chore(deps): bump the gh-actions group with 2 updates

[dependabot]

Bumps the gh-actions group with 2 updates: arthur-debert/release/.github/workflows/copilot-review.yml and actions/checkout.

Updates arthur-debert/release/.github/workflows/copilot-review.yml from 2 to 3

Release notes

Sourced from arthur-debert/release/.github/workflows/copilot-review.yml's releases.

v3.0.0

• canary run: strip PYTHONPATH and checkout-shim vars from the sandbox env so the round exercises the candidate wheel, not the operator checkout
• testing: provenance markers + ratchet lint for external-surface fixtures
• prstate: CodeRabbit reviewer adapter (requestable, attach-verified), piloted on phos-org repos via per-repo required_reviewers: opt-in; default required set stays [copilot], and the engine gates on the full required set against the current head
• Coordinated execution splits the PR loop: implementer stops at PR-open, coordinator owns waits + the ready flip, a fresh shepherd subagent per review round (dev-cycle §2, how-to, gh-pr-review-loop skill)
• release-core how-to now renders the §2 coordinator (complex/multi-PR) discipline; CLAUDE.md stub names it
• Fix pr-loop-guard resolving chained relative cd targets against the original cwd instead of folding left (release#632)
• remove fleet-saturated back-compat: pre-commit-framework gate fallback + legacy single/two-file changelog detection (#569)
• BREAKING: remove deprecated singular wasm-package input from rust-cli.yml; use wasm-packages (#569 B7)
• remove fleet-saturated WS4/WS7 untrack migrations, husky unset, .release-sync-state tombstone + changelog classifier (#569)
• rust-ci.yml: optional wasm-packages companion (PR-time wasm check/build) + sanctioned-bespoke # UNMANAGED marker convention (#630)
• admin repos verify: refresh clones unconditionally; remove --refresh flag

v2.21.0

• admin repos verify classifies expected toolchain-artifact FAILs (npm-deps mechanically, sibling-checkout cases via expect-verify-fail annotations; exit non-zero only on unexpected, stale annotations flagged) and new admin repos poke — one-command fresh-event consumer verification (empty commit, HEAD-SHA run resolution, classified --watch verdict); the INFRA/PROJECT failing-step classifier is extracted to release_core.classify, shared by canary run / verify / poke (#594, #595)
• managed .markdownlintignore exempts generated release-notes.md (same class as CHANGELOG) — fixes full-tree markdownlint reds in consumers that cut releases (#598)
• admin secrets token|install gain --repos per-repo targeting, validated against managed-repos.yaml (projects + canaries) (#601)
• canary: vscode-ext second family fixture + concurrent multi-family rounds + cert-only Apple signing on the rust canary (#605)
• pr review request now verifies the review_requested edge actually attached — a request GitHub silently drops (service stall / quota) fails loud with exit 1 instead of stalling the loop (#614)
• fix(canary): init registers a new family before the secrets converge — the token install validates against the registry init itself appends (self-deadlock caught on the first live vscode-ext init); registers the vscode-ext canary
• release-core admin canary init: idempotent create/reset of a family's canary repo from its tests/fixtures// seed — public create, fixture seed + from-source boot, fail-closed secrets (RELEASE_TOKEN only, publish trio refused), ruleset, registry append; --reset force-push sanctioned only for registered canaries (#604)
• fix(verify): classify.py parses the real captured lefthook summary glyph (✗, U+2717) — the 🥊 guess made every npm-artifact FAIL read as unexpected
• fix(cut): bump shortcuts (major|minor|patch) resolve the current version from the latest git tag in manifest-less repos — including repos with no detectable Kind, like release itself (#596)
• release-core cut refuses without green canary/ commit statuses on the exact HEAD being cut (no skip flag, #606)
• admin policy ruleset: auto-detection resolves reusable-workflow caller jobs to their nested ' / ' contexts (gh contents API at the pinned ref) instead of proposing the never-reported bare caller name (#602)

v2.20.0

• arm-gate: non-vN action refs (canary/* branches, bare SHAs, feature branches) install the release-core wheel --from-source from the action's own staged tree — the wheel always matches the composite's resolved ref (#587 OQ4) — after a published-wheel resolution probe (install-release-core --print-url) that keeps the gh-authenticated resolution path (#535 surface) exercised (#587 slice 1)
• release-core admin canary run --ref: pre-ship canary round — publish canary/, seed the canary consumer from source, dispatch CI + prerelease cut as fresh events, classified report + commit status (#587 slice 1)
• orphaned packaged-binary smoke-hook templates retired (dead since WS7; tombstoned so seeded consumers sweep the stale copies) (#590)

v2.19.0

• fleet-loop doctrine corrected: repos verify runs BEFORE the cut (release.yml auto-advances the major at cut — there is no separate advance step); stale soft-gate and flat-alias claims swept from the skill + fleet-tooling docs
• arm-gate gains toolset:false (materialize-only mode for consumer-authored jobs needing managed bin tools); release-core init warns at seed time when a consumer workflow job invokes an ephemeral mirror without materializing (#581)

v2.18.0

• consumer-contract manifest generated from sync.py (release-core admin contract dump|check) + assumption lint catching managed-path references in jobs that never materialize (#584, epic #583 WS-A)
• release-core pr wait retries transient gh/network poll failures with backoff instead of dying on the first blip; cut --help no longer shows the retired release-cut flat name (#582)
• orc probe now runs the clone's real SessionStart boot (setup-dev-env.sh) before the agent session, with a fail-loud boot-assert and boot report (#578)
• managed-sync commits and the .release-sync-source marker now carry the resolved release tag (e.g. v2.17.1) instead of the static wheel version (#580)
• WS-B: synthetic-consumer test/CI surfaces audited to the post-WS7 contract; consumer-contract lint baseline drained to zero (#588); stale repo-shape doc claims fixed; rerun-vs-fresh-event trap documented (epic #583)

v2.17.1

• rust-ci.yml e2e + bats-e2e.yml: materialize the managed tree via arm-gate (post-WS7 bin/check-e2e is an untracked mirror; the stale sparse checkout yielded a missing runner, exit 127 on every bats consumer)

v2.17.0

• prstate polish (#564): post-flip READY messaging, flip re-run heads-up in pr ready, thread-reading tool named in ADDRESSING, --reviewer named in the too-many-args error, pr wait cadence line
• Add kind-aware release-core coverage task verb (cargo llvm-cov / go tool cover / test runner --coverage) with a loud error when no coverage tool exists for the Kind (#568)
• Dev-cycle doctrine: the state engine is the arbiter — every push re-requests review; the minor/substantial re-review nuance is dropped (#565)
• gate pins its lefthook runner to the toolset pin and fails loud on an unmaterialized gate config (#567)

... (truncated)

Changelog

Sourced from arthur-debert/release/.github/workflows/copilot-review.yml's changelog.

3.11.0 - 2026-07-06

• Fix macOS signing of extra-binaries: sign all binaries in one sign-mac call so the per-invocation keychain isn't torn down before the extras are signed
• PreToolUse guard blocks git commit --no-verify (release-local dogfood)

3.10.1 - 2026-06-22

• Fix brew style Layout/EmptyLines failure in generated Homebrew formulae (empty PRIVATE_REPO_PREAMBLE left a double blank line before class)
• gate: markdownlint honors consumer-local .markdownlintignore (symmetric with prettier)

3.10.0 - 2026-06-22

• Add local code-review agent backends (codex, agy) under 'release-core review run'
• Local reviewers no longer falsely report 'request dropped'; backend timeouts/bad output fail cleanly; agy gets a 10m print timeout
• Post agent reviews as GitHub App bots (release-core review app + review post --as-app)
• Post agent reviews to GitHub PRs as inline reviews (release-core review post)
• Unify local agents with copilot: codex/agy as pr-review reviewer adapters
• Per-reviewer rerun config; review-once is the default (re-run is opt-in)

3.9.0 - 2026-06-21

• Fix: add GTK packaging tooling (gtk/rsvg -dev for linuxdeploy pkg-config) to slim package deps so AppImage bundling works
• Fix: assert-base-sha-green used gh api --slurp with --jq (unsupported); pipe slurped pages to jq so real releases don't fail at prepare. Adds a gh-slurp-jq-combo gate guard that statically rejects any gh api --slurp combined with --jq/--template across tracked shell + workflow YAML, so the regression class can't return.
• Fix: assert-base-sha-green scopes to the code gate, excluding the release pipeline's own check-runs (and prior failed attempts) so real cuts can pass
• Add a local+CI bundle integration smoke test that runs the real tauri bundle path against a pre-built artifact (#841)
• Add a delegate-guard PreToolUse hook that keeps the main agent loop delegating implementation to subagents — it blocks main-loop Edit/Write/NotebookEdit of project files (allowing subagent edits via agent_id, ~/.claude/ edits, and a one-shot delegate-armed sentinel), mirroring pr-loop-guard and synced to consumers
• Distribute stage 1: never ship the signer reseal payload as a release asset; assert the mac deliverable is exactly one dmg (#837)
• Remove checks:read from the tauri prepare job — a reusable job can't self-grant it (caller caps to none), which startup_failed every consumer; the base-sha assertion uses the RELEASE_TOKEN PAT instead
• Post-hoc signer now signs nested Mach-O (extra executables, dylibs, helper bundles) inner-first before the .app, so notarization no longer rejects unsigned nested code
• Fix cross-repo reusable-workflow ref: tauri sign job now uses the full arthur-debert/release/...@​v3 path (a local ./ ref resolved against the consumer repo, startup_failure)
• sign-mac uses a unique per-invocation keychain (+ EXIT cleanup) so repeated calls in one job (post-hoc Sign .app then Sign .dmg) no longer collide on the keychain name
• sign-mac no longer skips codesign for a passwordless .p12 (empty cert-password); skip is now gated on the cert alone
• Fix: pass GH_TOKEN to the split Build-frontend step so private-repo frontend deps (wasm) resolve
• Collapse Tauri sign-modes into one decomposed pipeline; signing is an optional step
• Slim the tauri package job to packaging/bundling deps (drops the compile toolchain: webkit/soup/appindicator -dev headers + mold) since it bundles a pre-built binary
• Decompose the tauri build/package jobs into per-phase steps (frontend, rust compile, per-format bundle) for run-UI timing (#835)
• Fail-loud guard: package job asserts the bundled main binary matches the expected name (mainBinaryName/productName/cargo name)
• Unify the dev cycle on always-delegate; implementer stops at PR-open, fresh shepherd per round; 6-round/all-nitpick review stop
• Add post-hoc macOS signing behind sign-mode input (reusable sign-notarize-mac workflow); default inline unchanged
• Release job consumes signed artifacts mode-agnostically: post-hoc ships the signed mac dmg, inline ships the in-build-signed bundle; partial-release prevention preserved
• Hoist Tauri bundling into a dedicated package job (post-hoc path)

3.8.0 - 2026-06-20

• Fix canary run-resolver timing out on Kinds whose release commits a version bump (drop the head_sha==seed tie on the release run; release#810 follow-on)
• Fix setup-sccache action failing to load: removed a live ${{ github.repository }} expression from the key-prefix description prose (the manifest validator evaluates expressions even in descriptions)
• Add a notify-downstreams input to rust-cli.yml and tree-sitter.yml so the reusable workflow fans repository_dispatch out to downstream repos itself; thin callers drop their hand-rolled notify jobs (release#804)
• Add sccache (shared GCS-backed) Rust compiler caching to the Rust and Tauri CI/release lanes for cross-branch cache reuse
• Document tauri build/bundle decoupling + post-hoc dmg signing spike verdict
• Preflight fails fast on empty changelog; Apple-secrets check gated on signing requested

... (truncated)

Commits

• 9964462 chore: Release v3.11.0
• 15d9865 fix(sign-mac): sign extra-binaries in the same sign-mac call as the primary
• 2337daf chore: remove weekly fleet-matrix drift routine (project sunset)
• 20f44a3 feat(guard): no-verify-guard blocks git commit --no-verify (release-local) (#...
• 7c7dab7 chore: Release v3.10.1
• d3566e4 fix(gate): markdownlint honors consumer-local .markdownlintignore (#856)
• 9769dd7 fix(brew): stop generated formulae failing brew style on blank lines (#853)
• d716436 chore: regenerate fleet conformance matrix (20260622) (#855)
• bbcdd4c chore: Release v3.10.0
• d7962c8 fix(review): local-reviewer request robustness (live bugs) (#854)
• Additional commits viewable in compare view

Updates actions/checkout from 6 to 7

Release notes

Sourced from actions/checkout's releases.

v7.0.0

What's Changed

• block checking out fork pr for pull_request_target and workflow_run by @​aiqiaoy in actions/checkout#2454
• Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @​dependabot[bot] in actions/checkout#2458
• Bump flatted from 3.3.1 to 3.4.2 by @​dependabot[bot] in actions/checkout#2460
• Bump js-yaml from 4.1.0 to 4.2.0 by @​dependabot[bot] in actions/checkout#2461
• Bump @​actions/core and @​actions/tool-cache and Remove uuid by @​dependabot[bot] in actions/checkout#2459
• upgrade module to esm and update dependencies by @​aiqiaoy in actions/checkout#2463
• Bump the minor-npm-dependencies group across 1 directory with 3 updates by @​dependabot[bot] in actions/checkout#2462
• getting ready for checkout v7 release by @​aiqiaoy in actions/checkout#2464
• update error wording by @​aiqiaoy in actions/checkout#2467

New Contributors

• @​aiqiaoy made their first contribution in actions/checkout#2454

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.0.3

What's Changed

• Update changelog by @​ericsciple in actions/checkout#2357
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in actions/checkout#2414
• Fix checkout init for SHA-256 repositories by @​yaananth in actions/checkout#2439
• Update changelog for v6.0.3 by @​yaananth in actions/checkout#2446

New Contributors

• @​yaananth made their first contribution in actions/checkout#2414

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

• Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by @​TingluoHuang in actions/checkout#2355
• Fix tag handling: preserve annotations and explicit fetch-tags by @​ericsciple in actions/checkout#2356

Full Changelog: actions/checkout@v6.0.1...v6.0.2

v6.0.1

What's Changed

• Update all references from v5 and v4 to v6 by @​ericsciple in actions/checkout#2314
• Add worktree support for persist-credentials includeIf by @​ericsciple in actions/checkout#2327
• Clarify v6 README by @​ericsciple in actions/checkout#2328

Full Changelog: actions/checkout@v6...v6.0.1

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.0

• Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in actions/checkout#2454
• Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @​dependabot[bot] in actions/checkout#2458
• Bump flatted from 3.3.1 to 3.4.2 by @​dependabot[bot] in actions/checkout#2460
• Bump js-yaml from 4.1.0 to 4.2.0 by @​dependabot[bot] in actions/checkout#2461
• Bump @​actions/core and @​actions/tool-cache and Remove uuid by @​dependabot[bot] in actions/checkout#2459
• upgrade module to esm and update dependencies by @​aiqiaoy in actions/checkout#2463
• Bump the minor-npm-dependencies group across 1 directory with 3 updates by @​dependabot[bot] in actions/checkout#2462

v6.0.3

• Fix checkout init for SHA-256 repositories by @​yaananth in actions/checkout#2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in actions/checkout#2414

v6.0.2

• Fix tag handling: preserve annotations and explicit fetch-tags by @​ericsciple in actions/checkout#2356

v6.0.1

• Add worktree support for persist-credentials includeIf by @​ericsciple in actions/checkout#2327

v6.0.0

• Persist creds to a separate file by @​ericsciple in actions/checkout#2286
• Update README to include Node.js 24 support details and requirements by @​salmanmkc in actions/checkout#2248

v5.0.1

• Port v6 cleanup to v5 by @​ericsciple in actions/checkout#2301

v5.0.0

• Update actions checkout to use node 24 by @​salmanmkc in actions/checkout#2226

v4.3.1

• Port v6 cleanup to v4 by @​ericsciple in actions/checkout#2305

v4.3.0

• docs: update README.md by @​motss in actions/checkout#1971
• Add internal repos for checking out multiple repositories by @​mouismail in actions/checkout#1977
• Documentation update - add recommended permissions to Readme by @​benwells in actions/checkout#2043
• Adjust positioning of user email note and permissions heading by @​joshmgross in actions/checkout#2044
• Update README.md by @​nebuk89 in actions/checkout#2194
• Update CODEOWNERS for actions by @​TingluoHuang in actions/checkout#2224
• Update package dependencies by @​salmanmkc in actions/checkout#2236

v4.2.2

• url-helper.ts now leverages well-known environment variables by @​jww3 in actions/checkout#1941
• Expand unit test coverage for isGhes by @​jww3 in actions/checkout#1946

v4.2.1

• Check out other refs/* by commit if provided, fall back to ref by @​orhantoy in actions/checkout#1924

... (truncated)

Commits

• 9c091bb update error wording (#2467)
• 1044a6d getting ready for checkout v7 release (#2464)
• f028218 Bump the minor-npm-dependencies group across 1 directory with 3 updates (#2462)
• d914b26 upgrade module to esm and update dependencies (#2463)
• 537c7ef Bump @​actions/core and @​actions/tool-cache and Remove uuid (#2459)
• 130a169 Bump js-yaml from 4.1.0 to 4.2.0 (#2461)
• 7d09575 Bump flatted from 3.3.1 to 3.4.2 (#2460)
• 0f9f3aa Bump actions/publish-immutable-action (#2458)
• f9e715a block checking out fork pr for pull_request_target and workflow_run (#2454)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions