build(deps): bump the actions group with 4 updates (#8)

dependabot[bot] · web-flow · commit 157d257aa936 · 2026-07-19T11:30:39.000+01:00
Bumps the actions group with 4 updates: [hyperpolymath/a2ml-validate-action](https://github.com/hyperpolymath/a2ml-validate-action), [hyperpolymath/k9-validate-action](https://github.com/hyperpolymath/k9-validate-action), [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) and [softprops/action-gh-release](https://github.com/softprops/action-gh-release). Updates `hyperpolymath/a2ml-validate-action` from cb3c1e298169dc5ac2b42e257068b0fb5920cd5e to 55e8c28bab4e7f2399fdbd57a6da1051369f3847 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/hyperpolymath/a2ml-validate-action/blob/main/CHANGELOG.md">hyperpolymath/a2ml-validate-action's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <p>All notable changes to this project will be documented in this file.</p> <p>The format is based on <a href="https://keepachangelog.com/en/1.1.0/">Keep a Changelog</a>, and this project adheres to <a href="https://semver.org/spec/v2.0.0.html">Semantic Versioning</a>.</p>   <h2>[Unreleased]</h2> <h2>[1.0.0] - 2026-05-29</h2> <h3>Added</h3> <ul> <li>Initial Marketplace-ready composite action for validating <code>.a2ml</code> manifests.</li> <li>Configurable <code>path</code>, <code>strict</code>, and <code>paths-ignore</code> inputs.</li> <li>GitHub Actions outputs for scanned files, validation errors, and warnings.</li> </ul> <h3>Fixed</h3> <ul> <li>Allow local smoke runs outside GitHub Actions by defaulting missing <code>GITHUB_OUTPUT</code> to <code>/dev/null</code>.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/hyperpolymath/a2ml-validate-action/commit/55e8c28bab4e7f2399fdbd57a6da1051369f3847"><code>55e8c28</code></a> chore(deps): bump the actions group with 4 updates (<a href="https://redirect.github.com/hyperpolymath/a2ml-validate-action/issues/57">#57</a>)</li> <li><a href="https://github.com/hyperpolymath/a2ml-validate-action/commit/05bcb78917c09702e90ed18004298a6728753914"><code>05bcb78</code></a> ci: Secret Scanner caller must grant the reusable's job permissions (<a href="https://redirect.github.com/hyperpolymath/a2ml-validate-action/issues/56">#56</a>)</li> <li><a href="https://github.com/hyperpolymath/a2ml-validate-action/commit/e558e79200c06226e7b9477004d6792b9c215b33"><code>e558e79</code></a> fix(ci): clear OSSF Scorecard startup_failure (<a href="https://redirect.github.com/hyperpolymath/a2ml-validate-action/issues/55">#55</a>)</li> <li><a href="https://github.com/hyperpolymath/a2ml-validate-action/commit/a1898b7803d21f81eab564954980efef6f2a1c95"><code>a1898b7</code></a> Revert <a href="https://redirect.github.com/hyperpolymath/a2ml-validate-action/issues/53">#53</a>: TOML is not canonical A2ML (spec is S-expr/Djot-like) (<a href="https://redirect.github.com/hyperpolymath/a2ml-validate-action/issues/54">#54</a>)</li> <li><a href="https://github.com/hyperpolymath/a2ml-validate-action/commit/db22cd51f07eb7eac8ec0b2acd01bf7186ef1d56"><code>db22cd5</code></a> feat: canonical A2ML dialect = TOML (warn-by-default, enforce flag) (<a href="https://redirect.github.com/hyperpolymath/a2ml-validate-action/issues/53">#53</a>)</li> <li><a href="https://github.com/hyperpolymath/a2ml-validate-action/commit/7e1cd7ede4d8671db82106fc0a73d3a5842c4bca"><code>7e1cd7e</code></a> chore(deps): bump the actions group with 3 updates (<a href="https://redirect.github.com/hyperpolymath/a2ml-validate-action/issues/52">#52</a>)</li> <li><a href="https://github.com/hyperpolymath/a2ml-validate-action/commit/c14a51a4f3766e239b5b912332828474dc2ae103"><code>c14a51a</code></a> chore(deps): bump the actions group with 2 updates (<a href="https://redirect.github.com/hyperpolymath/a2ml-validate-action/issues/51">#51</a>)</li> <li><a href="https://github.com/hyperpolymath/a2ml-validate-action/commit/abcc1a0e99acae357af500685c0478c51327de60"><code>abcc1a0</code></a> fix(clade): correct CLADE uuid (deterministic v5, was template residue) (<a href="https://redirect.github.com/hyperpolymath/a2ml-validate-action/issues/50">#50</a>)</li> <li><a href="https://github.com/hyperpolymath/a2ml-validate-action/commit/4ae6b4828e55aa08db690b25db72427feea88bfa"><code>4ae6b48</code></a> docs: post-canon reference + factual fixes (<a href="https://redirect.github.com/hyperpolymath/a2ml-validate-action/issues/49">#49</a>)</li> <li><a href="https://github.com/hyperpolymath/a2ml-validate-action/commit/ac1392ac5ddb4cf3b015a16a6d9228efc825e0b7"><code>ac1392a</code></a> chore(hooks): version-controlled pre-commit + SPDX split by file-type (<a href="https://redirect.github.com/hyperpolymath/a2ml-validate-action/issues/48">#48</a>)</li> <li>Additional commits viewable in <a href="https://github.com/hyperpolymath/a2ml-validate-action/compare/cb3c1e298169dc5ac2b42e257068b0fb5920cd5e...55e8c28bab4e7f2399fdbd57a6da1051369f3847">compare view</a></li> </ul> </details> <br /> Updates `hyperpolymath/k9-validate-action` from 236f0035cc159051c8dd5dc7cd8af1e8cf961462 to 7c3c0e9fa5165626e74ecce78109b3295b798b92 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/hyperpolymath/k9-validate-action/blob/main/CHANGELOG.md">hyperpolymath/k9-validate-action's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <p>All notable changes to this project will be documented in this file.</p> <p>The format is based on <a href="https://keepachangelog.com/en/1.1.0/">Keep a Changelog</a>, and this project adheres to <a href="https://semver.org/spec/v2.0.0.html">Semantic Versioning</a>.</p>   <h2>[Unreleased]</h2> <h2>[1.0.0] - 2026-05-29</h2> <h3>Added</h3> <ul> <li>Initial Marketplace-ready composite action for validating <code>.k9</code> and <code>.k9.ncl</code> files.</li> <li>Configurable <code>path</code>, <code>strict</code>, and <code>paths-ignore</code> inputs.</li> <li>GitHub Actions outputs for scanned files, validation errors, and warnings.</li> </ul> <h3>Fixed</h3> <ul> <li>Allow local smoke runs outside GitHub Actions by defaulting missing <code>GITHUB_OUTPUT</code> to <code>/dev/null</code>.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/hyperpolymath/k9-validate-action/commit/7c3c0e9fa5165626e74ecce78109b3295b798b92"><code>7c3c0e9</code></a> chore(deps): bump the actions group with 5 updates (<a href="https://redirect.github.com/hyperpolymath/k9-validate-action/issues/36">#36</a>)</li> <li><a href="https://github.com/hyperpolymath/k9-validate-action/commit/bddcd9109ee96f9ea3fdb4bf51084fe9cd0909ce"><code>bddcd91</code></a> ci: Secret Scanner caller must grant the reusable's job permissions (<a href="https://redirect.github.com/hyperpolymath/k9-validate-action/issues/35">#35</a>)</li> <li><a href="https://github.com/hyperpolymath/k9-validate-action/commit/3e091a341022b8c1bfa8cc86ebc1271bd20c1fdb"><code>3e091a3</code></a> chore(deps): bump the actions group with 4 updates (<a href="https://redirect.github.com/hyperpolymath/k9-validate-action/issues/34">#34</a>)</li> <li><a href="https://github.com/hyperpolymath/k9-validate-action/commit/91e2b6b170fb1ed7232dcdf404922d89a64be5c0"><code>91e2b6b</code></a> fix(clade): correct identity uuid (deterministic v5) (<a href="https://redirect.github.com/hyperpolymath/k9-validate-action/issues/33">#33</a>)</li> <li><a href="https://github.com/hyperpolymath/k9-validate-action/commit/b9acd2a2987e5cd175cd9d841cd245961171b258"><code>b9acd2a</code></a> chore(deps): bump the actions group with 2 updates (<a href="https://redirect.github.com/hyperpolymath/k9-validate-action/issues/32">#32</a>)</li> <li><a href="https://github.com/hyperpolymath/k9-validate-action/commit/eea3a8488e7b6bc6fe60e1691fd5235c0f6310e1"><code>eea3a84</code></a> docs(readme): convert README.adoc -&gt; Markdown (renders on Glama/profile/commu...</li> <li><a href="https://github.com/hyperpolymath/k9-validate-action/commit/9f9561436b302ee445fd589bb41ed63f3e62e4cd"><code>9f95614</code></a> chore(ci): add dormant push-email notification workflow (<a href="https://redirect.github.com/hyperpolymath/k9-validate-action/issues/30">#30</a>)</li> <li><a href="https://github.com/hyperpolymath/k9-validate-action/commit/90ac96b05add68467b4db4867153a1fca7256d30"><code>90ac96b</code></a> chore(clade): backfill [status] lifecycle block (<a href="https://redirect.github.com/hyperpolymath/k9-validate-action/issues/29">#29</a>)</li> <li><a href="https://github.com/hyperpolymath/k9-validate-action/commit/814972979e84ca836496698d5195441d9cb35dc4"><code>8149729</code></a> chore(licence): normalise to MPL-2.0 + CC-BY-SA-4.0 (canonical pair) (<a href="https://redirect.github.com/hyperpolymath/k9-validate-action/issues/28">#28</a>)</li> <li><a href="https://github.com/hyperpolymath/k9-validate-action/commit/4a64df71896bc3e0f27844af3e74009f8d3429d3"><code>4a64df7</code></a> chore(ci): bump standards reusable workflow pins (<a href="https://redirect.github.com/hyperpolymath/k9-validate-action/issues/27">#27</a>)</li> <li>Additional commits viewable in <a href="https://github.com/hyperpolymath/k9-validate-action/compare/236f0035cc159051c8dd5dc7cd8af1e8cf961462...7c3c0e9fa5165626e74ecce78109b3295b798b92">compare view</a></li> </ul> </details> <br /> Updates `trufflesecurity/trufflehog` from 3.95.8 to 3.95.9 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/trufflesecurity/trufflehog/releases">trufflesecurity/trufflehog's releases</a>.</em></p> <blockquote> <h2>v3.95.9</h2> <h2>What's Changed</h2> <ul> <li>feat: add OpenRouter detector by <a href="https://github.com/McPatate"><code>@​McPatate</code></a> in <a href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4500">trufflesecurity/trufflehog#4500</a></li> <li>Integrations fully codeowns detectors by <a href="https://github.com/trufflesteeeve"><code>@​trufflesteeeve</code></a> in <a href="https://redirect.github.com/trufflesecurity/trufflehog/pull/5104">trufflesecurity/trufflehog#5104</a></li> <li>[INS-332] Add New Relic Insights Insert key detector by <a href="https://github.com/mustansir14"><code>@​mustansir14</code></a> in <a href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4778">trufflesecurity/trufflehog#4778</a></li> <li>[INS-351] Added Duffel Token Detector by <a href="https://github.com/MuneebUllahKhan222"><code>@​MuneebUllahKhan222</code></a> in <a href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4795">trufflesecurity/trufflehog#4795</a></li> <li>[INS-341] Added Shippo detector by <a href="https://github.com/MuneebUllahKhan222"><code>@​MuneebUllahKhan222</code></a> in <a href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4820">trufflesecurity/trufflehog#4820</a></li> <li>[INS-467] Add IPinfo detector to default detectors list by <a href="https://github.com/mustansir14"><code>@​mustansir14</code></a> in <a href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4970">trufflesecurity/trufflehog#4970</a></li> <li>fix: reject --include-repos/--exclude-repos with --repo in github scan by <a href="https://github.com/kashifkhan0771"><code>@​kashifkhan0771</code></a> in <a href="https://redirect.github.com/trufflesecurity/trufflehog/pull/5112">trufflesecurity/trufflehog#5112</a></li> <li>[INS-468] Add improved lob detector to defaults.go by <a href="https://github.com/mustansir14"><code>@​mustansir14</code></a> in <a href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4971">trufflesecurity/trufflehog#4971</a></li> <li>feat(action): add image input to allow registry mirror overrides by <a href="https://github.com/eightseventhreethree"><code>@​eightseventhreethree</code></a> in <a href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4965">trufflesecurity/trufflehog#4965</a></li> <li>feat: Support archived repo exclusion from GH org scans by <a href="https://github.com/hibare"><code>@​hibare</code></a> in <a href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4875">trufflesecurity/trufflehog#4875</a></li> <li>[INT-715] Retry transient failures when verifying OpenAI keys by <a href="https://github.com/bill-rich"><code>@​bill-rich</code></a> in <a href="https://redirect.github.com/trufflesecurity/trufflehog/pull/5117">trufflesecurity/trufflehog#5117</a></li> <li>[INS-410] Added batch token detector by <a href="https://github.com/MuneebUllahKhan222"><code>@​MuneebUllahKhan222</code></a> in <a href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4824">trufflesecurity/trufflehog#4824</a></li> <li>[INT-650] Don't log as error when git diff is too long by <a href="https://github.com/bill-rich"><code>@​bill-rich</code></a> in <a href="https://redirect.github.com/trufflesecurity/trufflehog/pull/5113">trufflesecurity/trufflehog#5113</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/McPatate"><code>@​McPatate</code></a> made their first contribution in <a href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4500">trufflesecurity/trufflehog#4500</a></li> <li><a href="https://github.com/eightseventhreethree"><code>@​eightseventhreethree</code></a> made their first contribution in <a href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4965">trufflesecurity/trufflehog#4965</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/trufflesecurity/trufflehog/compare/v3.95.8...v3.95.9">https://github.com/trufflesecurity/trufflehog/compare/v3.95.8...v3.95.9</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/trufflesecurity/trufflehog/commit/27b0417c16317ca9a472a9a8092acce143b49c55"><code>27b0417</code></a> Don't log as error when git diff is too long (<a href="https://redirect.github.com/trufflesecurity/trufflehog/issues/5113">#5113</a>)</li> <li><a href="https://github.com/trufflesecurity/trufflehog/commit/d328285962406cf0c11e593fdce224a0e1334038"><code>d328285</code></a> [INS-410] Added batch token detector (<a href="https://redirect.github.com/trufflesecurity/trufflehog/issues/4824">#4824</a>)</li> <li><a href="https://github.com/trufflesecurity/trufflehog/commit/33d9daddb1f521c32e89aeb2ca5fce45e9980aac"><code>33d9dad</code></a> [INT-715] Retry transient failures when verifying OpenAI keys (<a href="https://redirect.github.com/trufflesecurity/trufflehog/issues/5117">#5117</a>)</li> <li><a href="https://github.com/trufflesecurity/trufflehog/commit/d7dcc6d3fe80206bc1bdcfb15db1dd8d890956fd"><code>d7dcc6d</code></a> feat: Support archived repo exclusion from GH org scans (<a href="https://redirect.github.com/trufflesecurity/trufflehog/issues/4875">#4875</a>)</li> <li><a href="https://github.com/trufflesecurity/trufflehog/commit/f845f184e44d45a8f5aa189a85bad263cbb18d60"><code>f845f18</code></a> feat(action): add image input to allow registry mirror overrides (<a href="https://redirect.github.com/trufflesecurity/trufflehog/issues/4965">#4965</a>)</li> <li><a href="https://github.com/trufflesecurity/trufflehog/commit/6c979705861339b7e6ca6229545904769240d75f"><code>6c97970</code></a> [INS-468] Add improved lob detector to defaults.go (<a href="https://redirect.github.com/trufflesecurity/trufflehog/issues/4971">#4971</a>)</li> <li><a href="https://github.com/trufflesecurity/trufflehog/commit/1675e1743f7ad74b11c91f232a3ed131f5281a27"><code>1675e17</code></a> fix: reject --include-repos/--exclude-repos with --repo in github scan (<a href="https://redirect.github.com/trufflesecurity/trufflehog/issues/5112">#5112</a>)</li> <li><a href="https://github.com/trufflesecurity/trufflehog/commit/5c2762667cca2c6bc9bce2ff6e2a04eb22fbd453"><code>5c27626</code></a> [INS-467] Add IPinfo detector to default detectors list (<a href="https://redirect.github.com/trufflesecurity/trufflehog/issues/4970">#4970</a>)</li> <li><a href="https://github.com/trufflesecurity/trufflehog/commit/53e63918ad831e2dfd8d568c07071912d2fbf05f"><code>53e6391</code></a> [INS-341] Added Shippo detector (<a href="https://redirect.github.com/trufflesecurity/trufflehog/issues/4820">#4820</a>)</li> <li><a href="https://github.com/trufflesecurity/trufflehog/commit/d3b54872981534871af5a94b33ca9ae9bc540148"><code>d3b5487</code></a> [INS-351] Added Duffel Token Detector (<a href="https://redirect.github.com/trufflesecurity/trufflehog/issues/4795">#4795</a>)</li> <li>Additional commits viewable in <a href="https://github.com/trufflesecurity/trufflehog/compare/00155c9dc586f34d189adc83d3ac2698c2ec551f...27b0417c16317ca9a472a9a8092acce143b49c55">compare view</a></li> </ul> </details> <br /> Updates `softprops/action-gh-release` from 3.0.1 to 3.0.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/softprops/action-gh-release/releases">softprops/action-gh-release's releases</a>.</em></p> <blockquote> <h2>v3.0.2</h2> <p><code>3.0.2</code> is a patch release focused on release reliability and compatibility. It reuses existing draft releases when publishing prereleases, supports replacing release assets on Gitea, hardens streamed asset uploads, and provides clearer release-creation diagnostics. It also includes TypeScript, coverage, and tooling maintenance merged since <code>3.0.1</code>.</p> <p>This release fixes <a href="https://redirect.github.com/softprops/action-gh-release/issues/795">#795</a>, <a href="https://redirect.github.com/softprops/action-gh-release/issues/438">#438</a>, and <a href="https://redirect.github.com/softprops/action-gh-release/issues/803">#803</a>. The upload transport hardening covers the historical failure reported in <a href="https://redirect.github.com/softprops/action-gh-release/issues/790">#790</a>, although current hosted Node 24 runners did not reproduce it naturally. The diagnostics work is related to <a href="https://redirect.github.com/softprops/action-gh-release/issues/786">#786</a> and does not claim a reproducible release-creation fix.</p> <h2>What's Changed</h2> <h3>Exciting New Features 🎉</h3> <ul> <li>feat: improve release error reporting and test coverage by <a href="https://github.com/chenrui333"><code>@​chenrui333</code></a> in <a href="https://redirect.github.com/softprops/action-gh-release/pull/813">softprops/action-gh-release#813</a></li> </ul> <h3>Bug fixes 🐛</h3> <ul> <li>fix: publish existing draft releases as prereleases by <a href="https://github.com/godfengliang"><code>@​godfengliang</code></a> in <a href="https://redirect.github.com/softprops/action-gh-release/pull/801">softprops/action-gh-release#801</a></li> <li>fix: upload small checksum assets reliably by <a href="https://github.com/chenrui333"><code>@​chenrui333</code></a> in <a href="https://redirect.github.com/softprops/action-gh-release/pull/815">softprops/action-gh-release#815</a></li> <li>fix: replace existing release assets on Gitea by <a href="https://github.com/chenrui333"><code>@​chenrui333</code></a> in <a href="https://redirect.github.com/softprops/action-gh-release/pull/816">softprops/action-gh-release#816</a></li> <li>fix: clarify release creation 404 errors by <a href="https://github.com/chenrui333"><code>@​chenrui333</code></a> in <a href="https://redirect.github.com/softprops/action-gh-release/pull/817">softprops/action-gh-release#817</a></li> </ul> <h3>Other Changes 🔄</h3> <ul> <li>chore(deps): upgrade TypeScript to 7 by <a href="https://github.com/chenrui333"><code>@​chenrui333</code></a> in <a href="https://redirect.github.com/softprops/action-gh-release/pull/812">softprops/action-gh-release#812</a></li> <li>chore(deps): remove unused TypeScript tooling by <a href="https://github.com/chenrui333"><code>@​chenrui333</code></a> in <a href="https://redirect.github.com/softprops/action-gh-release/pull/814">softprops/action-gh-release#814</a></li> <li>dependency, Node 24 pin, and CI maintenance merged since <code>3.0.1</code></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md">softprops/action-gh-release's changelog</a>.</em></p> <blockquote> <h2>3.0.2</h2> <p><code>3.0.2</code> is a patch release focused on release reliability and compatibility. It reuses existing draft releases when publishing prereleases, supports replacing release assets on Gitea, hardens streamed asset uploads, and provides clearer release-creation diagnostics. It also includes TypeScript, coverage, and tooling maintenance merged since <code>3.0.1</code>.