)]}' { "log": [ { "commit": "986c0349a20f330679c295a4c11481d5a2bdf426", "tree": "91568d45714d8fb6b3ac57f7dafe3a7223ef93b6", "parents": [ "935595d51598de050de07b4cef34579cc97bc2e0" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Oct 28 23:04:29 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 28 23:04:29 2026 +0100" }, "message": "build(deps): bump certifi from 2026.2.25 to 2026.10.18 (#1448)\n\nBumps [certifi](https://github.com/certifi/python-certifi) from 2026.2.25 to 2026.10.18.\n- [Commits](https://github.com/certifi/python-certifi/compare/2026.02.25...2026.10.18)\n\n---\nupdated-dependencies:\n- dependency-name: certifi\n dependency-version: 2026.10.18\n dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "935595d51598de050de07b4cef34579cc97bc2e0", "tree": "a1323695b9ab49ee5c194d7570a3637743980895", "parents": [ "36e391618baf31f50c5a7a7347faf00cba6cf085" ], "author": { "name": "asfgit", "email": "asfgit@users.noreply.github.com", "time": "Wed Oct 28 02:19:37 2026 +0000" }, "committer": { "name": "asfgit", "email": "asfgit@users.noreply.github.com", "time": "Wed Oct 28 02:19:37 2026 +0000" }, "message": "Remove Expired Refs\n\nGenerated by .github/workflows/remove_expired.yml\n" }, { "commit": "36e391618baf31f50c5a7a7347faf00cba6cf085", "tree": "8ce94e75597d5da758a30ba22a81c8272c855796", "parents": [ "95cba8ef8307d25983a859cbbd38320e2492c5ca" ], "author": { "name": "Kumar Ujjawal", "email": "ujjawalpathak6@gmail.com", "time": "Wed Oct 28 07:39:43 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 28 03:09:43 2026 +0100" }, "message": "ci: Add a shared fork workflow status action (#1444)\n\n* fork-ci: Add a shared fork workflow status action\n\nReport contributor CI on upstream PRs while keeping merge validation trusted.\n\nGenerated-by: Codex (GPT-6)\n\n* fork-ci: Serialize example test results without terminal colors\n\nParse JSON instead of comparing Node console output, which inherits FORCE_COLOR from the pytest workflow. Cover both color settings.\n\nGenerated-by: Codex (GPT-6)\n\n* fork-ci: Restrict callers and document API usage\n\nUse workflow_run signals and sweeps for PR updates. Document polling costs and token limits so adopters can size the recent window.\n\nGenerated-by: Codex (GPT-6)" }, { "commit": "95cba8ef8307d25983a859cbbd38320e2492c5ca", "tree": "be7e6e9e0a86baa4d1c6ba0328746fce127ef43a", "parents": [ "25aede57d771fc796b8133c7fdd38d676e8e8813" ], "author": { "name": "asfgit", "email": "asfgit@users.noreply.github.com", "time": "Wed Oct 28 01:54:46 2026 +0000" }, "committer": { "name": "asfgit", "email": "asfgit@users.noreply.github.com", "time": "Wed Oct 28 01:54:46 2026 +0000" }, "message": "Sync actions.yml, composite action, and approved_patterns.yml\n\nGenerated by .github/workflows/update.yml\n" }, { "commit": "25aede57d771fc796b8133c7fdd38d676e8e8813", "tree": "d3418e6824e4ac98a967906f275ea011e382be20", "parents": [ "e6b77215cff47c46b69b238e228a0c48ce69aff8" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Oct 28 02:54:43 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 28 02:54:43 2026 +0100" }, "message": "action-allowlist-review: bump jdx/mise-action (#1446)\n\nBumps [jdx/mise-action](https://github.com/jdx/mise-action) from 5.2.3 to 5.2.4.\n- [Release notes](https://github.com/jdx/mise-action/releases)\n- [Changelog](https://github.com/jdx/mise-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/jdx/mise-action/compare/82a612c5ab8bcda7cc5db6b7e81a8e7584c3dc6e...6be3c7ed4c21d4f76b208d351d95aac273ebb76d)\n\n---\nupdated-dependencies:\n- dependency-name: jdx/mise-action\n dependency-version: 5.2.4\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "e6b77215cff47c46b69b238e228a0c48ce69aff8", "tree": "15cf7a75b7a1ea7cec33255948b83e426eeb89f7", "parents": [ "d3a005f07dd94a34d11361b0287b0c1fdc6d55f5" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Oct 28 02:54:28 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 28 02:54:28 2026 +0100" }, "message": "action-allowlist-review: bump graalvm/setup-graalvm (#1447)\n\nBumps [graalvm/setup-graalvm](https://github.com/graalvm/setup-graalvm) from 1.6.7 to 1.6.8.\n- [Release notes](https://github.com/graalvm/setup-graalvm/releases)\n- [Commits](https://github.com/graalvm/setup-graalvm/compare/27b360dbb857524eaf0b4c4cef364d38e5b4f173...f70bc8032f90a104502824a54bcb94b6f01715bc)\n\n---\nupdated-dependencies:\n- dependency-name: graalvm/setup-graalvm\n dependency-version: 1.6.8\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "d3a005f07dd94a34d11361b0287b0c1fdc6d55f5", "tree": "3e5a396849c7850122da0a72aefc9b1e9fe2d06d", "parents": [ "e7a0894bb07f279c1194726aff7c5edbdee513e5" ], "author": { "name": "asfgit", "email": "asfgit@users.noreply.github.com", "time": "Tue Oct 27 02:27:12 2026 +0000" }, "committer": { "name": "asfgit", "email": "asfgit@users.noreply.github.com", "time": "Tue Oct 27 02:27:12 2026 +0000" }, "message": "Remove Expired Refs\n\nGenerated by .github/workflows/remove_expired.yml\n" }, { "commit": "e7a0894bb07f279c1194726aff7c5edbdee513e5", "tree": "a5ee0b564609e8b4f6f1aaaddc690751ed3d5c02", "parents": [ "1d3b0fe171c20098585833693bc6c1ed61038e5a" ], "author": { "name": "asfgit", "email": "asfgit@users.noreply.github.com", "time": "Mon Oct 26 17:45:20 2026 +0000" }, "committer": { "name": "asfgit", "email": "asfgit@users.noreply.github.com", "time": "Mon Oct 26 17:45:20 2026 +0000" }, "message": "Sync actions.yml, composite action, and approved_patterns.yml\n\nGenerated by .github/workflows/update.yml\n" }, { "commit": "1d3b0fe171c20098585833693bc6c1ed61038e5a", "tree": "ef7b48821ab43cf6bff5f10fc427e3d61fa4b5b9", "parents": [ "667c76687afb9f681a23c23d6f38a78e7b967ec3" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Oct 26 18:45:00 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 26 18:45:00 2026 +0100" }, "message": "action-allowlist-review: bump DavidAnson/markdownlint-cli2-action (#1445)\n\nBumps [DavidAnson/markdownlint-cli2-action](https://github.com/davidanson/markdownlint-cli2-action) from 24.2.0 to 25.0.0.\n- [Release notes](https://github.com/davidanson/markdownlint-cli2-action/releases)\n- [Commits](https://github.com/davidanson/markdownlint-cli2-action/compare/21c1be1b93ad9ed58fa840aacc3f279cde2a72ff...696eb3f2509270d7b882d2aa68347bc676e7af34)\n\n---\nupdated-dependencies:\n- dependency-name: DavidAnson/markdownlint-cli2-action\n dependency-version: 25.0.0\n dependency-type: direct:production\n update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "667c76687afb9f681a23c23d6f38a78e7b967ec3", "tree": "128e93ba50863e1b2b96809a425414e6ea7e17ac", "parents": [ "eb5fbad03d61c74d7d9ef72e430ecbb0f8338faa" ], "author": { "name": "asfgit", "email": "asfgit@users.noreply.github.com", "time": "Sun Oct 25 15:33:08 2026 +0000" }, "committer": { "name": "asfgit", "email": "asfgit@users.noreply.github.com", "time": "Sun Oct 25 15:33:08 2026 +0000" }, "message": "Sync actions.yml, composite action, and approved_patterns.yml\n\nGenerated by .github/workflows/update.yml\n" }, { "commit": "eb5fbad03d61c74d7d9ef72e430ecbb0f8338faa", "tree": "51aae250b17b69dfd1305d65d1df133ce4bbe4df", "parents": [ "10418eea2d6aa15b44d8d6e5fc38351d2f5bfdb2" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sun Oct 25 16:32:54 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Oct 25 16:32:54 2026 +0100" }, "message": "action-allowlist-review: bump commit-check/commit-check-action (#1443)\n\nBumps [commit-check/commit-check-action](https://github.com/commit-check/commit-check-action) from 2.18.1 to 2.18.2.\n- [Release notes](https://github.com/commit-check/commit-check-action/releases)\n- [Commits](https://github.com/commit-check/commit-check-action/compare/c6f5d0d50051a1249a381847322c5d85e15a6e06...b6819c7bfd40f576d670a78712646a67f2659ff3)\n\n---\nupdated-dependencies:\n- dependency-name: commit-check/commit-check-action\n dependency-version: 2.18.2\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "10418eea2d6aa15b44d8d6e5fc38351d2f5bfdb2", "tree": "f403a571f91c7c4bc35ec7755bd4a6ca4154aa04", "parents": [ "b6dbfe9d930081350a58c0845b8c41cc2eb12377" ], "author": { "name": "Jarek Potiuk", "email": "jarek@potiuk.com", "time": "Sun Oct 25 12:23:56 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Oct 25 12:23:56 2026 +0100" }, "message": "magpie: record reconciled skill hashes in lockfile (#1442)\n\nSetup reconcile against 0.9.0.dev202610250024 records which skill\nversions were reviewed, so later upgrades only flag skills that changed.\n\nGenerated-by: Claude Opus 5" }, { "commit": "b6dbfe9d930081350a58c0845b8c41cc2eb12377", "tree": "8d718854393abc69719103bf73f6ed71f8f7c8bd", "parents": [ "6dd2da6dfcfe6a05d28249b7dd7b62c857fa0490" ], "author": { "name": "asfgit", "email": "asfgit@users.noreply.github.com", "time": "Sun Oct 25 02:27:13 2026 +0000" }, "committer": { "name": "asfgit", "email": "asfgit@users.noreply.github.com", "time": "Sun Oct 25 02:27:13 2026 +0000" }, "message": "Remove Expired Refs\n\nGenerated by .github/workflows/remove_expired.yml\n" }, { "commit": "6dd2da6dfcfe6a05d28249b7dd7b62c857fa0490", "tree": "fdde318af517355373e80509e25a26798de6c3b3", "parents": [ "b69fcb10e1aeba985519b8ca5d62adcd18548684" ], "author": { "name": "Jarek Potiuk", "email": "jarek@potiuk.com", "time": "Sat Oct 24 18:35:35 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 24 18:35:35 2026 +0200" }, "message": "magpie: add vetted-ops to the plugin floor, document setup (#1441)\n\nThe Magpie adoption floor now seeds magpie-vetted-ops alongside setup,\nutilities and agent-guard; setup verify flagged the committed plugin set\nas stale without it. Also add the README section describing the\nmarketplace adoption for contributors.\n\nGenerated-by: Claude Opus 5" }, { "commit": "b69fcb10e1aeba985519b8ca5d62adcd18548684", "tree": "93a0a340f7dbda83bd4306f97254591bec83dc7e", "parents": [ "780e1b4f83be89981842b246abf2762b2ba16a7c" ], "author": { "name": "asfgit", "email": "asfgit@users.noreply.github.com", "time": "Sat Oct 24 13:57:37 2026 +0000" }, "committer": { "name": "asfgit", "email": "asfgit@users.noreply.github.com", "time": "Sat Oct 24 13:57:37 2026 +0000" }, "message": "Sync actions.yml, composite action, and approved_patterns.yml\n\nGenerated by .github/workflows/update.yml\n" }, { "commit": "780e1b4f83be89981842b246abf2762b2ba16a7c", "tree": "7708ef2edbf530fec93b04a8445b14f7bc0984e6", "parents": [ "53ebfe21df625e9cd8762617a42ac86731de89b7" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sat Oct 24 15:57:23 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 24 15:57:23 2026 +0200" }, "message": "action-allowlist-review: bump leafo/gh-actions-luarocks (#1437)\n\nBumps [leafo/gh-actions-luarocks](https://github.com/leafo/gh-actions-luarocks) from 6.1.0 to 6.1.1.\n- [Release notes](https://github.com/leafo/gh-actions-luarocks/releases)\n- [Commits](https://github.com/leafo/gh-actions-luarocks/compare/35d062def313a7699a0d513e996bcf4352f05389...1c4a92caecc8f6850f673cbadfd57b3e555417ce)\n\n---\nupdated-dependencies:\n- dependency-name: leafo/gh-actions-luarocks\n dependency-version: 6.1.1\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "53ebfe21df625e9cd8762617a42ac86731de89b7", "tree": "b40697a42a1f7c6c301db3620c2c7ba665f864c8", "parents": [ "d428c8a29515b82921130264eceb92f334173afe" ], "author": { "name": "asfgit", "email": "asfgit@users.noreply.github.com", "time": "Sat Oct 24 13:47:42 2026 +0000" }, "committer": { "name": "asfgit", "email": "asfgit@users.noreply.github.com", "time": "Sat Oct 24 13:47:42 2026 +0000" }, "message": "Sync actions.yml, composite action, and approved_patterns.yml\n\nGenerated by .github/workflows/update.yml\n" }, { "commit": "d428c8a29515b82921130264eceb92f334173afe", "tree": "017dc39629a025dc404cee4437ecc9bb20630357", "parents": [ "4dab5da88426b9e37f22625a0eadd0e6766d1db0" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sat Oct 24 15:47:39 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 24 15:47:39 2026 +0200" }, "message": "action-allowlist-review: bump jdx/mise-action (#1440)\n\nBumps [jdx/mise-action](https://github.com/jdx/mise-action) from 5.2.2 to 5.2.3.\n- [Release notes](https://github.com/jdx/mise-action/releases)\n- [Changelog](https://github.com/jdx/mise-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/jdx/mise-action/compare/8418fedb1110381a0d3ba51a7a415d7c1b884550...82a612c5ab8bcda7cc5db6b7e81a8e7584c3dc6e)\n\n---\nupdated-dependencies:\n- dependency-name: jdx/mise-action\n dependency-version: 5.2.3\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "4dab5da88426b9e37f22625a0eadd0e6766d1db0", "tree": "5289afad3d9fcf4776d3e8c3659b0fd2a6b7c5e6", "parents": [ "dd629340f026b97407163ba863de19ca7a082a65" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sat Oct 24 15:47:32 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 24 15:47:32 2026 +0200" }, "message": "action-allowlist-review: bump Kesin11/actions-timeline (#1439)\n\nBumps [Kesin11/actions-timeline](https://github.com/kesin11/actions-timeline) from 3.2.0 to 3.2.1.\n- [Release notes](https://github.com/kesin11/actions-timeline/releases)\n- [Commits](https://github.com/kesin11/actions-timeline/compare/57fc93f20c6da7fbc14063c6d24a2a5627c799ad...460b1f8a750077029ad3589824d371b200e91dcf)\n\n---\nupdated-dependencies:\n- dependency-name: Kesin11/actions-timeline\n dependency-version: 3.2.1\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "dd629340f026b97407163ba863de19ca7a082a65", "tree": "3a53d90337dd7e36e005b5eae8774052f9bb05a6", "parents": [ "2a4f033632b907081ff5380c41f7e7860a1eebe7" ], "author": { "name": "asfgit", "email": "asfgit@users.noreply.github.com", "time": "Sat Oct 24 13:47:14 2026 +0000" }, "committer": { "name": "asfgit", "email": "asfgit@users.noreply.github.com", "time": "Sat Oct 24 13:47:14 2026 +0000" }, "message": "Sync actions.yml, composite action, and approved_patterns.yml\n\nGenerated by .github/workflows/update.yml\n" }, { "commit": "2a4f033632b907081ff5380c41f7e7860a1eebe7", "tree": "880e92b0c076a582e58e3058246991418a0e5a5b", "parents": [ "fdc9b54c072903ef531db74357256ee4aff91787" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sat Oct 24 15:47:10 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 24 15:47:10 2026 +0200" }, "message": "action-allowlist-review: bump docker/login-action (#1438)\n\nBumps [docker/login-action](https://github.com/docker/login-action) from 4.6.0 to 4.7.0.\n- [Release notes](https://github.com/docker/login-action/releases)\n- [Commits](https://github.com/docker/login-action/compare/dbcb813823bdd20940b903addbd779551569679f...81c6f93d4bc991e510b342a00b419b3bb4efc5c6)\n\n---\nupdated-dependencies:\n- dependency-name: docker/login-action\n dependency-version: 4.7.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "fdc9b54c072903ef531db74357256ee4aff91787", "tree": "86b18fc881ea7178d9c3e0e096f5e3e58d33fa11", "parents": [ "26ba4d36c1e0be8aba42d493d876a63301ffff51" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sat Oct 24 15:47:03 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 24 15:47:03 2026 +0200" }, "message": "action-allowlist-review: bump zizmorcore/zizmor-action (#1435)\n\nBumps [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) from 0.7.1 to 0.8.0.\n- [Release notes](https://github.com/zizmorcore/zizmor-action/releases)\n- [Commits](https://github.com/zizmorcore/zizmor-action/compare/85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e...53290badfa369cb0bf7ad16342cb62c2fa47ac7b)\n\n---\nupdated-dependencies:\n- dependency-name: zizmorcore/zizmor-action\n dependency-version: 0.8.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "26ba4d36c1e0be8aba42d493d876a63301ffff51", "tree": "d50952b1a37ac10d85dd2181a24d47560c61374d", "parents": [ "9ef0490906c49908835502c2e46fe246e9adf4e9" ], "author": { "name": "asfgit", "email": "asfgit@users.noreply.github.com", "time": "Sat Oct 24 13:46:56 2026 +0000" }, "committer": { "name": "asfgit", "email": "asfgit@users.noreply.github.com", "time": "Sat Oct 24 13:46:56 2026 +0000" }, "message": "Sync actions.yml, composite action, and approved_patterns.yml\n\nGenerated by .github/workflows/update.yml\n" }, { "commit": "9ef0490906c49908835502c2e46fe246e9adf4e9", "tree": "9bfa0a6ba371ffc6ba1c64aa6cee56e2f5f45941", "parents": [ "e1c9b55d66ae934b92006839555ee8d098776637" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sat Oct 24 15:46:50 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 24 15:46:50 2026 +0200" }, "message": "action-allowlist-review: bump azure/login (#1431)\n\nBumps [azure/login](https://github.com/azure/login) from 3.0.2 to 3.1.0.\n- [Release notes](https://github.com/azure/login/releases)\n- [Commits](https://github.com/azure/login/compare/7ddb5af1ef8758cf1353cf3b42f940aee27ba21c...a641126d1b8aa4d1fa005f4f92df94a3a4c4c906)\n\n---\nupdated-dependencies:\n- dependency-name: azure/login\n dependency-version: 3.1.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "e1c9b55d66ae934b92006839555ee8d098776637", "tree": "a1bbb31d639ed0dbca7be708e1a50823b32f8404", "parents": [ "ff9ca13fdefa6ec52c619b4e02a87fadde9ca02c" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sat Oct 24 15:46:43 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 24 15:46:43 2026 +0200" }, "message": "action-allowlist-review: bump dawidd6/action-send-mail (#1430)\n\nBumps [dawidd6/action-send-mail](https://github.com/dawidd6/action-send-mail) from 22 to 23.\n- [Release notes](https://github.com/dawidd6/action-send-mail/releases)\n- [Commits](https://github.com/dawidd6/action-send-mail/compare/67ce3558d613188179559c61d3565140cf389968...47af4a10b540781705f283a2cf1a9650713ac795)\n\n---\nupdated-dependencies:\n- dependency-name: dawidd6/action-send-mail\n dependency-version: \u002723\u0027\n dependency-type: direct:production\n update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "ff9ca13fdefa6ec52c619b4e02a87fadde9ca02c", "tree": "cc06d75be49ee578c62df7d42172a434ef4a8de7", "parents": [ "fc9767fa7cd46a867ef3f14714923b8fa1f129aa" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sat Oct 24 15:46:36 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 24 15:46:36 2026 +0200" }, "message": "action-allowlist-review: bump pypa/cibuildwheel (#1429)\n\nBumps [pypa/cibuildwheel](https://github.com/pypa/cibuildwheel) from 4.3.3 to 4.3.4.\n- [Release notes](https://github.com/pypa/cibuildwheel/releases)\n- [Changelog](https://github.com/pypa/cibuildwheel/blob/main/docs/changelog.md)\n- [Commits](https://github.com/pypa/cibuildwheel/compare/8c2dcd2e96041a619f5ff03c9638d7941e2553a4...b9e566a2b284570af229f6c2a33673410d0389a3)\n\n---\nupdated-dependencies:\n- dependency-name: pypa/cibuildwheel\n dependency-version: 4.3.4\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "fc9767fa7cd46a867ef3f14714923b8fa1f129aa", "tree": "9123d0b063add97b82c35d3077213ca1ac1ea19e", "parents": [ "0a5c7384933868d614936f9a83d4bb401ac08ac9" ], "author": { "name": "asfgit", "email": "asfgit@users.noreply.github.com", "time": "Sat Oct 24 13:46:22 2026 +0000" }, "committer": { "name": "asfgit", "email": "asfgit@users.noreply.github.com", "time": "Sat Oct 24 13:46:22 2026 +0000" }, "message": "Sync actions.yml, composite action, and approved_patterns.yml\n\nGenerated by .github/workflows/update.yml\n" }, { "commit": "0a5c7384933868d614936f9a83d4bb401ac08ac9", "tree": "248fd2d0ca8b81bfa765ee92307f57c3c6f08ec4", "parents": [ "e53655e1070b768cf67b264008141d20367b3be9" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sat Oct 24 15:46:06 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 24 15:46:06 2026 +0200" }, "message": "action-allowlist-review: bump CodSpeedHQ/action (#1428)\n\nBumps [CodSpeedHQ/action](https://github.com/codspeedhq/action) from 5.5.0 to 5.6.0.\n- [Release notes](https://github.com/codspeedhq/action/releases)\n- [Changelog](https://github.com/CodSpeedHQ/action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/codspeedhq/action/compare/821a40cd6c80e3cfe387caf55668287addd808da...78102a468f96d8e0ccb92d0ec49425753fc42062)\n\n---\nupdated-dependencies:\n- dependency-name: CodSpeedHQ/action\n dependency-version: 5.6.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "e53655e1070b768cf67b264008141d20367b3be9", "tree": "a9d27497d88ea6afb2501b64b9338026789c75d6", "parents": [ "3c770f7d4e50d6bff95d419f5b566496bee995a0" ], "author": { "name": "asfgit", "email": "asfgit@users.noreply.github.com", "time": "Sat Oct 24 13:42:29 2026 +0000" }, "committer": { "name": "asfgit", "email": "asfgit@users.noreply.github.com", "time": "Sat Oct 24 13:42:29 2026 +0000" }, "message": "Sync actions.yml, composite action, and approved_patterns.yml\n\nGenerated by .github/workflows/update.yml\n" }, { "commit": "3c770f7d4e50d6bff95d419f5b566496bee995a0", "tree": "4cbe9c8d952757c80e8206026d2f42923cf37c39", "parents": [ "2662a0e68bc365872edc4c369e370ba6e1cd822c" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sat Oct 24 15:42:08 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 24 15:42:08 2026 +0200" }, "message": "action-allowlist-review: bump astral-sh/setup-uv (#1427)\n\nBumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 10.3.0 to 10.3.2.\n- [Release notes](https://github.com/astral-sh/setup-uv/releases)\n- [Commits](https://github.com/astral-sh/setup-uv/compare/1c37ad07a6a961277cf70c0d37d6f313000f5884...07a047e608db84b3d8c06cd9a7c7dcc9c355c18e)\n\n---\nupdated-dependencies:\n- dependency-name: astral-sh/setup-uv\n dependency-version: 10.3.2\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "2662a0e68bc365872edc4c369e370ba6e1cd822c", "tree": "18af8626ada60dc66c10e72eadbdb1d3253743e8", "parents": [ "0276499faee58e70e1fd0ccda388608c8808fd59" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sat Oct 24 15:31:18 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 24 15:31:18 2026 +0200" }, "message": "build(deps): bump zizmorcore/zizmor-action in /.github/workflows (#1433)\n\nBumps [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) from 0.6.4 to 0.7.1.\n- [Release notes](https://github.com/zizmorcore/zizmor-action/releases)\n- [Commits](https://github.com/zizmorcore/zizmor-action/compare/cc914d7f3750a2d13d75c7f184a1060aa0e9d482...85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e)\n\n---\nupdated-dependencies:\n- dependency-name: zizmorcore/zizmor-action\n dependency-version: 0.7.1\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "0276499faee58e70e1fd0ccda388608c8808fd59", "tree": "6245e5c32a1600dbaefd45a341d2ac0706e76f90", "parents": [ "9ef89ae3b50c5a404b06e200efaa6143dad61d83" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sat Oct 24 15:31:06 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 24 15:31:06 2026 +0200" }, "message": "build(deps): bump the codeql-action group across 1 directory with 2 updates (#1432)\n\nBumps the codeql-action group with 2 updates in the /.github/workflows directory: [github/codeql-action/init](https://github.com/github/codeql-action) and [github/codeql-action/analyze](https://github.com/github/codeql-action).\n\n\nUpdates `github/codeql-action/init` from 4.38.3 to 4.39.0\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee)\n\nUpdates `github/codeql-action/analyze` from 4.38.3 to 4.39.0\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee)\n\n---\nupdated-dependencies:\n- dependency-name: github/codeql-action/analyze\n dependency-version: 4.39.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n dependency-group: codeql-action\n- dependency-name: github/codeql-action/init\n dependency-version: 4.39.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n dependency-group: codeql-action\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "9ef89ae3b50c5a404b06e200efaa6143dad61d83", "tree": "30e98b49b2760a8fcb0d3d873197bd173f98f662", "parents": [ "2aa9b1a646f1a9a2fc28bf70708752e2f157b62b" ], "author": { "name": "Jarek Potiuk", "email": "jarek@potiuk.com", "time": "Sat Oct 24 12:34:44 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 24 12:34:44 2026 +0200" }, "message": "website-comment: offer previews only for site changes (#1436)\n\n* website-comment: offer previews only for site changes [minor]\n\nA site repository gets many pull requests that touch only CI or tooling,\nand each gets the preview explainer and uploads a preview with nothing new\nin it. preview-artifact takes a list of the site\u0027s paths and skips the upload\nwhen the diff touches none of them; preview-publish\u0027s howto:\nwith-preview-artifact posts the explainer only once a build has uploaded\none. The publisher still never reads the diff. Defaults keep today\u0027s\nbehaviour.\n\nGenerated-by: Claude Opus 5\n\n* website-comment: say when an armed PR has no preview to publish\n\nWith howto: with-preview-artifact, a /show-preview on a pull request that\nchanges none of the site\u0027s paths left its status at \"waiting on a build\",\npromising a preview no build would upload. Once its builds have succeeded\nwithout uploading one, the status says there is no preview and why.\n\nGenerated-by: Claude Opus 5" }, { "commit": "2aa9b1a646f1a9a2fc28bf70708752e2f157b62b", "tree": "94f2580166f47a84fce346449efd87b9ba96d855", "parents": [ "e4468a9369de13f913540590bb6b2fb666a254af" ], "author": { "name": "asfgit", "email": "asfgit@users.noreply.github.com", "time": "Sat Oct 24 02:25:03 2026 +0000" }, "committer": { "name": "asfgit", "email": "asfgit@users.noreply.github.com", "time": "Sat Oct 24 02:25:03 2026 +0000" }, "message": "Remove Expired Refs\n\nGenerated by .github/workflows/remove_expired.yml\n" }, { "commit": "e4468a9369de13f913540590bb6b2fb666a254af", "tree": "48c7d7bc21a3fc362689692c8592fe1dbe9adefc", "parents": [ "b1a7130596a7647c3cc3da3169f59515a93ede42" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Oct 23 12:15:22 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 23 12:15:22 2026 +0200" }, "message": "build(deps-dev): bump the dev-tooling group across 2 directories with 2 updates (#1434)\n\nBumps the dev-tooling group with 2 updates in the /pelican directory: [ruff](https://github.com/astral-sh/ruff) and [pylint](https://github.com/pylint-dev/pylint).\nBumps the dev-tooling group with 1 update in the /stash directory: [ruff](https://github.com/astral-sh/ruff).\n\n\nUpdates `ruff` from 0.16.10 to 0.17.1\n- [Release notes](https://github.com/astral-sh/ruff/releases)\n- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/astral-sh/ruff/compare/0.16.10...0.17.1)\n\nUpdates `pylint` from 4.1.2 to 4.1.3\n- [Release notes](https://github.com/pylint-dev/pylint/releases)\n- [Commits](https://github.com/pylint-dev/pylint/compare/v4.1.2...v4.1.3)\n\nUpdates `ruff` from 0.16.10 to 0.17.1\n- [Release notes](https://github.com/astral-sh/ruff/releases)\n- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/astral-sh/ruff/compare/0.16.10...0.17.1)\n\n---\nupdated-dependencies:\n- dependency-name: ruff\n dependency-version: 0.17.1\n dependency-type: direct:development\n update-type: version-update:semver-minor\n dependency-group: dev-tooling\n- dependency-name: pylint\n dependency-version: 4.1.3\n dependency-type: direct:development\n update-type: version-update:semver-patch\n dependency-group: dev-tooling\n- dependency-name: ruff\n dependency-version: 0.17.1\n dependency-type: direct:development\n update-type: version-update:semver-minor\n dependency-group: dev-tooling\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "b1a7130596a7647c3cc3da3169f59515a93ede42", "tree": "a6598ffd43e5f0ffc68a1e99e036979eeb54e785", "parents": [ "8b18c22d1e584ca6f920dd842cd317121861187e" ], "author": { "name": "Jarek Potiuk", "email": "jarek@potiuk.com", "time": "Thu Oct 22 19:27:55 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 22 19:27:55 2026 +0200" }, "message": "allowlist-approval: re-run the stale check after an approval (#1426)\n\nApproving an allow-list PR turns the review-triggered approval run\ngreen, but the ruleset keeps blocking on the earlier failed run from\nthe pull_request event. A workflow_run job now re-runs that failed run\nonce a review makes the check pass, so an approved PR becomes\nmergeable without a manual re-run.\n\nGenerated-by: Claude Opus 5" }, { "commit": "8b18c22d1e584ca6f920dd842cd317121861187e", "tree": "5492b464611f4c99cb4622fae67c98b41d7b8858", "parents": [ "f602eaa3c0ed531f42462a094b89f58ec3c795af" ], "author": { "name": "asfgit", "email": "asfgit@users.noreply.github.com", "time": "Thu Oct 22 17:24:15 2026 +0000" }, "committer": { "name": "asfgit", "email": "asfgit@users.noreply.github.com", "time": "Thu Oct 22 17:24:15 2026 +0000" }, "message": "Sync actions.yml, composite action, and approved_patterns.yml\n\nGenerated by .github/workflows/update.yml\n" }, { "commit": "f602eaa3c0ed531f42462a094b89f58ec3c795af", "tree": "e00b68af2633204e2b4f8acc357c78a3780acdee", "parents": [ "2ed64733c999648c1a386cbb68f9308cedf88701" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Oct 22 19:24:08 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 22 19:24:08 2026 +0200" }, "message": "action-allowlist-review: bump commit-check/commit-check-action (#1419)\n\nBumps [commit-check/commit-check-action](https://github.com/commit-check/commit-check-action) from 2.18.0 to 2.18.1.\n- [Release notes](https://github.com/commit-check/commit-check-action/releases)\n- [Commits](https://github.com/commit-check/commit-check-action/compare/bcbadb3fec596872bcae51074d8fdbea15c02ba5...c6f5d0d50051a1249a381847322c5d85e15a6e06)\n\n---\nupdated-dependencies:\n- dependency-name: commit-check/commit-check-action\n dependency-version: 2.18.1\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "2ed64733c999648c1a386cbb68f9308cedf88701", "tree": "a471d1814d724e45da50d3f18e6c58eb2484824e", "parents": [ "e2f20050d4e7048ba91025d5f4cf98d3e6dd41b9" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Oct 22 19:23:58 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 22 19:23:58 2026 +0200" }, "message": "action-allowlist-review: bump pypa/cibuildwheel (#1423)\n\nBumps [pypa/cibuildwheel](https://github.com/pypa/cibuildwheel) from 4.3.1 to 4.3.3.\n- [Release notes](https://github.com/pypa/cibuildwheel/releases)\n- [Changelog](https://github.com/pypa/cibuildwheel/blob/main/docs/changelog.md)\n- [Commits](https://github.com/pypa/cibuildwheel/compare/b3395e271a35f73dad77f21802abe9b986dfe299...8c2dcd2e96041a619f5ff03c9638d7941e2553a4)\n\n---\nupdated-dependencies:\n- dependency-name: pypa/cibuildwheel\n dependency-version: 4.3.3\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "e2f20050d4e7048ba91025d5f4cf98d3e6dd41b9", "tree": "7d63e95f4707f7504f2469418f4fc6182b541a85", "parents": [ "1a8adfc818c3244b8cd7008f13afc4b5029164c5" ], "author": { "name": "asfgit", "email": "asfgit@users.noreply.github.com", "time": "Thu Oct 22 17:23:54 2026 +0000" }, "committer": { "name": "asfgit", "email": "asfgit@users.noreply.github.com", "time": "Thu Oct 22 17:23:54 2026 +0000" }, "message": "Sync actions.yml, composite action, and approved_patterns.yml\n\nGenerated by .github/workflows/update.yml\n" }, { "commit": "1a8adfc818c3244b8cd7008f13afc4b5029164c5", "tree": "17020648f2e16c6402f6aa0c518b767e09ea190f", "parents": [ "ac3f68c4da671429878129c004e944ae6eddd923" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Oct 22 19:23:51 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 22 19:23:51 2026 +0200" }, "message": "action-allowlist-review: bump rust-lang/crates-io-auth-action (#1422)\n\nBumps [rust-lang/crates-io-auth-action](https://github.com/rust-lang/crates-io-auth-action) from 1.0.5 to 1.0.6.\n- [Release notes](https://github.com/rust-lang/crates-io-auth-action/releases)\n- [Commits](https://github.com/rust-lang/crates-io-auth-action/compare/c6f97d42243bad5fab37ca0427f495c86d5b1a18...3268eb413133e2960fa4ae0e963ca76380c54cd9)\n\n---\nupdated-dependencies:\n- dependency-name: rust-lang/crates-io-auth-action\n dependency-version: 1.0.6\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "ac3f68c4da671429878129c004e944ae6eddd923", "tree": "d260b6393212f4dc785e5b9c32d61a077e61e899", "parents": [ "28fbc8f6d0a8750edb85566b02d8b8daebb77086" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Oct 22 19:23:39 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 22 19:23:39 2026 +0200" }, "message": "action-allowlist-review: bump pypa/gh-action-pypi-publish (#1421)\n\nBumps [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) from 1.14.2 to 1.14.3.\n- [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases)\n- [Commits](https://github.com/pypa/gh-action-pypi-publish/compare/dc37677b2e1c63e2034f94d8a5b11f265b73ba33...7245906fb61fa33a13554f9d5fb856fe61758086)\n\n---\nupdated-dependencies:\n- dependency-name: pypa/gh-action-pypi-publish\n dependency-version: 1.14.3\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "28fbc8f6d0a8750edb85566b02d8b8daebb77086", "tree": "d297659bfc4a2892989d051d45504ae2a44602e8", "parents": [ "9affd23990883b3dc29651ed9900bfaf11ca1e30" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Oct 22 19:23:33 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 22 19:23:33 2026 +0200" }, "message": "action-allowlist-review: bump jdx/mise-action (#1420)\n\nBumps [jdx/mise-action](https://github.com/jdx/mise-action) from 5.2.1 to 5.2.2.\n- [Release notes](https://github.com/jdx/mise-action/releases)\n- [Changelog](https://github.com/jdx/mise-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/jdx/mise-action/compare/fc42bcc7ddbf51124c30f95a877a0c5168a3bfde...8418fedb1110381a0d3ba51a7a415d7c1b884550)\n\n---\nupdated-dependencies:\n- dependency-name: jdx/mise-action\n dependency-version: 5.2.2\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "9affd23990883b3dc29651ed9900bfaf11ca1e30", "tree": "a709f8032e2257fa85a4b61dc796c4a946704c40", "parents": [ "76be894ce3da9a2554675a7e4cdb5878e88800ce" ], "author": { "name": "asfgit", "email": "asfgit@users.noreply.github.com", "time": "Thu Oct 22 17:23:27 2026 +0000" }, "committer": { "name": "asfgit", "email": "asfgit@users.noreply.github.com", "time": "Thu Oct 22 17:23:27 2026 +0000" }, "message": "Sync actions.yml, composite action, and approved_patterns.yml\n\nGenerated by .github/workflows/update.yml\n" }, { "commit": "76be894ce3da9a2554675a7e4cdb5878e88800ce", "tree": "82efef6a63e3d6a6a8e3052c62df000c252bbd25", "parents": [ "3873776447b5ba5c65f9a76cf4e67f7e6dc86eb8" ], "author": { "name": "Xuanwo", "email": "github@xuanwo.io", "time": "Fri Oct 23 01:23:22 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 22 19:23:22 2026 +0200" }, "message": "Add azure/login v3.0.2 to allowlist (#1418)" }, { "commit": "3873776447b5ba5c65f9a76cf4e67f7e6dc86eb8", "tree": "783718d8bdca3351d7dba17cefd37af014fd60b9", "parents": [ "da11f61a9e3ba7a1639f2ad4797a8c18a555e05e" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Oct 22 19:23:13 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 22 19:23:13 2026 +0200" }, "message": "action-allowlist-review: bump italia/publiccode-parser-action (#1417)\n\nBumps [italia/publiccode-parser-action](https://github.com/italia/publiccode-parser-action) from 1.6.0 to 1.7.0.\n- [Release notes](https://github.com/italia/publiccode-parser-action/releases)\n- [Commits](https://github.com/italia/publiccode-parser-action/compare/0deab88c3f094aa12c5826e52ac2c4f176446821...f370d239aa3ec57b819909b467ff77679b6dc721)\n\n---\nupdated-dependencies:\n- dependency-name: italia/publiccode-parser-action\n dependency-version: 1.7.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "da11f61a9e3ba7a1639f2ad4797a8c18a555e05e", "tree": "b96f4a1b8c11531e0206d6e79219214fabd95053", "parents": [ "564ac078afc84dbd9870864fccb6b3b136b95cd7" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Oct 22 19:23:05 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 22 19:23:05 2026 +0200" }, "message": "action-allowlist-review: bump j178/prek-action (#1415)\n\nBumps [j178/prek-action](https://github.com/j178/prek-action) from 3.0.2 to 3.1.0.\n- [Release notes](https://github.com/j178/prek-action/releases)\n- [Commits](https://github.com/j178/prek-action/compare/af4d4fcb6922b8e6f65c0426947125fcc38794ce...44924fe9ef4a6f88253c4b6b1bf11c689d3ce53d)\n\n---\nupdated-dependencies:\n- dependency-name: j178/prek-action\n dependency-version: 3.1.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "564ac078afc84dbd9870864fccb6b3b136b95cd7", "tree": "f76e872865b0afa5ba201d9cefb0c8b5e1a6b731", "parents": [ "65a538352531210f043ebee7cb6f87d3773a73e2" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Oct 22 18:26:54 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 22 18:26:54 2026 +0200" }, "message": "build(deps): bump actions/setup-java in /.github/workflows (#1424)\n\nBumps [actions/setup-java](https://github.com/actions/setup-java) from 6.0.1 to 6.1.0.\n- [Release notes](https://github.com/actions/setup-java/releases)\n- [Commits](https://github.com/actions/setup-java/compare/de7274f081f381c8f8158605e0321c36c376e2e6...b843ebf9b913146b38da2eaa7aeddf76074ae1ad)\n\n---\nupdated-dependencies:\n- dependency-name: actions/setup-java\n dependency-version: 6.1.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "65a538352531210f043ebee7cb6f87d3773a73e2", "tree": "6cd5a670bdc81e5dd5f69281fc85693f1dc70915", "parents": [ "01bcdedeea785ada0161d7bc95191a6c1afa2f26" ], "author": { "name": "Jarek Potiuk", "email": "jarek@potiuk.com", "time": "Thu Oct 22 14:56:58 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 22 14:56:58 2026 +0200" }, "message": "website-comment: add per-pull-request website preview actions (#1332)\n\n* pr-preview: add per-pull-request website preview actions\n\nThree composite actions that publish an armed pull request\u0027s built site\nto \u003csite\u003e-pr\u003cN\u003e.staged.apache.org, with a review overlay that turns a\nmarked region into a screenshot and a link to its diff line.\n\npreview-annotate stamps source lines for Jekyll and Astro builds;\npreview-artifact packages any static site; preview-publish publishes,\nretires and cleans up. Extracted from apache/magpie-site, with\ngeneric names.\n\nGenerated-by: Claude Opus 5\n\n* pr-preview: sync with magpie-site preview plugin up to #214\n\nPorts apache/magpie-site #208, #210, #212 and #214 onto the extracted\nactions, keeping the generic names:\n\n- Arm with the `preview` label (a /show-preview comment or a dispatch\n adds it); publish on workflow_run / issue_comment, not a schedule.\n- Project every GitHub response so the publisher never reads PR\n content; the build computes the diff anchors (write-meta.mjs).\n- Post a new comment on each publish, and lead with the preview URL.\n- New preview-main-overlay action: the overlay on the published site,\n where a comment opens an issue.\n\nGenerated-by: Claude Opus 5\n\n* website-comment: rename the pr-preview directory\n\nThe actions keep their names and tag prefixes; only the path changes,\nto website-comment/\u003caction\u003e.\n\nGenerated-by: Claude Opus 5\n\n* website-comment: run the Jekyll adapter test on ubuntu-slim\n\nPorts apache/magpie-site #211: ubuntu-slim cannot start a job\ncontainer, so Ruby, Bundler and a C toolchain come from apt and gems go\nto a writable user gem home instead of the pinned ruby:3.3 image.\n\nGenerated-by: Claude Opus 5\n\n* website-comment: fix review findings, sync magpie-site Vite adapter\n\nPort magpie-site\u0027s switch from the Babel to a Vite Astro adapter (#220);\nthe site now hands the plugin its own vite module. Bump setup-node to\nv7.1.0 as magpie-site did.\n\nFix the roborev findings on #1332: encode branch names in ref deletes,\ndelete stale head branches under a lease, read the zip size from the\ntrailer only, lift the unzip listing buffer, release on website-comment\npushes, re-arm over a non-writer\u0027s label, make the publisher login\nconfigurable, pick pull_request builds only, keep Jekyll stamping out of\nquoted attributes, skip no-newline diff markers, and inject the overlay\ninto pages with an uppercase or omitted \u003c/body\u003e.\n\nGenerated-by: Claude Opus 5\n\n* website-comment: pin the test runner to ubuntu-26.04\n\nMatches the pin main adopted in #1407.\n\nGenerated-by: Claude Opus 5\n\n* website-comment: fix second-round review findings\n\nTry each successful build of a shared head commit until one is this PR\u0027s,\nlook up preview-site by name instead of one page of artifacts, remove\nevery extracted artifact after use, and repost a publish\u0027s comments when\nthe push landed but they did not. The production check now flags only\nreal data-preview-src attributes, and the Pelican example uploads the\ntempdir the action builds into.\n\nGenerated-by: Claude Opus 5\n\n* website-comment: fix third-round review findings\n\nReport an archive the fetcher refuses and try older builds, instead of\nfailing the run on every trigger; failed downloads still fail it. Keep\nartifact-controlled names and values out of refusal comments. Stamp\nAstro paths relative to the repository root, and pin setup-node to\nv7.1.0 everywhere.\n\nGenerated-by: Claude Opus 5\n\n* website-comment: fix fourth-round review findings\n\nTrust a label from the publisher\u0027s login only next to its arming record,\nsince github-actions[bot] is shared by every workflow in the repository.\nSize the screenshot cache to the page, encode source-link paths, inject\nthe overlay into .htm pages and inside one function scope, refuse Jekyll\nsites on the github-pages gem, detect entry scripts by real path, and\ncheck out the PR head for annotated builds in the README example.\n\nGenerated-by: Claude Opus 5\n\n* website-comment: fix fifth-round review findings\n\nAccept a publisher-login label only with an arming record made after it,\nso an old arming cannot vouch for a label re-added after a disarm. Inject\nthe overlay without lowercasing and as latin1, refuse malformed metadata\nper build, keep tombstoned branches for 30 minutes, skip re-screening an\nartifact already refused for the head, and tighten the github-pages\ncheck in prepare.sh.\n\nGenerated-by: Claude Opus 5\n\n* website-comment: fix sixth-round review findings\n\nBind the publisher\u0027s arming record to the label event\u0027s id rather than\nits time, recorded hidden in the explainer comment (an edit notifies\nnobody), the dispatch comment, or a short comment on a bot\u0027s PR. Treat\nanother PR\u0027s build of a shared head as not this PR\u0027s, remember refused\nbuild ids so a new build is still screened, skip unchanged status\nwrites, and match gem(\"github-pages\") in prepare.sh.\n\nGenerated-by: Claude Opus 5\n\n* website-comment: fix seventh-round review findings\n\nRecord an arming only when the label changed exactly once while being\nadded, and accept the record only where the publisher writes it. Make\nsure a retired PR says so before its tombstone branch goes, remember\npassed-over artifacts by artifact id one by one, and match a split\ndata-preview-src tag in the production check.\n\nGenerated-by: Claude Opus 5\n\n* preview-annotate: do not fail the production check on a clean page\n\nSteps run under bash -e -o pipefail, and the per-file loop ended on a\nnon-matching grep, so find returned non-zero and the clean-site case\naborted the step.\n\nGenerated-by: Claude Opus 5\n\n* website-comment: accept the publisher\u0027s own removal when re-arming\n\nReplacing a non-writer\u0027s label removes it first, and a lagging events\nAPI can show that removal next to the new label event, which the strict\nread-back refused on every run, so such a PR never armed.\n\nGenerated-by: Claude Opus 5" }, { "commit": "01bcdedeea785ada0161d7bc95191a6c1afa2f26", "tree": "3e87a3db9c866bb81239299ea2defc05dc1fab67", "parents": [ "039fd349d6281381d4e7856b4e48fc4cf41c6be3" ], "author": { "name": "asfgit", "email": "asfgit@users.noreply.github.com", "time": "Thu Oct 22 02:31:27 2026 +0000" }, "committer": { "name": "asfgit", "email": "asfgit@users.noreply.github.com", "time": "Thu Oct 22 02:31:27 2026 +0000" }, "message": "Remove Expired Refs\n\nGenerated by .github/workflows/remove_expired.yml\n" }, { "commit": "039fd349d6281381d4e7856b4e48fc4cf41c6be3", "tree": "faa92c62da8fe24ce37899bae2348299d1b83962", "parents": [ "5da27f5b746c2b441f1d5af88e6832dadeed79e2" ], "author": { "name": "asfgit", "email": "asfgit@users.noreply.github.com", "time": "Wed Oct 21 02:39:47 2026 +0000" }, "committer": { "name": "asfgit", "email": "asfgit@users.noreply.github.com", "time": "Wed Oct 21 02:39:47 2026 +0000" }, "message": "Remove Expired Refs\n\nGenerated by .github/workflows/remove_expired.yml\n" }, { "commit": "5da27f5b746c2b441f1d5af88e6832dadeed79e2", "tree": "240e6c760d5a16797bd1798dfc155b33c1a0ff19", "parents": [ "4304a6fd9cb1aabf84a1c9894e33e2954177644b" ], "author": { "name": "asfgit", "email": "asfgit@users.noreply.github.com", "time": "Tue Oct 20 02:26:10 2026 +0000" }, "committer": { "name": "asfgit", "email": "asfgit@users.noreply.github.com", "time": "Tue Oct 20 02:26:10 2026 +0000" }, "message": "Remove Expired Refs\n\nGenerated by .github/workflows/remove_expired.yml\n" }, { "commit": "4304a6fd9cb1aabf84a1c9894e33e2954177644b", "tree": "164e7e12ee574206413cae68c62e8ff771d06d54", "parents": [ "5bfad9b8d02eaec46d83bab8e2d337271b3881bc" ], "author": { "name": "Jarek Potiuk", "email": "jarek@potiuk.com", "time": "Tue Oct 20 01:23:40 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 20 01:23:40 2026 +0200" }, "message": "asf.yaml: drop integration_id so the Required checks ruleset applies (#1414)\n\nRaw ruleset values reach the API as strings except for a fixed set of\nkeys, so integration_id: -1 was sent as \"-1\" and GitHub rejected the\nrule (\"Invalid property /rules/0\"), leaving the ruleset uncreated.\nWithout it a check may come from any source, as intended.\n\nGenerated-by: Claude Opus 5" }, { "commit": "5bfad9b8d02eaec46d83bab8e2d337271b3881bc", "tree": "e802d9e52370599a2328e16cf3d98f8ee24ae894", "parents": [ "c837fa84c650d30a78aedec96243c029f238b942" ], "author": { "name": "Jarek Potiuk", "email": "jarek@potiuk.com", "time": "Tue Oct 20 01:19:00 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 20 01:19:00 2026 +0200" }, "message": "ci: require approval and verify checks via a ruleset (#1413)\n\n* ci: require the allow-list approval check, with a maintainer override\n\nMake \u0027approval\u0027 a required status check on main, so an allow-list PR\ncannot merge unapproved (#1409 did, as the check was advisory). A\nmaintainer can waive it with the allowlist-approval-override label, for\ntheir own allow-list PRs; it counts only if whoever last added it has\nwrite access.\n\nGenerated-by: Claude Opus 5\n\n* ci: require verify too, passing at once on non-allow-list PRs\n\nBoth verify workflows now start on every PR so the check can be\nrequired; a first step decides from the PR\u0027s file list and skips the\nrest when the allow list is untouched, failing closed.\n\nGenerated-by: Claude Opus 5\n\n* ci: verify every allow-list file, compare names exactly\n\nBoth verify jobs watch all three allow-list paths, so the one that runs\nfor a PR\u0027s author covers each; file names are matched as JSON strings\nand counted as entries, and a list at the API cap is verified.\n\nGenerated-by: Claude Opus 5\n\n* ci: put the required checks in a ruleset; drop the label override\n\nOnly a ruleset can say who may bypass a required check: admins always\n(asfgit\u0027s direct sync pushes), write access on pull requests only. That\nreplaces the allowlist-approval-override label, so the approval script\nis back to main\u0027s version.\n\nGenerated-by: Claude Opus 5" }, { "commit": "c837fa84c650d30a78aedec96243c029f238b942", "tree": "491e90f82220375092d63b522585dd1525369c23", "parents": [ "ea38d39b659b626df8863ed14458897c733f43f3" ], "author": { "name": "asfgit", "email": "asfgit@users.noreply.github.com", "time": "Mon Oct 19 23:08:57 2026 +0000" }, "committer": { "name": "asfgit", "email": "asfgit@users.noreply.github.com", "time": "Mon Oct 19 23:08:57 2026 +0000" }, "message": "Sync actions.yml, composite action, and approved_patterns.yml\n\nGenerated by .github/workflows/update.yml\n" }, { "commit": "ea38d39b659b626df8863ed14458897c733f43f3", "tree": "bef896af9a60ea34246b56289e0a99d25b74e129", "parents": [ "f15e7c603d2e3cf7ab5a3edd2dfa0d167dd9795b" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Tue Oct 20 01:05:59 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 20 01:05:59 2026 +0200" }, "message": "action-allowlist-review: bump jdx/mise-action (#1410)\n\nBumps [jdx/mise-action](https://github.com/jdx/mise-action) from 5.2.0 to 5.2.1.\n- [Release notes](https://github.com/jdx/mise-action/releases)\n- [Changelog](https://github.com/jdx/mise-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/jdx/mise-action/compare/9b200bcecbfd6303e69a4a261b2e09e3757440a7...fc42bcc7ddbf51124c30f95a877a0c5168a3bfde)\n\n---\nupdated-dependencies:\n- dependency-name: jdx/mise-action\n dependency-version: 5.2.1\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "f15e7c603d2e3cf7ab5a3edd2dfa0d167dd9795b", "tree": "08e147cc0f2792a94b6f7e8e083ddbeb0acac05c", "parents": [ "98e2dc50dc905144e793eadb5da589e8605313eb" ], "author": { "name": "asfgit", "email": "asfgit@users.noreply.github.com", "time": "Mon Oct 19 23:01:00 2026 +0000" }, "committer": { "name": "asfgit", "email": "asfgit@users.noreply.github.com", "time": "Mon Oct 19 23:01:00 2026 +0000" }, "message": "Sync actions.yml, composite action, and approved_patterns.yml\n\nGenerated by .github/workflows/update.yml\n" }, { "commit": "98e2dc50dc905144e793eadb5da589e8605313eb", "tree": "fa3661d49187041b31c1891e2cbd97a97ab1f42e", "parents": [ "5cf4948ce54edebeece7a49b09fdaeb3f54b83c8" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Tue Oct 20 00:56:15 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 20 00:56:15 2026 +0200" }, "message": "action-allowlist-review: bump j178/prek-action (#1409)\n\nBumps [j178/prek-action](https://github.com/j178/prek-action) from 3.0.1 to 3.0.2.\n- [Release notes](https://github.com/j178/prek-action/releases)\n- [Commits](https://github.com/j178/prek-action/compare/1382ad72dea72f9d53832f2bcb65b3e87a947204...af4d4fcb6922b8e6f65c0426947125fcc38794ce)\n\n---\nupdated-dependencies:\n- dependency-name: j178/prek-action\n dependency-version: 3.0.2\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "5cf4948ce54edebeece7a49b09fdaeb3f54b83c8", "tree": "8e1fdd1d21c60abe3de883f3bba8b97f6d604852", "parents": [ "8f8d7d440cd24d94b4404c9faf7ceafd73900710" ], "author": { "name": "Jarek Potiuk", "email": "jarek@potiuk.com", "time": "Mon Oct 19 20:56:31 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 19 20:56:31 2026 +0200" }, "message": "ci: require maintainer approval on allow-list PRs (#1412)\n\n* ci: require maintainer approval on allow-list PRs\n\nAdds an \"Allowlist Maintainer Approval\" check that fails PRs touching\nactions.yml, approved_patterns.yml or the Dependabot composite action\nuntil a reviewer with write access has approved. Re-runs on review\nevents; non-allowlist PRs pass, so it can be made a required check.\n\nGenerated-by: Claude Opus 5\n\n* ci: check renamed and truncated file lists in allow-list gate\n\nGenerated-by: Claude Opus 5" }, { "commit": "8f8d7d440cd24d94b4404c9faf7ceafd73900710", "tree": "ef85e3e9325c737c118141075e7b7803b5308fbf", "parents": [ "51e411ac5fd62d8a8a8a166f4ca43e3ed125144a" ], "author": { "name": "asfgit", "email": "asfgit@users.noreply.github.com", "time": "Mon Oct 19 18:50:08 2026 +0000" }, "committer": { "name": "asfgit", "email": "asfgit@users.noreply.github.com", "time": "Mon Oct 19 18:50:08 2026 +0000" }, "message": "Sync actions.yml, composite action, and approved_patterns.yml\n\nGenerated by .github/workflows/update.yml\n" }, { "commit": "51e411ac5fd62d8a8a8a166f4ca43e3ed125144a", "tree": "d5a9820ed248bf516f024769a0f7d79e01b9ca54", "parents": [ "877cc7ec6e42cf27a976e49ed7750ab0544566c1" ], "author": { "name": "Jarek Potiuk", "email": "jarek@potiuk.com", "time": "Mon Oct 19 20:05:41 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 19 20:05:41 2026 +0200" }, "message": "magpie: adopt Magpie plugin floor; make .agents/skills canonical (#1321)\n\n* magpie: adopt Apache Magpie plugin floor\n\nCommit a minimum Magpie version and plugin set (setup, utilities,\nagent-guard) so contributors get the same baseline on clone. The\ncommitted .claude/settings.json carries only the floor derived from\n.apache-magpie.lock; personal settings stay in settings.local.json.\n\nGenerated-by: Claude Opus 5\n\n* skills: make .agents/skills canonical, symlink agent dirs\n\nMove analyze-action-pr and sweep-open-prs to .agents/skills/ and point\n.claude/skills and .github/skills at it, so every agent that reads the\nshared path sees the same project skills.\n\nGenerated-by: Claude Opus 5" }, { "commit": "877cc7ec6e42cf27a976e49ed7750ab0544566c1", "tree": "70812b576ccca039832c195e06198a44002961a4", "parents": [ "47343c63d62187b706b16aae78b8108b80882eb3" ], "author": { "name": "Jarek Potiuk", "email": "jarek@potiuk.com", "time": "Mon Oct 19 19:58:02 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 19 19:58:02 2026 +0200" }, "message": "pelican: build cmark-gfm under CMake 4 (Ubuntu 26.04) (#1408)\n\n* pelican: let cmark-gfm configure under CMake 4\n\nUbuntu 26.04 ships CMake 4.4, which rejects cmark-gfm 0.28.3.gfm.12\u0027s\ncmake_minimum_required below 3.5, so the GFM build step fails. This\nhits every pelican action user once ubuntu-latest moves to 26.04.\n\nGenerated-by: Claude Opus 5\n\n* pelican: drop cmark-gfm\u0027s CMP0048 OLD policy for CMake 4\n\nThe policy-minimum flag gets past cmake_minimum_required, but CMake 4\nrefuses cmake_policy(SET CMP0048 OLD) outright. NEW is equivalent here\nbecause CMakeLists.txt sets PROJECT_VERSION itself after project().\n\nGenerated-by: Claude Opus 5" }, { "commit": "47343c63d62187b706b16aae78b8108b80882eb3", "tree": "70812b576ccca039832c195e06198a44002961a4", "parents": [ "2eadb5128a58df73546a5f4f114173dc2ea22511" ], "author": { "name": "Jarek Potiuk", "email": "jarek@potiuk.com", "time": "Mon Oct 19 19:57:51 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 19 19:57:51 2026 +0200" }, "message": "ci: pin runners to ubuntu-26.04; fix pelican GFM build on CMake 4 (#1407)\n\n* ci: pin ubuntu-latest jobs to ubuntu-26.04\n\nubuntu-latest starts moving to 26.04 on 2026-10-19 over several weeks\n(actions/runner-images#14748). A named label gives every run the same\nimage during the rollout and makes the next bump an explicit change.\n\nGenerated-by: Claude Opus 5\n\n* pelican: let cmark-gfm configure under CMake 4\n\nUbuntu 26.04 ships CMake 4.4, which rejects cmark-gfm 0.28.3.gfm.12\u0027s\ncmake_minimum_required below 3.5, so the GFM build step fails. This\nhits every pelican action user once ubuntu-latest moves to 26.04.\n\nGenerated-by: Claude Opus 5\n\n* pelican: drop cmark-gfm\u0027s CMP0048 OLD policy for CMake 4\n\nThe policy-minimum flag gets past cmake_minimum_required, but CMake 4\nrefuses cmake_policy(SET CMP0048 OLD) outright. NEW is equivalent here\nbecause CMakeLists.txt sets PROJECT_VERSION itself after project().\n\nGenerated-by: Claude Opus 5" }, { "commit": "2eadb5128a58df73546a5f4f114173dc2ea22511", "tree": "282d3a2deb1094fccc79c9fd311d5b49028f9904", "parents": [ "75ad4f8c98a08656d8f22f0d3be39fe0c2b93dac" ], "author": { "name": "Jarek Potiuk", "email": "jarek@potiuk.com", "time": "Mon Oct 19 19:57:35 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 19 19:57:35 2026 +0200" }, "message": "analyze-action-pr: add #1404 cargo-rail-action precedent (#1406)\n\nRecords that producer-side attestation closed the #1298 hold, and that\nthe remaining consumer-side gap is carried over, not a re-block.\n\nGenerated-by: Claude Opus 5" }, { "commit": "75ad4f8c98a08656d8f22f0d3be39fe0c2b93dac", "tree": "634b782de55b0ddbed6f509dc0b413fa87f8a721", "parents": [ "926db802a83c2b56b95c1ff3902285db40ba0502" ], "author": { "name": "Jarek Potiuk", "email": "jarek@potiuk.com", "time": "Mon Oct 19 19:57:24 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 19 19:57:24 2026 +0200" }, "message": "analyze-action-pr: run gh bare so the sandbox exclusion applies (#1403)\n\nexcludedCommands \"gh *\" only matches a single gh invocation; piping\nor redirecting its output re-sandboxes the command and it fails with a\nnetwork deny or an x509 TLS error. Drop the sed pipe from the CI log\nrecipe and record the symptom in the gotchas table.\n\nGenerated-by: Claude Opus 5" }, { "commit": "926db802a83c2b56b95c1ff3902285db40ba0502", "tree": "71c496a2f9ac3ae999804661c717b69164d9baa5", "parents": [ "292699c55e697e0163fba025a2a15dd0c17f91f5" ], "author": { "name": "Jarek Potiuk", "email": "jarek@potiuk.com", "time": "Mon Oct 19 19:57:09 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 19 19:57:09 2026 +0200" }, "message": "Approve sigstore/cosign-installer v4.1.2 (#1376)\n\nhelm/chart-testing-action v2.9.0 (#1374) pins cosign-installer@6f9f177\n(v4.1.2); only v4.0.0 is allowed, so the bump would break consumers.\n\nGenerated-by: Claude Opus 5" }, { "commit": "292699c55e697e0163fba025a2a15dd0c17f91f5", "tree": "b0924049041f3905c5822daf419651022caa9582", "parents": [ "978fdfb6cd0200e0419816d6819fe8144006e34a" ], "author": { "name": "Jarek Potiuk", "email": "jarek@potiuk.com", "time": "Mon Oct 19 19:56:56 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 19 19:56:56 2026 +0200" }, "message": "RELEASING: note that moved major tags need git fetch --force (#1375)\n\nMajor \u003cprefix\u003e/vN tags are force-moved on release, but a plain git fetch\nkeeps the stale local copy, so they look outdated in existing clones.\n\nCloses #1372\n\nGenerated-by: Claude Opus 5" }, { "commit": "978fdfb6cd0200e0419816d6819fe8144006e34a", "tree": "45631ba3324765559318c2ed4fc00dabe959d2fb", "parents": [ "20c17e74958a91b5106b3be26ed17f0cdbdfa9e2" ], "author": { "name": "Jarek Potiuk", "email": "jarek@potiuk.com", "time": "Mon Oct 19 19:56:45 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 19 19:56:45 2026 +0200" }, "message": "verify-action-build: scan scripts reached via the action path (#1357)\n\nComposite actions usually call bundled scripts as\n$GITHUB_ACTION_PATH/scripts/x.sh or ${{ github.action_path }}/x.sh.\nThe bare env-var form resolved to a bogus GITHUB_ACTION_PATH/... path\nand any line with a ${{ }} expression was skipped outright, so neither\nthe download scan nor script analysis read the script.\ncargo-rail-action v10.1.1 (#1345) reported \"no downloads\" for a\nbootstrap.sh that fetches a release binary. Strip the action-path\nprefix and blank other expressions instead of skipping the line.\n\nGenerated-by: Claude Opus 5" }, { "commit": "20c17e74958a91b5106b3be26ed17f0cdbdfa9e2", "tree": "756774c92b325cebec9722d32edd0ca94f7782a5", "parents": [ "363fb535a87be14da958a40d8819d524c2c2fa08" ], "author": { "name": "Jarek Potiuk", "email": "jarek@potiuk.com", "time": "Mon Oct 19 18:24:05 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 19 18:24:05 2026 +0200" }, "message": "analyze-action-pr: add #1323 and #1329 precedents (#1331)\n\nRecords the short-file-as-minified gap (#1323) and the carried-over\nrun-on-arch node_modules drift (#1329).\n\nGenerated-by: Claude Opus 5" }, { "commit": "363fb535a87be14da958a40d8819d524c2c2fa08", "tree": "b0d234f1dcd51f67690f215dbb7bb3a8acbfe825", "parents": [ "e857e2dcf78f1a88bd382d33028145f049608d74" ], "author": { "name": "Jarek Potiuk", "email": "jarek@potiuk.com", "time": "Mon Oct 19 18:23:54 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 19 18:23:54 2026 +0200" }, "message": "verify-action-build: keep short hand-written JS, npm6 false fields (#1330)\n\nThe pre-rebuild deletion treated any JS file under 10 lines as minified,\nso actions with no build step lost small hand-written modules\n(manusa/actions-setup-minikube\u0027s 8-line src/shell-quote.js) and failed\nwith \"only in original\". Minified now means long lines: average \u003e500\nchars, or a line \u003e500 chars in a file under 10 lines.\n\nThe registry check also flagged vendored package.json files carrying\nnpm v6\u0027s \"bundleDependencies\": false / \"deprecated\": false; both are now\ndropped when exactly false.\n\nSeen on #1323.\n\nGenerated-by: Claude Opus 5" }, { "commit": "e857e2dcf78f1a88bd382d33028145f049608d74", "tree": "338064b29ec215991e581a5f8e7c191cb3fcff0f", "parents": [ "c00a32813a98220632c166ea4ac636a7d58be886" ], "author": { "name": "Jarek Potiuk", "email": "jarek@potiuk.com", "time": "Mon Oct 19 18:23:30 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 19 18:23:30 2026 +0200" }, "message": "verify-action-build: resolve the Dockerfile named by runs.image: (#1320)\n\nDockerfile analysis probed only \u003csub_path\u003e/Dockerfile and the repo root,\nso a docker action that renames its Dockerfile or keeps it outside the\naction directory reported \"no Dockerfile\" and skipped every base-image\nand command check.\n\nFound on #1319: google/oss-fuzz\u0027s cifuzz actions point\nimage: \u0027../../../build_fuzzers.Dockerfile\u0027 three levels up, so their\nunpinned FROM gcr.io/oss-fuzz-base/cifuzz-base went unreported.\n\nGenerated-by: Claude Opus 5" }, { "commit": "c00a32813a98220632c166ea4ac636a7d58be886", "tree": "f9a6afd4cbfc427c097c5fcc2220231f0537c84c", "parents": [ "959b546c09920989850eae2344d03db35a2f06d6" ], "author": { "name": "Jarek Potiuk", "email": "jarek@potiuk.com", "time": "Mon Oct 19 18:23:17 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 19 18:23:17 2026 +0200" }, "message": "verify-action-build: catch variable-URL downloads, dual-license repos (#1312)\n\n* verify-action-build: catch variable-URL downloads, dual-license repos\n\nThe shell download scan only fired on lines carrying a literal URL, so\nthe \"resolve from the releases API, then curl $LOCATION\" installer shape\nreported \"No binary downloads detected\". orhun/git-cliff-action\u0027s\ninstall.sh (#1311) fetches and installs a tarball this way with no\nchecksum. Flag a variable-URL download when it is written to a file and\nthe same script goes on to extract, chmod, or install the result; pure\ndata fetches (command substitution, stdout) stay exempt.\n\nAlso recognise LICENSE-APACHE / LICENSE-MIT (and LICENCE), so Rust-style\ndual-licensed repos no longer warn \"No LICENSE file found\".\n\nUpstream: https://github.com/orhun/git-cliff-action/issues/87\n\nGenerated-by: Claude Code (Fable 5.1)\n\n* verify-action-build: strip ANSI in dual-license test\n\nCI forces colour, so the console output carried escape codes inside\n\"LICENSE-APACHE (Apache 2.0)\" and the substring match failed.\n\nGenerated-by: Claude Code (Fable 5.1)\n\n* verify-action-build: regression test for mktemp + sudo install download\n\nendersonmenezes/free-disk-space v4.0.0 (#1342) curls a release binary\ninto a mktemp file via a variable URL and `sudo install`s it with no\nchecksum; main reported \"No binary downloads detected\". The\nvariable-URL detection in this branch catches it; pin that shape.\n\nGenerated-by: Claude Opus 5\n\n* verify-action-build: join backslash-continued lines in download scan\n\nLong curl calls put the output flag and URL on continuation lines, so\nthe per-line scan saw a bare `curl --fail ... \\` and missed the\ndownload. cargo-rail-action v10.1.1 (#1345) bootstrap.sh fetches its\nruntime binary this way. Scan logical lines, reported at their first\nphysical line.\n\nGenerated-by: Claude Opus 5\n\n* verify-action-build: joined lines must not hide per-line findings\n\nScanning only joined continuation lines let a package-manager call\nearlier in a RUN shield a curl on its continuation line, and a comment\nending in a backslash swallow the next command. Scan every physical\nline as before and add a joined command only when none of its lines\nwas already flagged; comments never start a continuation.\n\nGenerated-by: Claude Opus 5" }, { "commit": "959b546c09920989850eae2344d03db35a2f06d6", "tree": "0c22037ed4b5cecc809a99a03d08ce690481445e", "parents": [ "dfa4b92ce20235425f13149c8d15c52d9abe6a85" ], "author": { "name": "Jarek Potiuk", "email": "jarek@potiuk.com", "time": "Mon Oct 19 18:23:03 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 19 18:23:03 2026 +0200" }, "message": "sweep-open-prs: skill for triaging the whole open PR queue (#1294)\n\n* sweep-open-prs: skill for triaging the whole open PR queue\n\nCodifies the pass a maintainer makes repeatedly: gather state for every open\nPR, bucket each one into merge-now / approve+merge / needs-triage / blocked,\nand act only on what is confirmed.\n\nTwo `gh pr list` calls cover the queue -- one for state, one for a check\nrollup collapsed to only non-green results -- which avoids the per-PR loop\nthat trips gh\u0027s spurious 401. Records the judgement rules that decide most of\nthe queue: BLOCKED + REVIEW_REQUIRED means \"needs one approval\" rather than\n\"broken\", self-authored PRs can never be self-approved, carried-over warnings\nare not regressions, and a held bump is often superseded rather than fixed.\n\nRoutes anything red, or any bump being approved on substance, to\nanalyze-action-pr rather than duplicating its failure taxonomy.\n\nGenerated-by: Claude Opus 5\n\n* README: document the agent skills\n\nAdds an Agent Skills section covering analyze-action-pr and sweep-open-prs,\nwith a TOC entry. Points readers at Batch-Reviewing Dependabot PRs as the\nnon-agent equivalent of the queue sweep.\n\nanalyze-action-pr had never been documented; it is included here rather than\nleft invisible now that the section exists.\n\nGenerated-by: Claude Opus 5\n\n* sweep-open-prs: report unfinished checks instead of blanking them\n\nA CheckRun carries conclusion: null until status reaches COMPLETED, and its\nstate is always null -- state belongs to the StatusContext shape. Reaching\nstraight for (.conclusion // .state) printed a bare \"name\u003d\" for every check\nstill running, which reads as a finding rather than \"ask again in a minute\".\nIt misreported a PR whose ten checks were simply mid-flight.\n\nRead status first and report QUEUED / IN_PROGRESS, and record alongside the\nUNKNOWN mergeability case that neither is a verdict.\n\nGenerated-by: Claude Opus 5\n\n* sweep-open-prs: run gh bare so the sandbox exclusion applies\n\nWith excludedCommands \"gh *\", gh needs no sandbox bypass, but only as\na single bare command; a pipe or redirect re-sandboxes it. Update the\nEnvironment section, drop the sed pipe from the red-check recipe, and\nadd the mistake to the table.\n\nGenerated-by: Claude Opus 5\n\n* sweep-open-prs: keep gh commands on one line\n\nA multi-line gh command (backslash continuation, multi-line --jq or\n--body) does not match the \"gh *\" sandbox exclusion. Collapse the\nrecipes to single lines and say so in Environment.\n\nGenerated-by: Claude Opus 5" }, { "commit": "dfa4b92ce20235425f13149c8d15c52d9abe6a85", "tree": "d1f5b20eeba5cbc7d207b762c79603b5df173969", "parents": [ "7a8ef189702fefbbe0d2ba6f15fbf8dd5745bb8e" ], "author": { "name": "Jarek Potiuk", "email": "jarek@potiuk.com", "time": "Mon Oct 19 18:22:36 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 19 18:22:36 2026 +0200" }, "message": "asf.yaml: drop required PR reviews on main (#1411)\n\nGenerated-by: Claude Opus 5" }, { "commit": "7a8ef189702fefbbe0d2ba6f15fbf8dd5745bb8e", "tree": "01e5264914f7791d89d52d0d90a17c78c8daa403", "parents": [ "415aa224539c6cb47689bcc3db8bbf2c8907541a" ], "author": { "name": "asfgit", "email": "asfgit@users.noreply.github.com", "time": "Mon Oct 19 02:35:13 2026 +0000" }, "committer": { "name": "asfgit", "email": "asfgit@users.noreply.github.com", "time": "Mon Oct 19 02:35:13 2026 +0000" }, "message": "Remove Expired Refs\n\nGenerated by .github/workflows/remove_expired.yml\n" }, { "commit": "415aa224539c6cb47689bcc3db8bbf2c8907541a", "tree": "3bac6d8a869995964fcec4262befc0405f0f2217", "parents": [ "1d17a83dbf6e02ec9460f5225229e0b9fb2ad018" ], "author": { "name": "asfgit", "email": "asfgit@users.noreply.github.com", "time": "Sun Oct 18 20:36:51 2026 +0000" }, "committer": { "name": "asfgit", "email": "asfgit@users.noreply.github.com", "time": "Sun Oct 18 20:36:51 2026 +0000" }, "message": "Sync actions.yml, composite action, and approved_patterns.yml\n\nGenerated by .github/workflows/update.yml\n" }, { "commit": "1d17a83dbf6e02ec9460f5225229e0b9fb2ad018", "tree": "95bb572829230871789d4f7bcf4c5d1e88ea370c", "parents": [ "4358c79d77274bcb6387d7cfda297829ce9271de" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sun Oct 18 22:36:27 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Oct 18 22:36:27 2026 +0200" }, "message": "action-allowlist-review: bump loadingalias/cargo-rail-action (#1404)\n\nBumps [loadingalias/cargo-rail-action](https://github.com/loadingalias/cargo-rail-action) from 11.0.1 to 12.0.0.\n- [Release notes](https://github.com/loadingalias/cargo-rail-action/releases)\n- [Changelog](https://github.com/loadingalias/cargo-rail-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/loadingalias/cargo-rail-action/compare/2104429578cfeef1a6a5beb379c2202e0310df78...fd41439dfa862939e6928cb98d7e76de580f673c)\n\n---\nupdated-dependencies:\n- dependency-name: loadingalias/cargo-rail-action\n dependency-version: 12.0.0\n dependency-type: direct:production\n update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "4358c79d77274bcb6387d7cfda297829ce9271de", "tree": "3ef662f7b3ebe40fa3f83a56139c10bcfb27fb01", "parents": [ "3a171ad70970b1ffaa964fff1d1fe499cb5c98ad" ], "author": { "name": "asfgit", "email": "asfgit@users.noreply.github.com", "time": "Sat Oct 17 00:56:07 2026 +0000" }, "committer": { "name": "asfgit", "email": "asfgit@users.noreply.github.com", "time": "Sat Oct 17 00:56:07 2026 +0000" }, "message": "Sync actions.yml, composite action, and approved_patterns.yml\n\nGenerated by .github/workflows/update.yml\n" }, { "commit": "3a171ad70970b1ffaa964fff1d1fe499cb5c98ad", "tree": "90745f8804613031b3fb6c16411bcbf291d64aad", "parents": [ "9c9dc55c0a4efbb7a0fdd45796929373fb8e7828", "2a91e53e8f972fd89e7fa1ed29526c3894e7ee3f" ], "author": { "name": "Jarek Potiuk", "email": "jarek@potiuk.com", "time": "Sat Oct 17 01:53:54 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 17 01:53:54 2026 +0100" }, "message": "Merge pull request #1392 from apache/dependabot/github_actions/dot-github/actions/for-dependabot-triggered-reviews/bazel-contrib/setup-bazel-0.19.1\n\naction-allowlist-review: bump bazel-contrib/setup-bazel from 0.19.0 to 0.19.1 in /.github/actions/for-dependabot-triggered-reviews" }, { "commit": "9c9dc55c0a4efbb7a0fdd45796929373fb8e7828", "tree": "19c1dfc853abb146a8dc205c66b4171964ac4723", "parents": [ "e4e367486a23da794beb597fd3d13b44d7fcae08" ], "author": { "name": "asfgit", "email": "asfgit@users.noreply.github.com", "time": "Sat Oct 17 00:49:17 2026 +0000" }, "committer": { "name": "asfgit", "email": "asfgit@users.noreply.github.com", "time": "Sat Oct 17 00:49:17 2026 +0000" }, "message": "Sync actions.yml, composite action, and approved_patterns.yml\n\nGenerated by .github/workflows/update.yml\n" }, { "commit": "e4e367486a23da794beb597fd3d13b44d7fcae08", "tree": "a98763348e884803691976e2be569f02612e9e15", "parents": [ "68b720aa224802db3f9fd85f3587f163bcb70e76", "dd7533ca67981ca25430453c3323596bc64baf0d" ], "author": { "name": "Jarek Potiuk", "email": "jarek@potiuk.com", "time": "Sat Oct 17 01:47:01 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 17 01:47:01 2026 +0100" }, "message": "Merge pull request #1389 from apache/dependabot/github_actions/dot-github/actions/for-dependabot-triggered-reviews/docker/bake-action-7.5.0\n\naction-allowlist-review: bump docker/bake-action from 7.4.0 to 7.5.0 in /.github/actions/for-dependabot-triggered-reviews" }, { "commit": "68b720aa224802db3f9fd85f3587f163bcb70e76", "tree": "6ba81bfdc9408956338c2ba3e53c1659f8f867b2", "parents": [ "3731821732d3d16deb7e4fdbdc18310521b5b9d5", "71364154d4db654b3eea38ee7b1207fd6e754281" ], "author": { "name": "Jarek Potiuk", "email": "jarek@potiuk.com", "time": "Sat Oct 17 01:45:26 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 17 01:45:26 2026 +0100" }, "message": "Merge pull request #1401 from apache/dependabot/github_actions/dot-github/actions/for-dependabot-triggered-reviews/zizmorcore/zizmor-action-0.7.1\n\naction-allowlist-review: bump zizmorcore/zizmor-action from 0.6.4 to 0.7.1 in /.github/actions/for-dependabot-triggered-reviews" }, { "commit": "3731821732d3d16deb7e4fdbdc18310521b5b9d5", "tree": "d04433cae18ccf283331cc25eea19333ece8ff5e", "parents": [ "0f9a35c47965885fea283267161876c4b6476574", "0c5d172b0dbf556e1360dad050929060c226cecd" ], "author": { "name": "Jarek Potiuk", "email": "jarek@potiuk.com", "time": "Sat Oct 17 01:45:22 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 17 01:45:22 2026 +0100" }, "message": "Merge pull request #1400 from apache/dependabot/github_actions/dot-github/actions/for-dependabot-triggered-reviews/jdx/mise-action-5.2.0\n\naction-allowlist-review: bump jdx/mise-action from 5.1.1 to 5.2.0 in /.github/actions/for-dependabot-triggered-reviews" }, { "commit": "0f9a35c47965885fea283267161876c4b6476574", "tree": "9446741317bc3feb140056194e59bc5121fc9bfc", "parents": [ "a279a1a95d78fd0ecbd3683d81745623ab91554a", "22746efc1ee3e5d44ad9f554177d7e4989ff8222" ], "author": { "name": "Jarek Potiuk", "email": "jarek@potiuk.com", "time": "Sat Oct 17 01:45:17 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 17 01:45:17 2026 +0100" }, "message": "Merge pull request #1399 from apache/dependabot/github_actions/dot-github/actions/for-dependabot-triggered-reviews/coursier/cache-action-8.2.0\n\naction-allowlist-review: bump coursier/cache-action from 8.1.1 to 8.2.0 in /.github/actions/for-dependabot-triggered-reviews" }, { "commit": "a279a1a95d78fd0ecbd3683d81745623ab91554a", "tree": "943465a9e06c591c401ef3c4eb1b5224b782a583", "parents": [ "15f1603bf38d9cf29b196b9cb8f8f2d3804a9478", "4f3fe9934f078cd527733db78ad030587aaae126" ], "author": { "name": "Jarek Potiuk", "email": "jarek@potiuk.com", "time": "Sat Oct 17 01:45:11 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 17 01:45:11 2026 +0100" }, "message": "Merge pull request #1395 from apache/dependabot/github_actions/dot-github/actions/for-dependabot-triggered-reviews/commit-check/commit-check-action-2.18.0\n\naction-allowlist-review: bump commit-check/commit-check-action from 2.17.1 to 2.18.0 in /.github/actions/for-dependabot-triggered-reviews" }, { "commit": "15f1603bf38d9cf29b196b9cb8f8f2d3804a9478", "tree": "94b7c8ea442e0eff1e2255f292c881e00e41a02d", "parents": [ "95974e93a742f0119e7830b32738b0ca8bceaf2f", "c4fc4987943bd8276a1e03b6c7996cb7a04bd200" ], "author": { "name": "Jarek Potiuk", "email": "jarek@potiuk.com", "time": "Sat Oct 17 01:43:46 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 17 01:43:46 2026 +0100" }, "message": "Merge pull request #1391 from apache/dependabot/github_actions/dot-github/actions/for-dependabot-triggered-reviews/CodSpeedHQ/action-5.5.0\n\naction-allowlist-review: bump CodSpeedHQ/action from 5.4.2 to 5.5.0 in /.github/actions/for-dependabot-triggered-reviews" }, { "commit": "95974e93a742f0119e7830b32738b0ca8bceaf2f", "tree": "4da4b4caa27234b5ba8d0ca13caa7604c78f6507", "parents": [ "4bac11fe657cc5c4811735779260b30c8e49d635", "d30c7aa0565d4e1ce392727cbdd1d5ca3933973b" ], "author": { "name": "Jarek Potiuk", "email": "jarek@potiuk.com", "time": "Sat Oct 17 01:43:32 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 17 01:43:32 2026 +0100" }, "message": "Merge pull request #1390 from apache/dependabot/github_actions/dot-github/actions/for-dependabot-triggered-reviews/endersonmenezes/free-disk-space-4.0.1\n\naction-allowlist-review: bump endersonmenezes/free-disk-space from 4.0.0 to 4.0.1 in /.github/actions/for-dependabot-triggered-reviews" }, { "commit": "4bac11fe657cc5c4811735779260b30c8e49d635", "tree": "0c9a609d71b1ffaac782acf6bc6cba41fb70eb53", "parents": [ "77972b1d5ed498eb1e22ac3503539ea07f51487c", "f9288769d02c3cb6fc76bf4c749faa60655da715" ], "author": { "name": "Jarek Potiuk", "email": "jarek@potiuk.com", "time": "Sat Oct 17 01:43:25 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 17 01:43:25 2026 +0100" }, "message": "Merge pull request #1388 from apache/dependabot/github_actions/dot-github/actions/for-dependabot-triggered-reviews/burnett01/rsync-deployments-9.0.2\n\naction-allowlist-review: bump burnett01/rsync-deployments from 9.0.1 to 9.0.2 in /.github/actions/for-dependabot-triggered-reviews" }, { "commit": "77972b1d5ed498eb1e22ac3503539ea07f51487c", "tree": "65ab777d46c58462cd509dcdd5c4c899487754dc", "parents": [ "355be3a7ea4e80a0d82338de6dbd2eebbd108862", "a040abd6cd3da02dceb3c77ee09874b4cce341bc" ], "author": { "name": "Jarek Potiuk", "email": "jarek@potiuk.com", "time": "Sat Oct 17 01:43:20 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 17 01:43:20 2026 +0100" }, "message": "Merge pull request #1387 from apache/dependabot/github_actions/dot-github/actions/for-dependabot-triggered-reviews/loadingalias/cargo-rail-action-11.0.1\n\naction-allowlist-review: bump loadingalias/cargo-rail-action from 11.0.0 to 11.0.1 in /.github/actions/for-dependabot-triggered-reviews" }, { "commit": "355be3a7ea4e80a0d82338de6dbd2eebbd108862", "tree": "23cc6f74df0f6cedc7ef179bbc75a6bce5e08c76", "parents": [ "d4bc2f8bba7ef45c8a71a3544c4db192d11e77bb", "db8e8c82eb3437fc48e49b06e6f848a39d29b196" ], "author": { "name": "Jarek Potiuk", "email": "jarek@potiuk.com", "time": "Sat Oct 17 01:43:15 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 17 01:43:15 2026 +0100" }, "message": "Merge pull request #1386 from apache/dependabot/github_actions/dot-github/actions/for-dependabot-triggered-reviews/sbt/setup-sbt-1.5.12\n\naction-allowlist-review: bump sbt/setup-sbt from 1.5.11 to 1.5.12 in /.github/actions/for-dependabot-triggered-reviews" }, { "commit": "dd7533ca67981ca25430453c3323596bc64baf0d", "tree": "eec5e28a08fea44072c64210551cab8e921bbf8e", "parents": [ "d4bc2f8bba7ef45c8a71a3544c4db192d11e77bb" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sat Oct 17 00:41:53 2026 +0000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 17 00:41:53 2026 +0000" }, "message": "action-allowlist-review: bump docker/bake-action\n\nBumps [docker/bake-action](https://github.com/docker/bake-action) from 7.4.0 to 7.5.0.\n- [Release notes](https://github.com/docker/bake-action/releases)\n- [Commits](https://github.com/docker/bake-action/compare/018cb6412ab401ebaa809aa5f85966b74628600f...59cb1203cd42bcefd40a1b6d73b589e48c86040e)\n\n---\nupdated-dependencies:\n- dependency-name: docker/bake-action\n dependency-version: 7.5.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "d4bc2f8bba7ef45c8a71a3544c4db192d11e77bb", "tree": "bf6027eaa2f5dea8c5963723c1b3cad668678ea2", "parents": [ "fb774d21dd1e86c5d14544f4578c219341955533" ], "author": { "name": "asfgit", "email": "asfgit@users.noreply.github.com", "time": "Sat Oct 17 00:39:57 2026 +0000" }, "committer": { "name": "asfgit", "email": "asfgit@users.noreply.github.com", "time": "Sat Oct 17 00:39:57 2026 +0000" }, "message": "Sync actions.yml, composite action, and approved_patterns.yml\n\nGenerated by .github/workflows/update.yml\n" }, { "commit": "fb774d21dd1e86c5d14544f4578c219341955533", "tree": "a18e1f27a8ec25f708a42eaaf6879e95dc8c2455", "parents": [ "e9765de6e0d2531944553429b0dcc558ea6f7baf", "cd5f43563ac37e08f748be2680e37afa7bd1ea93" ], "author": { "name": "Jarek Potiuk", "email": "jarek@potiuk.com", "time": "Sat Oct 17 01:39:32 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 17 01:39:32 2026 +0100" }, "message": "Merge pull request #1385 from apache/dependabot/github_actions/dot-github/actions/for-dependabot-triggered-reviews/goreleaser/goreleaser-action-7.3.0\n\naction-allowlist-review: bump goreleaser/goreleaser-action from 7.2.3 to 7.3.0 in /.github/actions/for-dependabot-triggered-reviews" }, { "commit": "e9765de6e0d2531944553429b0dcc558ea6f7baf", "tree": "0e8dc0819728fe94e4142eaa8107f45358e002cd", "parents": [ "126c297ad7d637391ecfa0b8394ea22380663ace", "872ce6bad8420f7af92eb3815b4a6b0cad2e3bb1" ], "author": { "name": "Jarek Potiuk", "email": "jarek@potiuk.com", "time": "Sat Oct 17 01:39:20 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 17 01:39:20 2026 +0100" }, "message": "Merge pull request #1397 from Paul-TT/main\n\nPelican plugins update - ASF Event data filtering" }, { "commit": "126c297ad7d637391ecfa0b8394ea22380663ace", "tree": "0530b960d061592165a6a821f9bab7bd1e1172fa", "parents": [ "7d3afde57801d8c9a2db9730c28ae4e036cc2ab9", "ed9c2972e553ab32bc7849375812d10dcfda231a" ], "author": { "name": "Jarek Potiuk", "email": "jarek@potiuk.com", "time": "Sat Oct 17 01:39:10 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 17 01:39:10 2026 +0100" }, "message": "Merge pull request #1398 from apache/dependabot/uv/pelican/dev-tooling-156c460f94\n\nBump the dev-tooling group across 1 directory with 3 updates" }, { "commit": "7d3afde57801d8c9a2db9730c28ae4e036cc2ab9", "tree": "5ef51a1f1f90f9a939edc65e315425dcd51d585a", "parents": [ "f16b9c702c4e9a37aab311ab1b7b9b188aac3c4f", "de3d1ad8a64354dbf9d7d197a90f29d1df8e1e2f" ], "author": { "name": "Jarek Potiuk", "email": "jarek@potiuk.com", "time": "Sat Oct 17 01:37:48 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 17 01:37:48 2026 +0100" }, "message": "Merge pull request #1393 from apache/dependabot/github_actions/stash/save/actions/upload-artifact-7.0.2\n\nBump actions/upload-artifact from 7.0.1 to 7.0.2 in /stash/save" }, { "commit": "f16b9c702c4e9a37aab311ab1b7b9b188aac3c4f", "tree": "95b40edee3cd2b59e537564201c208e1de0250bb", "parents": [ "afc0f26d03356cfb2c5d62a9ca42d5c8a169603e", "d351128450c007418e4f5e1c0fe12b531f9fa084" ], "author": { "name": "Jarek Potiuk", "email": "jarek@potiuk.com", "time": "Sat Oct 17 01:36:41 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 17 01:36:41 2026 +0100" }, "message": "Merge pull request #1396 from apache/dependabot/github_actions/dot-github/workflows/codeql-action-9159e49961\n\nBump the codeql-action group across 1 directory with 2 updates" }, { "commit": "afc0f26d03356cfb2c5d62a9ca42d5c8a169603e", "tree": "4d4ff40b73334b81326da9c5c1e962699272b48b", "parents": [ "604ea75ed9459f90d7a15aa124d765671158da3c", "d81360fc693de5c9f0335db791b4029b791e5c0e" ], "author": { "name": "Jarek Potiuk", "email": "jarek@potiuk.com", "time": "Sat Oct 17 01:34:47 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 17 01:34:47 2026 +0100" }, "message": "Merge pull request #1402 from apache/dependabot/github_actions/dot-github/workflows/astral-sh/setup-uv-10.3.0\n\nBump astral-sh/setup-uv from 10.2.0 to 10.3.0 in /.github/workflows" }, { "commit": "d351128450c007418e4f5e1c0fe12b531f9fa084", "tree": "c5c064abf458bd261631ba1a11fff01816e36aee", "parents": [ "604ea75ed9459f90d7a15aa124d765671158da3c" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Oct 16 13:49:24 2026 +0000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 16 13:49:24 2026 +0000" }, "message": "Bump the codeql-action group across 1 directory with 2 updates\n\nBumps the codeql-action group with 2 updates in the /.github/workflows directory: [github/codeql-action/init](https://github.com/github/codeql-action) and [github/codeql-action/analyze](https://github.com/github/codeql-action).\n\n\nUpdates `github/codeql-action/init` from 4.38.2 to 4.38.3\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...24c54180a607b1449ed407dd24f251e4e9147c8d)\n\nUpdates `github/codeql-action/analyze` from 4.38.2 to 4.38.3\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...24c54180a607b1449ed407dd24f251e4e9147c8d)\n\n---\nupdated-dependencies:\n- dependency-name: github/codeql-action/analyze\n dependency-version: 4.38.3\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: codeql-action\n- dependency-name: github/codeql-action/init\n dependency-version: 4.38.3\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: codeql-action\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "d81360fc693de5c9f0335db791b4029b791e5c0e", "tree": "4d4ff40b73334b81326da9c5c1e962699272b48b", "parents": [ "604ea75ed9459f90d7a15aa124d765671158da3c" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Oct 16 13:47:22 2026 +0000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 16 13:47:22 2026 +0000" }, "message": "Bump astral-sh/setup-uv from 10.2.0 to 10.3.0 in /.github/workflows\n\nBumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 10.2.0 to 10.3.0.\n- [Release notes](https://github.com/astral-sh/setup-uv/releases)\n- [Commits](https://github.com/astral-sh/setup-uv/compare/c18668ad3cf93ea998bef934396af7bb5c839dc7...1c37ad07a6a961277cf70c0d37d6f313000f5884)\n\n---\nupdated-dependencies:\n- dependency-name: astral-sh/setup-uv\n dependency-version: 10.3.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" } ], "next": "71364154d4db654b3eea38ee7b1207fd6e754281" }