="https://github.com/alexglynn"><code>@alexglynn</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1350">anthropics/claude-code-action#1350</a></li> <li>fix(mcp): align allowed-tools parser with SDK option parser by <a href="https://github.com/bymle"><code>@bymle</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1373">anthropics/claude-code-action#1373</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/alexglynn"><code>@alexglynn</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1350">anthropics/claude-code-action#1350</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.149">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.149</a></p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/anthropics/claude-code-action/commit/428971d2ecd6e3a7cb0ee0da2a3a8b33fdb3678d"><code>428971d</code></a> chore: bump Claude Code to 2.1.191 and Agent SDK to 0.3.191</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/74eedf1a1892082d619c3edb66b9402da6520e7f"><code>74eedf1</code></a> chore: bump Claude Code to 2.1.190 and Agent SDK to 0.3.190</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/80b31826338489861333dc17217865dfe8085cdc"><code>80b3182</code></a> chore: bump Claude Code to 2.1.187 and Agent SDK to 0.3.187</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/360be9c8fc5d80cb33661e0ffd33dcef4c7155aa"><code>360be9c</code></a> fix: allow @ in branch names (valid per git-check-ref-format) (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1411">#1411</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/e452eb9dce5f3ab14b90cf9386247fbcb3c4ac92"><code>e452eb9</code></a> test: cover format-turns content-type fallbacks and system_other handling (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1">#1</a>...</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/6b8063043eb8bc14e8448185a12d6d9dcf07ce55"><code>6b80630</code></a> fix: filter PR reviews and inline review comments to trigger time (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1385">#1385</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/30544b674398ee15c84819bd87caf8a87e8c7b55"><code>30544b6</code></a> chore: bump Claude Code to 2.1.186 and Agent SDK to 0.3.186</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/2fee15510437d71399d9139ed60433470484a8fb"><code>2fee155</code></a> chore: bump Claude Code to 2.1.185 and Agent SDK to 0.3.185</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/51705da45eecce209d4700538bf8377d5b5fc695"><code>51705da</code></a> chore: bump Claude Code to 2.1.183 and Agent SDK to 0.3.183</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/806af32823ef69c8ef357086c573a902af641307"><code>806af32</code></a> chore: bump Claude Code to 2.1.181 and Agent SDK to 0.3.181</li> <li>Additional commits viewable in <a href="https://github.com/anthropics/claude-code-action/compare/787c5a0ce96a9a6cfb050ea0c8f4c05f2447c251...428971d2ecd6e3a7cb0ee0da2a3a8b33fdb3678d">compare view</a></li> </ul> </details> <br /> Updates `actions/cache` from 5.0.5 to 6.1.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/cache/releases">actions/cache's releases</a>.</em></p> <blockquote> <h2>v6.1.0</h2> <h2>What's Changed</h2> <ul> <li>Bump <code>@actions/cache</code> to v6.1.0 - handle read-only cache access by <a href="https://github.com/jasongin"><code>@jasongin</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1768">actions/cache#1768</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v6...v6.1.0">https://github.com/actions/cache/compare/v6...v6.1.0</a></p> <h2>v6.0.0</h2> <h2>What's Changed</h2> <ul> <li>Update packages, migrate to ESM by <a href="https://github.com/Samirat"><code>@Samirat</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1760">actions/cache#1760</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v5...v6.0.0">https://github.com/actions/cache/compare/v5...v6.0.0</a></p> <h2>v5.1.0</h2> <h2>What's Changed</h2> <ul> <li>Bump <code>@actions/cache</code> to v5.1.0 - handle read-only cache access by <a href="https://github.com/jasongin"><code>@jasongin</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1775">actions/cache#1775</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v5...v5.1.0">https://github.com/actions/cache/compare/v5...v5.1.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/cache/blob/main/RELEASES.md">actions/cache's changelog</a>.</em></p> <blockquote> <h1>Releases</h1> <h2>How to prepare a release</h2> <blockquote> <p>[!NOTE] Relevant for maintainers with write access only.</p> </blockquote> <ol> <li>Switch to a new branch from <code>main</code>.</li> <li>Run <code>npm test</code> to ensure all tests are passing.</li> <li>Update the version in <a href="https://github.com/actions/cache/blob/main/package.json"><code>https://github.com/actions/cache/blob/main/package.json</code></a>.</li> <li>Run <code>npm run build</code> to update the compiled files.</li> <li>Update this <a href="https://github.com/actions/cache/blob/main/RELEASES.md"><code>https://github.com/actions/cache/blob/main/RELEASES.md</code></a> with the new version and changes in the <code>## Changelog</code> section.</li> <li>Run <code>licensed cache</code> to update the license report.</li> <li>Run <code>licensed status</code> and resolve any warnings by updating the <a href="https://github.com/actions/cache/blob/main/.licensed.yml"><code>https://github.com/actions/cache/blob/main/.licensed.yml</code></a> file with the exceptions.</li> <li>Commit your changes and push your branch upstream.</li> <li>Open a pull request against <code>main</code> and get it reviewed and merged.</li> <li>Draft a new release <a href="https://github.com/actions/cache/releases">https://github.com/actions/cache/releases</a> use the same version number used in <code>package.json</code> <ol> <li>Create a new tag with the version number.</li> <li>Auto generate release notes and update them to match the changes you made in <code>RELEASES.md</code>.</li> <li>Toggle the set as the latest release option.</li> <li>Publish the release.</li> </ol> </li> <li>Navigate to <a href="https://github.com/actions/cache/actions/workflows/release-new-action-version.yml">https://github.com/actions/cache/actions/workflows/release-new-action-version.yml</a> <ol> <li>There should be a workflow run queued with the same version number.</li> <li>Approve the run to publish the new version and update the major tags for this action.</li> </ol> </li> </ol> <h2>Changelog</h2> <h3>6.1.0</h3> <ul> <li>Bump <code>@actions/cache</code> to v6.1.0 to pick up <a href="https://redirect.github.com/actions/toolkit/pull/2435">actions/toolkit#2435 Handle cache write error due to read-only token</a></li> <li>Switch redundant "Cache save failed" warning to debug log in save-only</li> </ul> <h3>6.0.0</h3> <ul> <li>Updated <code>@actions/cache</code> to ^6.0.1, <code>@actions/core</code> to ^3.0.1, <code>@actions/exec</code> to ^3.0.0, <code>@actions/io</code> to ^3.0.2</li> <li>Migrated to ESM module system</li> <li>Upgraded Jest to v30 and test infrastructure to be ESM compatible</li> </ul> <h3>5.0.4</h3> <ul> <li>Bump <code>minimatch</code> to v3.1.5 (fixes ReDoS via globstar patterns)</li> <li>Bump <code>undici</code> to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)</li> <li>Bump <code>fast-xml-parser</code> to v5.5.6</li> </ul> <h3>5.0.3</h3> <ul> <li>Bump <code>@actions/cache</code> to v5.0.5 (Resolves: <a href="https://github.com/actions/cache/security/dependabot/33">https://github.com/actions/cache/security/dependabot/33</a>)</li> <li>Bump <code>@actions/core</code> to v2.0.3</li> </ul> <h3>5.0.2</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/cache/commit/55cc8345863c7cc4c66a329aec7e433d2d1c52a9"><code>55cc834</code></a> Merge pull request <a href="https://redirect.github.com/actions/cache/issues/1768">#1768</a> from jasongin/readonly-cache</li> <li><a href="https://github.com/actions/cache/commit/d8cd72f230726cdf4457ebb61ec1b593a8d12337"><code>d8cd72f</code></a> Bump <code>@actions/cache</code> to v6.1.0 - handle cache write error due to RO token</li> <li><a href="https://github.com/actions/cache/commit/2c8a9bd7457de244a408f35966fab2fb45fda9c8"><code>2c8a9bd</code></a> Merge pull request <a href="https://redirect.github.com/actions/cache/issues/1760">#1760</a> from actions/samirat/esm_migration_and_package_update</li> <li><a href="https://github.com/actions/cache/commit/e9b91fdc3fea7d79165fceb79042ef45c2d51023"><code>e9b91fd</code></a> Prettier fixes</li> <li><a href="https://github.com/actions/cache/commit/e4884b8ff7f92ef6b52c79eda480bbc86e685adb"><code>e4884b8</code></a> Rebuild dist</li> <li><a href="https://github.com/actions/cache/commit/10baf0191a3c426ea0fa4a3253a5c04233b6e18f"><code>10baf01</code></a> Fixed licenses</li> <li><a href="https://github.com/actions/cache/commit/e39b386c9004d72a15d864ade8c0b3a702d47a37"><code>e39b386</code></a> Fix test mock return order</li> <li><a href="https://github.com/actions/cache/commit/b6928203372a8571ff984c0c883ef3a1adfb0c06"><code>b692820</code></a> PR feedback</li> <li><a href="https://github.com/actions/cache/commit/60749128a44d25d3c520a489e576380cf00ff3f1"><code>6074912</code></a> Rebuild dist bundles as ESM to match type:module</li> <li><a href="https://github.com/actions/cache/commit/5a912e8b4af820fa082a0e75cfd2c782f8fbfe0e"><code>5a912e8</code></a> Fix lint and jest issues</li> <li>Additional commits viewable in <a href="https://github.com/actions/cache/compare/27d5ce7f107fe9357f9df03efb73ab90386fccae...55cc8345863c7cc4c66a329aec7e433d2d1c52a9">compare view</a></li> </ul> </details> <br /> Updates `azure/setup-helm` from 5.0.0 to 5.0.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/azure/setup-helm/releases">azure/setup-helm's releases</a>.</em></p> <blockquote> <h2>v5.0.1</h2> <h3>Fixed</h3> <ul> <li><a href="https://redirect.github.com/azure/setup-helm/issues/271">#271</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/271">Fix TypeScript 6.0 compatibility errors in run.ts</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/278">#278</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/278">fix: use chmod 755 instead of 777 for downloaded helm binary and folder</a></li> </ul> <h3>Changed</h3> <ul> <li><a href="https://redirect.github.com/azure/setup-helm/issues/286">#286</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/286">Bump actions/checkout from 6.0.3 to 7.0.0 in /.github/workflows in the actions group</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/285">#285</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/285">Bump the actions group with 2 updates</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/284">#284</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/284">Bump undici</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/283">#283</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/283">Bump the actions group with 5 updates</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/280">#280</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/280">Bump actions/checkout from 6.0.2 to 6.0.3 in /.github/workflows in the actions group</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/279">#279</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/279">Bump the actions group with 2 updates</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/277">#277</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/277">Bump vitest from 4.1.7 to 4.1.8 in the actions group</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/276">#276</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/276">chore: remove deprecated OliverMKing release workflow, pin to SHA</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/275">#275</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/275">Bump actions/stale from 10.2.0 to 10.3.0 in /.github/workflows in the actions group</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/274">#274</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/274">Bump the actions group with 3 updates</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/273">#273</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/273">Bump the actions group with 2 updates</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/269">#269</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/269">Bump the actions group across 1 directory with 7 updates</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/268">#268</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/268">Bump vite from 8.0.0 to 8.0.5</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/260">#260</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/260">Migrate to ESM with esbuild/vitest and upgrade to node24 (v5.0.0)</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/Azure/setup-helm/blob/main/CHANGELOG.md">azure/setup-helm's changelog</a>.</em></p> <blockquote> <h1>Change Log</h1> <h2>[5.0.1] - 2026-06-23</h2> <h3>Fixed</h3> <ul> <li><a href="https://redirect.github.com/azure/setup-helm/issues/271">#271</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/271">Fix TypeScript 6.0 compatibility errors in run.ts</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/278">#278</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/278">fix: use chmod 755 instead of 777 for downloaded helm binary and folder</a></li> </ul> <h3>Changed</h3> <ul> <li><a href="https://redirect.github.com/azure/setup-helm/issues/286">#286</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/286">Bump actions/checkout from 6.0.3 to 7.0.0 in /.github/workflows in the actions group</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/285">#285</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/285">Bump the actions group with 2 updates</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/284">#284</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/284">Bump undici</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/283">#283</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/283">Bump the actions group with 5 updates</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/280">#280</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/280">Bump actions/checkout from 6.0.2 to 6.0.3 in /.github/workflows in the actions group</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/279">#279</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/279">Bump the actions group with 2 updates</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/277">#277</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/277">Bump vitest from 4.1.7 to 4.1.8 in the actions group</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/276">#276</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/276">chore: remove deprecated OliverMKing release workflow, pin to SHA</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/275">#275</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/275">Bump actions/stale from 10.2.0 to 10.3.0 in /.github/workflows in the actions group</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/274">#274</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/274">Bump the actions group with 3 updates</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/273">#273</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/273">Bump the actions group with 2 updates</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/269">#269</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/269">Bump the actions group across 1 directory with 7 updates</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/268">#268</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/268">Bump vite from 8.0.0 to 8.0.5</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/260">#260</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/260">Migrate to ESM with esbuild/vitest and upgrade to node24 (v5.0.0)</a></li> </ul> <h2>[5.0.0] - 2026-03-23</h2> <h3>Changed</h3> <ul> <li><a href="https://redirect.github.com/azure/setup-helm/issues/259">#259</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/259">Update Node.js runtime from node20 to node24</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/263">#263</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/263">Bump undici</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/257">#257</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/257">Bump undici and @actions/http-client</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/256">#256</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/256">Bump minimatch</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/248">#248</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/248">Bump the actions group with 2 updates</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/247">#247</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/247">Bump the actions group with 3 updates</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/246">#246</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/246">Bump @types/node from 25.0.2 to 25.0.3 in the actions group</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/245">#245</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/245">Bump the actions group with 3 updates</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/243">#243</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/243">Bump the actions group with 2 updates</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/240">#240</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/240">Bump prettier from 3.6.2 to 3.7.3 in the actions group</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/229">#229</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/229">Bump the actions group across 1 directory with 3 updates</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/231">#231</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/231">Bump js-yaml from 3.14.1 to 3.14.2</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/234">#234</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/234">Bump glob from 10.4.5 to 10.5.0</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/225">#225</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/225">Fix build error</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/222">#222</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/222">Bump @types/node from 24.7.2 to 24.8.1 in the actions group</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/220">#220</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/220">Bump the actions group across 1 directory with 4 updates</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/216">#216</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/216">Bump the actions group across 1 directory with 4 updates</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/213">#213</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/213">Bump the actions group with 2 updates</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/211">#211</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/211">Bump undici</a></li> <li><a href="https://redirect.github.com/azure/setup-helm/issues/212">#212</a> <a href="https://redirect.github.com/Azure/setup-helm/pull/212">Bump jest from 30.0.5 to 30.1.2 in the actions group</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/Azure/setup-helm/commit/9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310"><code>9bc31f4</code></a> build</li> <li><a href="https://github.com/Azure/setup-helm/commit/95ecf4967d92f8074e91c548e394f8ac547da403"><code>95ecf49</code></a> Bump version to 5.0.1 and update CHANGELOG with recent changes (<a href="https://redirect.github.com/azure/setup-helm/issues/287">#287</a>)</li> <li><a href="https://github.com/Azure/setup-helm/commit/4180b1c05c03707c071b0c4ffb32f7ccf49b71bd"><code>4180b1c</code></a> Bump the actions group with 2 updates (<a href="https://redirect.github.com/azure/setup-helm/issues/285">#285</a>)</li> <li><a href="https://github.com/Azure/setup-helm/commit/6949b7ff3ed0c7f9b29dc9eafb275834aacc7802"><code>6949b7f</code></a> Bump undici (<a href="https://redirect.github.com/azure/setup-helm/issues/284">#284</a>)</li> <li><a href="https://github.com/Azure/setup-helm/commit/51ce767c788f32a9d2a8b911f38e9033afd42959"><code>51ce767</code></a> Bump actions/checkout in /.github/workflows in the actions group (<a href="https://redirect.github.com/azure/setup-helm/issues/286">#286</a>)</li> <li><a href="https://github.com/Azure/setup-helm/commit/d6da4f47af55af3a717c150920167917cdd944b3"><code>d6da4f4</code></a> Bump the actions group with 5 updates (<a href="https://redirect.github.com/azure/setup-helm/issues/283">#283</a>)</li> <li><a href="https://github.com/Azure/setup-helm/commit/7e2bc108ba1a7390c1467373bceaa033d6bb74e8"><code>7e2bc10</code></a> Bump actions/checkout in /.github/workflows in the actions group (<a href="https://redirect.github.com/azure/setup-helm/issues/280">#280</a>)</li> <li><a href="https://github.com/Azure/setup-helm/commit/64d6be9869229723b9bbc197a01e7d2e3c81895c"><code>64d6be9</code></a> Bump the actions group with 2 updates (<a href="https://redirect.github.com/azure/setup-helm/issues/279">#279</a>)</li> <li><a href="https://github.com/Azure/setup-helm/commit/69214f9d74fea2fd41b0d5ca2f5222dd5ba34fd4"><code>69214f9</code></a> fix: use chmod 755 instead of 777 for downloaded helm binary and folder (<a href="https://redirect.github.com/azure/setup-helm/issues/278">#278</a>)</li> <li><a href="https://github.com/Azure/setup-helm/commit/9dad99fe3c3d2198a1403a6aab02375f0f27dd09"><code>9dad99f</code></a> Bump vitest from 4.1.7 to 4.1.8 in the actions group (<a href="https://redirect.github.com/azure/setup-helm/issues/277">#277</a>)</li> <li>Additional commits viewable in <a href="https://github.com/azure/setup-helm/compare/dda3372f752e03dde6b3237bc9431cdc2f7a02a2...9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310">compare view</a></li> </ul> </details> <br /> Updates `softprops/action-gh-release` from 3.0.0 to 3.0.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/softprops/action-gh-release/releases">softprops/action-gh-release's releases</a>.</em></p> <blockquote> <h2>v3.0.1</h2> <h2>3.0.1</h2> <ul> <li>maintenance release with updated dependencies</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md">softprops/action-gh-release's changelog</a>.</em></p> <blockquote> <h2>3.0.1</h2> <ul> <li>maintenance release with updated dependencies</li> </ul> <h2>3.0.0</h2> <p><code>3.0.0</code> is a major release that moves the action runtime from Node 20 to Node 24. Use <code>v3</code> on GitHub-hosted runners and self-hosted fleets that already support the Node 24 Actions runtime. If you still need the last Node 20-compatible line, stay on <code>v2.6.2</code>.</p> <h2>What's Changed</h2> <h3>Other Changes 🔄</h3> <ul> <li>Move the action runtime and bundle target to Node 24</li> <li>Update <code>@types/node</code> to the Node 24 line and allow future Dependabot updates</li> <li>Keep the floating major tag on <code>v3</code>; <code>v2</code> remains pinned to the latest <code>2.x</code> release</li> </ul> <h2>2.6.2</h2> <h2>What's Changed</h2> <h3>Other Changes 🔄</h3> <ul> <li>chore(deps): bump picomatch from 4.0.3 to 4.0.4 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/softprops/action-gh-release/pull/775">softprops/action-gh-release#775</a></li> <li>chore(deps): bump brace-expansion from 5.0.4 to 5.0.5 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/softprops/action-gh-release/pull/777">softprops/action-gh-release#777</a></li> <li>chore(deps): bump vite from 8.0.0 to 8.0.5 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/softprops/action-gh-release/pull/781">softprops/action-gh-release#781</a></li> </ul> <h2>2.6.1</h2> <p><code>2.6.1</code> is a patch release focused on restoring linked discussion thread creation when <code>discussion_category_name</code> is set. It fixes <code>[#764](https://github.com/softprops/action-gh-release/issues/764)</code>, where the draft-first publish flow stopped carrying the discussion category through the final publish step.</p> <p>If you still hit an issue after upgrading, please open a report with the bug template and include a minimal repro or sanitized workflow snippet where possible.</p> <h2>What's Changed</h2> <h3>Bug fixes 🐛</h3> <ul> <li>fix: preserve discussion category on publish by <a href="https://github.com/chenrui333"><code>@chenrui333</code></a> in <a href="https://redirect.github.com/softprops/action-gh-release/pull/765">softprops/action-gh-release#765</a></li> </ul> <h2>2.6.0</h2> <p><code>2.6.0</code> is a minor release centered on <code>previous_tag</code> support for <code>generate_release_notes</code>, which lets workflows pin GitHub's comparison base explicitly instead of relying on the default range. It also includes the recent concurrent asset upload recovery fix, a <code>working_directory</code> docs sync, a checked-bundle freshness guard for maintainers, and clearer immutable-prerelease guidance where GitHub platform behavior imposes constraints on how prerelease asset uploads can be published.</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/softprops/action-gh-release/commit/718ea10b132b3b2eba29c1007bb80653f286566b"><code>718ea10</code></a> release 3.0.1</li> <li><a href="https://github.com/softprops/action-gh-release/commit/f1a938b9d84ca9b770d0d8dfeb3e7285fe261e63"><code>f1a938b</code></a> chore(deps): bump esbuild from 0.28.0 to 0.28.1 (<a href="https://redirect.github.com/softprops/action-gh-release/issues/802">#802</a>)</li> <li><a href="https://github.com/softprops/action-gh-release/commit/0066ead0de7252b4876b36b5357fc3974619d36a"><code>0066ead</code></a> chore(deps): bump vite from 8.0.14 to 8.0.16 (<a href="https://redirect.github.com/softprops/action-gh-release/issues/806">#806</a>)</li> <li><a href="https://github.com/softprops/action-gh-release/commit/dc643cac6252aaa00c9b0b6c940d489cd7bf6b23"><code>dc643ca</code></a> chore(deps): bump the npm group with 3 updates (<a href="https://redirect.github.com/softprops/action-gh-release/issues/805">#805</a>)</li> <li><a href="https://github.com/softprops/action-gh-release/commit/85ee99b6b20742a3823a8a289ee5e6ceab44e8aa"><code>85ee99b</code></a> chore(deps): bump actions/checkout in the github-actions group (<a href="https://redirect.github.com/softprops/action-gh-release/issues/804">#804</a>)</li> <li><a href="https://github.com/softprops/action-gh-release/commit/9ed3cf9a6863b31f005d951c8d19de20628cf4eb"><code>9ed3cf9</code></a> chore(deps): bump the npm group with 2 updates (<a href="https://redirect.github.com/softprops/action-gh-release/issues/800">#800</a>)</li> <li><a href="https://github.com/softprops/action-gh-release/commit/3efcac8951299998593f871640ea8059d6818655"><code>3efcac8</code></a> chore(deps): bump the npm group with 3 updates (<a href="https://redirect.github.com/softprops/action-gh-release/issues/798">#798</a>)</li> <li><a href="https://github.com/softprops/action-gh-release/commit/05d6b9164aa74958de40b0179d6a773112fcdc7f"><code>05d6b91</code></a> chore(deps): bump brace-expansion from 5.0.5 to 5.0.6 (<a href="https://redirect.github.com/softprops/action-gh-release/issues/797">#797</a>)</li> <li><a href="https://github.com/softprops/action-gh-release/commit/403a5240f3837fa857f642062e05aad6bb3391ca"><code>403a524</code></a> chore(deps): bump <code>@types/node</code> from 24.12.2 to 24.12.3 in the npm group (<a href="https://redirect.github.com/softprops/action-gh-release/issues/796">#796</a>)</li> <li><a href="https://github.com/softprops/action-gh-release/commit/437e073e786973c6b6af97d9e445c41ae43b1d29"><code>437e073</code></a> chore(deps): bump the npm group with 4 updates (<a href="https://redirect.github.com/softprops/action-gh-release/issues/792">#792</a>)</li> <li>Additional commits viewable in <a href="https://github.com/softprops/action-gh-release/compare/b4309332981a82ec1c5618f44dd2e27cc8bfbfda...718ea10b132b3b2eba29c1007bb80653f286566b">compare view</a></li> </ul> </details> <br /> Updates `zizmorcore/zizmor-action` from 0.5.6 to 0.5.7 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/zizmorcore/zizmor-action/releases">zizmorcore/zizmor-action's releases</a>.</em></p> <blockquote> <h2>v0.5.7</h2> <p>1.26.1 is now available via the action 1.26.1 is now the default version of zizmor used by the action</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/zizmorcore/zizmor-action/commit/192e21d79ab29983730a13d1382995c2307fbcaa"><code>192e21d</code></a> Sync zizmor versions (<a href="https://redirect.github.com/zizmorcore/zizmor-action/issues/127">#127</a>)</li> <li><a href="https://github.com/zizmorcore/zizmor-action/commit/2720f2673c0b64a8656d08b009ac239b9383c0ae"><code>2720f26</code></a> Update README.md with new actions/checkout version (<a href="https://redirect.github.com/zizmorcore/zizmor-action/issues/126">#126</a>)</li> <li><a href="https://github.com/zizmorcore/zizmor-action/commit/40b41b824eab0ad9c19ddf9856be25550729e6d8"><code>40b41b8</code></a> chore(deps): bump the github-actions group with 2 updates (<a href="https://redirect.github.com/zizmorcore/zizmor-action/issues/123">#123</a>)</li> <li><a href="https://github.com/zizmorcore/zizmor-action/commit/a687b25bf3aa149153e80ed5f45292e47589888c"><code>a687b25</code></a> chore(deps): bump github/codeql-action from 4.35.5 to 4.36.0 in the github-ac...</li> <li><a href="https://github.com/zizmorcore/zizmor-action/commit/64a6900ea7f40fab0caa7dcfc77b392d28fe0cb1"><code>64a6900</code></a> add note to explain that the default value for <code>online-checks</code> is different t...</li> <li><a href="https://github.com/zizmorcore/zizmor-action/commit/14050abd109fcba34e6e2f31a723280997808e82"><code>14050ab</code></a> chore(deps): bump the github-actions group with 2 updates (<a href="https://redirect.github.com/zizmorcore/zizmor-action/issues/118">#118</a>)</li> <li><a href="https://github.com/zizmorcore/zizmor-action/commit/ee9b4194a74f093e38908dbcfcb078f63eeef002"><code>ee9b419</code></a> chore(deps): bump github/codeql-action in the github-actions group (<a href="https://redirect.github.com/zizmorcore/zizmor-action/issues/116">#116</a>)</li> <li><a href="https://github.com/zizmorcore/zizmor-action/commit/fddf2b4aa9bf29290c6bf9866e6d113b0cdf6f67"><code>fddf2b4</code></a> Bump pins in README (<a href="https://redirect.github.com/zizmorcore/zizmor-action/issues/115">#115</a>)</li> <li>See full diff in <a href="https://github.com/zizmorcore/zizmor-action/compare/5f14fd08f7cf1cb1609c1e344975f152c7ee938d...192e21d79ab29983730a13d1382995c2307fbcaa">compare view</a></li> </ul> </details> <br /> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: nicktrn <55853254+nicktrn@users.noreply.github.com>	2026-07-01 18:46:54 +00:00
Chris Arderne	a5ef4778aa	chore: re-activate blacksmith ci runners (#4093 ) This reverts commit `d5ea3dd3b7`.	2026-07-01 12:15:17 +01:00
Chris Arderne	d5ea3dd3b7	chore: revert to github ci runners (#4091 ) Having issues with blacksmith runners coming online.	2026-06-30 17:57:16 +01:00
Chris Arderne	4ef8baa971	chore: switch build jobs to blacksmith (#4075 )	2026-06-29 18:10:48 +01:00
Chris Arderne	243d52bfd7	chore: add testbox workflows and scripts (#4071 ) Needed to trigger Blacksmith Testbox workflows.	2026-06-29 15:08:04 +01:00
Chris Arderne	ef9a04c39b	chore: switch some CI checks to blacksmith (#4068 )	2026-06-29 12:52:52 +01:00
Chris Arderne	b54201f986	chore: switch to oxfmt, oxlint - add ci checks (#3977 )	2026-06-26 12:19:29 +01:00
Eric Allam	c6f0769299	fix(webapp): bound logs search memory and fix pagination at scale (#4012 ) ## Summary The logs search page (behind a feature flag) ran ClickHouse out of memory when browsing back over long time ranges. This keeps it within bounded memory and fixes a pagination bug that could skip or duplicate rows at a page boundary. ## Fix Memory: the list query reads in sort-key order, which opens one read stream per part in the window, and on object storage those per-part read buffers dominate peak memory, so it scaled with the number of parts scanned. Two changes bound it: - The logs ClickHouse client caps the per-part read buffers via new env-tunable settings. The object-storage-only setting is opt-in, so it is never sent to a ClickHouse version that lacks it. - Recent-first window narrowing: rows come back newest first, so the presenter probes the most recent window and only widens toward the full requested range when a page is short. A busy environment fills a page from a few recent parts instead of scanning the whole range; a quiet one still returns every row in a couple of cheap reads. Correctness: the keyset cursor ordered on (triggered_timestamp, trace_id), which is not unique because the spans of a trace share both, so rows at a tie could be skipped or duplicated across pages. The cursor and ORDER BY now include span_id, and the cursor is versioned so stale cursors reset to the first page. Guards: the effective page size is capped, and the existing per-query memory limit lets a pathological wide browse fail with an error instead of taking the node down. ## ClickHouse 26.2 The memory fix relies on lazy materialization deferring the wide attributes column to the output rows, which only holds on 26.x. Cloud already runs 26.2, so this moves the dev stack, testcontainers, and CI to match. The ClickHouse test suite passes on 26.2. 🤖 Generated with [Claude Code](https://claude.com/claude-code)	2026-06-22 13:48:27 +01:00
Daniel Sutton	135c7e9f7b	ci: raise CLAUDE.md audit turn limit and pin Opus 4.8 (#3999 ) ## Summary The CLAUDE.md audit job (`.github/workflows/claude-md-audit.yml`) frequently hits its 15-turn cap before it finishes reviewing a PR, so the job fails without posting a verdict. For example, the audit job failed on [this run](https://github.com/triggerdotdev/trigger.dev/actions/runs/27837408945/job/82390460772?pr=3990). This raises `--max-turns` from 15 to 25 to give the review room to complete, and pins `--model claude-opus-4-8` (the job previously inherited the action default model).	2026-06-19 21:27:47 +01:00
Eric Allam	2936382e3e	ci: add docs-release-* tag workflow to publish docs at release (#3969 ) ## Summary Docs deploy from the `docs-live` branch via Mintlify, so merging to `main` no longer publishes docs on its own. To publish, push a `docs-release-*` tag at the commit you want live. The workflow runs the Mintlify broken-links check against that commit, then fast-forwards `docs-live` to it, which is what Mintlify deploys from. ## Design The ref move uses the GitHub API with `force=false`, making it fast-forward only: a tag that is not ahead of `docs-live` fails the job rather than rewinding production. Mintlify's GitHub app reacts to the resulting push and deploys, so no extra deploy credentials are needed. Usage: ```bash git tag docs-release-2026.06.16 # tag the main commit you want live git push origin docs-release-2026.06.16 ```	2026-06-16 15:33:49 +01:00
