From 3ac1c76085283b8954e0ffa4d569c0bd7975c71b Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Tue, 13 Oct 2026 03:09:24 +0000 Subject: [PATCH 1/4] chore(deps): update github-actions --- .github/actions/ci/action.yaml | 2 +- .github/workflows/check-licenses.yaml | 8 ++-- .github/workflows/ci-e2e.yaml | 6 +-- .github/workflows/ci-packages.yaml | 2 +- .github/workflows/code-review.lock.yml | 48 ++++++++++----------- .github/workflows/codeql.yml | 6 +-- .github/workflows/copilot-setup-steps.yml | 2 +- .github/workflows/dependency-changeset.yaml | 4 +- .github/workflows/doc-check.yaml | 6 +-- .github/workflows/gh-aw-recompile.yml | 2 +- .github/workflows/lint-github-actions.yaml | 6 +-- .github/workflows/pkg-pr-new.yaml | 4 +- .github/workflows/release.yaml | 6 +-- 13 files changed, 51 insertions(+), 51 deletions(-) diff --git a/.github/actions/ci/action.yaml b/.github/actions/ci/action.yaml index 831ee61a2..2d9d6ad98 100644 --- a/.github/actions/ci/action.yaml +++ b/.github/actions/ci/action.yaml @@ -4,7 +4,7 @@ description: Run linter and type-checker and test runs: using: composite steps: - - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0 + - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0 with: run_install: false - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 diff --git a/.github/workflows/check-licenses.yaml b/.github/workflows/check-licenses.yaml index b2d0e7191..2e52cb612 100644 --- a/.github/workflows/check-licenses.yaml +++ b/.github/workflows/check-licenses.yaml @@ -26,15 +26,15 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9 + - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0 with: run_install: false - - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: cache: pnpm cache-dependency-path: ./pnpm-lock.yaml @@ -73,7 +73,7 @@ jobs: EOF - name: Check licenses - uses: tailor-platform/actions/check-licenses@d3040e3b5da92f72696d89db24bc9da62e0993d8 # v1.6.0 + uses: tailor-platform/actions/check-licenses@a3c3032e14277e81039eb26ae1a425adb22eb532 # v1.7.0 with: license-groups: ${{ vars.CHECK_LICENSES_ALLOWED_LICENSE_GROUPS }} additional-licenses: ${{ vars.CHECK_LICENSES_ALLOWED_LICENSES }} diff --git a/.github/workflows/ci-e2e.yaml b/.github/workflows/ci-e2e.yaml index adefd0f6a..d0cbe64a5 100644 --- a/.github/workflows/ci-e2e.yaml +++ b/.github/workflows/ci-e2e.yaml @@ -18,9 +18,9 @@ jobs: permissions: contents: read container: - image: mcr.microsoft.com/playwright:v1.63.0-noble@sha256:eff16c30e6f3f4af0a03fa4b706120d5e9b0891c344a27d64559aff5900a4a27 + image: mcr.microsoft.com/playwright:v1.64.0-noble@sha256:06a9939e57531807f8d5fd76ce44b53165ffb7d7501d87ab10e285c20b1e971f steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: persist-credentials: false # Running in a container causes git "dubious ownership" errors because the @@ -28,7 +28,7 @@ jobs: # lefthook install (triggered by pnpm prepare) can run git commands. - name: Fix git ownership run: git config --global --add safe.directory "$GITHUB_WORKSPACE" - - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0 + - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0 with: run_install: false - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 diff --git a/.github/workflows/ci-packages.yaml b/.github/workflows/ci-packages.yaml index c2a8dc005..76d4d220d 100644 --- a/.github/workflows/ci-packages.yaml +++ b/.github/workflows/ci-packages.yaml @@ -20,7 +20,7 @@ jobs: contents: read pull-requests: write steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: fetch-depth: 2 persist-credentials: false diff --git a/.github/workflows/code-review.lock.yml b/.github/workflows/code-review.lock.yml index 519404cb3..84e18d45e 100644 --- a/.github/workflows/code-review.lock.yml +++ b/.github/workflows/code-review.lock.yml @@ -114,7 +114,7 @@ jobs: steps: - name: Setup Scripts id: setup - uses: github/gh-aw-actions/setup@924af5fdc64061cfbf66fb584c8b07e2ac230c60 # v0.89.21 + uses: github/gh-aw-actions/setup@a0486bb9f7e2d8b990201dc43e34e7d668f191a4 # v0.91.9 with: destination: ${{ runner.temp }}/gh-aw/actions job-name: ${{ github.job }} @@ -200,7 +200,7 @@ jobs: - name: Publish daily AIC scan observations if: always() && env.GH_AW_MAX_DAILY_AI_CREDITS != '' continue-on-error: true - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: aic-usage-scan-v2 path: /tmp/gh-aw/agentic-workflow-usage-scan-v2.jsonl @@ -403,7 +403,7 @@ jobs: bash "${RUNNER_TEMP}/gh-aw/actions/print_prompt_summary.sh" - name: Upload info artifact if: success() || failure() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: info path: /tmp/gh-aw/aw_info.json @@ -414,7 +414,7 @@ jobs: cp -a "${RUNNER_TEMP}/gh-aw/aw-prompts/." /tmp/gh-aw/aw-prompts/ - name: Upload activation artifact if: success() || failure() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: activation include-hidden-files: true @@ -481,7 +481,7 @@ jobs: steps: - name: Setup Scripts id: setup - uses: github/gh-aw-actions/setup@924af5fdc64061cfbf66fb584c8b07e2ac230c60 # v0.89.21 + uses: github/gh-aw-actions/setup@a0486bb9f7e2d8b990201dc43e34e7d668f191a4 # v0.91.9 with: destination: ${{ runner.temp }}/gh-aw/actions job-name: ${{ github.job }} @@ -540,7 +540,7 @@ jobs: env: GH_TOKEN: ${{ github.token }} - name: Download activation artifact - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: activation path: /tmp/gh-aw @@ -1152,7 +1152,7 @@ jobs: - name: Upload agent output fallback artifact if: always() continue-on-error: true - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: agent-output-fallback path: | @@ -1168,7 +1168,7 @@ jobs: - name: Upload agent artifacts if: always() continue-on-error: true - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: agent path: | @@ -1224,7 +1224,7 @@ jobs: steps: - name: Setup Scripts id: setup - uses: github/gh-aw-actions/setup@924af5fdc64061cfbf66fb584c8b07e2ac230c60 # v0.89.21 + uses: github/gh-aw-actions/setup@a0486bb9f7e2d8b990201dc43e34e7d668f191a4 # v0.91.9 with: destination: ${{ runner.temp }}/gh-aw/actions job-name: ${{ github.job }} @@ -1239,7 +1239,7 @@ jobs: - name: Download agent output artifact id: download-agent-output continue-on-error: true - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: pattern: "{agent,agent-output-fallback}" merge-multiple: true @@ -1256,7 +1256,7 @@ jobs: - name: Download detection artifact id: download-detection-artifact continue-on-error: true - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: detection path: /tmp/gh-aw/threat-detection/ @@ -1264,7 +1264,7 @@ jobs: id: download-safe-outputs-manifest if: always() continue-on-error: true - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: pattern: safe-outputs-items merge-multiple: true @@ -1277,7 +1277,7 @@ jobs: id: upload-usage-artifact if: always() continue-on-error: true - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: usage path: | @@ -1305,7 +1305,7 @@ jobs: id: upload-usage-artifact-retry if: always() && steps.upload-usage-artifact.outcome == 'failure' continue-on-error: true - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: usage path: | @@ -1519,7 +1519,7 @@ jobs: steps: - name: Setup Scripts id: setup - uses: github/gh-aw-actions/setup@924af5fdc64061cfbf66fb584c8b07e2ac230c60 # v0.89.21 + uses: github/gh-aw-actions/setup@a0486bb9f7e2d8b990201dc43e34e7d668f191a4 # v0.91.9 with: destination: ${{ runner.temp }}/gh-aw/actions job-name: ${{ github.job }} @@ -1533,14 +1533,14 @@ jobs: GH_AW_INFO_ENGINE_ID: "copilot" - name: Download activation artifact continue-on-error: true - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: activation path: /tmp/gh-aw - name: Download agent output artifact id: download-agent-output continue-on-error: true - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: pattern: "{agent,agent-output-fallback}" merge-multiple: true @@ -1623,9 +1623,9 @@ jobs: - name: Install AWF binary run: bash "${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh" v0.28.23 --rootless - name: Setup Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: - node-version: '24' + node-version: '24.21.0' package-manager-cache: false - name: Install GitHub Copilot CLI run: bash "${RUNNER_TEMP}/gh-aw/actions/install_copilot_cli.sh" @@ -1762,7 +1762,7 @@ jobs: await main(); - name: Upload threat detection artifact if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: detection path: | @@ -1799,7 +1799,7 @@ jobs: steps: - name: Setup Scripts id: setup - uses: github/gh-aw-actions/setup@924af5fdc64061cfbf66fb584c8b07e2ac230c60 # v0.89.21 + uses: github/gh-aw-actions/setup@a0486bb9f7e2d8b990201dc43e34e7d668f191a4 # v0.91.9 with: destination: ${{ runner.temp }}/gh-aw/actions job-name: ${{ github.job }} @@ -1880,7 +1880,7 @@ jobs: steps: - name: Setup Scripts id: setup - uses: github/gh-aw-actions/setup@924af5fdc64061cfbf66fb584c8b07e2ac230c60 # v0.89.21 + uses: github/gh-aw-actions/setup@a0486bb9f7e2d8b990201dc43e34e7d668f191a4 # v0.91.9 with: destination: ${{ runner.temp }}/gh-aw/actions job-name: ${{ github.job }} @@ -1897,7 +1897,7 @@ jobs: - name: Download agent output artifact id: download-agent-output continue-on-error: true - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: pattern: "{agent,agent-output-fallback}" merge-multiple: true @@ -1941,7 +1941,7 @@ jobs: await main(); - name: Upload Safe Outputs Items if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: safe-outputs-items path: | diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 32ac40802..b853d1e69 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -58,7 +58,7 @@ jobs: # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages steps: - name: Checkout repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -70,7 +70,7 @@ jobs: # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 + uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} @@ -100,6 +100,6 @@ jobs: exit 1 - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 + uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: category: "/language:${{matrix.language}}" diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml index 6537ff951..944469fe1 100644 --- a/.github/workflows/copilot-setup-steps.yml +++ b/.github/workflows/copilot-setup-steps.yml @@ -27,7 +27,7 @@ jobs: # If you do not check out your code, Copilot will do this for you. steps: - name: Checkout code - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: persist-credentials: false diff --git a/.github/workflows/dependency-changeset.yaml b/.github/workflows/dependency-changeset.yaml index cedbe16ce..1ca1ce51b 100644 --- a/.github/workflows/dependency-changeset.yaml +++ b/.github/workflows/dependency-changeset.yaml @@ -14,8 +14,8 @@ jobs: permissions: contents: write steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: fetch-depth: 0 persist-credentials: false - - uses: IzumiSy/deps2changesets@e6224362658fa941bf2f1bc34f2a41591eb875be # main + - uses: IzumiSy/deps2changesets@1e89736c02d7e4ca62a0ae8e5324ebc62b22d6e2 # main diff --git a/.github/workflows/doc-check.yaml b/.github/workflows/doc-check.yaml index dba402812..b527ad5d8 100644 --- a/.github/workflows/doc-check.yaml +++ b/.github/workflows/doc-check.yaml @@ -15,13 +15,13 @@ jobs: contents: read steps: - name: Checkout - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: persist-credentials: false - - uses: aquaproj/aqua-installer@96a9bc20066c5bf5e275b41019cfc165b25f4e2e # v4.0.5 + - uses: aquaproj/aqua-installer@82d0e83878a8657c4a6f2ff1755d3bfbfc67f329 # v4.1.0 with: - aqua_version: v2.62.3 + aqua_version: v2.64.0 - name: Check links in docs run: | diff --git a/.github/workflows/gh-aw-recompile.yml b/.github/workflows/gh-aw-recompile.yml index 0c3a4456e..a963e1425 100644 --- a/.github/workflows/gh-aw-recompile.yml +++ b/.github/workflows/gh-aw-recompile.yml @@ -37,7 +37,7 @@ jobs: steps: - name: Mint App token id: app-token - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 with: app-id: ${{ vars.RECOMPILE_APP_ID }} private-key: ${{ secrets.RECOMPILE_APP_PRIVATE_KEY }} diff --git a/.github/workflows/lint-github-actions.yaml b/.github/workflows/lint-github-actions.yaml index 8a3a0b725..70dc5e713 100644 --- a/.github/workflows/lint-github-actions.yaml +++ b/.github/workflows/lint-github-actions.yaml @@ -26,13 +26,13 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: persist-credentials: false - - uses: aquaproj/aqua-installer@96a9bc20066c5bf5e275b41019cfc165b25f4e2e # v4.0.5 + - uses: aquaproj/aqua-installer@82d0e83878a8657c4a6f2ff1755d3bfbfc67f329 # v4.1.0 with: - aqua_version: v2.62.3 + aqua_version: v2.64.0 # Both linters should only check the hand-authored files in this repo. # Collect workflows and local action metadata into one source of truth. diff --git a/.github/workflows/pkg-pr-new.yaml b/.github/workflows/pkg-pr-new.yaml index a03f5cdc7..54312b319 100644 --- a/.github/workflows/pkg-pr-new.yaml +++ b/.github/workflows/pkg-pr-new.yaml @@ -19,10 +19,10 @@ jobs: contents: read pull-requests: write steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: persist-credentials: false - - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0 + - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0 with: run_install: false - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 3152b7437..d2b2e89e2 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -17,17 +17,17 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 20 steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: fetch-depth: 0 persist-credentials: false - - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0 + - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0 with: run_install: false - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version-file: "./package.json" - run: pnpm install - - uses: changesets/action@198f833dd7d863100ea6e28967bc9a9fdefadb0a # v2.1.0 + - uses: changesets/action@ae32849d5ba541f9ae29e40e22a623bc13562f51 # v2.1.2 with: publish-script: pnpm changeset:publish From 05cdc7e8b12298dbeb604442e01f49a54235755a Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 13 Oct 2026 03:10:49 +0000 Subject: [PATCH 2/4] fix(ci): match Playwright image to e2e dependency Co-authored-by: IzumiSy <982850+IzumiSy@users.noreply.github.com> --- .github/workflows/ci-e2e.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci-e2e.yaml b/.github/workflows/ci-e2e.yaml index d0cbe64a5..fed0270c1 100644 --- a/.github/workflows/ci-e2e.yaml +++ b/.github/workflows/ci-e2e.yaml @@ -18,7 +18,7 @@ jobs: permissions: contents: read container: - image: mcr.microsoft.com/playwright:v1.64.0-noble@sha256:06a9939e57531807f8d5fd76ce44b53165ffb7d7501d87ab10e285c20b1e971f + image: mcr.microsoft.com/playwright:v1.63.0-noble@sha256:eff16c30e6f3f4af0a03fa4b706120d5e9b0891c344a27d64559aff5900a4a27 steps: - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: From a8c6d5132b63c3f7546565a20e6bd2f178e3c5a1 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 13 Oct 2026 06:22:09 +0000 Subject: [PATCH 3/4] chore(renovate): ignore generated code-review workflow Co-authored-by: IzumiSy <982850+IzumiSy@users.noreply.github.com> --- .github/workflows/code-review.lock.yml | 48 +++++++++++++------------- renovate.json | 5 +++ 2 files changed, 29 insertions(+), 24 deletions(-) diff --git a/.github/workflows/code-review.lock.yml b/.github/workflows/code-review.lock.yml index 84e18d45e..519404cb3 100644 --- a/.github/workflows/code-review.lock.yml +++ b/.github/workflows/code-review.lock.yml @@ -114,7 +114,7 @@ jobs: steps: - name: Setup Scripts id: setup - uses: github/gh-aw-actions/setup@a0486bb9f7e2d8b990201dc43e34e7d668f191a4 # v0.91.9 + uses: github/gh-aw-actions/setup@924af5fdc64061cfbf66fb584c8b07e2ac230c60 # v0.89.21 with: destination: ${{ runner.temp }}/gh-aw/actions job-name: ${{ github.job }} @@ -200,7 +200,7 @@ jobs: - name: Publish daily AIC scan observations if: always() && env.GH_AW_MAX_DAILY_AI_CREDITS != '' continue-on-error: true - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: aic-usage-scan-v2 path: /tmp/gh-aw/agentic-workflow-usage-scan-v2.jsonl @@ -403,7 +403,7 @@ jobs: bash "${RUNNER_TEMP}/gh-aw/actions/print_prompt_summary.sh" - name: Upload info artifact if: success() || failure() - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: info path: /tmp/gh-aw/aw_info.json @@ -414,7 +414,7 @@ jobs: cp -a "${RUNNER_TEMP}/gh-aw/aw-prompts/." /tmp/gh-aw/aw-prompts/ - name: Upload activation artifact if: success() || failure() - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: activation include-hidden-files: true @@ -481,7 +481,7 @@ jobs: steps: - name: Setup Scripts id: setup - uses: github/gh-aw-actions/setup@a0486bb9f7e2d8b990201dc43e34e7d668f191a4 # v0.91.9 + uses: github/gh-aw-actions/setup@924af5fdc64061cfbf66fb584c8b07e2ac230c60 # v0.89.21 with: destination: ${{ runner.temp }}/gh-aw/actions job-name: ${{ github.job }} @@ -540,7 +540,7 @@ jobs: env: GH_TOKEN: ${{ github.token }} - name: Download activation artifact - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: activation path: /tmp/gh-aw @@ -1152,7 +1152,7 @@ jobs: - name: Upload agent output fallback artifact if: always() continue-on-error: true - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: agent-output-fallback path: | @@ -1168,7 +1168,7 @@ jobs: - name: Upload agent artifacts if: always() continue-on-error: true - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: agent path: | @@ -1224,7 +1224,7 @@ jobs: steps: - name: Setup Scripts id: setup - uses: github/gh-aw-actions/setup@a0486bb9f7e2d8b990201dc43e34e7d668f191a4 # v0.91.9 + uses: github/gh-aw-actions/setup@924af5fdc64061cfbf66fb584c8b07e2ac230c60 # v0.89.21 with: destination: ${{ runner.temp }}/gh-aw/actions job-name: ${{ github.job }} @@ -1239,7 +1239,7 @@ jobs: - name: Download agent output artifact id: download-agent-output continue-on-error: true - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: pattern: "{agent,agent-output-fallback}" merge-multiple: true @@ -1256,7 +1256,7 @@ jobs: - name: Download detection artifact id: download-detection-artifact continue-on-error: true - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: detection path: /tmp/gh-aw/threat-detection/ @@ -1264,7 +1264,7 @@ jobs: id: download-safe-outputs-manifest if: always() continue-on-error: true - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: pattern: safe-outputs-items merge-multiple: true @@ -1277,7 +1277,7 @@ jobs: id: upload-usage-artifact if: always() continue-on-error: true - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: usage path: | @@ -1305,7 +1305,7 @@ jobs: id: upload-usage-artifact-retry if: always() && steps.upload-usage-artifact.outcome == 'failure' continue-on-error: true - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: usage path: | @@ -1519,7 +1519,7 @@ jobs: steps: - name: Setup Scripts id: setup - uses: github/gh-aw-actions/setup@a0486bb9f7e2d8b990201dc43e34e7d668f191a4 # v0.91.9 + uses: github/gh-aw-actions/setup@924af5fdc64061cfbf66fb584c8b07e2ac230c60 # v0.89.21 with: destination: ${{ runner.temp }}/gh-aw/actions job-name: ${{ github.job }} @@ -1533,14 +1533,14 @@ jobs: GH_AW_INFO_ENGINE_ID: "copilot" - name: Download activation artifact continue-on-error: true - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: activation path: /tmp/gh-aw - name: Download agent output artifact id: download-agent-output continue-on-error: true - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: pattern: "{agent,agent-output-fallback}" merge-multiple: true @@ -1623,9 +1623,9 @@ jobs: - name: Install AWF binary run: bash "${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh" v0.28.23 --rootless - name: Setup Node.js - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: - node-version: '24.21.0' + node-version: '24' package-manager-cache: false - name: Install GitHub Copilot CLI run: bash "${RUNNER_TEMP}/gh-aw/actions/install_copilot_cli.sh" @@ -1762,7 +1762,7 @@ jobs: await main(); - name: Upload threat detection artifact if: always() - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: detection path: | @@ -1799,7 +1799,7 @@ jobs: steps: - name: Setup Scripts id: setup - uses: github/gh-aw-actions/setup@a0486bb9f7e2d8b990201dc43e34e7d668f191a4 # v0.91.9 + uses: github/gh-aw-actions/setup@924af5fdc64061cfbf66fb584c8b07e2ac230c60 # v0.89.21 with: destination: ${{ runner.temp }}/gh-aw/actions job-name: ${{ github.job }} @@ -1880,7 +1880,7 @@ jobs: steps: - name: Setup Scripts id: setup - uses: github/gh-aw-actions/setup@a0486bb9f7e2d8b990201dc43e34e7d668f191a4 # v0.91.9 + uses: github/gh-aw-actions/setup@924af5fdc64061cfbf66fb584c8b07e2ac230c60 # v0.89.21 with: destination: ${{ runner.temp }}/gh-aw/actions job-name: ${{ github.job }} @@ -1897,7 +1897,7 @@ jobs: - name: Download agent output artifact id: download-agent-output continue-on-error: true - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: pattern: "{agent,agent-output-fallback}" merge-multiple: true @@ -1941,7 +1941,7 @@ jobs: await main(); - name: Upload Safe Outputs Items if: always() - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: safe-outputs-items path: | diff --git a/renovate.json b/renovate.json index dbefac479..b41ba5f28 100644 --- a/renovate.json +++ b/renovate.json @@ -4,6 +4,11 @@ "timezone": "Asia/Tokyo", "schedule": ["before 9am on monday"], "labels": ["dependencies"], + "ignorePaths": [ + "**/node_modules/**", + "**/bower_components/**", + ".github/workflows/code-review.lock.yml" + ], "vulnerabilityAlerts": { "enabled": true, "labels": ["security"] From aa5d16dca18efae0e72f8aa93f698fe9cc731602 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 13 Oct 2026 06:39:22 +0000 Subject: [PATCH 4/4] chore(renovate): ignore all generated workflow lockfiles Co-authored-by: IzumiSy <982850+IzumiSy@users.noreply.github.com> --- renovate.json | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/renovate.json b/renovate.json index b41ba5f28..c1e1e8a9b 100644 --- a/renovate.json +++ b/renovate.json @@ -4,11 +4,7 @@ "timezone": "Asia/Tokyo", "schedule": ["before 9am on monday"], "labels": ["dependencies"], - "ignorePaths": [ - "**/node_modules/**", - "**/bower_components/**", - ".github/workflows/code-review.lock.yml" - ], + "ignorePaths": ["**/node_modules/**", "**/bower_components/**", ".github/workflows/*.lock.yml"], "vulnerabilityAlerts": { "enabled": true, "labels": ["security"]