</p> <p>This release fixes <a href="https://redirect.github.com/softprops/action-gh-release/issues/795">#795</a>, <a href="https://redirect.github.com/softprops/action-gh-release/issues/438">#438</a>, and <a href="https://redirect.github.com/softprops/action-gh-release/issues/803">#803</a>. The upload transport hardening covers the historical failure reported in <a href="https://redirect.github.com/softprops/action-gh-release/issues/790">#790</a>, although current hosted Node 24 runners did not reproduce it naturally. The diagnostics work is related to <a href="https://redirect.github.com/softprops/action-gh-release/issues/786">#786</a> and does not claim a reproducible release-creation fix.</p> <h2>What's Changed</h2> <h3>Exciting New Features 🎉</h3> <ul> <li>feat: improve release error reporting and test coverage by <a href="https://github.com/chenrui333"><code>@​chenrui333</code></a> in <a href="https://redirect.github.com/softprops/action-gh-release/pull/813">softprops/action-gh-release#813</a></li> </ul> <h3>Bug fixes 🐛</h3> <ul> <li>fix: publish existing draft releases as prereleases by <a href="https://github.com/godfengliang"><code>@​godfengliang</code></a> in <a href="https://redirect.github.com/softprops/action-gh-release/pull/801">softprops/action-gh-release#801</a></li> <li>fix: upload small checksum assets reliably by <a href="https://github.com/chenrui333"><code>@​chenrui333</code></a> in <a href="https://redirect.github.com/softprops/action-gh-release/pull/815">softprops/action-gh-release#815</a></li> <li>fix: replace existing release assets on Gitea by <a href="https://github.com/chenrui333"><code>@​chenrui333</code></a> in <a href="https://redirect.github.com/softprops/action-gh-release/pull/816">softprops/action-gh-release#816</a></li> <li>fix: clarify release creation 404 errors by <a href="https://github.com/chenrui333"><code>@​chenrui333</code></a> in <a href="https://redirect.github.com/softprops/action-gh-release/pull/817">softprops/action-gh-release#817</a></li> </ul> <h3>Other Changes 🔄</h3> <ul> <li>chore(deps): upgrade TypeScript to 7 by <a href="https://github.com/chenrui333"><code>@​chenrui333</code></a> in <a href="https://redirect.github.com/softprops/action-gh-release/pull/812">softprops/action-gh-release#812</a></li> <li>chore(deps): remove unused TypeScript tooling by <a href="https://github.com/chenrui333"><code>@​chenrui333</code></a> in <a href="https://redirect.github.com/softprops/action-gh-release/pull/814">softprops/action-gh-release#814</a></li> <li>dependency, Node 24 pin, and CI maintenance merged since <code>3.0.1</code></li> </ul> <h2>3.0.1</h2> <ul> <li>maintenance release with updated dependencies</li> </ul> <h2>3.0.0</h2> <p><code>3.0.0</code> is a major release that moves the action runtime from Node 20 to Node 24. Use <code>v3</code> on GitHub-hosted runners and self-hosted fleets that already support the Node 24 Actions runtime. <code>v2.6.2</code> was the final Node 20-compatible release and is no longer maintained or supported.</p> <h2>What's Changed</h2> <h3>Other Changes 🔄</h3> <ul> <li>Move the action runtime and bundle target to Node 24</li> <li>Update <code>@types/node</code> to the Node 24 line and allow future Dependabot updates</li> <li>Keep the floating major tag on <code>v3</code>; freeze <code>v2</code> at the final <code>v2.6.2</code> release</li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/softprops/action-gh-release/commit/3d0d9888cb7fd7b750713d6e236d1fcb99157228"><code>3d0d988</code></a> release 3.0.2 (<a href="https://redirect.github.com/softprops/action-gh-release/issues/818">#818</a>)</li> <li><a href="https://github.com/softprops/action-gh-release/commit/7e13ed4ac596a4adf801d3812be5a089356949aa"><code>7e13ed4</code></a> fix: clarify release creation 404 errors (<a href="https://redirect.github.com/softprops/action-gh-release/issues/817">#817</a>)</li> <li><a href="https://github.com/softprops/action-gh-release/commit/e6c70a53cf67373fbff7eeebca7782b4fe8f106c"><code>e6c70a5</code></a> fix: replace existing release assets on Gitea (<a href="https://redirect.github.com/softprops/action-gh-release/issues/816">#816</a>)</li> <li><a href="https://github.com/softprops/action-gh-release/commit/f3453378888d5ef6208e2788af1c5ba50d8a898d"><code>f345337</code></a> fix: publish existing draft releases as prereleases (<a href="https://redirect.github.com/softprops/action-gh-release/issues/801">#801</a>)</li> <li><a href="https://github.com/softprops/action-gh-release/commit/d8a89a206684ded8435bf16d6f698bf04ab05164"><code>d8a89a2</code></a> fix: upload small checksum assets reliably (<a href="https://redirect.github.com/softprops/action-gh-release/issues/815">#815</a>)</li> <li><a href="https://github.com/softprops/action-gh-release/commit/45ece40c3178522904ac6c51c21d8a4e3565f3c8"><code>45ece40</code></a> chore(deps): remove unused TypeScript tooling (<a href="https://redirect.github.com/softprops/action-gh-release/issues/814">#814</a>)</li> <li><a href="https://github.com/softprops/action-gh-release/commit/f6b913c3f95302d88e8ef7cb2859c2e7656aa01e"><code>f6b913c</code></a> feat: improve release error reporting and test coverage (<a href="https://redirect.github.com/softprops/action-gh-release/issues/813">#813</a>)</li> <li><a href="https://github.com/softprops/action-gh-release/commit/15f193d7d8aa9623b5181913a31fafceb4e8cef9"><code>15f193d</code></a> chore(deps): upgrade TypeScript to 7 (<a href="https://redirect.github.com/softprops/action-gh-release/issues/812">#812</a>)</li> <li><a href="https://github.com/softprops/action-gh-release/commit/cc8268d46a81d57ec9b061f27b0dd68ebd7fb17f"><code>cc8268d</code></a> chore(deps): bump actions/checkout in the github-actions group (<a href="https://redirect.github.com/softprops/action-gh-release/issues/810">#810</a>)</li> <li><a href="https://github.com/softprops/action-gh-release/commit/fd0ed1e85b6730f87f5c67d7355751c46ad513d6"><code>fd0ed1e</code></a> chore(deps): bump the npm group with 3 updates (<a href="https://redirect.github.com/softprops/action-gh-release/issues/811">#811</a>)</li> <li>Additional commits viewable in <a href="https://github.com/softprops/action-gh-release/compare/718ea10b132b3b2eba29c1007bb80653f286566b...3d0d9888cb7fd7b750713d6e236d1fcb99157228">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml
@@ -42,7 +42,7 @@ jobs:
 
       - name: Validate A2ML manifests
         if: steps.detect.outputs.count > 0
-        uses: hyperpolymath/a2ml-validate-action@cb3c1e298169dc5ac2b42e257068b0fb5920cd5e # main
+        uses: hyperpolymath/a2ml-validate-action@55e8c28bab4e7f2399fdbd57a6da1051369f3847 # main
         with:
           path: '.'
           strict: 'false'
@@ -91,7 +91,7 @@ jobs:
 
       - name: Validate K9 contracts
         if: steps.detect.outputs.k9_count > 0
-        uses: hyperpolymath/k9-validate-action@236f0035cc159051c8dd5dc7cd8af1e8cf961462 # main
+        uses: hyperpolymath/k9-validate-action@7c3c0e9fa5165626e74ecce78109b3295b798b92 # main
         with:
           path: '.'
           strict: 'false'
diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml
@@ -26,7 +26,7 @@ jobs:
         run: |
           find . -type f -perm /111 -name "*.sh" | head -10 || true
       - name: Check for secrets
-        uses: trufflesecurity/trufflehog@00155c9dc586f34d189adc83d3ac2698c2ec551f # v3.93.3
+        uses: trufflesecurity/trufflehog@27b0417c16317ca9a472a9a8092acce143b49c55 # v3.93.3
         with:
           path: ./
           base: ${{ github.event.pull_request.base.sha || github.event.before }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -130,7 +130,7 @@ jobs:
       #     name: release-artifacts
       #     path: artifacts/
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v2
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v2
         with:
           body: ${{ needs.changelog.outputs.changelog }}
           draft: false
diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
@@ -21,6 +21,6 @@ jobs:
         with:
           fetch-depth: 0
       - name: TruffleHog Secret Scan
-        uses: trufflesecurity/trufflehog@00155c9dc586f34d189adc83d3ac2698c2ec551f # v3.95.8
+        uses: trufflesecurity/trufflehog@27b0417c16317ca9a472a9a8092acce143b49c55 # v3.95.9
         with:
           extra_args: --only-verified --fail