Daniel Sutton	1cf56e5d29	ci: gate optional publish/notify jobs behind repository variables (#3950 ) ## Summary Several optional workflow jobs fail on forks and private mirrors that lack org-specific secrets or registry permissions. This adds per-job repository-variable gates so those deployments can switch them off without editing workflows — matching the pattern from #3901 (`ENABLE_CLAUDE_CODE` / `ENABLE_WORKFLOW_SECURITY_SCAN`). Two variables, both default-enabled (a job runs unless its variable is explicitly `'false'`), so canonical-repo behaviour is unchanged where the variables are unset: `ENABLE_HELM_PRERELEASE` — gates the chart-publish jobs that push to `oci://ghcr.io/<owner>/charts` (needs `write_package` on the owner's charts namespace): - `helm-prerelease.yml` → `prerelease` job - `release-helm.yml` → `release` job Without the permission these fail with `403: denied: permission_denied: write_package` on every PR / `helm-v` tag. The `lint-and-test` jobs (lint + template + kubeconform, no push) always run, so chart validity is still enforced everywhere. `ENABLE_DEPENDABOT_ALERTS`* — gates the Dependabot notifier crons that need `DEPENDABOT_ALERTS_TOKEN` / `SLACK_BOT_TOKEN` and post to a specific Slack: - `dependabot-critical-alerts.yml` → `alert` job (daily cron) - `dependabot-weekly-summary.yml` → `summary` job (weekly cron) On a fork/mirror these otherwise fire on schedule and fail (or post nowhere) indefinitely. ## Test plan - Variables unset (default): all jobs run as today. - `ENABLE_HELM_PRERELEASE=false`: helm `lint-and-test` runs, publish jobs skip — no 403 on repos lacking `write_package`. - `ENABLE_DEPENDABOT_ALERTS=false`: the two cron jobs skip cleanly (neutral, not failed). 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-15 12:41:16 +01:00
Daniel Sutton	f073d8708a	ci: gate optional Claude and security-scan jobs behind repository variables (#3901 ) ## Summary Add per-job `if:` gates so deployments that don't want — or can't run — these jobs can switch them off via repository variables, without editing workflows. - `ENABLE_CLAUDE_CODE` gates the Claude jobs: interactive `@claude`, the CLAUDE.md audit, and the REVIEW.md drift audit. - `ENABLE_WORKFLOW_SECURITY_SCAN` gates the Zizmor job, which uploads SARIF and so needs GitHub code scanning enabled. Both default to enabled: a job runs unless its variable is explicitly set to `'false'`, so behaviour is unchanged anywhere the variables are unset. The sibling `actionlint` job and the report-only Trivy scan are untouched. ## Test plan - [x] `actionlint` clean on the four edited workflows - [x] YAML parses for all four files	2026-06-15 11:49:51 +01:00
Eric Allam	78b7136bf7	chore: vouch saasjesus as a contributor (#3917 ) Vouches `saasjesus` as a contributor (vouch request #3915) so their PRs clear the vouch check instead of being auto-closed.	2026-06-12 11:56:45 +01:00
Daniel Sutton	459dce2a97	ci: make the main-image dispatch repo and ref configurable (#3883 ) The `dispatch-main-image` job was hard-gated to `triggerdotdev/trigger.dev` on the `main` ref. This makes it configurable via repository variables, all defaulting to the current values: - `MAIN_IMAGE_DISPATCH_REPO` — the repo allowed to dispatch (default `triggerdotdev/trigger.dev`). - `MAIN_IMAGE_DISPATCH_REF_PREFIX` — the ref-name prefix that dispatches, matched with `startsWith(github.ref_name, …)` (default `main`). - `MAIN_IMAGE_DISPATCH_TARGET` — the `repository_dispatch` target (default `triggerdotdev/cloud`). The job is additionally gated on `github.event_name == 'push'`. This is necessary, not just defensive: the gate now keys off `github.ref_name` rather than the computed image tag, and `ref_name` is still `main` when `release.yml` invokes this workflow via `workflow_call` during a release — so without the event guard the job would fire during every release and fail on the absent `CROSS_REPO_PAT`. A version-equality check can't replace it because `build-` tags strip the prefix to the version output. Behaviour note: the intended dispatch paths — push to `main`, and push of a `<prefix>` tag in a downstream repo — are `push` events and are unchanged. The one case that no longer dispatches is a manual `workflow_dispatch` run of `publish.yml` on `main` (it previously did, via the old `version == 'main'` check). That path is indistinguishable from a manual release by event name, so `push`-only is the clean discriminator. Dispatching still requires `CROSS_REPO_PAT`, so setting the variables alone doesn't enable anything. --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-10 11:31:04 +01:00
Matt Aitken	df964ea4ee	feat(ci): dispatch a repository event when the main webapp image is published (#3875 ) ## Summary On every `main` build, once the webapp image is pushed to the registry, the publish workflow emits a cross-repo `repository_dispatch` event (`main-image-published`) carrying a digest-pinned image ref. Other repositories in the org can subscribe to that event and build or deploy from the exact artifact, instead of chasing the moving `main` tag. ## Design `publish-webapp.yml` now exposes the pushed multi-arch index digest as a workflow output. `publish.yml` adds a `dispatch-main-image` job (after `publish-webapp`) that builds `<image_repo>@<digest>` and sends the dispatch via the same pinned `peter-evans/repository-dispatch` action already used elsewhere in this repo, authed with `CROSS_REPO_PAT`. It fires only when the published tag is `main`, so semver releases and other tag builds are excluded, and only from the canonical repo so forks never dispatch. The payload is JSON-escaped with `jq`.	2026-06-09 14:20:06 +01:00
Daniel Sutton	e9c459fb8d	ci: allow forks to override published container image namespace (#3866 ) ## Summary The container publish workflows hardcoded `ghcr.io/triggerdotdev/...` as the image destination. As a result, a fork that builds on push-to-`main` (or on the worker publish tags) would attempt to push to — and attest — the upstream packages rather than its own, which fails on permissions and is surprising besides. This makes the image destination configurable via a single `IMAGE_REGISTRY` repository variable, while leaving the upstream defaults byte-identical: - Single source of truth (`publish.yml`): a `resolve-registry` job resolves the target registry namespace once — `IMAGE_REGISTRY` repository variable, defaulting to `ghcr.io/${{ github.repository_owner }}` — and passes it down to every publish job as an `image_registry` input. So a fork publishes to its own namespace automatically with no configuration. - Webapp (`publish-webapp.yml`): the image now lives at `<registry>/<repo-name>` (e.g. `ghcr.io/<owner>/trigger.dev`). The provenance attestation and the downstream Trivy scan follow the same computed repo via the `image_repo` workflow output. - Workers (`publish-worker.yml`, `publish-worker-v4.yml`): build under `<registry>/<worker-name>`. They keep a `vars.IMAGE_REGISTRY \|\| ghcr.io/<owner>` fallback so they still resolve correctly on their direct `infra-` / `re2-` push triggers (which bypass the parent workflow). A single `IMAGE_REGISTRY` namespace variable now governs both webapp and workers (the earlier `WEBAPP_IMAGE_REPO` full-path override is dropped, removing the full-path/namespace asymmetry). When `IMAGE_REGISTRY` is unset, every resolved image name is exactly what it is today, so there is no change for this repo. ## Test plan - [x] `actionlint` passes on all four workflows - [ ] On merge, confirm the webapp publish still pushes `ghcr.io/triggerdotdev/trigger.dev:main` + the commit-SHA tag (defaults unchanged) --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-09 09:37:39 +01:00
nicktrn	fa15438e42	perf(ci): speed up unit tests with LPT sharding + container scoping (#3855 ) Speeds up and de-flakes the unit-test suite: testcontainers booted once per vitest worker (per-test isolation kept only where a test runs background redis work that outlives it), a duration-weighted shard sequencer so each shard does roughly equal work, the slowest suites split, two genuine flakes fixed (`streamBatchItems` shared-redis leak; run-engine waits that relied on fixed sleeps), and transient DockerHub pulls retried. Timings (CI, per-shard wall): worst unit-test shard ~771s → ~294s; packages/webapp shards ~250-270s, most internal ~190-240s. All 25 shards green. A shard breaks down as ~70s fixed setup (install / image-pull / generate) + ~70s cold `^build` + the actual container tests. So the remaining cost is mostly the tests themselves plus that fixed setup. Next (separate, timings): - typecheck (~6m24s) — the slowest check overall; bound by full-graph `tsc`, not the TS version (a TS6 branch is still ~6m17s). The real lever is tsgo (the Go compiler). - Possible later: turbo CI caching could trim the ~70s cold build on warm runs, but it's conditional (cold runs rebuild anyway) and doesn't touch setup or test time — secondary. `cli-v3` e2e and `sdk-compat` are path-gated (don't run on test-infra changes) and already comfortably fast.	2026-06-07 12:00:32 +01:00
nicktrn	707bf1adb4	ci: reduce unit test flakiness and shard re-run cost (#3844 ) A unit-test shard recently failed on a timing race rather than a real regression - a run-engine waitpoint test sleeps 1250ms waiting on a 1000ms timeout that's processed by a ~1000ms worker poll, so on a CPU-starved shard the margin evaporates and the whole matrix goes red. Because `fail-fast` defaults on, that one flake cancels the sibling shards, and the only recovery is re-running the entire matrix "just to be sure" - which is itself slow. This is the low-risk first pass at that pain: - `fail-fast: false` on the webapp and internal shard matrices, so one flaky shard no longer cancels its siblings. "Re-run failed jobs" now re-runs just the failed shard instead of the whole matrix. - CI-scoped `retry: process.env.CI ? 2 : 0` on the timing-sensitive packages (`run-engine`, `redis-worker`, `schedule-engine`). Flakes self-heal in CI; local runs stay at `retry: 0` so they still surface in dev. A stopgap until the timing tests are made deterministic. - `fetch-depth: 1` on the unit-test checkouts - they don't use git history, so the full clone was wasted setup time across ~20 jobs. - Reconcile the pre-pull image tags with what testcontainers actually pulls (`redis:7-alpine` -> `redis:7.2`, `ryuk:0.11.0` -> `ryuk:0.14.0`) and add `minio/minio:latest` to the webapp pre-pull. Otherwise those images pull unauthenticated at test time and risk Docker Hub rate-limit flakes (worst on fork PRs, where the authenticated pre-pull is skipped entirely). Deeper follow-ups - bigger runners, turbo remote cache, runtime-weighted sharding, and the real root-cause fix (container reuse / template-DB isolation + deterministic timing tests) - are tracked under TRI-10484.	2026-06-05 17:59:11 +01:00
nicktrn	16d59aa9e7	chore: harden webapp docker image (#3845 ) Hardens the webapp Docker image and adds a CVE scan of each published image. - Base image `bullseye-slim` → `bookworm-slim` (Debian 12), pinned by digest. Adds `apt-get upgrade` + `--no-install-recommends` + apt-cache cleanup across the build stages so OS packages are patched at build time. - Moves the `react-email` CLI to `devDependencies` in `internal-packages/emails` — only the `email dev` preview script uses it; the runtime render path is `@react-email/render` + `@react-email/components`. This also drops the bundled `esbuild` binary from the production image. - Bumps `goose` v3.26.0 → v3.27.1 and its Go builder image 1.23 → 1.26. - Adds a reusable Trivy image-scan workflow wired into `publish.yml`, so every published image (main builds and releases) is scanned for OS-package CVEs right after it's pushed to GHCR. Report-only (writes to the run summary), runs alongside the worker publishes so it never blocks a deploy. Verified locally: the image builds clean on the new base, and `@react-email/render` carries no `esbuild` dependency so email rendering is unaffected.	2026-06-05 17:52:42 +01:00
dependabot[bot]	d1f430247e	chore(deps): bump the github-actions group across 1 directory with 6 updates (#3824 ) Bumps the github-actions group with 6 updates in the / directory: \| Package \| From \| To \| \| --- \| --- \| --- \| \| [changesets/action](https://github.com/changesets/action) \| `1.7.0` \| `1.8.0` \| \| [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) \| `1.0.111` \| `1.0.133` \| \| [docker/login-action](https://github.com/docker/login-action) \| `4.1.0` \| `4.2.0` \| \| [depot/build-push-action](https://github.com/depot/build-push-action) \| `1.17.0` \| `1.18.0` \| \| [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) \| `4.0.0` \| `4.1.0` \| \| [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) \| `0.5.3` \| `0.5.6` \| Updates `changesets/action` from 1.7.0 to 1.8.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/changesets/action/releases">changesets/action's releases</a>.</em></p> <blockquote> <h2>v1.8.0</h2> <h3>Minor Changes</h3> <ul> <li><a href="https://redirect.github.com/changesets/action/pull/258">#258</a> <a href="https://github.com/changesets/action/commit/f5dbf72f96949cb0daf45152f0f63062df70e97d"><code>f5dbf72</code></a> Thanks <a href="https://github.com/tom-sherman"><code>@tom-sherman</code></a>! - Support draft version PR modes with a new <code>prDraft</code> input. Use <code>create</code> to create new version PRs as drafts, or <code>always</code> to also convert existing version PRs back to draft when updating them.</li> </ul> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/changesets/action/pull/502">#502</a> <a href="https://github.com/changesets/action/commit/6002dbd987f49a3c0a134910d9c7bca975b79977"><code>6002dbd</code></a> Thanks <a href="https://github.com/oshytiko"><code>@oshytiko</code></a>! - Fixed initial <code>.changeset</code> state being picked up, when <code>cwd</code> parameter is provided</p> </li> <li> <p><a href="https://redirect.github.com/changesets/action/pull/536">#536</a> <a href="https://github.com/changesets/action/commit/81b3f61ebffcb868f73e4c0b2682517149c834a2"><code>81b3f61</code></a> Thanks <a href="https://github.com/radnan"><code>@radnan</code></a>! - Fixed <code>.changeset</code> state being picked for the version command when <code>cwd</code> parameter is provided</p> </li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/changesets/action/blob/main/CHANGELOG.md">changesets/action's changelog</a>.</em></p> <blockquote> <h1><code>@changesets/action</code></h1> <h2>1.9.0</h2> <h3>Minor Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/changesets/action/pull/636">#636</a> <a href="https://github.com/changesets/action/commit/b072bccc4c664a373c42168eed9139dce1e003b1"><code>b072bcc</code></a> Thanks <a href="https://github.com/bluwy"><code>@bluwy</code></a>! - Add a new <code>@changesets/action/pr-comment</code> sub-action to comment on PRs</p> </li> <li> <p><a href="https://redirect.github.com/changesets/action/pull/625">#625</a> <a href="https://github.com/changesets/action/commit/8795eee5eee884e887d352ac673a515ffe35aaa6"><code>8795eee</code></a> Thanks <a href="https://github.com/bluwy"><code>@bluwy</code></a>! - Add a new <code>@changesets/action/pr-status</code> sub-action to generate the changeset status comment for PRs as an alternative to the <a href="https://github.com/apps/changeset-bot">Changesets Bot</a>.</p> </li> </ul> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/changesets/action/pull/535">#535</a> <a href="https://github.com/changesets/action/commit/34f64f6e2e1e47ddc183f174aa27c197aa47f520"><code>34f64f6</code></a> Thanks <a href="https://github.com/Andarist"><code>@Andarist</code></a>! - Fixed an issue with GitHub releases not being created for successfully published packages when <em>some</em> packages failed to be published to the registry.</p> </li> <li> <p><a href="https://redirect.github.com/changesets/action/pull/632">#632</a> <a href="https://github.com/changesets/action/commit/1d54b9e660e435237accbcae0b4581af3be641b4"><code>1d54b9e</code></a> Thanks <a href="https://github.com/bluwy"><code>@bluwy</code></a>! - Simplify internal implementation to get changelog entries for a package version</p> </li> <li> <p><a href="https://redirect.github.com/changesets/action/pull/629">#629</a> <a href="https://github.com/changesets/action/commit/e0c90aa7fbd0cc26931a679c5abe9bbc0deb0b50"><code>e0c90aa</code></a> Thanks <a href="https://github.com/bluwy"><code>@bluwy</code></a>! - Fix custom version and publish command argument parsing</p> </li> <li> <p><a href="https://redirect.github.com/changesets/action/pull/645">#645</a> <a href="https://github.com/changesets/action/commit/f9585d966a9c7d2f668b97199990de6f885823cf"><code>f9585d9</code></a> Thanks <a href="https://github.com/Andarist"><code>@Andarist</code></a>! - Improved force-push handling when using <code>commitMode: "github-api"</code> so updating an existing branch no longer temporarily resets the target branch to the base commit, avoiding cases where GitHub closes open pull requests during the update. This should remove a possibility of a GitHub state race that caused the force-pushed PRs not being reopened.</p> </li> </ul> <h2>1.8.0</h2> <h3>Minor Changes</h3> <ul> <li><a href="https://redirect.github.com/changesets/action/pull/258">#258</a> <a href="https://github.com/changesets/action/commit/f5dbf72f96949cb0daf45152f0f63062df70e97d"><code>f5dbf72</code></a> Thanks <a href="https://github.com/tom-sherman"><code>@tom-sherman</code></a>! - Support draft version PR modes with a new <code>prDraft</code> input. Use <code>create</code> to create new version PRs as drafts, or <code>always</code> to also convert existing version PRs back to draft when updating them.</li> </ul> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/changesets/action/pull/502">#502</a> <a href="https://github.com/changesets/action/commit/6002dbd987f49a3c0a134910d9c7bca975b79977"><code>6002dbd</code></a> Thanks <a href="https://github.com/oshytiko"><code>@oshytiko</code></a>! - Fixed initial <code>.changeset</code> state being picked up, when <code>cwd</code> parameter is provided</p> </li> <li> <p><a href="https://redirect.github.com/changesets/action/pull/536">#536</a> <a href="https://github.com/changesets/action/commit/81b3f61ebffcb868f73e4c0b2682517149c834a2"><code>81b3f61</code></a> Thanks <a href="https://github.com/radnan"><code>@radnan</code></a>! - Fixed <code>.changeset</code> state being picked for the version command when <code>cwd</code> parameter is provided</p> </li> </ul> <h2>1.7.0</h2> <h3>Minor Changes</h3> <ul> <li><a href="https://redirect.github.com/changesets/action/pull/564">#564</a> <a href="https://github.com/changesets/action/commit/935fe876b0054dfc962ac86bcddf028460040d46"><code>935fe87</code></a> Thanks <a href="https://github.com/Andarist"><code>@Andarist</code></a>! - Automatically use the GitHub-provided token to allow most users to avoid explicit <code>GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}</code> configuration.</li> </ul> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/changesets/action/pull/545">#545</a> <a href="https://github.com/changesets/action/commit/54220dd92c06e7da112b139f95d8beb933e4cdde"><code>54220dd</code></a> Thanks <a href="https://github.com/ryanbas21"><code>@ryanbas21</code></a>! - The <code>.npmrc</code> generation now intelligently handles both traditional NPM token authentication and trusted publishing scenarios by only appending the auth token when <code>NPM_TOKEN</code> is defined. This prevents 'undefined' from being written to the registry configuration when using OIDC tokens from GitHub Actions trusted publishing.</p> </li> <li> <p><a href="https://redirect.github.com/changesets/action/pull/563">#563</a> <a href="https://github.com/changesets/action/commit/6af4a7ec080d23ac6b304f69b67fd0aa92e089e7"><code>6af4a7e</code></a> Thanks <a href="https://github.com/Andarist"><code>@Andarist</code></a>! - Don't error on already committed symlinks and executables that stay untouched</p> </li> </ul> <h2>1.6.0</h2> <h3>Minor Changes</h3> <ul> <li><a href="https://redirect.github.com/changesets/action/pull/558">#558</a> <a href="https://github.com/changesets/action/commit/342005d41242bccd9dd9ae8d3679efce96af48ae"><code>342005d</code></a> Thanks <a href="https://github.com/harsha-venugopal-ledn"><code>@harsha-venugopal-ledn</code></a>! - Upgrade from Node.js 20 to Node.js 24 LTS</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/changesets/action/commit/63a615b9cd06ba9a3e6d13796c7fbcb080a60a0b"><code>63a615b</code></a> v1.8.0</li> <li><a href="https://github.com/changesets/action/commit/84c24326acc93f51d3f24f30a546316c82e2115c"><code>84c2432</code></a> Version Packages (<a href="https://redirect.github.com/changesets/action/issues/598">#598</a>)</li> <li><a href="https://github.com/changesets/action/commit/f5dbf72f96949cb0daf45152f0f63062df70e97d"><code>f5dbf72</code></a> Add draft mode support (<a href="https://redirect.github.com/changesets/action/issues/258">#258</a>)</li> <li><a href="https://github.com/changesets/action/commit/91b911142e975cceaa134eecb302493230d68c05"><code>91b9111</code></a> Protect publishes with env gate (<a href="https://redirect.github.com/changesets/action/issues/610">#610</a>)</li> <li><a href="https://github.com/changesets/action/commit/d4c53c294341eec8a419ec2d1927138bfdeec234"><code>d4c53c2</code></a> Fix <code>CODEOWNERS</code> pattern</li> <li><a href="https://github.com/changesets/action/commit/2ae596f3dd74aaee4f346b31fda33a58528d3d40"><code>2ae596f</code></a> Tweak CI setup (<a href="https://redirect.github.com/changesets/action/issues/599">#599</a>)</li> <li><a href="https://github.com/changesets/action/commit/0784b0ec8fcaa273fc06742c926ee7cfc946a8e7"><code>0784b0e</code></a> Add <code>CODEOWNERS</code></li> <li><a href="https://github.com/changesets/action/commit/81b3f61ebffcb868f73e4c0b2682517149c834a2"><code>81b3f61</code></a> Fixed <code>.changeset</code> state being picked for the version command when <code>cwd</code> para...</li> <li><a href="https://github.com/changesets/action/commit/6002dbd987f49a3c0a134910d9c7bca975b79977"><code>6002dbd</code></a> Fix reading <code>.changeset</code> directory from path provided in <code>cwd</code> parameter (<a href="https://redirect.github.com/changesets/action/issues/502">#502</a>)</li> <li>See full diff in <a href="https://github.com/changesets/action/compare/6a0a831ff30acef54f2c6aa1cbbc1096b066edaf...63a615b9cd06ba9a3e6d13796c7fbcb080a60a0b">compare view</a></li> </ul> </details> <br /> Updates `anthropics/claude-code-action` from 1.0.111 to 1.0.133 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/anthropics/claude-code-action/releases">anthropics/claude-code-action's releases</a>.</em></p> <blockquote> <h2>v1.0.133</h2> <h2>What's Changed</h2> <ul> <li>Use workload identity federation for Claude auth in CI workflows by <a href="https://github.com/ashwin-ant"><code>@ashwin-ant</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1344">anthropics/claude-code-action#1344</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.133">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.133</a></p> <h2>v1.0.132</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.132">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.132</a></p> <h2>v1.0.131</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.131">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.131</a></p> <h2>v1.0.130</h2> <h2>What's Changed</h2> <ul> <li>Add Workload Identity Federation (OIDC) authentication support by <a href="https://github.com/ashwin-ant"><code>@ashwin-ant</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1338">anthropics/claude-code-action#1338</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.130">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.130</a></p> <h2>v1.0.129</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.129">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.129</a></p> <h2>v1.0.128</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.128">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.128</a></p> <h2>v1.0.127</h2> <h2>What's Changed</h2> <ul> <li>Refactor allowed_bots actor resolution by <a href="https://github.com/ashwin-ant"><code>@ashwin-ant</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1330">anthropics/claude-code-action#1330</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.127">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.127</a></p> <h2>v1.0.126</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.126">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.126</a></p> <h2>v1.0.125</h2> <h2>What's Changed</h2> <ul> <li>Simplify comment tool instructions in prompt by <a href="https://github.com/ashwin-ant"><code>@ashwin-ant</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1328">anthropics/claude-code-action#1328</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.125">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.125</a></p> <h2>v1.0.124</h2> <h2>What's Changed</h2> <ul> <li>fix: add parentheses to fix operator precedence in co-author check by <a href="https://github.com/FuturizeRush"><code>@FuturizeRush</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1199">anthropics/claude-code-action#1199</a></li> <li>Strengthen simplified tag-mode prompt (USE_SIMPLE_PROMPT) by <a href="https://github.com/ashwin-ant"><code>@ashwin-ant</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1313">anthropics/claude-code-action#1313</a></li> <li>Fix prettier formatting in create-prompt by <a href="https://github.com/ashwin-ant"><code>@ashwin-ant</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1325">anthropics/claude-code-action#1325</a></li> </ul> <h2>New Contributors</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/anthropics/claude-code-action/commit/787c5a0ce96a9a6cfb050ea0c8f4c05f2447c251"><code>787c5a0</code></a> chore: bump Claude Code to 2.1.150 and Agent SDK to 0.3.150</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/4257c8e0591343e1130ae550a49ae34dd17c7060"><code>4257c8e</code></a> Use workload identity federation for Claude auth in CI workflows (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1344">#1344</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/bbfaf8e1ffe3e688f7ab65ceee78de241e24a238"><code>bbfaf8e</code></a> chore: bump Claude Code to 2.1.149 and Agent SDK to 0.3.149</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/4481e6d3c7bbb88db2a928ca3444c536f589c7c1"><code>4481e6d</code></a> chore: bump Claude Code to 2.1.148 and Agent SDK to 0.3.148</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/661a6fefbd0569ef35809da16775508ab1937862"><code>661a6fe</code></a> Add Workload Identity Federation (OIDC) authentication support (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1338">#1338</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/c9d66afb1788e701c57d58842e324dca17fd276e"><code>c9d66af</code></a> chore: bump Claude Code to 2.1.147 and Agent SDK to 0.3.147</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/20c8abf165d5f85ab3fc970db9498436377dc9d1"><code>20c8abf</code></a> chore: bump Claude Code to 2.1.146 and Agent SDK to 0.3.146</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/1dc994ee7a008f0ecc866d9ac23ef036b7229f84"><code>1dc994e</code></a> Resolve actor account type before applying allowed_bots (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1330">#1330</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/ca89df3d42dc1bc03c5ab87f533195bef6d36af0"><code>ca89df3</code></a> chore: bump Claude Code to 2.1.145 and Agent SDK to 0.3.145</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/fd1877debc1340db5a461a0e4644931de8e1c271"><code>fd1877d</code></a> Simplify comment tool instructions in prompt (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1328">#1328</a>)</li> <li>Additional commits viewable in <a href="https://github.com/anthropics/claude-code-action/compare/fefa07e9c665b7320f08c3b525980457f22f58aa...787c5a0ce96a9a6cfb050ea0c8f4c05f2447c251">compare view</a></li> </ul> </details> <br /> Updates `docker/login-action` from 4.1.0 to 4.2.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/docker/login-action/releases">docker/login-action's releases</a>.</em></p> <blockquote> <h2>v4.2.0</h2> <ul> <li>Bump <code>@actions/core</code> from 3.0.0 to 3.0.1 in <a href="https://redirect.github.com/docker/login-action/pull/976">docker/login-action#976</a></li> <li>Bump <code>@aws-sdk/client-ecr</code> and <code>@aws-sdk/client-ecr-public</code> to 3.1050.0 in <a href="https://redirect.github.com/docker/login-action/pull/960">docker/login-action#960</a></li> <li>Bump <code>@docker/actions-toolkit</code> from 0.86.0 to 0.90.0 in <a href="https://redirect.github.com/docker/login-action/pull/970">docker/login-action#970</a></li> <li>Bump brace-expansion from 2.0.1 to 5.0.6 in <a href="https://redirect.github.com/docker/login-action/pull/993">docker/login-action#993</a></li> <li>Bump fast-xml-builder from 1.1.4 to 1.2.0 in <a href="https://redirect.github.com/docker/login-action/pull/985">docker/login-action#985</a></li> <li>Bump fast-xml-parser from 5.3.6 to 5.8.0 in <a href="https://redirect.github.com/docker/login-action/pull/963">docker/login-action#963</a></li> <li>Bump http-proxy-agent and https-proxy-agent to 9.0.0 in <a href="https://redirect.github.com/docker/login-action/pull/961">docker/login-action#961</a></li> <li>Bump postcss from 8.5.6 to 8.5.10 in <a href="https://redirect.github.com/docker/login-action/pull/979">docker/login-action#979</a></li> <li>Bump tar from 6.2.1 to 7.5.15 in <a href="https://redirect.github.com/docker/login-action/pull/991">docker/login-action#991</a></li> <li>Bump vite from 7.3.1 to 7.3.3 in <a href="https://redirect.github.com/docker/login-action/pull/986">docker/login-action#986</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/docker/login-action/compare/v4.1.0...v4.2.0">https://github.com/docker/login-action/compare/v4.1.0...v4.2.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/docker/login-action/commit/650006c6eb7dba73a995cc03b0b2d7f5ca915bee"><code>650006c</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/960">#960</a> from docker/dependabot/npm_and_yarn/aws-sdk-dependenc...</li> <li><a href="https://github.com/docker/login-action/commit/99df1a3f6d65e48177ea57671a50e2242eae4b63"><code>99df1a3</code></a> chore: update generated content</li> <li><a href="https://github.com/docker/login-action/commit/3ab375f324f46da5f6901efeda4be4e2566ebaa2"><code>3ab375f</code></a> build(deps): bump the aws-sdk-dependencies group across 1 directory with 2 up...</li> <li><a href="https://github.com/docker/login-action/commit/39d85804ae465a1816c68ff58158ec66883981b4"><code>39d8580</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/970">#970</a> from docker/dependabot/npm_and_yarn/docker/actions-to...</li> <li><a href="https://github.com/docker/login-action/commit/4eefcd33ca7213989697445a78b6730274bfaba6"><code>4eefcd3</code></a> chore: update generated content</li> <li><a href="https://github.com/docker/login-action/commit/56d092c8b3f04006c22f4fc20a2b3d2442caed56"><code>56d092c</code></a> build(deps): bump <code>@docker/actions-toolkit</code> from 0.86.0 to 0.90.0</li> <li><a href="https://github.com/docker/login-action/commit/e2e31ca87063ae00fd41ad3b9c548dd8ec24c5ff"><code>e2e31ca</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/976">#976</a> from docker/dependabot/npm_and_yarn/actions/core-3.0.1</li> <li><a href="https://github.com/docker/login-action/commit/0bced941e843afc786fbfd58b1c6c13ca11e09c9"><code>0bced94</code></a> chore: update generated content</li> <li><a href="https://github.com/docker/login-action/commit/3e75a0f266b07e09777a621d0ca5f4432ef9f10c"><code>3e75a0f</code></a> build(deps): bump <code>@actions/core</code> from 3.0.0 to 3.0.1</li> <li><a href="https://github.com/docker/login-action/commit/365bebd9d646160567ebad47824f026e09ee6970"><code>365bebd</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/984">#984</a> from docker/dependabot/github_actions/aws-actions/con...</li> <li>Additional commits viewable in <a href="https://github.com/docker/login-action/compare/4907a6ddec9925e35a0a9e82d7399ccc52663121...650006c6eb7dba73a995cc03b0b2d7f5ca915bee">compare view</a></li> </ul> </details> <br /> Updates `depot/build-push-action` from 1.17.0 to 1.18.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/depot/build-push-action/releases">depot/build-push-action's releases</a>.</em></p> <blockquote> <h2>v1.18.0</h2> <h2>What's Changed</h2> <ul> <li>Upgrade action runtime to Node 24 (<a href="https://redirect.github.com/depot/build-push-action/issues/48">#48</a>) <a href="https://github.com/Akatama"><code>@Akatama</code></a></li> <li>Add Depot Registry save example (<a href="https://redirect.github.com/depot/build-push-action/issues/47">#47</a>) <a href="https://github.com/maschwenk"><code>@maschwenk</code></a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/depot/build-push-action/commit/98e78adca7817480b8185f474a400b451d74e287"><code>98e78ad</code></a> Merge pull request <a href="https://redirect.github.com/depot/build-push-action/issues/48">#48</a> from depot/upgrade-node-24-runtime</li> <li><a href="https://github.com/depot/build-push-action/commit/e97ebff18729ac91be067461138674a006ab9bff"><code>e97ebff</code></a> Remove Node 24 compatibility docs</li> <li><a href="https://github.com/depot/build-push-action/commit/2db929fa768ebb3ad332ae8fc530412bf0964782"><code>2db929f</code></a> Upgrade action runtime to Node 24</li> <li><a href="https://github.com/depot/build-push-action/commit/f78af826a1c272c4b60c485e934974b515094928"><code>f78af82</code></a> Merge pull request <a href="https://redirect.github.com/depot/build-push-action/issues/47">#47</a> from maschwenk/maschwenk/add-depot-registry-example</li> <li><a href="https://github.com/depot/build-push-action/commit/6855818d5954fa4361879bb0b0e5c32856fc6703"><code>6855818</code></a> Update action.yml</li> <li><a href="https://github.com/depot/build-push-action/commit/b984f6a1944d5420eefb2b012d6eb856249bd225"><code>b984f6a</code></a> Clarify save/save-tag/save-tags input descriptions</li> <li><a href="https://github.com/depot/build-push-action/commit/1a34abd3707433f4f7b6d594e49e56b4b9f4d6d0"><code>1a34abd</code></a> Add Depot Registry save example</li> <li>See full diff in <a href="https://github.com/depot/build-push-action/compare/5f3b3c2e5a00f0093de47f657aeaefcedff27d18...98e78adca7817480b8185f474a400b451d74e287">compare view</a></li> </ul> </details> <br /> Updates `docker/setup-buildx-action` from 4.0.0 to 4.1.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/docker/setup-buildx-action/releases">docker/setup-buildx-action's releases</a>.</em></p> <blockquote> <h2>v4.1.0</h2> <ul> <li>Bump <code>@docker/actions-toolkit</code> from 0.79.0 to 0.90.0 in <a href="https://redirect.github.com/docker/setup-buildx-action/pull/489">docker/setup-buildx-action#489</a></li> <li>Bump brace-expansion from 1.1.12 to 5.0.6 in <a href="https://redirect.github.com/docker/setup-buildx-action/pull/547">docker/setup-buildx-action#547</a> <a href="https://redirect.github.com/docker/setup-buildx-action/pull/508">docker/setup-buildx-action#508</a></li> <li>Bump fast-xml-builder from 1.0.0 to 1.2.0 in <a href="https://redirect.github.com/docker/setup-buildx-action/pull/540">docker/setup-buildx-action#540</a></li> <li>Bump fast-xml-parser from 5.4.2 to 5.8.0 in <a href="https://redirect.github.com/docker/setup-buildx-action/pull/496">docker/setup-buildx-action#496</a></li> <li>Bump flatted from 3.3.3 to 3.4.2 in <a href="https://redirect.github.com/docker/setup-buildx-action/pull/499">docker/setup-buildx-action#499</a></li> <li>Bump glob from 10.3.12 to 13.0.6 in <a href="https://redirect.github.com/docker/setup-buildx-action/pull/495">docker/setup-buildx-action#495</a></li> <li>Bump handlebars from 4.7.8 to 4.7.9 in <a href="https://redirect.github.com/docker/setup-buildx-action/pull/504">docker/setup-buildx-action#504</a></li> <li>Bump lodash from 4.17.23 to 4.18.1 in <a href="https://redirect.github.com/docker/setup-buildx-action/pull/523">docker/setup-buildx-action#523</a></li> <li>Bump picomatch from 4.0.3 to 4.0.4 in <a href="https://redirect.github.com/docker/setup-buildx-action/pull/503">docker/setup-buildx-action#503</a></li> <li>Bump postcss from 8.5.6 to 8.5.10 in <a href="https://redirect.github.com/docker/setup-buildx-action/pull/537">docker/setup-buildx-action#537</a></li> <li>Bump tar from 6.2.1 to 7.5.15 in <a href="https://redirect.github.com/docker/setup-buildx-action/pull/545">docker/setup-buildx-action#545</a></li> <li>Bump undici from 6.23.0 to 6.25.0 in <a href="https://redirect.github.com/docker/setup-buildx-action/pull/492">docker/setup-buildx-action#492</a></li> <li>Bump vite from 7.3.1 to 7.3.2 in <a href="https://redirect.github.com/docker/setup-buildx-action/pull/520">docker/setup-buildx-action#520</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/docker/setup-buildx-action/compare/v4.0.0...v4.1.0">https://github.com/docker/setup-buildx-action/compare/v4.0.0...v4.1.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/docker/setup-buildx-action/commit/d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5"><code>d7f5e7f</code></a> Merge pull request <a href="https://redirect.github.com/docker/setup-buildx-action/issues/489">#489</a> from docker/dependabot/npm_and_yarn/docker/actions-to...</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/92bc5c9777806d0a73d9d668ba2114fa1177f164"><code>92bc5c9</code></a> chore: update generated content</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/da11e35abee0f20cb4f1c1b7c461d37c29be52f5"><code>da11e35</code></a> build(deps): bump <code>@docker/actions-toolkit</code> from 0.79.0 to 0.90.0</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/f021e162ef95b6fba51af1c6674f537f25bce851"><code>f021e16</code></a> Merge pull request <a href="https://redirect.github.com/docker/setup-buildx-action/issues/492">#492</a> from docker/dependabot/npm_and_yarn/undici-6.24.1</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/b5af94fab700aee0c64d6077e0e34ae987815b67"><code>b5af94f</code></a> chore: update generated content</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/16ad9776a801d0c47f0a05f007b88a3789aa8ab6"><code>16ad977</code></a> build(deps): bump undici from 6.23.0 to 6.25.0</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/d7a12d7df895b33bd02a9b4bf62a12f2b9a24458"><code>d7a12d7</code></a> Merge pull request <a href="https://redirect.github.com/docker/setup-buildx-action/issues/495">#495</a> from docker/dependabot/npm_and_yarn/glob-10.5.0</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/28ff27de4eed7518d361591f2cd1dfb69c34a7cb"><code>28ff27d</code></a> build(deps): bump glob from 10.3.12 to 13.0.6</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/daf436b50e13d9053b9730cbc16516891878b019"><code>daf436b</code></a> Merge pull request <a href="https://redirect.github.com/docker/setup-buildx-action/issues/496">#496</a> from docker/dependabot/npm_and_yarn/fast-xml-parser-5...</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/9725348367859764880f2f2e688a6b0c353e3f35"><code>9725348</code></a> chore: update generated content</li> <li>Additional commits viewable in <a href="https://github.com/docker/setup-buildx-action/compare/4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd...d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5">compare view</a></li> </ul> </details> <br /> Updates `zizmorcore/zizmor-action` from 0.5.3 to 0.5.6 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/zizmorcore/zizmor-action/releases">zizmorcore/zizmor-action's releases</a>.</em></p> <blockquote> <h2>v0.5.6</h2> <ul> <li>1.25.2 is now available via the action</li> <li>1.25.2 is now the default version of zizmor used by the action</li> </ul> <h2>v0.5.5</h2> <p>This is a no-op release.</p> <h2>v0.5.4</h2> <ul> <li>1.25.0 is now available via the action</li> <li>1.25.0 is now the default version of zizmor used by the action</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/zizmorcore/zizmor-action/commit/5f14fd08f7cf1cb1609c1e344975f152c7ee938d"><code>5f14fd0</code></a> Sync zizmor versions (<a href="https://redirect.github.com/zizmorcore/zizmor-action/issues/114">#114</a>)</li> <li><a href="https://github.com/zizmorcore/zizmor-action/commit/a16621b09c6db4281f81a93cb393b05dcd7b7165"><code>a16621b</code></a> Bump pins in README (<a href="https://redirect.github.com/zizmorcore/zizmor-action/issues/112">#112</a>)</li> <li><a href="https://github.com/zizmorcore/zizmor-action/commit/1c03e047a3633631b1e5648c48243045b1de0d25"><code>1c03e04</code></a> chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3 in the github-ac...</li> <li><a href="https://github.com/zizmorcore/zizmor-action/commit/b572f7b1a1c2d41efaab43d504f68d215c3cd727"><code>b572f7b</code></a> Sync zizmor versions (<a href="https://redirect.github.com/zizmorcore/zizmor-action/issues/111">#111</a>)</li> <li><a href="https://github.com/zizmorcore/zizmor-action/commit/06928c5dcba418c7d6108a4bd6e2d34cbf3c9377"><code>06928c5</code></a> chore(deps): bump github/codeql-action in the github-actions group (<a href="https://redirect.github.com/zizmorcore/zizmor-action/issues/109">#109</a>)</li> <li><a href="https://github.com/zizmorcore/zizmor-action/commit/5ea8b96e1078453e04a1b81443890d9e7da5ddf3"><code>5ea8b96</code></a> docs: Update link to GitHub docs (<a href="https://redirect.github.com/zizmorcore/zizmor-action/issues/108">#108</a>)</li> <li><a href="https://github.com/zizmorcore/zizmor-action/commit/849ac260951adeb7c02481da6c7e749b39f4ea6d"><code>849ac26</code></a> chore(deps): bump the github-actions group with 2 updates (<a href="https://redirect.github.com/zizmorcore/zizmor-action/issues/106">#106</a>)</li> <li><a href="https://github.com/zizmorcore/zizmor-action/commit/814f9778aceea8641503a8cd8f0cffebc55d790c"><code>814f977</code></a> Bump pins in README (<a href="https://redirect.github.com/zizmorcore/zizmor-action/issues/103">#103</a>)</li> <li>See full diff in <a href="https://github.com/zizmorcore/zizmor-action/compare/b1d7e1fb5de872772f31590499237e7cce841e8e...5f14fd08f7cf1cb1609c1e344975f152c7ee938d">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-03 15:56:44 +00:00
nicktrn	a9f756b260	chore: move reference projects to their own repo (#3812 ) The reference/example projects (`references/`) now live in their own repo, https://github.com/triggerdotdev/references, so their heavy, frequently-changing dependencies are no longer part of this repo's lockfile and tooling. This removes them here and repoints everything that referenced them. - Deletes `references/`; updates the pnpm workspace + lockfile. - Clears the references-only CI rules and `.vscode` configs. - Repoints the docs (contributor/agent + one public page) to the new repo. - `seed.mts` keeps the local-dev projects (hello-world, d3-chat, realtime-streams).	2026-06-02 22:19:28 +01:00
Eric Allam	005d7e0a3f	chore: add pkg.pr.new preview package releases (#3806 ) ## What Adds [pkg.pr.new](https://pkg.pr.new) continuous preview releases. Every push to a branch builds the public `@trigger.dev/` packages and publishes installable preview builds keyed by commit SHA — without touching the npm registry. pkg.pr.new drops install instructions on the associated PR: ``` npm i https://pkg.pr.new/@trigger.dev/sdk@<sha> ``` This lets reviewers and users try a branch (SDK, CLI, core, etc.) before anything is released, separate from the changesets release, the manual `--snapshot` prerelease, and the chat-prerelease flow. ## How `.github/workflows/preview-packages.yml` (push trigger) → install → generate Prisma → stamp preview version* → build → `pkg-pr-new publish`. ### The version stamp (the important part) pkg.pr.new serves previews by SHA but does not rewrite the package.json `version` field. If a preview shipped as `4.5.0-rc.4`, a consumer who installed it would pin `4.5.0-rc.4` to the preview tarball in their lockfile/cache — and a later `npm i @trigger.dev/sdk@4.5.0-rc.4` from npm could resolve to the stale preview. This is a known, by-design gap in the tool (stackblitz-labs/pkg.pr.new#250, #390). `scripts/stamp-preview-version.mjs` runs before the build and rewrites every public package to a unique `0.0.0-preview-<sha>`. The `0.0.0-` prefix can never satisfy a real semver range, so the collision is structurally impossible (same convention React/Next canaries use). Running before the build also means `scripts/updateVersion.ts` bakes the preview version into the runtime `VERSION` constant, so previews are self-identifying (`trigger --version`, the `x-trigger-cli-version` header, the MCP server version) instead of all reporting the RC version. Sibling `workspace:` specifiers are relaxed to `workspace:` so `pnpm pack` resolves them against the rewritten versions — `packages/python` pins peerDependencies as `workspace:^4.5.0-rc.4`, which would otherwise be unsatisfiable once the version changes. Non-public deps (`@trigger.dev/database`, `@internal/`) are left untouched. All mutations happen on the ephemeral CI checkout; nothing is committed. ## GitHub App The pkg.pr.new GitHub App is already installed on `triggerdotdev/trigger.dev` (has been for a while), so no setup is needed. Confirmed live — this branch's pushes published all 10 public packages, e.g. ``` pnpm add https://pkg.pr.new/@trigger.dev/sdk@e4dfc59 ``` ## Fork limitation pkg.pr.new authenticates with a GitHub Actions OIDC token, which GitHub does not issue to `pull_request` workflows from forks. The `push` trigger therefore covers branches pushed to this repo (core team), not external fork PRs. Fork coverage would need a `workflow_run` two-stage setup; left out for now. ## Notes - Pinned `pkg-pr-new@0.0.75` (no Node engine constraint; Node 20 CI is fine). - pkg.pr.new [#525](https://github.com/stackblitz-labs/pkg.pr.new/pull/525) adds a built-in `--previewVersion` flag (still open). If it lands we can drop the version-rewrite half of the script, but we'd keep a pre-build stamp anyway so `updateVersion.ts` picks up the preview version (the flag rewrites at pack time, too late for the baked `VERSION`).	2026-06-02 15:20:32 +01:00
nicktrn	11631c19e1	chore: bump node to latest patch release (#3802 ) Bumps Node to the latest 20.x patch.	2026-06-02 11:48:46 +01:00
Matt Aitken	b23ec26d16	chore: vouch ConProgramming (#3804 ) Vouches GitHub user [`ConProgramming`](https://github.com/ConProgramming) (Conner) as an outside contributor by adding them to `.github/VOUCHED.td`, so their PRs aren't auto-closed by the vouch check. Done as a direct edit rather than via the issue flow because they have no open Vouch Request issue to comment `vouch` on. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-02 10:48:00 +01:00
Dan	cd252801eb	feat: dashboard agent - package upgrades (#3793 ) 1. in webapp folder update ai-sdk to 6.x.x 2. update vitest to 4.xx	2026-06-02 10:46:34 +01:00
Saadi Myftija	181d9ba541	feat: preview environment dispatch workflow (#3786 ) Publishes a `repository_dispatch` `preview-deploy` event that enables preview deployments. Opt-in only currently.	2026-06-01 11:57:40 +02:00
nicktrn	18d7144e74	ci: daily dependabot critical-severity slack alerts (#3701 ) Sibling to the weekly summary, focused on critical alerts only. Pings Slack daily while any critical alerts are open; skips the post entirely when zero, so no daily "all clear" noise. - Daily 08:00 UTC cron + `workflow_dispatch` with `severity` input (default `critical`, override to `high`/`medium`/`low` for manual checks) - Reuses the existing `dependabot-summary` environment (token, channel, bot) - Alerts link at the end is severity-filtered	2026-05-22 10:32:08 +01:00
Eric Allam	422f9f0bb2	ci: unblock changesets release PRs (#3687 ) ## Summary Two CI workflows were blocking the v4.5.0-rc.0 release PR (#3563) and would block every future changeset release PR. ### 1. `changesets-pr.yml` — self-report `All PR Checks` The changesets bot pushes commits authored by `GITHUB_TOKEN`. By GitHub design, `GITHUB_TOKEN`-authored pushes can't trigger downstream workflows (loop-prevention). That means `pr_checks.yml` never fires on release-PR commits, leaving the required `All PR Checks` status permanently `Expected — Waiting for status to be reported`. The PR can't merge. The fix: after `changesets/action` creates the PR, post a `success` check with the exact `All PR Checks` context onto the PR's head SHA. GitHub's required-check evaluation is satisfied by any check with the right context name — the source doesn't have to be `pr_checks.yml`. Why this is safe: the release PR only mechanically bumps `package.json`, `pnpm-lock.yaml`, and `CHANGELOG.md` from changesets that were already on `main` (and already ran full CI when they merged). If a human ever pushes a commit to `changeset-release/main`, `pr_checks.yml` fires on that push (real user, not `GITHUB_TOKEN`) and posts its own `All PR Checks` status — last write wins for the same context on the same SHA, so the human-push result overrides the auto-success. ### 2. `vouch-check-pr.yml` — exempt `github-actions[bot]` The `require-draft` job auto-closes any non-draft PR whose author is not a `MEMBER`/`OWNER`/`COLLABORATOR`, with an explicit allowlist for `devin-ai-integration[bot]` and `dependabot[bot]`. The changesets bot publishes as `github-actions[bot]` with `author_association: CONTRIBUTOR`, so every release PR was getting auto-closed on open with a "please re-open as draft" comment. Add `github-actions[bot]` to the exemption list. ## Test plan - [ ] After merge, the next changeset bot push to `changeset-release/main` should post `All PR Checks: success` on the release PR's head SHA, and the PR should not get auto-closed by `Vouch - Check PR`. - [ ] Confirm `pr_checks.yml` still fires + gates normal (human-authored) PRs to `main`.	2026-05-21 14:22:52 +01:00
Eric Allam	e825409f0e	ci(release): exit changeset pre mode before snapshot prerelease (#3665 ) ## Summary The prerelease (snapshot) path of the release workflow fails immediately whenever `main` carries an active `.changeset/pre.json` (i.e. during an in-progress RC cycle, like the current v4 RC): ``` 🦋 error Snapshot release is not allowed in pre mode 🦋 To resolve this exit the pre mode by running `changeset pre exit` ``` This blocks `chat-prerelease` snapshots from main even though the snapshots are unrelated to the RC cycle. Adds a conditional `changeset pre exit` step right before `Snapshot version` in the prerelease job. The job runs on a checkout with `persist-credentials: false`, so the `pre.json` deletion stays on the runner's working tree — main's persisted pre-mode state is untouched, and v4 RC publishes keep working normally. ## Test plan - [ ] Re-run the `🦋 Changesets Release` workflow with `type=prerelease`, `ref=main`, `prerelease_tag=chat-prerelease` and confirm it gets past the snapshot step and publishes. - [ ] Confirm `.changeset/pre.json` on `main` is unchanged after the run.	2026-05-19 10:11:44 +01:00
nicktrn	a8280f125c	ci: fix code path filter negation (#3637 ) `dorny/paths-filter` defaults to OR semantics across the pattern array, so the leading `**` matched every file and the `!...` excludes were no-ops. The `code` filter has been returning `true` for every PR since #3615. Split into two filter steps: `code` moves into its own step with `predicate-quantifier: every` so excludes actually subtract. The two re-include workflow files become a separate `typecheck_self` filter that the `typecheck` job ORs into its `if:`. Side effect: workflow-file-only PRs that don't touch `pr_checks.yml` or `typecheck.yml` no longer trigger typecheck. Previously they did because the filter was broken-true.	2026-05-16 12:51:35 +03:00
Eric Allam	dfa3ede209	feat(ci): support release candidates via changesets pre mode (#3628 ) ## Summary Enables shipping `X.Y.Z-rc.N` prereleases of `@trigger.dev/*` via changesets pre mode. RCs publish under the `rc` npm dist-tag, never claim `latest`, and don't trigger marketing-site changelog PRs. The plumbing is hyphen-in-version detection in `release.yml` — no separate workflow, no opt-in flag at publish time. Validated end-to-end against a sandbox repo (real npm publishes, Docker builds, Helm chart pushes, GitHub releases) before porting back. Full RC lifecycle tested: pre enter → rc.0 → iterate to rc.1 → pre exit → stable. Plus interaction with the existing release-branch hotfix flow. ## What changes ### `release.yml` - New `is_prerelease` output (hyphen-in-version) - GitHub release adds `--prerelease` flag for RC publishes (Pre-release badge, not Latest) - `dispatch-changelog` job gated on `is_prerelease != 'true'` — no marketing-site PR per RC ### Docker workflows - Removes the `:v4-beta` floating tag entirely from `publish-webapp.yml` and `publish-worker-v4.yml`. v4 is GA; the tag is a misnomer and is already inconsistent with the npm side (npm `v4-beta` dist-tag was frozen at 4.0.4 months ago while Docker `:v4-beta` kept bumping). Self-hosters should pin to a versioned tag going forward — the last value of `:v4-beta` stays frozen wherever it currently points. ### CLI version-check fix (`packages/cli-v3/src/utilities/initialBanner.ts`) Switches the "new version available" comparison from JavaScript `localeCompare` to `semver.lt`. The old comparison handled `X.Y.Z-rc.N` vs `X.Y.Z` incorrectly — a user on `4.5.0-rc.0` would never be prompted to upgrade once `4.5.0` stable shipped (lex order put the prerelease ahead of the bare version). Real semver gets this right. Stable users were never affected: the check queries the `@latest` dist-tag, which by convention never points at a prerelease. ## How an RC actually publishes after this 1. `pnpm exec changeset pre enter rc` on main, push the `pre.json` 2. Bot regenerates the release PR as `chore: release v<X.Y.Z>-rc.0` 3. Merge → `release.yml` runs `changeset publish` which reads `pre.json.tag` and publishes under `--tag rc`. GitHub release marked Pre-release. No marketing-site dispatch. 4. Iterate by adding changesets normally; bot bumps to `rc.1`, `rc.2`, … 5. When ready: `pnpm exec changeset pre exit`, push, merge regenerated PR → stable ships under `latest` and the marketing-site dispatch fires.	2026-05-15 16:43:26 +01:00
nicktrn	0510fd6661	ci: skip typecheck for refs and non-code file PRs (#3624 ) Follow-up to #3615. The `code` filter currently fires typecheck for any change outside `docs/`, `.changeset/`, `hosting/`, or `.github/` - so a docs-only PR like #3623 (touching `references/ai-chat/.env.example` + `README.md`) triggered the typecheck job. None of the `references/` packages declare a `typecheck` script either, so even when a real code change lands there, `turbo run typecheck` skips them. Running the job is pure cost. Tightens the filter to also exclude: - `references/` - playground projects, none of them contribute to `turbo run typecheck` today - `/.md` - markdown anywhere - `**/.env.example` - example env files anywhere Two known gaps left open: - references/ have no real CI typecheck coverage. Separate question - either add `typecheck` scripts to each (or top-level `tsc -p`), or accept playground status. - `changes` job still runs (it's a path-filter step) but the dependent jobs all skip on irrelevant PRs.	2026-05-14 19:36:09 +01:00
nicktrn	b62c8a19c2	ci: add dependabot weekly summary workflow (#3616 ) Adds a Mon 08:00 UTC workflow that posts a summary of open Dependabot alerts and PRs to Slack. Uses env-scoped secrets so the alerts PAT and Slack token are only available to this workflow.	2026-05-14 15:44:37 +02:00
nicktrn	9caf4ceaf1	ci: skip typecheck for workflow-only PRs (#3619 ) The `code` paths filter currently matches `*` minus a tiny exclusion list, so a PR that only touches `.github/workflows/.yml` still flips `code == true` and runs typecheck (~2 min on the runner). Exclude `.github/**` from `code`, then re-include just `pr_checks.yml` and `typecheck.yml` so a change to either of those still triggers the full code check matrix. Effect: - workflow-only PRs (this one, future dependabot/codeql/etc.) skip typecheck; `all-checks` treats the skipped job as non-failure so the required status passes. - modifying `pr_checks.yml` or `typecheck.yml` themselves still triggers typecheck. - the existing per-suite filters (`webapp`, `packages`, `internal`, `cli`, `sdk`) already re-include the specific workflows that gate them, so they're unaffected.	2026-05-14 14:37:55 +01:00
nicktrn	d144220174	ci: path-based skip and gate job in pr_checks (#3615 ) `pr_checks` runs the full matrix on every PR. #3609 touched only `apps/webapp/app/routes/admin.tsx` and still ran the 4-job CLI e2e matrix and 5-job sdk-compat suite. Adds a `changes` job using `dorny/paths-filter` and gates each tier: - webapp + e2e-webapp: `apps/webapp/`, `packages/`, `internal-packages/` - packages: `packages/` - internal: `internal-packages/` + `packages/` (cross-deps) - e2e (cli-v3): `packages/{cli-v3,build,core,schema-to-json}/` - sdk-compat: `packages/{trigger-sdk,core}/` `.configs/**`, `package.json`, `pnpm-lock.yaml`, `pnpm-workspace.yaml`, `turbo.json` are also included in every filter since they affect the whole workspace. Inlines the `units` reusable-workflow children so each can be gated independently (status check names also flatten from `units / webapp / ...` to `webapp / ...`). `unit-tests.yml` is unaffected - still used by `publish.yml`. Adds an `all-checks` gate that always runs and short-circuits to success when every dependent is success-or-skipped. With this in place a single required status check (`All PR Checks`) is enough; before this, `paths-ignore` would have left required checks Pending on docs/changeset PRs ([gh docs](https://docs.github.com/en/actions/managing-workflow-runs/skipping-workflow-runs)).	2026-05-13 22:37:20 +00:00

1 2 3 4 5

244 Commits