Skip to content

build(deps): bump the actions group across 1 directory with 5 updates - #11336

Merged
timotheeguerin merged 1 commit into
mainfrom
dependabot/github_actions/actions-bdf042b046
Jul 21, 2026
Merged

build(deps): bump the actions group across 1 directory with 5 updates#11336
timotheeguerin merged 1 commit into
mainfrom
dependabot/github_actions/actions-bdf042b046

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 21, 2026

Copy link
Copy Markdown
Contributor

Bumps the actions group with 5 updates in the / directory:

Package From To
actions/checkout 6 7
actions/setup-python 6 7
github/gh-aw 0.81.6 0.82.14
actions/setup-dotnet 5 6
actions/setup-node 6 7

Updates actions/checkout from 6 to 7

Release notes

Sourced from actions/checkout's releases.

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

What's Changed

New Contributors

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

Full Changelog: actions/checkout@v6.0.1...v6.0.2

v6.0.1

What's Changed

... (truncated)

Commits

Updates actions/setup-python from 6 to 7

Release notes

Sourced from actions/setup-python's releases.

v7.0.0

What's Changed

Enhancements

Bug Fix

Dependency Upgrade

New Contributors

Full Changelog: actions/setup-python@v6...v7.0.0

v6.3.0

What's Changed

Enhancement

Dependency update

Documentation

New Contributors

Full Changelog: actions/setup-python@v6.2.0...v6.3.0

v6.2.0

What's Changed

Dependency Upgrades

... (truncated)

Commits

Updates github/gh-aw from 0.81.6 to 0.82.14

Release notes

Sourced from github/gh-aw's releases.

v0.82.14

🌟 Release Highlights

This release focuses on safe-outputs reliability, workshop UX polish, a new top-level model field, and a wave of new linters and security guardrails.

✨ What's New

  • Top-level model field — You can now specify the model at the top level of your workflow (e.g., model: claude-sonnet-4-5), deprecating the nested engine.model path. Reference docs
  • auto_upgrade_cron in aw.json — Configure a custom auto-upgrade schedule directly in your project manifest instead of relying on defaults.
  • Evals enabled across 64 agentic workflows — Broader evaluation coverage improves regression detection and workflow quality assurance.
  • --rootless flag for install_copilot_cli.sh — ARC/DinD runners can now install the Copilot CLI without root privileges.
  • Mode-specific intent guidance for safe-output tools — Mutation tools now surface targeted guidance based on the current workflow mode, reducing misuse and improving agent decision quality.
  • Fail-fast guardrail for schema file changes — The compiler now rejects schema changes that were made without a rebuild, preventing subtle runtime mismatches.
  • Workshop: journey/adventure filtering, GFM alerts & task lists — Workshop steps now support filtering by journey/adventure tags, render GitHub-flavored alerts (> [!NOTE]), and display task-list checkboxes.
  • Workshop URL hash navigation — Browser back/forward now restores workshop state via URL hash encoding.
  • DeepSec & VulnHunter security scan workflows — On-demand and daily security scanning workflows added for continuous vulnerability detection.
  • errgroup for structured concurrency in MCP inspector — Replaces ad-hoc goroutine management with proper error propagation.

🐛 Bug Fixes & Improvements

  • tools.startup-timeout now propagates to gateway.startupTimeout — Fixes safeoutputs eviction on slow runners where the gateway was timing out before the tool server was ready.
  • OTEL_SERVICE_NAME respected — User-defined OpenTelemetry service names are no longer overridden when OTLP observability is enabled.
  • MCP CLI prompt list reflects --disable-builtin-mcps — The listed MCP servers now accurately reflect which servers are actually mounted.
  • logs tool fixed for missing workflow_name filter — Previously caused a context deadline exceeded error; now handled gracefully.
  • safe.directory trust bridged via GIT_CONFIG_* env vars — Fixes git operations in safe-outputs on restrictive runners.
  • partial_execution + terminal safe-output treated as success — Prevents false failure signals when an agent completes its final safe-output action after a partial execution state.
  • Stable cron schedule in make recompile — Pins --schedule-seed to eliminate drift in auto-upgrade lock files across recompiles.
  • #nosec justification separators normalized — - and — variants are now normalised to -- for consistent security annotation parsing.
  • close_issue and assign_to_agent payloads — Issue-intent metadata is now correctly nested in the payload structure.
  • update_issue MCP body length regression coverage — Added tests to guard against silent truncation above 10 KB.

⚡ Performance

  • parseEngineDefinitionFromJSON cached — Eliminates a per-compile JSON→YAML round-trip, reducing compilation overhead for workflows with engine definitions.
  • Reduced ambient context token usage — 4 workflows updated to use narrower context windows, lowering AI-credit burn.
  • Scheduled workflow staggering — Midnight batch workflows staggered to reduce peak AI-credit consumption.

🔒 Security

  • SHA-256 checksum pinned for sentrux binary install — Resolves RGS-018 supply-chain finding.
  • no-exec-interpolated-command ESLint rule — Flags shell commands constructed from interpolated strings.
  • no-github-request-interpolated-route extended — Now recognises global.getOctokit() aliases.
  • Cross-repo regex tightened (SEC-005) — Eliminates false positive on frontmatter_hash_pure.cjs.

🔧 New Linters

  • timenowsub — Flags time.Now().Sub(t) patterns that should be time.Since(t).
  • trimleftright — Detects distinct-character prefix/suffix bugs from strings.TrimLeft/TrimRight misuse.
  • appendoneelement — Catches single-element append patterns that could use assignment.
  • no-core-error-then-process-exit (ESLint) — Prevents error-then-exit anti-patterns in GitHub Scripts.

... (truncated)

Commits
  • 8b820ae fix: propagate tools.startup-timeout to gateway.startupTimeout (prevents safe...
  • bd3f5d9 fix: mode-specific intent guidance for all intent-aware safe-output mutations...
  • cdd7b86 [WIP] Fix failing GitHub Actions job for CLI completion (#46859)
  • deea8a4 Recognize global.getOctokit() aliases in `no-github-request-interpolated-ro...
  • 0d16d68 feat: mode-specific intent guidance for all safe-output mutation tools (#46861)
  • f1220ce chore: remove dead functions — 1 function removed (#46860)
  • 3ceb8ec feat(init): make --codespaces optional-value; grant discussions/issues write ...
  • 9dc71fb fix: nest issue-intent metadata correctly in close_issue and assign_to_agent ...
  • e03203a [eslint-factory] core-method-resolve: recognize function-parameter core bin...
  • f9ecca5 Replace in-doc workshop experience with external workshop repository link (#4...
  • Additional commits viewable in compare view

Updates actions/setup-dotnet from 5 to 6

Release notes

Sourced from actions/setup-dotnet's releases.

v6.0.0

What's Changed

New Contributors

Full Changelog: actions/setup-dotnet@v5...v6.0.0

v5.4.0

What's Changed

Enhancements

Documentation

Bug Fixes

Dependency Updates

New Contributors

Full Changelog: actions/setup-dotnet@v5...v5.4.0

v5.3.0

What's Changed

Enhancements

Dependency Updates

... (truncated)

Commits

Updates actions/setup-node from 6 to 7

Release notes

Sourced from actions/setup-node's releases.

v7.0.0

What's Changed

Enhancements:

Bug fixes:

Documentation updates:

Dependency update:

New Contributors

Full Changelog: actions/setup-node@v6...v7.0.0

v6.5.0

What's Changed

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

v6.4.0

What's Changed

Dependency updates:

New Contributors

Full Changelog: actions/setup-node@v6...v6.4.0

v6.3.0

What's Changed

Enhancements:

... (truncated)

Commits
  • 8207627 Migrate to ESM and upgrade dependencies (#1574)
  • 04be95c Add cache-primary-key and cache-matched-key as outputs (#1577)
  • 7c2c68d docs: Update caching recommendations to mitigate cache poisoning risks (#1567)
  • 6a61c03 Merge pull request #1569 from jasongin/update-actions-cache-5.1.0
  • 30eb73b Resolve high-severity audit issues
  • 4e1a87a Update dist
  • 360237f Strict equality
  • 4f8aac5 Bump @​actions/cache to 5.1.0, log cache write denied
  • f4a67bb Only use mirrorToken in getManifest if it's provided (#1548)
  • 0355742 Remove dummy NODE_AUTH_TOKEN export (#1558)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the actions group across 1 directory with 5 updates
cf650cc 
Bumps the actions group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `6` | `7` |
| [actions/setup-python](https://github.com/actions/setup-python) | `6` | `7` |
| [github/gh-aw](https://github.com/github/gh-aw) | `0.81.6` | `0.82.14` |
| [actions/setup-dotnet](https://github.com/actions/setup-dotnet) | `5` | `6` |
| [actions/setup-node](https://github.com/actions/setup-node) | `6` | `7` |



Updates `actions/checkout` from 6 to 7
- [Release notes](https://github.com/actions/checkout/releases)
- [Commits](actions/checkout@v6...v7)

Updates `actions/setup-python` from 6 to 7
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@v6...v7)

Updates `github/gh-aw` from 0.81.6 to 0.82.14
- [Release notes](https://github.com/github/gh-aw/releases)
- [Changelog](https://github.com/github/gh-aw/blob/main/CHANGELOG.md)
- [Commits](github/gh-aw@v0.81.6...v0.82.14)

Updates `actions/setup-dotnet` from 5 to 6
- [Release notes](https://github.com/actions/setup-dotnet/releases)
- [Commits](actions/setup-dotnet@v5...v6)

Updates `actions/setup-node` from 6 to 7
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@v6...v7)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/setup-python
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: github/gh-aw
  dependency-version: 0.82.14
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: actions/setup-dotnet
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/setup-node
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@azure-pipelines

azure-pipelines Bot commented Jul 21, 2026

Copy link
Copy Markdown
Azure Pipelines:
Successfully started running 1 pipeline(s).
1 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

@timotheeguerin
timotheeguerin enabled auto-merge July 21, 2026 20:12
@github-actions

github-actions Bot commented Jul 21, 2026

Copy link
Copy Markdown
Contributor

Python emitter diff

Baseline gh:424acf6b25304abb21ca8980c432849b97481068 vs this PR.

No changes to generated output.

Rendered diff: inline on the run summary, or the emitter-diff-html artifact.

Informational check (eng/emitter-diff); does not block the PR.

@timotheeguerin
timotheeguerin added this pull request to the merge queue Jul 21, 2026
@github-merge-queue
github-merge-queue Bot removed this pull request from the merge queue due to failed status checks Jul 21, 2026
@timotheeguerin
timotheeguerin added this pull request to the merge queue Jul 21, 2026
Merged via the queue into main with commit 63abfc2 Jul 21, 2026
29 checks passed
@timotheeguerin
timotheeguerin deleted the dependabot/github_actions/actions-bdf042b046 branch July 21, 2026 21:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@timotheeguerin timotheeguerin timotheeguerin approved these changes
@bterlson bterlson Awaiting requested review from bterlson
@markcowl markcowl Awaiting requested review from markcowl markcowl is a code owner
@witemple-msft witemple-msft Awaiting requested review from witemple-msft
@iscai-msft iscai-msft Awaiting requested review from iscai-msft iscai-msft is a code owner
@catalinaperalta catalinaperalta Awaiting requested review from catalinaperalta catalinaperalta is a code owner

Assignees

No one assigned

Labels

eng

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@timotheeguerin