chore(deps): bump stella/.github/.github/actions/changeset-policy from 1.3.0 to 1.8.0 in the dependencies group across 1 directory

[dependabot]

Bumps the dependencies group with 1 update in the / directory: stella/.github/.github/actions/changeset-policy.

Updates stella/.github/.github/actions/changeset-policy from 1.3.0 to 1.8.0

Release notes

Sourced from stella/.github/.github/actions/changeset-policy's releases.

v1.8.0

Adds the shared ci-plan action: plans CI jobs by changed path from a versioned policy, fails untrusted merge groups, and supports GitHub filter-pattern character classes.

v1.7.1

Reads every changeset-policy diff query with --no-renames, so a release commit that carries its empty changeset entry forward under a new name is recognized as adding an entry instead of being refused.

v1.6.0

Adds opt-in Rust Wasm preparation to the shared Changesets workflow, using the caller's locked dependency graph to install a matching wasm-bindgen CLI. Shared workflow and action contracts now run continuously alongside actionlint.

CC on behalf of @​jan-kubica

Safe Chain 1.5.14 mirror

Unmodified mirror of Aikido Safe Chain 1.5.14.

The installer and Linux static x64 binary are byte-identical upstream release assets. The installer hash matches the pinned CI action hash; the binary hash matches the verified installer. SHA256SUMS contains the asset hashes.

Safe Chain is distributed under the upstream AGPL-3.0-or-later license. LICENSE is included unchanged. Corresponding source for version 1.5.14, including build scripts, is available here as safe-chain-1.5.14-source.tar.gz at no charge. Upstream source: https://github.com/AikidoSec/safe-chain/tree/1.5.14.

v1.5.2

Retries newly created npm draft-release verification with bounded backoff, while preserving fail-closed staging after the retry budget is exhausted.

CC on behalf of sok0

v1.5.1

Handles the flat extraction layout produced when a release run downloads exactly one package artifact, while retaining isolated directories and exact-count checks for multi-package releases.

CC on behalf of sok0

v1.5.0

Adds fail-closed recovery for independently versioned npm releases. A caller can resume exact artifacts from an earlier run only when that run matches both the resolved source commit and the caller workflow path; artifact-read and release-write credentials remain separate.

CC on behalf of @​jan-kubica

v1.4.0

Makes independent npm releases resumable when package drafts already exist. Release discovery now includes drafts, indexes the paginated release collection once per state load, and rejects duplicate package-tag drafts.

CC on behalf of @​jan-kubica

Commits

• 37bfa04 feat(ci-plan): share the CI planner as a versioned action (#122)
• 0fd8afa chore: update dependencies (#123)
• 636b784 feat: add a reusable pull request provenance sync (#121)
• 412fb4b chore(labels): add ci:full for stella (#118)
• 83febc0 fix(npm-independent-release): make the npm visibility wait budget configurabl...
• aff5017 chore: update shared AI tooling (#116)
• 9090741 chore: update shared AI tooling (#115)
• 6af949a chore: remove Claude instruction aliases (#114)
• 2ac8052 fix(changeset-policy): count a renamed changeset entry as newly added (#113)
• 35506c4 chore(changesets): pin the lifecycle action to its unarmed revision (#112)
• Additional commits viewable in compare view