[dependabot]

Bumps jdx/mr-boxington-action from 1.5.0 to 1.7.2.

Release notes

Sourced from jdx/mr-boxington-action's releases.

v1.7.2: Fix isolated objects-cache cleanup with mbx 1.22 and add clean-target-before-export

Cleanup of the isolated objects cache now works with the read-only object trees that mbx 1.22 creates. A new opt-in input, clean-target-before-export, frees runner disk space before the bundle is exported. Both changes apply only with isolate-objects-cache: true.

Added

• clean-target-before-export input (#68, @​donbeave). Defaults to false. When set, the post step runs mbx clean for the configured workspace just before it exports the isolated objects bundle. This removes the workspace's managed Cargo target and learned incremental state, so the target and the staged bundle are not both on disk at the same time. The mbx action results and objects stay in the isolated store and are exported as usual.

  - uses: jdx/mr-boxington-action@v1
    with:
      github-cache-mode: objects
      isolate-objects-cache: true
      clean-target-before-export: true

  The input requires isolate-objects-cache: true, and setup fails without it. Cleanup runs only when the action is going to save after a cache miss. Restore-only runs and exact cache hits skip it. If cleanup fails, the action doesn't export the bundle. Enable this input only when no later step in the job needs the target tree. The disk-usage diagnostics also record a sample after cleanup and before export.

Fixed

• Removing isolated objects-cache directories with mbx 1.22 (#62, @​donbeave). mbx 1.22 creates object-cache OUT_DIR trees that are read-only. Because of this, the action could not delete the isolated store or bundle after a successful import or during post-step cleanup. The action now restores owner write access across its own tree before deleting it. On Windows, it also clears the read-only flag on files. Symlinks inside the tree are not followed, so their targets outside the tree are left unchanged.

Full Changelog: jdx/mr-boxington-action@v1.7.1...v1.7.2

v1.7.1: More accurate disk-usage reporting in isolated objects-cache mode

Fixes the disk-usage diagnostics that the post step logs when isolate-objects-cache: true is set. Cache restore and save behavior is unchanged.

Fixed

• Disk-usage summary for isolate-objects-cache (#60, @​donbeave). The Objects cache sample summary in the post step is now more accurate and more reliable:
  • The action now waits for any sample still in progress and takes one last sample before it prints the summary. Before, the summary could be printed before sampling had finished, so it could miss the final disk usage.
  • When a diagnostic sample fails, the failure no longer replaces the actual result of the cache operation. If the restore or save itself failed, that original error is still the one reported. The summary records the number of sampling failures and a short reason code, such as code:EIO, without including file paths.
  • The archive-size figures now count cache.tar staging files, which are used on Windows runners, as well as cache.tgz.

Full Changelog: jdx/mr-boxington-action@v1.7.0...v1.7.1

v1.7.0: Isolated objects cache and cache key suffixes

Parallel jobs can now save under their own primary keys with cache-key-suffix. On disposable hosted runners, the GitHub objects payload can now run from a private, job-scoped store with isolate-objects-cache. Both inputs are opt-in, so existing workflows are unaffected.

Added

• cache-key-suffix input (#58, @​donbeave). The suffix is added to the end of the generated primary key, so matrix or parallel jobs save their own entries. It does not change the generated restore prefixes, so any job can still warm-start from another job's compatible entry.

  - uses: jdx/mr-boxington-action@v1
    with:
      cache-key-suffix: ${{ matrix.job }}

  The suffix may only contain ASCII letters, numbers, periods, underscores, and hyphens. The final key must be at most 512 characters. Setting both cache-key-suffix and cache-key is an error, so use cache-key on its own when you supply the full primary key. Explicit restore-keys are used as given.

• isolate-objects-cache input (#58, @​donbeave). Defaults to false and requires backend: github with github-cache-mode: objects. Setup fails if you enable it with any other backend or mode. When it is on:

  • The live mbx store (MBX_CACHE_DIR) is placed in a private directory under RUNNER_TEMP.
  • On restore, the bundle is imported and then deleted.
  • On save, the action exports a bundle and checks it. It then deletes the isolated store before actions/cache packs its upload archive, so the job doesn't keep two copies on disk at once. Only the exported bundle is saved.

... (truncated)

Changelog

Sourced from jdx/mr-boxington-action's changelog.

Changelog

---

1.7.2 - 2026-10-10

🐛 Bug Fixes

• (cache) remove read-only MBX object trees (#62) by @​donbeave in #62
• (cache) clean managed target before objects export (#68) by @​donbeave in #68

⚙️ Miscellaneous Tasks

• (ci) lint workflows with jactionlint (#69) by @​jdx in #69
• (ci) switch to jactionlint v2 and drop zizmor (#71) by @​jdx in #71
• (deps) bump jdx/mise-action from 4.3.0 to 5.0.1 (#67) by @​dependabot[bot] in #67
• (deps) bump @​actions/cache from 6.2.0 to 6.3.0 (#65) by @​dependabot[bot] in #65
• (deps-dev) bump @​types/node from 26.6.2 to 26.6.4 (#64) by @​dependabot[bot] in #64
• (deps-dev) bump vitest from 5.0.1 to 5.0.3 (#66) by @​dependabot[bot] in #66
• require zizmor in final (#70) by @​jdx in #70

---

1.7.1 - 2026-10-04

🐛 Bug Fixes

• (cache) await resource samples before reporting (#60) by @​donbeave in #60

---

1.7.0 - 2026-10-04

🚀 Features

• (cache) isolate objects caching and support key suffixes (#58) by @​donbeave in #58

New Contributors

• @​donbeave made their first contribution in #58

---

1.6.0 - 2026-10-02

🚀 Features

• (cache) opt in to saving from pull requests and protected branches (#48) by @​garysassano in #48
• add a remote backend that keeps MBX_REMOTE_* settings from earlier steps (#53) by @​jdx in #53

🐛 Bug Fixes

• (cache) restore a saving pull request's own entries before its base (#52) by @​garysassano in #52

... (truncated)

Commits

• 47ce49b chore: release v1.7.2 (#63)
• af4e595 chore(ci): switch to jactionlint v2 and drop zizmor (#71)
• c5aebbc ci: require zizmor in final (#70)
• a341eb0 chore(ci): lint workflows with jactionlint (#69)
• c2c66d3 fix(cache): clean managed target before objects export (#68)
• 2f12799 build(deps): bump @​actions/cache from 6.2.0 to 6.3.0 (#65)
• 23ff4ea build(deps-dev): bump vitest from 5.0.1 to 5.0.3 (#66)
• f23bf12 build(deps-dev): bump @​types/node from 26.6.2 to 26.6.4 (#64)
• e63f543 build(deps): bump jdx/mise-action from 4.3.0 to 5.0.1 (#67)
• e26ba57 fix(cache): remove read-only MBX object trees (#62)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)