build(deps): bump the actions-routine group across 1 directory with 7 updates by dependabot[bot] · Pull Request #274 · lentago/.github

dependabot · 2026-10-25T05:44:40Z

Bumps the actions-routine group with 7 updates in the / directory:

Package	From	To
actions/setup-python	`7.0.0`	`7.1.0`
lentago/shared-workflows/.github/workflows/claude-responder.yml	`1.3.0`	`1.4.0`
lentago/shared-workflows/.github/workflows/docs-check.yml	`1.3.0`	`1.4.0`
ossf/scorecard-action	`2.4.4`	`2.5.0`
github/codeql-action/upload-sarif	`4.38.3`	`4.39.1`
lentago/shared-workflows/.github/workflows/shellcheck.yml	`1.3.0`	`1.4.0`
lentago/shared-workflows/.github/workflows/tf-lint.yml	`1.3.0`	`1.4.0`

Updates actions/setup-python from 7.0.0 to 7.1.0

Release notes

Sourced from actions/setup-python's releases.

v7.1.0

What's Changed

Enhancements

Add mirror and mirror-token inputs for custom Python distribution sources by @luhenry in actions/setup-python#1302

Improve error message clarity by @v-lmvysakh in actions/setup-python#1351

Dependency Upgrade

Upgrade browserslist from 4.28.2 to 4.28.9 by @dependabot in actions/setup-python#1353

Upgrade @typescript-eslint/parser from 8.62.0 to 8.70.0 by @dependabot in actions/setup-python#1343

Upgrade eslint-plugin-jest from 29.15.2 to 29.16.6 by @dependabot in actions/setup-python#1342

Upgrade @vercel/ncc from 0.44.0 to 0.45.0 by @dependabot in actions/setup-python#1357

Upgrade @types/semver from 7.7.1 to 7.8.0 by @dependabot in actions/setup-python#1359

Upgrade undici from 6.28.0 to 6.29.0 by @dependabot in actions/setup-python#1364

Upgrade ts-jest from 29.4.11 to 29.4.14 by @dependabot in actions/setup-python#1361

Upgrade brace-expansion from 5.0.9 to 5.0.12 by @dependabot in actions/setup-python#1365

Upgrade prettier from 3.8.4 to 3.9.9 and package.json from 7.0.0 to 7.1.0 by @dependabot in actions/setup-python#1363

Upgrade @typescript-eslint/eslint-plugin from 8.62.0 to 8.71.1 by @dependabot in actions/setup-python#1369

Upgrade actions/checkout from 7.0.0 to 7.0.1 by @dependabot in actions/setup-python#1345

Upgrade cache to 6.3.0 by @v-HarithaVattikuti in actions/setup-python#1370

Resolve Basic Validation audit failures by @v-HarithaVattikuti in actions/setup-python#1347

Resolve npm audit failures by @v-HarithaVattikuti in actions/setup-python#1350

New Contributors

@luhenry made their first contribution in actions/setup-python#1302

Full Changelog: actions/setup-python@v7.0.0...v7.1.0

Commits

6d4fd22 Cache upgrade to 6.3.0 (#1370)
ec52d0a Bump @typescript-eslint/eslint-plugin from 8.62.0 to 8.71.1 (#1369)
ff73b24 Bump prettier from 3.8.4 to 3.9.9 and package.json from 7.0.0 to 7.1.0 (#1363)
0e40890 Bump brace-expansion from 5.0.9 to 5.0.12 (#1365)
3892123 Bump ts-jest from 29.4.11 to 29.4.14 (#1361)
6609657 Bump undici from 6.28.0 to 6.29.0 (#1364)
e1be392 Bump @types/semver from 7.7.1 to 7.8.0 (#1359)
06da627 Bump @vercel/ncc from 0.44.0 to 0.45.0 (#1357)
af9bcc7 Bump eslint-plugin-jest from 29.15.2 to 29.16.6 (#1342)
7aeabeb Bump @typescript-eslint/parser from 8.62.0 to 8.70.0 (#1343)
Additional commits viewable in compare view

Updates lentago/shared-workflows/.github/workflows/claude-responder.yml from 1.3.0 to 1.4.0

Release notes

Sourced from lentago/shared-workflows/.github/workflows/claude-responder.yml's releases.

v1.4.0

What's new

claude-responder.yml: the max_turns default rises from 40 to 80. At 40 the cap failed runs that had already finished their work ("Claude reported a successful result after 46 turns, exceeding the configured maximum of 40"), leaving a red check after the comment or branch was posted. 46 turns was a normal issue-reading task, so 80 leaves room for one while still stopping a session that never converges. If you want the old cap, set max_turns: 40. (#72, #74)

Internal render-claude-summary refs in claude-responder.yml and claude-review.yml now pin @v1.4.0.

Minor, not patch: an existing input's default changed; the only effect for callers on the default is that longer runs are allowed.

Callers

Bump your uses: refs to @v1.4.0 (from @v1.3.0 or @v1.3.1). Dependabot opens these as PRs automatically where it is enabled.

v1.3.1

What's new

claude-responder.yml: bot-authored events are skipped at the job level instead of started and refused. A @claude mention written by a bot the caller has not listed in allowed_bots (CodeRabbit's review comments were the recurring case) used to start the job, which claude-code-action then failed with "Workflow initiated by non-human actor", leaving a red claude / claude check and an UNSTABLE merge state for no defect in the repo. The job's if: now mirrors the action's allow-list (*, or the sender's login with or without [bot], case-insensitive), so those events leave the check skipped; human mentions and listed bots run as before. No input changed; the allowed_bots default stays github-actions. (#68, #73)

Internal render-claude-summary refs in claude-responder.yml and claude-review.yml now pin @v1.3.1.

Callers

Bump your uses: refs from @v1.2.3 (or @v1.3.0) to @v1.3.1. Dependabot opens these as PRs automatically where it is enabled; the open actions-routine group PRs pick the new version up on their next refresh.

Changelog

Sourced from lentago/shared-workflows/.github/workflows/claude-responder.yml's changelog.

v1.4.0 (2026-10-13)

Changed

claude-responder.yml: the max_turns default rises from 40 to 80. The cap is a runaway guard, but at 40 it failed runs that had already finished their work: claude-code-action reports "Claude reported a successful result after 46 turns, exceeding the configured maximum of 40" and the run goes red after lentago/claytonia#139#140 on 2026-10-13; see #72). 46 turns was a normal issue-reading task, so 80 leaves room for one while still stopping a session that never converges. If you want the old cap, set max_turns: 40. Minor, not patch: a default changed, and the only effect for callers on the default is that longer runs are allowed.

Internal render-claude-summary refs point at v1.4.0.

v1.3.1 (2026-10-13)

Fixed

claude-responder.yml: bot-authored events are skipped at the job level instead of started and refused. A @claude mention written by a bot the caller has not listed in allowed_bots (CodeRabbit's review comments were the recurring case) used to start the job, which claude-code-action then failed with "Workflow initiated by non-human actor", leaving a red claude / claude check and an UNSTABLE merge state on the PR for no defect in the repo. The job's if: now mirrors the action's allow-list (*, or the sender's login with or without [bot], case-insensitive), so those events leave the check skipped; human mentions and listed bots run as before. No input changed and the allowed_bots default stays github-actions. (#68)

Internal render-claude-summary refs point at v1.3.1.

Commits

3289cf7 feat(claude-responder): raise the max_turns default to 80 (#74)
c3de18b fix(claude-responder): skip bot-initiated events instead of failing (#73)
See full diff in compare view

Updates lentago/shared-workflows/.github/workflows/docs-check.yml from 1.3.0 to 1.4.0

Release notes

Sourced from lentago/shared-workflows/.github/workflows/docs-check.yml's releases.

v1.4.0

What's new

claude-responder.yml: the max_turns default rises from 40 to 80. At 40 the cap failed runs that had already finished their work ("Claude reported a successful result after 46 turns, exceeding the configured maximum of 40"), leaving a red check after the comment or branch was posted. 46 turns was a normal issue-reading task, so 80 leaves room for one while still stopping a session that never converges. If you want the old cap, set max_turns: 40. (#72, #74)

Internal render-claude-summary refs in claude-responder.yml and claude-review.yml now pin @v1.4.0.

Minor, not patch: an existing input's default changed; the only effect for callers on the default is that longer runs are allowed.

Callers

Bump your uses: refs to @v1.4.0 (from @v1.3.0 or @v1.3.1). Dependabot opens these as PRs automatically where it is enabled.

v1.3.1

What's new

claude-responder.yml: bot-authored events are skipped at the job level instead of started and refused. A @claude mention written by a bot the caller has not listed in allowed_bots (CodeRabbit's review comments were the recurring case) used to start the job, which claude-code-action then failed with "Workflow initiated by non-human actor", leaving a red claude / claude check and an UNSTABLE merge state for no defect in the repo. The job's if: now mirrors the action's allow-list (*, or the sender's login with or without [bot], case-insensitive), so those events leave the check skipped; human mentions and listed bots run as before. No input changed; the allowed_bots default stays github-actions. (#68, #73)

Internal render-claude-summary refs in claude-responder.yml and claude-review.yml now pin @v1.3.1.

Callers

Bump your uses: refs from @v1.2.3 (or @v1.3.0) to @v1.3.1. Dependabot opens these as PRs automatically where it is enabled; the open actions-routine group PRs pick the new version up on their next refresh.

Changelog

Sourced from lentago/shared-workflows/.github/workflows/docs-check.yml's changelog.

v1.4.0 (2026-10-13)

Changed

claude-responder.yml: the max_turns default rises from 40 to 80. The cap is a runaway guard, but at 40 it failed runs that had already finished their work: claude-code-action reports "Claude reported a successful result after 46 turns, exceeding the configured maximum of 40" and the run goes red after lentago/claytonia#139#140 on 2026-10-13; see #72). 46 turns was a normal issue-reading task, so 80 leaves room for one while still stopping a session that never converges. If you want the old cap, set max_turns: 40. Minor, not patch: a default changed, and the only effect for callers on the default is that longer runs are allowed.

Internal render-claude-summary refs point at v1.4.0.

v1.3.1 (2026-10-13)

Fixed

claude-responder.yml: bot-authored events are skipped at the job level instead of started and refused. A @claude mention written by a bot the caller has not listed in allowed_bots (CodeRabbit's review comments were the recurring case) used to start the job, which claude-code-action then failed with "Workflow initiated by non-human actor", leaving a red claude / claude check and an UNSTABLE merge state on the PR for no defect in the repo. The job's if: now mirrors the action's allow-list (*, or the sender's login with or without [bot], case-insensitive), so those events leave the check skipped; human mentions and listed bots run as before. No input changed and the allowed_bots default stays github-actions. (#68)

Internal render-claude-summary refs point at v1.3.1.

Commits

3289cf7 feat(claude-responder): raise the max_turns default to 80 (#74)
c3de18b fix(claude-responder): skip bot-initiated events instead of failing (#73)
See full diff in compare view

Updates ossf/scorecard-action from 2.4.4 to 2.5.0

Release notes

Sourced from ossf/scorecard-action's releases.

v2.5.0

What's Changed

This release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted services moved to new infrastructure.

For changes to checks and results, and what the infrastructure move means for you, see the Scorecard v5.6.0 release notes.

The action's container image is built with Go 1.27.2 on a refreshed distroless base. by @justaugustus in ossf/scorecard-action#1716

The installer (cmd/installer) now creates .github/workflows/scorecard.yml, and still recognizes existing scorecards.yml and scorecards-analysis.yml workflows. by @justaugustus in ossf/scorecard-action#1716

The Scorecard version in results now always matches the Scorecard release the action is built with. by @justaugustus in ossf/scorecard-action#1718

The action no longer prints the GitHub token variable while validating its options. by @arpitjain099 in ossf/scorecard-action#1709

results_format accepts intoto, which wraps the JSON results in an in-toto attestation statement. by @puerco in ossf/scorecard-action#1702

Other

Add a daily canary against Scorecard main by @justaugustus in ossf/scorecard-action#1711

Bump Scorecard to the v5.6.0 candidate and fix the canary toolchain by @justaugustus in ossf/scorecard-action#1714

Run Scorecard on every merge, add a zizmor presubmit, analyze workflows with CodeQL, and update RELEASE.md by @justaugustus in ossf/scorecard-action#1716

Bump Scorecard to v5.6.0 by @justaugustus in ossf/scorecard-action#1719

New Contributors

@arpitjain099 made their first contribution in ossf/scorecard-action#1709

@puerco made their first contribution in ossf/scorecard-action#1702

Full Changelog: ossf/scorecard-action@v2.4.4...v2.5.0

Commits

fa7117d Bump action tag for v2.5.0 release (#1720)
cef4eb5 🌱 Bump Scorecard to v5.6.0 (#1719)
bedb16e ✨ Add intoto results format (#1702)
de70347 Remove the leftover debug print of the auth token (#1709)
950873d 🌱 Derive the reported Scorecard version from go.mod (#1718)
2ce8ee4 🌱 Bump github.com/sigstore/cosign/v2 from 2.6.4 to 2.6.5 (#1695)
aabdf5a 🌱 Bump the github-actions group across 1 directory with 7 updates (#...
b4b9adf 🌱 CodeQL: Analyze workflows instead of a placeholder JavaScript file
4e9f2a2 📖 RELEASE.md: Document drafting release notes
f618e8b 🌱 Build the image with Go 1.27.2 and refresh distroless
Additional commits viewable in compare view

Updates github/codeql-action/upload-sarif from 4.38.3 to 4.39.1

Release notes

Sourced from github/codeql-action/upload-sarif's releases.

v4.39.1

Update default CodeQL bundle version to 2.27.3. #4256

v4.39.0

Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205

The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148

Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206

The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

Changelog

Sourced from github/codeql-action/upload-sarif's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.39.1 - 21 Oct 2026

Update default CodeQL bundle version to 2.27.3. #4256

4.39.0 - 15 Oct 2026

Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205

The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148

Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206

The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

4.38.3 - 08 Oct 2026

Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188

Update default CodeQL bundle version to 2.27.2. #4203

Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

4.38.2 - 24 Sept 2026

Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124

The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072

Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

Update default CodeQL bundle version to 2.26.3. #4085

... (truncated)

Commits

9b32540 Merge pull request #4257 from github/update-v4.39.1-c5a2f4b0f
b5e1ed9 Trigger workflows
20f5ec3 Update changelog for v4.39.1
c5a2f4b Merge pull request #4245 from github/henrymercer/graduate-overlay-trap-caching
61a5a80 Merge pull request #4256 from github/update-bundle/codeql-bundle-v2.27.3
3dd33f8 Merge pull request #4249 from github/mbg/upload-improvements-for-4223
b96e339 Change comment for getConfig call in upload-sarif
7fa4518 Use shouldSkipSarifUpload in analyze-action.ts
a69c7cb Document that setting the env vars to false takes precedence
74ddcd9 Fix typo in comment
Additional commits viewable in compare view

Updates lentago/shared-workflows/.github/workflows/shellcheck.yml from 1.3.0 to 1.4.0

Release notes

Sourced from lentago/shared-workflows/.github/workflows/shellcheck.yml's releases.

v1.4.0

What's new

claude-responder.yml: the max_turns default rises from 40 to 80. At 40 the cap failed runs that had already finished their work ("Claude reported a successful result after 46 turns, exceeding the configured maximum of 40"), leaving a red check after the comment or branch was posted. 46 turns was a normal issue-reading task, so 80 leaves room for one while still stopping a session that never converges. If you want the old cap, set max_turns: 40. (#72, #74)

Internal render-claude-summary refs in claude-responder.yml and claude-review.yml now pin @v1.4.0.

Minor, not patch: an existing input's default changed; the only effect for callers on the default is that longer runs are allowed.

Callers

Bump your uses: refs to @v1.4.0 (from @v1.3.0 or @v1.3.1). Dependabot opens these as PRs automatically where it is enabled.

v1.3.1

What's new

claude-responder.yml: bot-authored events are skipped at the job level instead of started and refused. A @claude mention written by a bot the caller has not listed in allowed_bots (CodeRabbit's review comments were the recurring case) used to start the job, which claude-code-action then failed with "Workflow initiated by non-human actor", leaving a red claude / claude check and an UNSTABLE merge state for no defect in the repo. The job's if: now mirrors the action's allow-list (*, or the sender's login with or without [bot], case-insensitive), so those events leave the check skipped; human mentions and listed bots run as before. No input changed; the allowed_bots default stays github-actions. (#68, #73)

Internal render-claude-summary refs in claude-responder.yml and claude-review.yml now pin @v1.3.1.

Callers

Bump your uses: refs from @v1.2.3 (or @v1.3.0) to @v1.3.1. Dependabot opens these as PRs automatically where it is enabled; the open actions-routine group PRs pick the new version up on their next refresh.

Changelog

Sourced from lentago/shared-workflows/.github/workflows/shellcheck.yml's changelog.

v1.4.0 (2026-10-13)

Changed

claude-responder.yml: the max_turns default rises from 40 to 80. The cap is a runaway guard, but at 40 it failed runs that had already finished their work: claude-code-action reports "Claude reported a successful result after 46 turns, exceeding the configured maximum of 40" and the run goes red after lentago/claytonia#139#140 on 2026-10-13; see #72). 46 turns was a normal issue-reading task, so 80 leaves room for one while still stopping a session that never converges. If you want the old cap, set max_turns: 40. Minor, not patch: a default changed, and the only effect for callers on the default is that longer runs are allowed.

Internal render-claude-summary refs point at v1.4.0.

v1.3.1 (2026-10-13)

Fixed

claude-responder.yml: bot-authored events are skipped at the job level instead of started and refused. A @claude mention written by a bot the caller has not listed in allowed_bots (CodeRabbit's review comments were the recurring case) used to start the job, which claude-code-action then failed with "Workflow initiated by non-human actor", leaving a red claude / claude check and an UNSTABLE merge state on the PR for no defect in the repo. The job's if: now mirrors the action's allow-list (*, or the sender's login with or without [bot], case-insensitive), so those events leave the check skipped; human mentions and listed bots run as before. No input changed and the allowed_bots default stays github-actions. (#68)

Internal render-claude-summary refs point at v1.3.1.

Commits

3289cf7 feat(claude-responder): raise the max_turns default to 80 (#74)
c3de18b fix(claude-responder): skip bot-initiated events instead of failing (#73)
See full diff in compare view

Updates lentago/shared-workflows/.github/workflows/tf-lint.yml from 1.3.0 to 1.4.0

Release notes

Sourced from lentago/shared-workflows/.github/workflows/tf-lint.yml's releases.

v1.4.0

What's new

claude-responder.yml: the max_turns default rises from 40 to 80. At 40 the cap failed runs that had already finished their work ("Claude reported a successful result after 46 turns, exceeding the configured maximum of 40"), leaving a red check after the comment or branch was posted. 46 turns was a normal issue-reading task, so 80 leaves room for one while still stopping a session that never converges. If you want the old cap, set max_turns: 40. (#72, #74)

Internal render-claude-summary refs in claude-responder.yml and claude-review.yml now pin @v1.4.0.

Minor, not patch: an existing input's default changed; the only effect for callers on the default is that longer runs are allowed.

Callers

Bump your uses: refs to @v1.4.0 (from @v1.3.0 or @v1.3.1). Dependabot opens these as PRs automatically where it is enabled.

v1.3.1

What's new

claude-responder.yml: bot-authored events are skipped at the job level instead of started and refused. A @claude mention written by a bot the caller has not listed in allowed_bots (CodeRabbit's review comments were the recurring case) used to start the job, which claude-code-action then failed with "Workflow initiated by non-human actor", leaving a red claude / claude check and an UNSTABLE merge state for no defect in the repo. The job's if: now mirrors the action's allow-list (*, or the sender's login with or without [bot], case-insensitive), so those events leave the check skipped; human mentions and listed bots run as before. No input changed; the allowed_bots default stays github-actions. (#68, #73)

Internal render-claude-summary refs in claude-responder.yml and claude-review.yml now pin @v1.3.1.

Callers

Bump your uses: refs from @v1.2.3 (or @v1.3.0) to @v1.3.1. Dependabot opens these as PRs automatically where it is enabled; the open actions-routine group PRs pick the new version up on their next refresh.

Changelog

Sourced from lentago/shared-workflows/.github/workflows/tf-lint.yml's changelog.

v1.4.0 (2026-10-13)

Changed

claude-responder.yml: the max_turns default rises from 40 to 80. The cap is a runaway guard, but at 40 it failed runs that had already finished their work: claude-code-action reports "Claude reported a successful result after 46 turns, exceeding the configured maximum of 40" and the run goes red after lentago/claytonia#139#140 on 2026-10-13; see #72). 46 turns was a normal issue-reading task, so 80 leaves room for one while still stopping a session that never converges. If you want the old cap, set max_turns: 40. Minor, not patch: a default changed, and the only effect for callers on the default is that longer runs are allowed.

Internal render-claude-summary refs point at v1.4.0.

v1.3.1 (2026-10-13)

Fixed

claude-responder.yml: bot-authored events are skipped at the job level instead of started and refused. A @claude mention written by a bot the caller has not listed in allowed_bots (CodeRabbit's review comments were the recurring case) used to start the job, which claude-code-action then failed with "Workflow initiated by non-human actor", leaving a red claude / claude check and an UNSTABLE merge state on the PR for no defect in the repo. The job's if: now mirrors the action's allow-list (*, or the sender's login with or without [bot], case-insensitive), so those events leave the check skipped; human mentions and listed bots run as before. No input changed and the allowed_bots default stays github-actions. (#68)

Internal render-claude-summary refs point at v1.3.1.

Commits

3289cf7 feat(claude-responder): raise the max_turns default to 80 (#74)
c3de18b fix(claude-responder): skip bot-initiated events instead of failing (#73)
See full diff in compare view

cpitzi · 2026-10-29T17:23:52Z

@dependabot rebase

… updates Bumps the actions-routine group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/setup-python](https://github.com/actions/setup-python) | `7.0.0` | `7.1.0` | | [lentago/shared-workflows/.github/workflows/claude-responder.yml](https://github.com/lentago/shared-workflows) | `1.3.0` | `1.4.0` | | [lentago/shared-workflows/.github/workflows/docs-check.yml](https://github.com/lentago/shared-workflows) | `1.3.0` | `1.4.0` | | [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.4` | `2.5.0` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.38.3` | `4.39.1` | | [lentago/shared-workflows/.github/workflows/shellcheck.yml](https://github.com/lentago/shared-workflows) | `1.3.0` | `1.4.0` | | [lentago/shared-workflows/.github/workflows/tf-lint.yml](https://github.com/lentago/shared-workflows) | `1.3.0` | `1.4.0` | Updates `actions/setup-python` from 7.0.0 to 7.1.0 - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@5fda3b9...6d4fd22) Updates `lentago/shared-workflows/.github/workflows/claude-responder.yml` from 1.3.0 to 1.4.0 - [Release notes](https://github.com/lentago/shared-workflows/releases) - [Changelog](https://github.com/lentago/shared-workflows/blob/main/CHANGELOG.md) - [Commits](lentago/shared-workflows@v1.3.0...v1.4.0) Updates `lentago/shared-workflows/.github/workflows/docs-check.yml` from 1.3.0 to 1.4.0 - [Release notes](https://github.com/lentago/shared-workflows/releases) - [Changelog](https://github.com/lentago/shared-workflows/blob/main/CHANGELOG.md) - [Commits](lentago/shared-workflows@v1.3.0...v1.4.0) Updates `ossf/scorecard-action` from 2.4.4 to 2.5.0 - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](ossf/scorecard-action@2d11466...fa7117d) Updates `github/codeql-action/upload-sarif` from 4.38.3 to 4.39.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@24c5418...9b32540) Updates `lentago/shared-workflows/.github/workflows/shellcheck.yml` from 1.3.0 to 1.4.0 - [Release notes](https://github.com/lentago/shared-workflows/releases) - [Changelog](https://github.com/lentago/shared-workflows/blob/main/CHANGELOG.md) - [Commits](lentago/shared-workflows@v1.3.0...v1.4.0) Updates `lentago/shared-workflows/.github/workflows/tf-lint.yml` from 1.3.0 to 1.4.0 - [Release notes](https://github.com/lentago/shared-workflows/releases) - [Changelog](https://github.com/lentago/shared-workflows/blob/main/CHANGELOG.md) - [Commits](lentago/shared-workflows@v1.3.0...v1.4.0) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-routine - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.39.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-routine - dependency-name: lentago/shared-workflows/.github/workflows/claude-responder.yml dependency-version: 1.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-routine - dependency-name: lentago/shared-workflows/.github/workflows/docs-check.yml dependency-version: 1.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-routine - dependency-name: lentago/shared-workflows/.github/workflows/shellcheck.yml dependency-version: 1.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-routine - dependency-name: lentago/shared-workflows/.github/workflows/tf-lint.yml dependency-version: 1.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-routine - dependency-name: ossf/scorecard-action dependency-version: 2.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-routine ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot requested a review from cpitzi as a code owner October 25, 2026 05:44

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 25, 2026

cpitzi enabled auto-merge (squash) October 29, 2026 17:23

dependabot Bot force-pushed the dependabot/github_actions/actions-routine-cb8b56f565 branch from 66c6145 to 2208f99 Compare October 29, 2026 17:26

cpitzi merged commit a1448d7 into main Oct 29, 2026
11 checks passed

cpitzi deleted the dependabot/github_actions/actions-routine-cb8b56f565 branch October 29, 2026 17:27

Navigation Menu

Repository navigation

build(deps): bump the actions-routine group across 1 directory with 7 updates - #274

build(deps): bump the actions-routine group across 1 directory with 7 updates#274
cpitzi merged 1 commit into
mainfrom
dependabot/github_actions/actions-routine-cb8b56f565

dependabot Bot commented on behalf of github Oct 25, 2026 •

edited

Loading

Uh oh!

cpitzi commented Oct 29, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Oct 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v7.1.0

What's Changed

Enhancements

Dependency Upgrade

New Contributors

v1.4.0

What's new

Callers

v1.3.1

What's new

Callers

v1.4.0 (2026-10-13)

Changed

v1.3.1 (2026-10-13)

Fixed

v1.4.0

What's new

Callers

v1.3.1

What's new

Callers

v1.4.0 (2026-10-13)

Changed

v1.3.1 (2026-10-13)

Fixed

v2.5.0

What's Changed

Other

New Contributors

v4.39.1

v4.39.0

CodeQL Action Changelog

[UNRELEASED]

4.39.1 - 21 Oct 2026

4.39.0 - 15 Oct 2026

4.38.3 - 08 Oct 2026

4.38.2 - 24 Sept 2026

4.38.1 - 18 Sept 2026

4.38.0 - 09 Sept 2026

4.37.9 - 26 Aug 2026

4.37.8 - 21 Aug 2026

4.37.7 - 13 Aug 2026

v1.4.0

What's new

Callers

v1.3.1

What's new

Callers

v1.4.0 (2026-10-13)

Changed

v1.3.1 (2026-10-13)

Fixed

v1.4.0

What's new

Callers

v1.3.1

What's new

Callers

v1.4.0 (2026-10-13)

Changed

v1.3.1 (2026-10-13)

Fixed

Uh oh!

cpitzi commented Oct 29, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Oct 25, 2026 •

edited

Loading