From 5bd185d3134ed657358af77bbba8233adc96f191 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 5 Sep 2026 21:14:49 +0000 Subject: [PATCH 1/3] build: bump actions/checkout in the github-actions group Bumps the github-actions group with 1 update: [actions/checkout](https://github.com/actions/checkout). Updates `actions/checkout` from 5.1.0 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v5.1.0...3d3c42e5aac5ba805825da76410c181273ba90b1) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] --- .github/workflows/ci.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index f5653d4..99e6f53 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -93,7 +93,7 @@ jobs: steps: # actions/checkout v5.1.0 — pinned to a full-length commit SHA because this # org requires it; a tag or short SHA is rejected at "Set up job". - - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 - name: Install shellcheck run: sudo apt-get update && sudo apt-get install -y shellcheck @@ -117,7 +117,7 @@ jobs: steps: # actions/checkout v5.1.0 — pinned to a full-length commit SHA because this # org requires it; a tag or short SHA is rejected at "Set up job". - - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 - name: Install PSScriptAnalyzer shell: pwsh @@ -151,7 +151,7 @@ jobs: steps: # actions/checkout v5.1.0 — pinned to a full-length commit SHA because this # org requires it; a tag or short SHA is rejected at "Set up job". - - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 - name: jq — manifests are well-formed JSON run: | @@ -197,7 +197,7 @@ jobs: steps: # actions/checkout v5.1.0 — pinned to a full-length commit SHA because this # org requires it; a tag or short SHA is rejected at "Set up job". - - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # Relative links only. External URLs are deliberately NOT checked here: # GitHub and cursor.directory return 403/429 to CI runners, which would From db4299d9771045be9b7b9e583dd4c1102336b253 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Mon, 7 Sep 2026 08:40:48 +0000 Subject: [PATCH 2/3] ci: retitle checkout pin comments to v7.0.1 The four SHA pins already point at actions/checkout v7.0.1; the comments above them still said v5.1.0. Co-authored-by: ksextonmelodic --- .github/workflows/ci.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a49bb77..c83d7e9 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -91,7 +91,7 @@ jobs: if: ${{ !(github.event.pull_request.head.repo.full_name == github.repository && (contains(fromJSON('["labeled","unlabeled"]'), github.event.action) || (github.event.action == 'edited' && !github.event.changes.base))) }} runs-on: ubuntu-latest steps: - # actions/checkout v5.1.0 — pinned to a full-length commit SHA because this + # actions/checkout v7.0.1 — pinned to a full-length commit SHA because this # org requires it; a tag or short SHA is rejected at "Set up job". - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 @@ -115,7 +115,7 @@ jobs: if: ${{ !(github.event.pull_request.head.repo.full_name == github.repository && (contains(fromJSON('["labeled","unlabeled"]'), github.event.action) || (github.event.action == 'edited' && !github.event.changes.base))) }} runs-on: ubuntu-latest steps: - # actions/checkout v5.1.0 — pinned to a full-length commit SHA because this + # actions/checkout v7.0.1 — pinned to a full-length commit SHA because this # org requires it; a tag or short SHA is rejected at "Set up job". - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 @@ -149,7 +149,7 @@ jobs: if: ${{ !(github.event.pull_request.head.repo.full_name == github.repository && (contains(fromJSON('["labeled","unlabeled"]'), github.event.action) || (github.event.action == 'edited' && !github.event.changes.base))) }} runs-on: ubuntu-latest steps: - # actions/checkout v5.1.0 — pinned to a full-length commit SHA because this + # actions/checkout v7.0.1 — pinned to a full-length commit SHA because this # org requires it; a tag or short SHA is rejected at "Set up job". - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 @@ -195,7 +195,7 @@ jobs: if: ${{ !(github.event.pull_request.head.repo.full_name == github.repository && (contains(fromJSON('["labeled","unlabeled"]'), github.event.action) || (github.event.action == 'edited' && !github.event.changes.base))) }} runs-on: ubuntu-latest steps: - # actions/checkout v5.1.0 — pinned to a full-length commit SHA because this + # actions/checkout v7.0.1 — pinned to a full-length commit SHA because this # org requires it; a tag or short SHA is rejected at "Set up job". - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 From 407b0286983f2a41a2ef90ae810cd605be1f65dc Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Mon, 7 Sep 2026 08:40:48 +0000 Subject: [PATCH 3/3] ci: drop missing github_actions label from dependabot.yml An explicit labels list replaces Dependabot's defaults. github_actions is not in the org github-iac roster, so Dependabot could not apply it. Co-authored-by: ksextonmelodic --- .github/dependabot.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 79c9c03..cbcd7fe 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -9,12 +9,12 @@ updates: schedule: interval: weekly # An explicit labels: list replaces (not adds to) Dependabot's automatic - # labels, so the ecosystem-derived default is restated alongside - # dependencies. + # labels. Only `dependencies` is listed: the ecosystem default + # `github_actions` is not in this org's github-iac label roster, and + # Dependabot fails the apply with "label could not be found". # https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#labels labels: - dependencies - - github_actions # `ci-status` fails a pull request whose title is not Conventional Commits, # and Dependabot's default title carries no type, so the prefix is # required rather than cosmetic.