Conversation
Bumps the actions-deps group with 4 updates: [actions/setup-dotnet](https://github.com/actions/setup-dotnet), [actions/checkout](https://github.com/actions/checkout), [softprops/action-gh-release](https://github.com/softprops/action-gh-release) and [DavidAnson/markdownlint-cli2-action](https://github.com/davidanson/markdownlint-cli2-action). Updates `actions/setup-dotnet` from 5.3.0 to 6.0.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/setup-dotnet/releases">actions/setup-dotnet's releases</a>.</em></p> <blockquote> <h2>v6.0.0</h2> <h2>What's Changed</h2> <ul> <li>Migrate to ESM and upgrade dependencies by <a href="https://github.com/priyagupta108"><code>@priyagupta108</code></a> in <a href="https://redirect.github.com/actions/setup-dotnet/pull/752">actions/setup-dotnet#752</a></li> <li>Bump actions/checkout from 6.0.3 to 7.0.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/setup-dotnet/pull/751">actions/setup-dotnet#751</a></li> <li>chore(deps): bump <code>@actions/cache</code> to 6.2.0 by <a href="https://github.com/philip-gai"><code>@philip-gai</code></a> in <a href="https://redirect.github.com/actions/setup-dotnet/pull/756">actions/setup-dotnet#756</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/philip-gai"><code>@philip-gai</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-dotnet/pull/756">actions/setup-dotnet#756</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-dotnet/compare/v5...v6.0.0">https://github.com/actions/setup-dotnet/compare/v5...v6.0.0</a></p> <h2>v5.4.0</h2> <h2>What's Changed</h2> <h3>Enhancements</h3> <ul> <li>Pin actions to commit SHAs in workflows by <a href="https://github.com/priya-kinthali"><code>@priya-kinthali</code></a> in <a href="https://redirect.github.com/actions/setup-dotnet/pull/744">actions/setup-dotnet#744</a></li> <li>Expand the CSC problem matcher to light up more errors on GitHub. by <a href="https://github.com/StephenCleary"><code>@StephenCleary</code></a> in <a href="https://redirect.github.com/actions/setup-dotnet/pull/717">actions/setup-dotnet#717</a></li> <li>Improve global.json SDK version validation for rollForward by <a href="https://github.com/priyagupta108"><code>@priyagupta108</code></a> in <a href="https://redirect.github.com/actions/setup-dotnet/pull/742">actions/setup-dotnet#742</a></li> </ul> <blockquote> <p>The action now validates the <code>sdk.version</code> field in <code>global.json</code> when <code>rollForward</code> is specified. The version must be a fully-qualified SDK version (e.g., <code>8.0.100</code>, <code>10.0.100</code>). Wildcard versions (e.g., <code>10.0.*</code>) and runtime-style versions (e.g., <code>8.0.0</code>) will now fail. See the <a href="https://learn.microsoft.com/en-us/dotnet/core/tools/global-json#version">.NET SDK version specification</a> for details.</p> </blockquote> <h3>Documentation</h3> <ul> <li>Docs(action): Explicitly mark all optional inputs with required: false by <a href="https://github.com/kranthipoturaju"><code>@kranthipoturaju</code></a> in <a href="https://redirect.github.com/actions/setup-dotnet/pull/737">actions/setup-dotnet#737</a></li> </ul> <h3>Bug Fixes</h3> <ul> <li>Fix global.json creation command by <a href="https://github.com/michal2612"><code>@michal2612</code></a> in <a href="https://redirect.github.com/actions/setup-dotnet/pull/694">actions/setup-dotnet#694</a></li> </ul> <h3>Dependency Updates</h3> <ul> <li>Upgrade <code>@actions/cache</code> to 5.1.0, log cache write denied by <a href="https://github.com/jasongin"><code>@jasongin</code></a> in <a href="https://redirect.github.com/actions/setup-dotnet/pull/746">actions/setup-dotnet#746</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/jasongin"><code>@jasongin</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-dotnet/pull/746">actions/setup-dotnet#746</a></li> <li><a href="https://github.com/michal2612"><code>@michal2612</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-dotnet/pull/694">actions/setup-dotnet#694</a></li> <li><a href="https://github.com/kranthipoturaju"><code>@kranthipoturaju</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-dotnet/pull/737">actions/setup-dotnet#737</a></li> <li><a href="https://github.com/StephenCleary"><code>@StephenCleary</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-dotnet/pull/717">actions/setup-dotnet#717</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-dotnet/compare/v5.3.0...v5.4.0">https://github.com/actions/setup-dotnet/compare/v5.3.0...v5.4.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/setup-dotnet/commit/a98b56852c35b8e3190ac28c8c2271da59106c68"><code>a98b568</code></a> chore(deps): bump <code>@actions/cache</code> to 6.2.0 (<a href="https://redirect.github.com/actions/setup-dotnet/issues/756">#756</a>)</li> <li><a href="https://github.com/actions/setup-dotnet/commit/afb2931642fd907238eb71bce2da0dcc910b3553"><code>afb2931</code></a> Bump actions/checkout from 6.0.3 to 7.0.0 (<a href="https://redirect.github.com/actions/setup-dotnet/issues/751">#751</a>)</li> <li><a href="https://github.com/actions/setup-dotnet/commit/6df8cefd1440cf9313e76b8fdb8aaf90cfa745a3"><code>6df8cef</code></a> Migrate to ESM and upgrade dependencies (<a href="https://redirect.github.com/actions/setup-dotnet/issues/752">#752</a>)</li> <li><a href="https://github.com/actions/setup-dotnet/commit/26b0ec14cb23fa6904739307f278c14f94c95bf1"><code>26b0ec1</code></a> Expand the CSC problem matcher to light up more errors on GitHub. (<a href="https://redirect.github.com/actions/setup-dotnet/issues/717">#717</a>)</li> <li><a href="https://github.com/actions/setup-dotnet/commit/da5e5482f2d0700168cff080da45b50da8b60f0e"><code>da5e548</code></a> docs(action): explicitly mark all optional inputs with required: false (<a href="https://redirect.github.com/actions/setup-dotnet/issues/737">#737</a>)</li> <li><a href="https://github.com/actions/setup-dotnet/commit/9bd3b44355ba7c500f3d2e029636c6d29ac5caab"><code>9bd3b44</code></a> Improve readability of global.json creation command (<a href="https://redirect.github.com/actions/setup-dotnet/issues/694">#694</a>)</li> <li><a href="https://github.com/actions/setup-dotnet/commit/4406a635cd2be9c92689ea22b2f74ea57297088c"><code>4406a63</code></a> Bump <code>@actions/cache</code> to 5.1.0, log cache write denied (<a href="https://redirect.github.com/actions/setup-dotnet/issues/746">#746</a>)</li> <li><a href="https://github.com/actions/setup-dotnet/commit/dc3262dda80e97f1c7865b3b122e99240e30b738"><code>dc3262d</code></a> pin actions to commit SHAs in workflows (<a href="https://redirect.github.com/actions/setup-dotnet/issues/744">#744</a>)</li> <li><a href="https://github.com/actions/setup-dotnet/commit/95a3f8b067437dc9b2027a437f5dc3b4569ddd49"><code>95a3f8b</code></a> Validate global.json SDK version before rollForward optimization (<a href="https://redirect.github.com/actions/setup-dotnet/issues/742">#742</a>)</li> <li>See full diff in <a href="https://github.com/actions/setup-dotnet/compare/9a946fdbd5fb07b82b2f5a4466058b876ab72bb2...a98b56852c35b8e3190ac28c8c2271da59106c68">compare view</a></li> </ul> </details> <br /> Updates `actions/checkout` from 7.0.0 to 7.0.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/releases">actions/checkout's releases</a>.</em></p> <blockquote> <h2>v7.0.1</h2> <h2>What's Changed</h2> <ul> <li>skip running unsafe pr check if input is default by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2518">actions/checkout#2518</a></li> <li>trim only ascii whitespace for branch by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2521">actions/checkout#2521</a></li> <li>escape values passed to --unset by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2530">actions/checkout#2530</a></li> <li>Various dependency updates</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v7...v7.0.1">https://github.com/actions/checkout/compare/v7...v7.0.1</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2>v7.0.1</h2> <ul> <li>Skip running unsafe pr check if input is default by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2518">actions/checkout#2518</a></li> <li>Trim only ascii whitespace for branch by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2521">actions/checkout#2521</a></li> <li>Escape values passed to --unset by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2530">actions/checkout#2530</a></li> <li>Various dependency updates</li> </ul> <h2>v7.0.0</h2> <ul> <li>Block checking out fork PR for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> <li>Various dependency updates</li> </ul> <h2>v6.0.3</h2> <ul> <li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li> <li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> </ul> <h2>v6.0.2</h2> <ul> <li>Fix tag handling: preserve annotations and explicit fetch-tags by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li> </ul> <h2>v6.0.1</h2> <ul> <li>Add worktree support for persist-credentials includeIf by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li> </ul> <h2>v6.0.0</h2> <ul> <li>Persist creds to a separate file by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li> <li>Update README to include Node.js 24 support details and requirements by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li> </ul> <h2>v5.0.1</h2> <ul> <li>Port v6 cleanup to v5 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li> </ul> <h2>v5.0.0</h2> <ul> <li>Update actions checkout to use node 24 by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li> </ul> <h2>v4.3.1</h2> <ul> <li>Port v6 cleanup to v4 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li> </ul> <h2>v4.3.0</h2> <ul> <li>docs: update README.md by <a href="https://github.com/motss"><code>@motss</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li> <li>Add internal repos for checking out multiple repositories by <a href="https://github.com/mouismail"><code>@mouismail</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li> <li>Documentation update - add recommended permissions to Readme by <a href="https://github.com/benwells"><code>@benwells</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li> <li>Adjust positioning of user email note and permissions heading by <a href="https://github.com/joshmgross"><code>@joshmgross</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li> <li>Update README.md by <a href="https://github.com/nebuk89"><code>@nebuk89</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li> <li>Update CODEOWNERS for actions by <a href="https://github.com/TingluoHuang"><code>@TingluoHuang</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li> <li>Update package dependencies by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li> </ul> <h2>v4.2.2</h2> <ul> <li><code>url-helper.ts</code> now leverages well-known environment variables by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li> <li>Expand unit test coverage for <code>isGhes</code> by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li> </ul> <h2>v4.2.1</h2> <ul> <li>Check out other refs/* by commit if provided, fall back to ref by <a href="https://github.com/orhantoy"><code>@orhantoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/checkout/commit/3d3c42e5aac5ba805825da76410c181273ba90b1"><code>3d3c42e</code></a> prep v7.0.1 release (<a href="https://redirect.github.com/actions/checkout/issues/2531">#2531</a>)</li> <li><a href="https://github.com/actions/checkout/commit/28802689a136bfcdb721715abd713740beecbe07"><code>2880268</code></a> escape values passed to --unset (<a href="https://redirect.github.com/actions/checkout/issues/2530">#2530</a>)</li> <li><a href="https://github.com/actions/checkout/commit/12cd2235efa0937479335606d7c3ac9f6c0973b1"><code>12cd223</code></a> trim only ascii whitespace for branch (<a href="https://redirect.github.com/actions/checkout/issues/2521">#2521</a>)</li> <li><a href="https://github.com/actions/checkout/commit/62661c4e71a304b2823ed026347b8d34c3eac541"><code>62661c4</code></a> skip running unsafe pr check if input is default (<a href="https://redirect.github.com/actions/checkout/issues/2518">#2518</a>)</li> <li><a href="https://github.com/actions/checkout/commit/e8d4307400f9427dba7cb98e488d6ab85f1cec5f"><code>e8d4307</code></a> Bump the minor-actions-dependencies group with 2 updates (<a href="https://redirect.github.com/actions/checkout/issues/2499">#2499</a>)</li> <li><a href="https://github.com/actions/checkout/commit/631c942040754b6e095e929c1677c07e10ed4f87"><code>631c942</code></a> eslint 9 (<a href="https://redirect.github.com/actions/checkout/issues/2474">#2474</a>)</li> <li><a href="https://github.com/actions/checkout/commit/4f1f4aec02e41874fa0262ea8ff5172d7978ad1e"><code>4f1f4ae</code></a> Bump actions/upload-artifact from 4 to 7 (<a href="https://redirect.github.com/actions/checkout/issues/2476">#2476</a>)</li> <li><a href="https://github.com/actions/checkout/commit/ba097532fb203f7e88c9c3c0b899b49469908a92"><code>ba09753</code></a> Bump actions/checkout from 6 to 7 (<a href="https://redirect.github.com/actions/checkout/issues/2488">#2488</a>)</li> <li><a href="https://github.com/actions/checkout/commit/b9e0990d219a03df7633c93f6f005a8fecbcab22"><code>b9e0990</code></a> Bump docker/login-action from 3.3.0 to 4.2.0 (<a href="https://redirect.github.com/actions/checkout/issues/2479">#2479</a>)</li> <li><a href="https://github.com/actions/checkout/commit/e8cb398be4a550817e382abf69e4c12c76fce1f2"><code>e8cb398</code></a> Bump docker/build-push-action from 6.5.0 to 7.2.0 (<a href="https://redirect.github.com/actions/checkout/issues/2478">#2478</a>)</li> <li>Additional commits viewable in <a href="https://github.com/actions/checkout/compare/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0...3d3c42e5aac5ba805825da76410c181273ba90b1">compare view</a></li> </ul> </details> <br /> Updates `softprops/action-gh-release` from 3.0.1 to 3.0.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/softprops/action-gh-release/releases">softprops/action-gh-release's releases</a>.</em></p> <blockquote> <h2>v3.0.2</h2> <p><code>3.0.2</code> is a patch release focused on release reliability and compatibility. It reuses existing draft releases when publishing prereleases, supports replacing release assets on Gitea, hardens streamed asset uploads, and provides clearer release-creation diagnostics. It also includes TypeScript, coverage, and tooling maintenance merged since <code>3.0.1</code>.</p> <p>This release fixes <a href="https://redirect.github.com/softprops/action-gh-release/issues/795">#795</a>, <a href="https://redirect.github.com/softprops/action-gh-release/issues/438">#438</a>, and <a href="https://redirect.github.com/softprops/action-gh-release/issues/803">#803</a>. The upload transport hardening covers the historical failure reported in <a href="https://redirect.github.com/softprops/action-gh-release/issues/790">#790</a>, although current hosted Node 24 runners did not reproduce it naturally. The diagnostics work is related to <a href="https://redirect.github.com/softprops/action-gh-release/issues/786">#786</a> and does not claim a reproducible release-creation fix.</p> <h2>What's Changed</h2> <h3>Exciting New Features 🎉</h3> <ul> <li>feat: improve release error reporting and test coverage by <a href="https://github.com/chenrui333"><code>@chenrui333</code></a> in <a href="https://redirect.github.com/softprops/action-gh-release/pull/813">softprops/action-gh-release#813</a></li> </ul> <h3>Bug fixes 🐛</h3> <ul> <li>fix: publish existing draft releases as prereleases by <a href="https://github.com/godfengliang"><code>@godfengliang</code></a> in <a href="https://redirect.github.com/softprops/action-gh-release/pull/801">softprops/action-gh-release#801</a></li> <li>fix: upload small checksum assets reliably by <a href="https://github.com/chenrui333"><code>@chenrui333</code></a> in <a href="https://redirect.github.com/softprops/action-gh-release/pull/815">softprops/action-gh-release#815</a></li> <li>fix: replace existing release assets on Gitea by <a href="https://github.com/chenrui333"><code>@chenrui333</code></a> in <a href="https://redirect.github.com/softprops/action-gh-release/pull/816">softprops/action-gh-release#816</a></li> <li>fix: clarify release creation 404 errors by <a href="https://github.com/chenrui333"><code>@chenrui333</code></a> in <a href="https://redirect.github.com/softprops/action-gh-release/pull/817">softprops/action-gh-release#817</a></li> </ul> <h3>Other Changes 🔄</h3> <ul> <li>chore(deps): upgrade TypeScript to 7 by <a href="https://github.com/chenrui333"><code>@chenrui333</code></a> in <a href="https://redirect.github.com/softprops/action-gh-release/pull/812">softprops/action-gh-release#812</a></li> <li>chore(deps): remove unused TypeScript tooling by <a href="https://github.com/chenrui333"><code>@chenrui333</code></a> in <a href="https://redirect.github.com/softprops/action-gh-release/pull/814">softprops/action-gh-release#814</a></li> <li>dependency, Node 24 pin, and CI maintenance merged since <code>3.0.1</code></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md">softprops/action-gh-release's changelog</a>.</em></p> <blockquote> <h2>3.0.2</h2> <p><code>3.0.2</code> is a patch release focused on release reliability and compatibility. It reuses existing draft releases when publishing prereleases, supports replacing release assets on Gitea, hardens streamed asset uploads, and provides clearer release-creation diagnostics. It also includes TypeScript, coverage, and tooling maintenance merged since <code>3.0.1</code>.</p> <p>This release fixes <a href="https://redirect.github.com/softprops/action-gh-release/issues/795">#795</a>, <a href="https://redirect.github.com/softprops/action-gh-release/issues/438">#438</a>, and <a href="https://redirect.github.com/softprops/action-gh-release/issues/803">#803</a>. The upload transport hardening covers the historical failure reported in <a href="https://redirect.github.com/softprops/action-gh-release/issues/790">#790</a>, although current hosted Node 24 runners did not reproduce it naturally. The diagnostics work is related to <a href="https://redirect.github.com/softprops/action-gh-release/issues/786">#786</a> and does not claim a reproducible release-creation fix.</p> <h2>What's Changed</h2> <h3>Exciting New Features 🎉</h3> <ul> <li>feat: improve release error reporting and test coverage by <a href="https://github.com/chenrui333"><code>@chenrui333</code></a> in <a href="https://redirect.github.com/softprops/action-gh-release/pull/813">softprops/action-gh-release#813</a></li> </ul> <h3>Bug fixes 🐛</h3> <ul> <li>fix: publish existing draft releases as prereleases by <a href="https://github.com/godfengliang"><code>@godfengliang</code></a> in <a href="https://redirect.github.com/softprops/action-gh-release/pull/801">softprops/action-gh-release#801</a></li> <li>fix: upload small checksum assets reliably by <a href="https://github.com/chenrui333"><code>@chenrui333</code></a> in <a href="https://redirect.github.com/softprops/action-gh-release/pull/815">softprops/action-gh-release#815</a></li> <li>fix: replace existing release assets on Gitea by <a href="https://github.com/chenrui333"><code>@chenrui333</code></a> in <a href="https://redirect.github.com/softprops/action-gh-release/pull/816">softprops/action-gh-release#816</a></li> <li>fix: clarify release creation 404 errors by <a href="https://github.com/chenrui333"><code>@chenrui333</code></a> in <a href="https://redirect.github.com/softprops/action-gh-release/pull/817">softprops/action-gh-release#817</a></li> </ul> <h3>Other Changes 🔄</h3> <ul> <li>chore(deps): upgrade TypeScript to 7 by <a href="https://github.com/chenrui333"><code>@chenrui333</code></a> in <a href="https://redirect.github.com/softprops/action-gh-release/pull/812">softprops/action-gh-release#812</a></li> <li>chore(deps): remove unused TypeScript tooling by <a href="https://github.com/chenrui333"><code>@chenrui333</code></a> in <a href="https://redirect.github.com/softprops/action-gh-release/pull/814">softprops/action-gh-release#814</a></li> <li>dependency, Node 24 pin, and CI maintenance merged since <code>3.0.1</code></li> </ul> <h2>3.0.1</h2> <ul> <li>maintenance release with updated dependencies</li> </ul> <h2>3.0.0</h2> <p><code>3.0.0</code> is a major release that moves the action runtime from Node 20 to Node 24. Use <code>v3</code> on GitHub-hosted runners and self-hosted fleets that already support the Node 24 Actions runtime. <code>v2.6.2</code> was the final Node 20-compatible release and is no longer maintained or supported.</p> <h2>What's Changed</h2> <h3>Other Changes 🔄</h3> <ul> <li>Move the action runtime and bundle target to Node 24</li> <li>Update <code>@types/node</code> to the Node 24 line and allow future Dependabot updates</li> <li>Keep the floating major tag on <code>v3</code>; freeze <code>v2</code> at the final <code>v2.6.2</code> release</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/softprops/action-gh-release/commit/3d0d9888cb7fd7b750713d6e236d1fcb99157228"><code>3d0d988</code></a> release 3.0.2 (<a href="https://redirect.github.com/softprops/action-gh-release/issues/818">#818</a>)</li> <li><a href="https://github.com/softprops/action-gh-release/commit/7e13ed4ac596a4adf801d3812be5a089356949aa"><code>7e13ed4</code></a> fix: clarify release creation 404 errors (<a href="https://redirect.github.com/softprops/action-gh-release/issues/817">#817</a>)</li> <li><a href="https://github.com/softprops/action-gh-release/commit/e6c70a53cf67373fbff7eeebca7782b4fe8f106c"><code>e6c70a5</code></a> fix: replace existing release assets on Gitea (<a href="https://redirect.github.com/softprops/action-gh-release/issues/816">#816</a>)</li> <li><a href="https://github.com/softprops/action-gh-release/commit/f3453378888d5ef6208e2788af1c5ba50d8a898d"><code>f345337</code></a> fix: publish existing draft releases as prereleases (<a href="https://redirect.github.com/softprops/action-gh-release/issues/801">#801</a>)</li> <li><a href="https://github.com/softprops/action-gh-release/commit/d8a89a206684ded8435bf16d6f698bf04ab05164"><code>d8a89a2</code></a> fix: upload small checksum assets reliably (<a href="https://redirect.github.com/softprops/action-gh-release/issues/815">#815</a>)</li> <li><a href="https://github.com/softprops/action-gh-release/commit/45ece40c3178522904ac6c51c21d8a4e3565f3c8"><code>45ece40</code></a> chore(deps): remove unused TypeScript tooling (<a href="https://redirect.github.com/softprops/action-gh-release/issues/814">#814</a>)</li> <li><a href="https://github.com/softprops/action-gh-release/commit/f6b913c3f95302d88e8ef7cb2859c2e7656aa01e"><code>f6b913c</code></a> feat: improve release error reporting and test coverage (<a href="https://redirect.github.com/softprops/action-gh-release/issues/813">#813</a>)</li> <li><a href="https://github.com/softprops/action-gh-release/commit/15f193d7d8aa9623b5181913a31fafceb4e8cef9"><code>15f193d</code></a> chore(deps): upgrade TypeScript to 7 (<a href="https://redirect.github.com/softprops/action-gh-release/issues/812">#812</a>)</li> <li><a href="https://github.com/softprops/action-gh-release/commit/cc8268d46a81d57ec9b061f27b0dd68ebd7fb17f"><code>cc8268d</code></a> chore(deps): bump actions/checkout in the github-actions group (<a href="https://redirect.github.com/softprops/action-gh-release/issues/810">#810</a>)</li> <li><a href="https://github.com/softprops/action-gh-release/commit/fd0ed1e85b6730f87f5c67d7355751c46ad513d6"><code>fd0ed1e</code></a> chore(deps): bump the npm group with 3 updates (<a href="https://redirect.github.com/softprops/action-gh-release/issues/811">#811</a>)</li> <li>Additional commits viewable in <a href="https://github.com/softprops/action-gh-release/compare/718ea10b132b3b2eba29c1007bb80653f286566b...3d0d9888cb7fd7b750713d6e236d1fcb99157228">compare view</a></li> </ul> </details> <br /> Updates `DavidAnson/markdownlint-cli2-action` from 24.0.0 to 24.2.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/DavidAnson/markdownlint-cli2-action/commit/21c1be1b93ad9ed58fa840aacc3f279cde2a72ff"><code>21c1be1</code></a> Update to version 24.2.0.</li> <li><a href="https://github.com/DavidAnson/markdownlint-cli2-action/commit/cb5282d62ceb01cf9ed9f24c23675d95a1aa0b06"><code>cb5282d</code></a> Freshen generated package-lock.json file, freshen generated index.js file.</li> <li><a href="https://github.com/DavidAnson/markdownlint-cli2-action/commit/d36517c02f0ca87b17baeb4fabee83cd48490f38"><code>d36517c</code></a> Add eslint-package-json/all to lint script, address new issues.</li> <li><a href="https://github.com/DavidAnson/markdownlint-cli2-action/commit/57b7f618e76408c4f7861015e5f0e0ac07985c18"><code>57b7f61</code></a> Refactor eslint.config.mjs to use defineConfig, change eslint-plugin-n from "...</li> <li><a href="https://github.com/DavidAnson/markdownlint-cli2-action/commit/fe75d07fdb84c7ad9ff784bd5b63745d172c6ec6"><code>fe75d07</code></a> Address new lint error from previous commit, freshen generated index.js file.</li> <li><a href="https://github.com/DavidAnson/markdownlint-cli2-action/commit/cea0e19b34dbe39c35833f585399255cb1b5ee8d"><code>cea0e19</code></a> Bump eslint-plugin-unicorn from 71.1.0 to 72.0.0</li> <li><a href="https://github.com/DavidAnson/markdownlint-cli2-action/commit/5137af3b1518ab092d3aa1c946881297643df019"><code>5137af3</code></a> Freshen generated index.js file.</li> <li><a href="https://github.com/DavidAnson/markdownlint-cli2-action/commit/ab8971b4890335d9e552a310d43bbaa1e68c52cd"><code>ab8971b</code></a> Bump markdownlint-cli2 from 0.23.1 to 0.23.2</li> <li><a href="https://github.com/DavidAnson/markdownlint-cli2-action/commit/92a0fc4bfcca7cda90e73e14c0c17568b057574e"><code>92a0fc4</code></a> Bump actions/setup-node from 6 to 7</li> <li><a href="https://github.com/DavidAnson/markdownlint-cli2-action/commit/03ca1e440e033e6cff1e838d3fb4749dea9d9284"><code>03ca1e4</code></a> Bump eslint from 10.6.0 to 10.7.0</li> <li>Additional commits viewable in <a href="https://github.com/davidanson/markdownlint-cli2-action/compare/8de2aa07cae85fd17c0b35642db70cf5495f1d25...21c1be1b93ad9ed58fa840aacc3f279cde2a72ff">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Follows the #609 promotion, which went partial at 61 of 62 files and stayed there through two re-requests. That prompted measuring whether the remedy the gate recommends has ever worked. It has not. ## The measurement Over the **332 Copilot review bodies** on the newest 120 pull requests, read beside `gh pr list --json number,changedFiles,additions,deletions`: | Question | Answer | | --- | --- | | Pull requests that went partial | **4** - #476, #479, #592, and the #609 promotion | | Rounds those four produced | **7** | | Rounds that recovered | **0** - every later round repeated the identical ratio | | Files skipped, each time | exactly **1** | ``` PR 592: round 1 = 2/3 round 2 = 2/3 PR 476: round 1 = 10/11 round 2 = 10/11 PR 479: round 1 = 16/17 PR 609: round 1 = 61/62 round 2 = 61/62 (after a re-request on a new head) ``` So the digest was telling a reader to spend a round on a retry that nothing has ever retried out of. ## Two hypotheses tested and rejected, so they are not re-derived **Size does not predict it.** The partials changed 502, 629 and 961 lines. Fully covered pull requests on this repository reach **33 files and 2,219 changed lines**, well past all three. **The denominator is not itself lossy.** I suspected the reviewer might drop a file before counting, which would make `N out of N` a lie. It does not: the stated denominator equals the API's own `changedFiles` on **103 of 104** pull requests, and the single exception is one whose branch shrank between rounds. The reviewer counts the file and does not read it. ## What changed The three places that stated the remedy now state what the record supports, swept by grepping the phrasing rather than by fixing the one the finding pointed at: - `scripts/pr_review.py` - the `status=COVERAGE_IS_PARTIAL` line, the digest's `COVERAGE IS PARTIAL` block, and the `status` exit-code docstring. - `.github/copilot-instructions.md` - the "Counts unequal" bucket. - `scripts/README.md` - the coverage paragraph, carrying the measurements. The new wording says a re-request has never cleared one, that splitting is real for a feature branch and unavailable for a promotion whose head is `develop`, and that the merge decision is the maintainer's, taken knowing one file has no review. **No exit code or verdict changes**, since the gate was reporting the state correctly. Only the advice attached to it was wrong. ## What is left open `TODO.md` gains an entry under the programmatic-reading cluster, with the measurements attached: **which** file is skipped, and why. The reviewer names no file list in these rounds, so it cannot be recovered from the API, and the pull request page may be the only place it appears. Whether it is worth escalating to GitHub needs the file first. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Ships the `Branch Bootstrap in the Standup` cluster from `TODO.md`, selected by that file's own `How to Select the Next Item` procedure. ## The gap [`STANDUP.md`](./STANDUP.md) section 0 requires signing to be live before the first commit, and section 0A hands the maintainer prerequisites over before step 1. Then it goes straight to classification. Nothing in the file says how `main` and `develop` come into being, so an agent commits onto whichever branch `git init` produced, and the exploratory standup becomes the repository's permanent history. Verified on `develop` at `676a2bd`: `git init` appears twice, both inside section 0 about the signing window, and a search for `checkout -b`, `git branch`, `feature branch`, `branch from` and `root commit` returns nothing. ## What section 0B says Create `main` empty, create `develop` from it, create the first feature branch from `develop`, run the whole standup there through the audit in step 5, add the repository and apply the configuration while still on that branch, then open a normal pull request into `develop`. Carrying nothing means exactly one signed empty root commit, since a git branch cannot exist without a commit, and section 0's signing window applies to it like any other. ## Why the cleanup is unavailable afterwards Committing onto `develop` and squashing later is rejected, because `non_fast_forward` is set on both `develop` payloads and that squash is the rewrite the rule blocks. The protection is uneven, which is the part worth stating in the file: | Payload | Rules | Blocks a direct commit | | --- | --- | --- | | `repo-config/develop.json` | `deletion`, `non_fast_forward`, `required_linear_history`, `required_signatures`, `pull_request`, `required_status_checks`, `copilot_code_review` | yes, via `pull_request` | | `repo-config/operational/develop.json` | `deletion`, `non_fast_forward`, `required_signatures` | no | So a conformant operational repository accepts the commit this step exists to prevent, and reports nothing wrong afterwards. On a public repository the squash is the one chance to leave a wrong secret value, a throwaway credential and a run of noise commits out of what gets published. ## Scope `STANDUP.md` is hub machinery and deliberately not carried, per [`spec/section-model.md`](./spec/section-model.md), so this owes no re-vendor and adds nothing to the outstanding sweep. [#490](#490) covered the human-gated half and is closed, which left this half, so there is no issue to close here. `TODO.md` drops the shipped cluster per step 9 of its own procedure, and the `issue-490` link definition it was the only user of. One departure from the cluster text, stated so it is a decision rather than an omission: the cluster names Blog as the repository that was blocked, and the section describes the case without naming it. The evidence is the mechanism, and `STANDUP.md` is read by agents standing up unrelated repositories. ## Verification - `prose_lint.py`, both CI invocations plus `sentence-split` by name, which is in neither. Confirmed with `--list-files` that both files were actually read, rather than passing on an empty set. - `editorconfig-checker`, exit 0. Line endings checked independently too, since a scripted rewrite converts them silently: `STANDUP.md` is 191 of 191 CRLF lines and `TODO.md` 494 of 494. - `markdownlint-cli2`, 0 issues across 44 files. - `cspell` reads `README.md` and `HISTORY.md` only, neither of which this touches.
There was a problem hiding this comment.
Pull request overview
Promotes the current develop state to main, incorporating already-merged updates to the standup bootstrap procedure, Copilot review partial-coverage guidance, and pinned GitHub Actions versions.
Changes:
- Add a new
STANDUP.mdsection describing how to createmain/developearly and run the standup on a feature branch. - Update the review-reader guidance (
scripts/pr_review.py,scripts/README.md,.github/copilot-instructions.md,TODO.md) to reflect measured behavior for partial-coverage rounds. - Bump pinned workflow action SHAs in validation and release workflows.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| TODO.md | Removes the shipped standup-bootstrap backlog item and adds a new research item for identifying the skipped file in partial-coverage rounds. |
| STANDUP.md | Introduces section 0B with an explicit branch-bootstrap sequence to keep exploratory standup history off main/develop. |
| scripts/README.md | Documents the measured behavior that partial coverage does not recover via re-request, and clarifies the intended operator response. |
| scripts/pr_review.py | Updates exit-code 42 guidance and digest output text to stop recommending re-request as a remedy for partial coverage. |
| .github/workflows/validate-task.yml | Updates pinned SHAs for checkout and markdownlint action wrappers. |
| .github/workflows/publish-release.yml | Updates pinned SHAs for setup-dotnet, checkout, and release actions. |
| .github/copilot-instructions.md | Updates the runbook guidance for partial coverage and adds a Disproved Claims entry related to STANDUP.md grammar. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Uh oh!
There was an error while loading. Please reload this page.
Fixes the finding Copilot raised on the promotion pull request [#615](#615), against code [#613](#613) shipped. ## The defect The `status=COVERAGE_IS_PARTIAL` line ended with "taken knowing one file of the diff has no review". The code knows only that the reviewed and changed counts differ. It never computed the difference. Every partial on record skipped exactly one file, over four pull requests and seven rounds, which is where the wording came from. That is a measurement of those rounds rather than a property the state carries, so a round skipping two files would have been reported as skipping one, on the single line whose whole purpose is to inform a merge decision. ## The fix `report_verdict` now keeps the coverage line that decided `PARTIAL` and re-reads its counts, so the message reports the difference the run carries and agrees with the `coverage=PARTIAL` ratio printed beside it: ```text ... taken knowing 1 of the 3 changed files has no review ... taken knowing 4 of the 9 changed files have no review ``` Re-reading cannot return `None`, because `PARTIAL` is reached only where that same line parsed, and the comment says so rather than leaving a reader to derive it. ## Verification - `python3 scripts/test_pr_review.py`, 175 tests, OK. The new case asserts both a one-file and a four-file gap, and it **fails against the previous wording**, confirmed by stashing the fix and re-running: `FAILED (failures=2)`. - The rest of the CI gate list run locally and green: `spec/validate.py`, `test_prose_lint.py`, `test_repo_gate.py`, `spec/audit.py --selftest`, `gh-write-guard.py --selftest`, `repo_gate.py`, and both `prose_lint.py` invocations. - `ruff` reports 22 findings across these two files, all pre-existing and none inside the changed hunks, and the hub's CI does not run it over `scripts/`.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 8 out of 8 changed files in this pull request and generated no new comments.
Suppressed comments (1)
STANDUP.md:67
- The branch rename uses long options (
--move --force), but the paragraph below explicitly says the block "needs no minimum version". Using the long options may impose a newer Git requirement than the short form, so this can undermine the compatibility claim. Prefer the traditional-Mform here to keep the bootstrap as version-agnostic as possible.
git branch --move --force main # Renames whichever branch git init produced, in a repo holding only it.
Fixes a finding Copilot raised on the promotion pull request [#615](#615), against the command block [#614](#614) added. A promotion's head is `develop`, so the fix lands here rather than there. ## The finding > The branch rename uses long options (`--move --force`), but the paragraph below explicitly says the block "needs no minimum version". Using the long options may impose a newer Git requirement than the short form, so this can undermine the compatibility claim. Prefer the traditional `-M` form here to keep the bootstrap as version-agnostic as possible. ## What the source says Checked against git's own option tables rather than taken on faith, since the claim is about when a spelling became available: | Tag | `git branch` option table | | --- | --- | | `v1.5.4` | `OPT_BIT('m', NULL, ...)`, `OPT_BIT('M', NULL, ...)`, `OPT_BOOLEAN('f', NULL, ...)` | | `v2.0.0` | `OPT_BIT('m', "move", ...)`, `OPT_BIT('M', NULL, ...)`, `OPT__FORCE(...)` | So `--move` and `--force` did not exist in 1.5.4 and did by 2.0.0, and `-M` has no long equivalent in either. The finding has the direction right. It also bounds how wrong the block was. The long forms are far older than `git switch` at 2.23 and `git init --initial-branch` at 2.28, which is what the prose named, so nothing here was going to break on a plausible host. The claim was **no floor at all** rather than a floor earlier than those two, and the long forms do carry one. ## The change The line reads `git branch -M main`, and the paragraph says the short form is deliberate rather than terse, so a later edit does not restore the long form for consistency with the rest of the block. ## Verification `prose_lint.py` both invocations plus `sentence-split`, `editorconfig-checker` exit 0, `markdownlint-cli2` 0 issues across 44 files, and `STANDUP.md` at 206 of 206 CRLF lines. The block's comment column is unchanged at 65.
ptr727
commented
Aug 8, 2026
Answering the suppressed finding raised on 08cf819 here, since a suppressed comment has no thread to resolve. Accepted, and fixed in 8515666 through #617 rather than on this pull request.
Checked against git's own option tables rather than taken on faith, since the finding is a claim about when a spelling became available:
Neither long option exists in 1.5.4 and both do by 2.0.0, and The line is The fix took its own pull request because this one is a promotion, whose head is |
Uh oh!
There was an error while loading. Please reload this page.
Promotes
developtomain, carrying five merged pull requests.What is being promoted
8515666, the branch rename written-Mrather than--move --force, which git gained later, checked against git's own option tables atv1.5.4andv2.0.0.08cf819, the partial-coverage status line counting the unread files rather than asserting there is one.f39e0c0, the branch bootstrap step inSTANDUP.md. Section 0B states the sequence that keeps the exploratory standup offmainanddevelop, carries the procedure's onlygit initalongside both of section 0's identity checks, and records why the post-hoc cleanup is unavailable. It also carries one Disproved Claims entry and the removal of the shipped backlog cluster.676a2bd, the partial-coverage remedy inscripts/pr_review.pyand its two documentation mirrors, corrected to what the record supports after measuring 4 pull requests and 7 rounds with 0 recoveries.1892d6f, a Dependabot group bump of four actions.#616 and #617 both answer findings raised by the review on this promotion. A promotion's head is
develop, so neither could be fixed here, and each took its own pull request intodevelopand its own review rounds before merging.Review state
Each of the five was reviewed and merged on its own pull request, so this promotion carries no unreviewed change. #614 ran 13 rounds, 12 findings accepted and 1 declined and recorded under Disproved Claims. #616 ran 3 rounds and #617 ran 2, all findings accepted.
Merge shape
This is a promotion, so it merges as a merge commit rather than a squash, per
GOVERNANCE.md"Branching Model". Its head isdevelopitself, so it must not be merged with--delete-branch.