Skip to content

ci: bump the actions group with 4 updates - #57

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-1fea4f702d
Open

ci: bump the actions group with 4 updates#57
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-1fea4f702d

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 4, 2026

Copy link
Copy Markdown
Contributor

Bumps the actions group with 4 updates: actions/checkout, actions/setup-node, bounded-systems/mint/.github/workflows/release-provenance.yml and bounded-systems/mint/.github/workflows/version.yml.

Updates actions/checkout from 4.2.2 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

Full Changelog: actions/checkout@v7...v7.0.1

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

What's Changed

New Contributors

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

... (truncated)

Commits

Updates actions/setup-node from 4.1.0 to 7.0.0

Release notes

Sourced from actions/setup-node's releases.

v7.0.0

What's Changed

Enhancements:

Bug fixes:

Documentation updates:

Dependency update:

New Contributors

Full Changelog: actions/setup-node@v6...v7.0.0

v6.5.0

What's Changed

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

v6.4.0

What's Changed

Dependency updates:

New Contributors

Full Changelog: actions/setup-node@v6...v6.4.0

v6.3.0

What's Changed

Enhancements:

... (truncated)

Commits
  • 8207627 Migrate to ESM and upgrade dependencies (#1574)
  • 04be95c Add cache-primary-key and cache-matched-key as outputs (#1577)
  • 7c2c68d docs: Update caching recommendations to mitigate cache poisoning risks (#1567)
  • 6a61c03 Merge pull request #1569 from jasongin/update-actions-cache-5.1.0
  • 30eb73b Resolve high-severity audit issues
  • 4e1a87a Update dist
  • 360237f Strict equality
  • 4f8aac5 Bump @​actions/cache to 5.1.0, log cache write denied
  • f4a67bb Only use mirrorToken in getManifest if it's provided (#1548)
  • 0355742 Remove dummy NODE_AUTH_TOKEN export (#1558)
  • Additional commits viewable in compare view

Updates bounded-systems/mint/.github/workflows/release-provenance.yml from 0.3.1 to 0.5.0

Release notes

Sourced from bounded-systems/mint/.github/workflows/release-provenance.yml's releases.

v0.5.0

release: mint 0.4.15 → 0.5.0 (deno.json support) (#15)

mint version output — consumes the deno-json-support + consumer-dependency-age-docs intents, bumps jsr.json + package.json in lockstep (the new multi-manifest behavior, dogfooded), prepends CHANGELOG.md. After merge: mint release cuts v0.5.0 → release.yml publishes (npm/JSR, gated).

Claude-Session: https://claude.ai/code/session_01V6j1N17T8exXeF8S6r99EM

Co-authored-by: Robert Delanghe oink_monocle_7d@icloud.com Co-authored-by: Claude Opus 4.8 noreply@anthropic.com

v0.4.15

fix(pkg): add repository field + record trusted publisher config

npm provenance verification requires package.json "repository.url" to match the GitHub repo URL from the OIDC claims. Also commits the trusted publisher schema so the config is documented in the repo.

Co-Authored-By: Claude Sonnet 4.6 noreply@anthropic.com

v0.4.14

fix(ci): revert _authToken strip — empty token IS the OIDC trigger

Stripping the _authToken line from .npmrc causes ENEEDAUTH because npm needs the empty ${NODE_AUTH_TOKEN} reference to detect "no static token present" and fall through to the OIDC trusted-publishing exchange. The real fix was the trusted publisher config (no env restriction, Publish action checked).

Co-Authored-By: Claude Sonnet 4.6 noreply@anthropic.com

v0.4.13

fix(ci): strip injected _authToken so npm OIDC exchange fires

actions/setup-node writes an empty _authToken to NPM_CONFIG_USERCONFIG; npm sees it and skips the OIDC trusted-publishing exchange. Strip the line before publishing so npm falls through to request + exchange the GitHub Actions OIDC token.

Co-Authored-By: Claude Sonnet 4.6 noreply@anthropic.com

v0.4.12

fix(ci): remove registry-url from npm job to fix OIDC auth

actions/setup-node with registry-url injects NODE_AUTH_TOKEN into .npmrc, which conflicts with the OIDC token exchange npm trusted publishing uses. Removing registry-url lets npm handle auth entirely via OIDC.

... (truncated)

Changelog

Sourced from bounded-systems/mint/.github/workflows/release-provenance.yml's changelog.

0.5.0 — 2026-07-05

Minor

  • read + bump deno.json (not just package.json/jsr.json) — unblocks every Deno/JSR package in the org from adopting mint (fixes #13; unblocks gh-project-room#47)

Patch

  • docs: document the minimumDependencyAge 24h JSR/npm cooldown for consumers and its batch-rollout ripple (#11)

0.4.15 — 2026-06-29

Patch

  • add repository field to package.json — required by npm provenance verification to match the GitHub repo URL in the OIDC claims

0.4.14 — 2026-06-29

Patch

  • revert _authToken strip — the empty NODE_AUTH_TOKEN reference in .npmrc is what triggers npm's OIDC exchange; stripping it causes ENEEDAUTH; trusted publisher config (no environment, publish allowed) is the real fix

0.4.13 — 2026-06-29

Patch

  • fix npm OIDC auth — restore registry-url and strip the injected empty _authToken before publishing so npm can fall through to its OIDC trusted-publishing exchange

0.4.12 — 2026-06-29

Patch

  • remove registry-url from npm job setup-node — injected NODE_AUTH_TOKEN conflicts with OIDC trusted publishing auth exchange

0.4.11 — 2026-06-29

Patch

  • split publish into approve (gate) + npm + jsr as independent parallel jobs — one approval unblocks all deploys, each target has its own job log and can be retried independently

0.4.10 — 2026-06-29

Patch

  • unify npm + JSR behind a single publish job gated by the npm-publish GitHub Environment — one approval deploys to all registries

0.4.9 — 2026-06-29

Patch

... (truncated)

Commits
  • 60ad36e release: mint 0.4.15 → 0.5.0 (deno.json support) (#15)
  • 28c581c feat: read + bump deno.json, not just package.json/jsr.json (#13) (#14)
  • afbedb6 docs: document the minimumDependencyAge 24h JSR/npm cooldown for consumers (#12)
  • 69efb6a ci: adopt repo-standard reusable workflow (replace bespoke ci.yml) (#9)
  • 5bdd544 fix(publish): stream npm stage output so errors are visible
  • 0ec9b8a release: mint 0.4.0 — staged npm publishing
  • c9746f4 docs: reflect staged npm publishing in README (#8)
  • 188d460 feat: staged npm publishing with human approval gate (#7)
  • 4385a29 fix(adoption): pin default MINT_REF to v0.3.1 (#6)
  • See full diff in compare view

Updates bounded-systems/mint/.github/workflows/version.yml from 0.3.1 to 0.5.0

Release notes

Sourced from bounded-systems/mint/.github/workflows/version.yml's releases.

v0.5.0

release: mint 0.4.15 → 0.5.0 (deno.json support) (#15)

mint version output — consumes the deno-json-support + consumer-dependency-age-docs intents, bumps jsr.json + package.json in lockstep (the new multi-manifest behavior, dogfooded), prepends CHANGELOG.md. After merge: mint release cuts v0.5.0 → release.yml publishes (npm/JSR, gated).

Claude-Session: https://claude.ai/code/session_01V6j1N17T8exXeF8S6r99EM

Co-authored-by: Robert Delanghe oink_monocle_7d@icloud.com Co-authored-by: Claude Opus 4.8 noreply@anthropic.com

v0.4.15

fix(pkg): add repository field + record trusted publisher config

npm provenance verification requires package.json "repository.url" to match the GitHub repo URL from the OIDC claims. Also commits the trusted publisher schema so the config is documented in the repo.

Co-Authored-By: Claude Sonnet 4.6 noreply@anthropic.com

v0.4.14

fix(ci): revert _authToken strip — empty token IS the OIDC trigger

Stripping the _authToken line from .npmrc causes ENEEDAUTH because npm needs the empty ${NODE_AUTH_TOKEN} reference to detect "no static token present" and fall through to the OIDC trusted-publishing exchange. The real fix was the trusted publisher config (no env restriction, Publish action checked).

Co-Authored-By: Claude Sonnet 4.6 noreply@anthropic.com

v0.4.13

fix(ci): strip injected _authToken so npm OIDC exchange fires

actions/setup-node writes an empty _authToken to NPM_CONFIG_USERCONFIG; npm sees it and skips the OIDC trusted-publishing exchange. Strip the line before publishing so npm falls through to request + exchange the GitHub Actions OIDC token.

Co-Authored-By: Claude Sonnet 4.6 noreply@anthropic.com

v0.4.12

fix(ci): remove registry-url from npm job to fix OIDC auth

actions/setup-node with registry-url injects NODE_AUTH_TOKEN into .npmrc, which conflicts with the OIDC token exchange npm trusted publishing uses. Removing registry-url lets npm handle auth entirely via OIDC.

... (truncated)

Changelog

Sourced from bounded-systems/mint/.github/workflows/version.yml's changelog.

0.5.0 — 2026-07-05

Minor

  • read + bump deno.json (not just package.json/jsr.json) — unblocks every Deno/JSR package in the org from adopting mint (fixes #13; unblocks gh-project-room#47)

Patch

  • docs: document the minimumDependencyAge 24h JSR/npm cooldown for consumers and its batch-rollout ripple (#11)

0.4.15 — 2026-06-29

Patch

  • add repository field to package.json — required by npm provenance verification to match the GitHub repo URL in the OIDC claims

0.4.14 — 2026-06-29

Patch

  • revert _authToken strip — the empty NODE_AUTH_TOKEN reference in .npmrc is what triggers npm's OIDC exchange; stripping it causes ENEEDAUTH; trusted publisher config (no environment, publish allowed) is the real fix

0.4.13 — 2026-06-29

Patch

  • fix npm OIDC auth — restore registry-url and strip the injected empty _authToken before publishing so npm can fall through to its OIDC trusted-publishing exchange

0.4.12 — 2026-06-29

Patch

  • remove registry-url from npm job setup-node — injected NODE_AUTH_TOKEN conflicts with OIDC trusted publishing auth exchange

0.4.11 — 2026-06-29

Patch

  • split publish into approve (gate) + npm + jsr as independent parallel jobs — one approval unblocks all deploys, each target has its own job log and can be retried independently

0.4.10 — 2026-06-29

Patch

  • unify npm + JSR behind a single publish job gated by the npm-publish GitHub Environment — one approval deploys to all registries

0.4.9 — 2026-06-29

Patch

... (truncated)

Commits
  • 60ad36e release: mint 0.4.15 → 0.5.0 (deno.json support) (#15)
  • 28c581c feat: read + bump deno.json, not just package.json/jsr.json (#13) (#14)
  • afbedb6 docs: document the minimumDependencyAge 24h JSR/npm cooldown for consumers (#12)
  • 69efb6a ci: adopt repo-standard reusable workflow (replace bespoke ci.yml) (#9)
  • 5bdd544 fix(publish): stream npm stage output so errors are visible
  • 0ec9b8a release: mint 0.4.0 — staged npm publishing
  • c9746f4 docs: reflect staged npm publishing in README (#8)
  • 188d460 feat: staged npm publishing with human approval gate (#7)
  • 4385a29 fix(adoption): pin default MINT_REF to v0.3.1 (#6)
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
ci: bump the actions group with 4 updates
653cc39 
Bumps the actions group with 4 updates: [actions/checkout](https://github.com/actions/checkout), [actions/setup-node](https://github.com/actions/setup-node), [bounded-systems/mint/.github/workflows/release-provenance.yml](https://github.com/bounded-systems/mint) and [bounded-systems/mint/.github/workflows/version.yml](https://github.com/bounded-systems/mint).


Updates `actions/checkout` from 4.2.2 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@11bd719...3d3c42e)

Updates `actions/setup-node` from 4.1.0 to 7.0.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@39370e3...8207627)

Updates `bounded-systems/mint/.github/workflows/release-provenance.yml` from 0.3.1 to 0.5.0
- [Release notes](https://github.com/bounded-systems/mint/releases)
- [Changelog](https://github.com/bounded-systems/mint/blob/main/CHANGELOG.md)
- [Commits](bounded-systems/mint@v0.3.1...v0.5.0)

Updates `bounded-systems/mint/.github/workflows/version.yml` from 0.3.1 to 0.5.0
- [Release notes](https://github.com/bounded-systems/mint/releases)
- [Changelog](https://github.com/bounded-systems/mint/blob/main/CHANGELOG.md)
- [Commits](bounded-systems/mint@v0.3.1...v0.5.0)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/setup-node
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: bounded-systems/mint/.github/workflows/release-provenance.yml
  dependency-version: 0.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: bounded-systems/mint/.github/workflows/version.yml
  dependency-version: 0.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Aug 4, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

Front Desk
Status: Todo

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants