Skip to content

chore(deps): bump the actions-dependencies group with 4 updates#358

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-dependencies-0d4e60f6a5
Open

chore(deps): bump the actions-dependencies group with 4 updates#358
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-dependencies-0d4e60f6a5

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 10, 2026

Copy link
Copy Markdown
Contributor

Bumps the actions-dependencies group with 4 updates: actions/checkout, astral-sh/setup-uv, github/gh-aw and github/gh-aw-actions.

Updates actions/checkout from 6.0.2 to 6.0.3

Release notes

Sourced from actions/checkout's releases.

v6.0.3

What's Changed

New Contributors

Full Changelog: actions/checkout@v6...v6.0.3

Changelog

Sourced from actions/checkout's changelog.

Changelog

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

v4.2.0

v4.1.7

... (truncated)

Commits

Updates astral-sh/setup-uv from 8.1.0 to 8.2.0

Release notes

Sourced from astral-sh/setup-uv's releases.

v8.2.0 🌈 New inputs quiet and download-from-astral-mirror

Changes

This release brings two new inputs and a few bug fixes.

New inputs

Lets talk about the new inputs first.

quiet

Pretty simple. It turns of all info loggings. Useful if you use this in a composite action and are not interested in all the details. In the upcoming releases we will add log groups to fully implement support for "less noise"

[!NOTE]
Warnings and errors are always logged.

download-from-astral-mirror

In some cases you may want to directly use the fallback of checking for available versions and downloading releases from GitHub instead of using the astral.sh mirror. Setting download-from-astral-mirror: false allows you to do that.

Bugfixes

When using the astral.sh mirror to query available versions and download releases (done by default) we now stop sending the GitHub token in the header. The mirror never looked at it but we shouldn't be handing out that data even if it is just a short lived token. All other bugfixes try to limit the impact of failed GitHub queries due to retries and other faults.

We couldn't pinpoint all rootcauses yet but added more logging for error cases to track them down.

🐛 Bug fixes

🚀 Enhancements

🧰 Maintenance

... (truncated)

Commits
  • fac544c chore(deps): roll up dependabot updates (#903)
  • 7390f77 docs: update dependabot rollup biome guidance (#902)
  • 363c64a chore(deps): roll up dependabot updates (#901)
  • c4fcbaf chore(deps): bump release-drafter/release-drafter from 7.3.0 to 7.3.1 (#900)
  • 8e642c5 chore: update known checksums for 0.11.18 (#899)
  • a92cb43 Add quiet input to suppress info-level log output (#898)
  • e07f2ac chore(deps): bump eifinger/actionlint-action from 1.10.1 to 1.10.2 (#842)
  • bc4034e chore(deps): bump github/codeql-action from 4.35.4 to 4.36.0 (#893)
  • df42d4f chore(deps): bump zizmorcore/zizmor-action from 0.5.5 to 0.5.6 (#891)
  • b9c8c4c feat: add download-from-astral-mirror input (#897)
  • Additional commits viewable in compare view

Updates github/gh-aw from 0.76.1 to 0.77.5

Release notes

Sourced from github/gh-aw's releases.

v0.77.5

🌟 Release Highlights

This release tightens the daily effective-workflow guardrail with smarter configuration gating, structured diagnostics, and a bug fix for artifact client setup — plus a project-level UTC offset feature for more accurate timestamps across timezones.

✨ What's New

  • Project UTC offset for timestamps (#36142) — Rendered timestamps and expiration messages now respect a configured project UTC offset, so deadlines and expiry notices display correctly for teams in any timezone.
  • Structured diagnostics in daily ET guardrail (#36164) — The daily effective-workflow guardrail now emits structured diagnostic output, making it easier to understand and debug guardrail evaluation results.
  • close_discussion safe output in Daily Regulatory workflow (#36155) — The Daily Regulatory workflow can now close discussions as part of its safe-output actions, completing the full discussion lifecycle.
  • New fmterrorfnoverbs linter (#36146) — A new Go linter enforces correct verb usage in fmt.Errorf calls, catching a common class of formatting mistakes at lint time.

🐛 Bug Fixes & Improvements

  • Gate ET guardrail on explicit configuration (#36179) — The daily effective-workflow guardrail and its artifact client setup are now only activated when explicitly configured, preventing unnecessary overhead in workflows that do not use this feature.
  • Fix @actions/artifact install for ET guardrail (#36153) — Resolved a missing dependency that caused failures when the daily-effective-workflow guardrail was enabled.
  • Deploy command refactor (#36144) — Deploy command orchestration in pkg/cli was refactored to satisfy largefunc linter limits, improving maintainability without changing behavior.
  • Parser test coverage (#36149) — Frontmatter extraction tests migrated to testify with additional coverage, strengthening the parser test suite.

For complete details, see CHANGELOG.

Generated by 🚀 Release · sonnet46 659.7K


What's Changed

Full Changelog: github/gh-aw@v0.77.4...v0.77.5

v0.77.4

🌟 Release Highlights

This release delivers Anthropic WIF authentication, a new copilot-sdk engine, expanded aw.yml manifest capabilities, and a battery of reliability fixes across safe-outputs, threat-detection, and workflow compilation.

✨ What's New

... (truncated)

Commits
  • f990bbb Gate daily ET guardrail and artifact client setup on explicit configuration (...
  • ff60ee5 Weekly blog post – 2026-06-01 (#36178)
  • 4f17e34 Add structured diagnostics to the daily workflow ET guardrail (#36164)
  • 65d045e [blog] Agent of the Day – 2026-06-01 (#36158)
  • 7b11cb6 Enable close_discussion safe output in Daily Regulatory workflow (#36155)
  • faa33b8 test(parser): migrate frontmatter_extraction_test.go to testify + add missing...
  • 73ad414 Refactor deploy command orchestration to satisfy largefunc limits in `pkg/cli...
  • e270a5c [linter-miner] feat(linters): add fmterrorfnoverbs linter (#36146)
  • 9f10a06 Fix: install @​actions/artifact when daily-effective-workflow guardrail is con...
  • ecca252 Add project UTC offset support for rendered timestamps and expiration message...
  • Additional commits viewable in compare view

Updates github/gh-aw-actions from 0.74.8 to 0.78.1

Release notes

Sourced from github/gh-aw-actions's releases.

v0.78.1

Sync of actions from gh-aw at v0.78.1.

v0.78.0

Sync of actions from gh-aw at v0.78.0.

v0.77.6

Sync of actions from gh-aw at v0.77.6.

v0.77.5

Sync of actions from gh-aw at v0.77.5.

v0.77.4

Sync of actions from gh-aw at v0.77.4.

v0.77.3

Sync of actions from gh-aw at v0.77.3.

v0.77.2

Sync of actions from gh-aw at v0.77.2.

v0.77.1

Sync of actions from gh-aw at v0.77.1.

v0.77.0

Sync of actions from gh-aw at v0.77.0.

v0.76.1

Sync of actions from gh-aw at v0.76.1.

v0.76.0

Sync of actions from gh-aw at v0.76.0.

v0.75.4

Sync of actions from gh-aw at v0.75.4.

v0.75.3

Sync of actions from gh-aw at v0.75.3.

v0.75.2

Sync of actions from gh-aw at v0.75.2.

v0.75.1

Sync of actions from gh-aw at v0.75.1.

v0.75.0

Sync of actions from gh-aw at v0.75.0.

v0.74.9

Sync of actions from gh-aw at v0.74.9.

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the actions-dependencies group with 4 updates: [actions/checkout](https://github.com/actions/checkout), [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv), [github/gh-aw](https://github.com/github/gh-aw) and [github/gh-aw-actions](https://github.com/github/gh-aw-actions).


Updates `actions/checkout` from 6.0.2 to 6.0.3
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@de0fac2...df4cb1c)

Updates `astral-sh/setup-uv` from 8.1.0 to 8.2.0
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@0880764...fac544c)

Updates `github/gh-aw` from 0.76.1 to 0.77.5
- [Release notes](https://github.com/github/gh-aw/releases)
- [Changelog](https://github.com/github/gh-aw/blob/main/CHANGELOG.md)
- [Commits](github/gh-aw@58d1bed...f990bbb)

Updates `github/gh-aw-actions` from 0.74.8 to 0.78.1
- [Release notes](https://github.com/github/gh-aw-actions/releases)
- [Changelog](https://github.com/github/gh-aw-actions/blob/main/CHANGELOG.md)
- [Commits](github/gh-aw-actions@efa5584...73ed520)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions-dependencies
- dependency-name: astral-sh/setup-uv
  dependency-version: 8.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-dependencies
- dependency-name: github/gh-aw
  dependency-version: 0.77.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-dependencies
- dependency-name: github/gh-aw-actions
  dependency-version: 0.78.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jun 10, 2026
@github-actions

Copy link
Copy Markdown

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant