Skip to content

ci: bump the whuppi-ci group with 8 updates - #9

Open
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/github_actions/dev/whuppi-ci-dbe21f0fe8
Open

ci: bump the whuppi-ci group with 8 updates#9
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/github_actions/dev/whuppi-ci-dbe21f0fe8

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 3, 2026

Copy link
Copy Markdown

Bumps the whuppi-ci group with 8 updates:

Package From To
whuppi/ci/.github/workflows/auto-close.yml 2.0.5 2.4.0
whuppi/ci 2.0.5 2.4.0
whuppi/ci/.github/workflows/labels.yml 2.0.5 2.4.0
whuppi/ci/.github/workflows/pr-checks.yml 2.0.5 2.4.0
whuppi/ci/.github/workflows/release.yml 2.0.5 2.4.0
whuppi/ci/.github/workflows/retry.yml 2.0.5 2.4.0
whuppi/ci/.github/workflows/triage.yml 2.0.5 2.4.0
whuppi/ci/.github/workflows/upgrade-check.yml 2.0.5 2.4.0

Updates whuppi/ci/.github/workflows/auto-close.yml from 2.0.5 to 2.4.0

Release notes

Sourced from whuppi/ci/.github/workflows/auto-close.yml's releases.

whuppi/ci 2.4.0

  • The opt-in composite sweep now owns every action uses: ref, not just the composite blind spot — renamed composite-refs → action-refs. It sweeps every whuppi/ci ref (workflows + composites, uniform) to the latest release AND pins every third-party action (workflows AND composites) to the latest SHA via pinact. No more split between Dependabot and a sweep across workflow-vs-composite.
  • This leaves Dependabot owning only pub deps. Consumers drop the whole github-actions ecosystem from dependabot.yml (not just whuppi/ci*), keep sweepActions: true + CI_ACTIONS_TOKEN, and get one PR for all action bumps.
  • The label/branch changed with the rename (upgrade-action-refs / chore/action-refs); a consumer on 2.3.0's short-lived composite-refs shape just re-points its wrapper.
  • e8b093a release: v2.4.0
  • c450cfc ci: one owner for every action ref — no workflow/composite split (#39)

whuppi/ci 2.3.0

  • Reverted Renovate (added in 2.2.0). Deleted the reusable renovate.yml. The self-hosted Renovate machine — a dashboard issue, a per-consumer renovate.json5, a status-check/token-scope surface — was far more than the one gap that actually bit us: composite action.yml refs Dependabot can't see (dependabot-core#6704).
  • Closed that gap in the existing radar instead. New opt-in composite-refs job in the reusable upgrade-check.yml: sweeps every whuppi/ci ref across .github (workflows AND composites) to the latest release — uniform, so the pin never splits — and pins third-party actions inside composites to the latest SHA via pinact. Dependabot keeps pub deps + third-party actions in workflow files; the two never overlap. A consumer opts in with sweepActions: true + CI_ACTIONS_TOKEN and adds whuppi/ci* to its Dependabot ignore.
  • Added pinact to the pinned tool supply chain (PINACT_VERSION), owned by self-upgrade.yml like actionlint/zizmor.
  • Renamed the org secret RENOVATE_TOKEN → CI_ACTIONS_TOKEN (same Workflows-scope PAT; GITHUB_TOKEN still can't write .github/workflows/). secrets.sh's org scope stays — it's generic.
  • cce8645 release: v2.3.0
  • c86dbd8 ci: revert Renovate — close the composite-refs gap in the existing radar (#38)
  • c832143 ci: restore Renovate configurable log level (revert temp debug) (#37)
  • 72a8a34 ci: temp debug logging (diagnose repository-changed) (#36)
  • 6917770 ci: Renovate — commit via platform API (fix repository-changed abort) (#35)

... (truncated)

Changelog

Sourced from whuppi/ci/.github/workflows/auto-close.yml's changelog.

2.4.0

  • The opt-in composite sweep now owns every action uses: ref, not just the composite blind spot — renamed composite-refs → action-refs. It sweeps every whuppi/ci ref (workflows + composites, uniform) to the latest release AND pins every third-party action (workflows AND composites) to the latest SHA via pinact. No more split between Dependabot and a sweep across workflow-vs-composite.
  • This leaves Dependabot owning only pub deps. Consumers drop the whole github-actions ecosystem from dependabot.yml (not just whuppi/ci*), keep sweepActions: true + CI_ACTIONS_TOKEN, and get one PR for all action bumps.
  • The label/branch changed with the rename (upgrade-action-refs / chore/action-refs); a consumer on 2.3.0's short-lived composite-refs shape just re-points its wrapper.

2.3.0

  • Reverted Renovate (added in 2.2.0). Deleted the reusable renovate.yml. The self-hosted Renovate machine — a dashboard issue, a per-consumer renovate.json5, a status-check/token-scope surface — was far more than the one gap that actually bit us: composite action.yml refs Dependabot can't see (dependabot-core#6704).
  • Closed that gap in the existing radar instead. New opt-in composite-refs job in the reusable upgrade-check.yml: sweeps every whuppi/ci ref across .github (workflows AND composites) to the latest release — uniform, so the pin never splits — and pins third-party actions inside composites to the latest SHA via pinact. Dependabot keeps pub deps + third-party actions in workflow files; the two never overlap. A consumer opts in with sweepActions: true + CI_ACTIONS_TOKEN and adds whuppi/ci* to its Dependabot ignore.
  • Added pinact to the pinned tool supply chain (PINACT_VERSION), owned by self-upgrade.yml like actionlint/zizmor.
  • Renamed the org secret RENOVATE_TOKEN → CI_ACTIONS_TOKEN (same Workflows-scope PAT; GITHUB_TOKEN still can't write .github/workflows/). secrets.sh's org scope stays — it's generic.

2.2.0

  • Added a reusable renovate.yml — self-hosted Renovate that each consumer calls from a thin wrapper (same shape as upgrade-check.yml), running against the calling repo. It reads composite action.yml (dependabot-core#6704 blind spot), so it keeps whuppi/ci refs uniform and bumps third-party actions hidden in composites. Needs a RENOVATE_TOKEN org secret (Contents + Workflows + Pull-requests + Issues: write) — Renovate must write .github/workflows/, which GITHUB_TOKEN can't.
  • secrets.sh gained an org scope for org-wide secrets (set org/KEY).
  • Removed the whuppi-ci-refs job from upgrade-check.yml. Renovate replaces it: the sweep needed a Workflows-scope token GITHUB_TOKEN couldn't provide, and Renovate reads composites natively. Consumers migrate to the renovate.yml wrapper and drop their Dependabot github-actions + pub config.

... (truncated)

Commits
  • e8b093a release: v2.4.0
  • c450cfc ci: one owner for every action ref — no workflow/composite split (#39)
  • c86dbd8 ci: revert Renovate — close the composite-refs gap in the existing radar (#38)
  • c832143 ci: restore Renovate configurable log level (revert temp debug) (#37)
  • 72a8a34 ci: temp debug logging (diagnose repository-changed) (#36)
  • 6917770 ci: Renovate — commit via platform API (fix repository-changed abort) (#35)
  • 7679737 ci: release 2.2.0 — Renovate replaces the whuppi-ci-refs sweep (#34)
  • bd10d2e ci: add central Renovate runner + renovate secrets env (#33)
  • a8ce7d6 chore: bump pinned versions (#31)
  • a1254e3 feat: sweep whuppi/ci refs to latest via upgrade-check (#32)
  • Additional commits viewable in compare view

Updates whuppi/ci from 2.0.5 to 2.4.0

Release notes

Sourced from whuppi/ci's releases.

whuppi/ci 2.4.0

  • The opt-in composite sweep now owns every action uses: ref, not just the composite blind spot — renamed composite-refs → action-refs. It sweeps every whuppi/ci ref (workflows + composites, uniform) to the latest release AND pins every third-party action (workflows AND composites) to the latest SHA via pinact. No more split between Dependabot and a sweep across workflow-vs-composite.
  • This leaves Dependabot owning only pub deps. Consumers drop the whole github-actions ecosystem from dependabot.yml (not just whuppi/ci*), keep sweepActions: true + CI_ACTIONS_TOKEN, and get one PR for all action bumps.
  • The label/branch changed with the rename (upgrade-action-refs / chore/action-refs); a consumer on 2.3.0's short-lived composite-refs shape just re-points its wrapper.
  • e8b093a release: v2.4.0
  • c450cfc ci: one owner for every action ref — no workflow/composite split (#39)

whuppi/ci 2.3.0

  • Reverted Renovate (added in 2.2.0). Deleted the reusable renovate.yml. The self-hosted Renovate machine — a dashboard issue, a per-consumer renovate.json5, a status-check/token-scope surface — was far more than the one gap that actually bit us: composite action.yml refs Dependabot can't see (dependabot-core#6704).
  • Closed that gap in the existing radar instead. New opt-in composite-refs job in the reusable upgrade-check.yml: sweeps every whuppi/ci ref across .github (workflows AND composites) to the latest release — uniform, so the pin never splits — and pins third-party actions inside composites to the latest SHA via pinact. Dependabot keeps pub deps + third-party actions in workflow files; the two never overlap. A consumer opts in with sweepActions: true + CI_ACTIONS_TOKEN and adds whuppi/ci* to its Dependabot ignore.
  • Added pinact to the pinned tool supply chain (PINACT_VERSION), owned by self-upgrade.yml like actionlint/zizmor.
  • Renamed the org secret RENOVATE_TOKEN → CI_ACTIONS_TOKEN (same Workflows-scope PAT; GITHUB_TOKEN still can't write .github/workflows/). secrets.sh's org scope stays — it's generic.
  • cce8645 release: v2.3.0
  • c86dbd8 ci: revert Renovate — close the composite-refs gap in the existing radar (#38)
  • c832143 ci: restore Renovate configurable log level (revert temp debug) (#37)
  • 72a8a34 ci: temp debug logging (diagnose repository-changed) (#36)
  • 6917770 ci: Renovate — commit via platform API (fix repository-changed abort) (#35)

... (truncated)

Changelog

Sourced from whuppi/ci's changelog.

2.4.0

  • The opt-in composite sweep now owns every action uses: ref, not just the composite blind spot — renamed composite-refs → action-refs. It sweeps every whuppi/ci ref (workflows + composites, uniform) to the latest release AND pins every third-party action (workflows AND composites) to the latest SHA via pinact. No more split between Dependabot and a sweep across workflow-vs-composite.
  • This leaves Dependabot owning only pub deps. Consumers drop the whole github-actions ecosystem from dependabot.yml (not just whuppi/ci*), keep sweepActions: true + CI_ACTIONS_TOKEN, and get one PR for all action bumps.
  • The label/branch changed with the rename (upgrade-action-refs / chore/action-refs); a consumer on 2.3.0's short-lived composite-refs shape just re-points its wrapper.

2.3.0

  • Reverted Renovate (added in 2.2.0). Deleted the reusable renovate.yml. The self-hosted Renovate machine — a dashboard issue, a per-consumer renovate.json5, a status-check/token-scope surface — was far more than the one gap that actually bit us: composite action.yml refs Dependabot can't see (dependabot-core#6704).
  • Closed that gap in the existing radar instead. New opt-in composite-refs job in the reusable upgrade-check.yml: sweeps every whuppi/ci ref across .github (workflows AND composites) to the latest release — uniform, so the pin never splits — and pins third-party actions inside composites to the latest SHA via pinact. Dependabot keeps pub deps + third-party actions in workflow files; the two never overlap. A consumer opts in with sweepActions: true + CI_ACTIONS_TOKEN and adds whuppi/ci* to its Dependabot ignore.
  • Added pinact to the pinned tool supply chain (PINACT_VERSION), owned by self-upgrade.yml like actionlint/zizmor.
  • Renamed the org secret RENOVATE_TOKEN → CI_ACTIONS_TOKEN (same Workflows-scope PAT; GITHUB_TOKEN still can't write .github/workflows/). secrets.sh's org scope stays — it's generic.

2.2.0

  • Added a reusable renovate.yml — self-hosted Renovate that each consumer calls from a thin wrapper (same shape as upgrade-check.yml), running against the calling repo. It reads composite action.yml (dependabot-core#6704 blind spot), so it keeps whuppi/ci refs uniform and bumps third-party actions hidden in composites. Needs a RENOVATE_TOKEN org secret (Contents + Workflows + Pull-requests + Issues: write) — Renovate must write .github/workflows/, which GITHUB_TOKEN can't.
  • secrets.sh gained an org scope for org-wide secrets (set org/KEY).
  • Removed the whuppi-ci-refs job from upgrade-check.yml. Renovate replaces it: the sweep needed a Workflows-scope token GITHUB_TOKEN couldn't provide, and Renovate reads composites natively. Consumers migrate to the renovate.yml wrapper and drop their Dependabot github-actions + pub config.

... (truncated)

Commits
  • e8b093a release: v2.4.0
  • c450cfc ci: one owner for every action ref — no workflow/composite split (#39)
  • c86dbd8 ci: revert Renovate — close the composite-refs gap in the existing radar (#38)
  • c832143 ci: restore Renovate configurable log level (revert temp debug) (#37)
  • 72a8a34 ci: temp debug logging (diagnose repository-changed) (#36)
  • 6917770 ci: Renovate — commit via platform API (fix repository-changed abort) (#35)
  • 7679737 ci: release 2.2.0 — Renovate replaces the whuppi-ci-refs sweep (#34)
  • bd10d2e ci: add central Renovate runner + renovate secrets env (#33)
  • a8ce7d6 chore: bump pinned versions (#31)
  • a1254e3 feat: sweep whuppi/ci refs to latest via upgrade-check (#32)
  • Additional commits viewable in compare view

Updates whuppi/ci/.github/workflows/labels.yml from 2.0.5 to 2.4.0

Release notes

Sourced from whuppi/ci/.github/workflows/labels.yml's releases.

whuppi/ci 2.4.0

  • The opt-in composite sweep now owns every action uses: ref, not just the composite blind spot — renamed composite-refs → action-refs. It sweeps every whuppi/ci ref (workflows + composites, uniform) to the latest release AND pins every third-party action (workflows AND composites) to the latest SHA via pinact. No more split between Dependabot and a sweep across workflow-vs-composite.
  • This leaves Dependabot owning only pub deps. Consumers drop the whole github-actions ecosystem from dependabot.yml (not just whuppi/ci*), keep sweepActions: true + CI_ACTIONS_TOKEN, and get one PR for all action bumps.
  • The label/branch changed with the rename (upgrade-action-refs / chore/action-refs); a consumer on 2.3.0's short-lived composite-refs shape just re-points its wrapper.
  • e8b093a release: v2.4.0
  • c450cfc ci: one owner for every action ref — no workflow/composite split (#39)

whuppi/ci 2.3.0

  • Reverted Renovate (added in 2.2.0). Deleted the reusable renovate.yml. The self-hosted Renovate machine — a dashboard issue, a per-consumer renovate.json5, a status-check/token-scope surface — was far more than the one gap that actually bit us: composite action.yml refs Dependabot can't see (dependabot-core#6704).
  • Closed that gap in the existing radar instead. New opt-in composite-refs job in the reusable upgrade-check.yml: sweeps every whuppi/ci ref across .github (workflows AND composites) to the latest release — uniform, so the pin never splits — and pins third-party actions inside composites to the latest SHA via pinact. Dependabot keeps pub deps + third-party actions in workflow files; the two never overlap. A consumer opts in with sweepActions: true + CI_ACTIONS_TOKEN and adds whuppi/ci* to its Dependabot ignore.
  • Added pinact to the pinned tool supply chain (PINACT_VERSION), owned by self-upgrade.yml like actionlint/zizmor.
  • Renamed the org secret RENOVATE_TOKEN → CI_ACTIONS_TOKEN (same Workflows-scope PAT; GITHUB_TOKEN still can't write .github/workflows/). secrets.sh's org scope stays — it's generic.
  • cce8645 release: v2.3.0
  • c86dbd8 ci: revert Renovate — close the composite-refs gap in the existing radar (#38)
  • c832143 ci: restore Renovate configurable log level (revert temp debug) (#37)
  • 72a8a34 ci: temp debug logging (diagnose repository-changed) (#36)
  • 6917770 ci: Renovate — commit via platform API (fix repository-changed abort) (#35)

... (truncated)

Changelog

Sourced from whuppi/ci/.github/workflows/labels.yml's changelog.

2.4.0

  • The opt-in composite sweep now owns every action uses: ref, not just the composite blind spot — renamed composite-refs → action-refs. It sweeps every whuppi/ci ref (workflows + composites, uniform) to the latest release AND pins every third-party action (workflows AND composites) to the latest SHA via pinact. No more split between Dependabot and a sweep across workflow-vs-composite.
  • This leaves Dependabot owning only pub deps. Consumers drop the whole github-actions ecosystem from dependabot.yml (not just whuppi/ci*), keep sweepActions: true + CI_ACTIONS_TOKEN, and get one PR for all action bumps.
  • The label/branch changed with the rename (upgrade-action-refs / chore/action-refs); a consumer on 2.3.0's short-lived composite-refs shape just re-points its wrapper.

2.3.0

  • Reverted Renovate (added in 2.2.0). Deleted the reusable renovate.yml. The self-hosted Renovate machine — a dashboard issue, a per-consumer renovate.json5, a status-check/token-scope surface — was far more than the one gap that actually bit us: composite action.yml refs Dependabot can't see (dependabot-core#6704).
  • Closed that gap in the existing radar instead. New opt-in composite-refs job in the reusable upgrade-check.yml: sweeps every whuppi/ci ref across .github (workflows AND composites) to the latest release — uniform, so the pin never splits — and pins third-party actions inside composites to the latest SHA via pinact. Dependabot keeps pub deps + third-party actions in workflow files; the two never overlap. A consumer opts in with sweepActions: true + CI_ACTIONS_TOKEN and adds whuppi/ci* to its Dependabot ignore.
  • Added pinact to the pinned tool supply chain (PINACT_VERSION), owned by self-upgrade.yml like actionlint/zizmor.
  • Renamed the org secret RENOVATE_TOKEN → CI_ACTIONS_TOKEN (same Workflows-scope PAT; GITHUB_TOKEN still can't write .github/workflows/). secrets.sh's org scope stays — it's generic.

2.2.0

  • Added a reusable renovate.yml — self-hosted Renovate that each consumer calls from a thin wrapper (same shape as upgrade-check.yml), running against the calling repo. It reads composite action.yml (dependabot-core#6704 blind spot), so it keeps whuppi/ci refs uniform and bumps third-party actions hidden in composites. Needs a RENOVATE_TOKEN org secret (Contents + Workflows + Pull-requests + Issues: write) — Renovate must write .github/workflows/, which GITHUB_TOKEN can't.
  • secrets.sh gained an org scope for org-wide secrets (set org/KEY).
  • Removed the whuppi-ci-refs job from upgrade-check.yml. Renovate replaces it: the sweep needed a Workflows-scope token GITHUB_TOKEN couldn't provide, and Renovate reads composites natively. Consumers migrate to the renovate.yml wrapper and drop their Dependabot github-actions + pub config.

... (truncated)

Commits
  • e8b093a release: v2.4.0
  • c450cfc ci: one owner for every action ref — no workflow/composite split (#39)
  • c86dbd8 ci: revert Renovate — close the composite-refs gap in the existing radar (#38)
  • c832143 ci: restore Renovate configurable log level (revert temp debug) (#37)
  • 72a8a34 ci: temp debug logging (diagnose repository-changed) (#36)
  • 6917770 ci: Renovate — commit via platform API (fix repository-changed abort) (#35)
  • 7679737 ci: release 2.2.0 — Renovate replaces the whuppi-ci-refs sweep (#34)
  • bd10d2e ci: add central Renovate runner + renovate secrets env (#33)
  • a8ce7d6 chore: bump pinned versions (#31)
  • a1254e3 feat: sweep whuppi/ci refs to latest via upgrade-check (#32)
  • Additional commits viewable in compare view

Updates whuppi/ci/.github/workflows/pr-checks.yml from 2.0.5 to 2.4.0

Release notes

Sourced from whuppi/ci/.github/workflows/pr-checks.yml's releases.

whuppi/ci 2.4.0

  • The opt-in composite sweep now owns every action uses: ref, not just the composite blind spot — renamed composite-refs → action-refs. It sweeps every whuppi/ci ref (workflows + composites, uniform) to the latest release AND pins every third-party action (workflows AND composites) to the latest SHA via pinact. No more split between Dependabot and a sweep across workflow-vs-composite.
  • This leaves Dependabot owning only pub deps. Consumers drop the whole github-actions ecosystem from dependabot.yml (not just whuppi/ci*), keep sweepActions: true + CI_ACTIONS_TOKEN, and get one PR for all action bumps.
  • The label/branch changed with the rename (upgrade-action-refs / chore/action-refs); a consumer on 2.3.0's short-lived composite-refs shape just re-points its wrapper.
  • e8b093a release: v2.4.0
  • c450cfc ci: one owner for every action ref — no workflow/composite split (#39)

whuppi/ci 2.3.0

  • Reverted Renovate (added in 2.2.0). Deleted the reusable renovate.yml. The self-hosted Renovate machine — a dashboard issue, a per-consumer renovate.json5, a status-check/token-scope surface — was far more than the one gap that actually bit us: composite action.yml refs Dependabot can't see (dependabot-core#6704).
  • Closed that gap in the existing radar instead. New opt-in composite-refs job in the reusable upgrade-check.yml: sweeps every whuppi/ci ref across .github (workflows AND composites) to the latest release — uniform, so the pin never splits — and pins third-party actions inside composites to the latest SHA via pinact. Dependabot keeps pub deps + third-party actions in workflow files; the two never overlap. A consumer opts in with sweepActions: true + CI_ACTIONS_TOKEN and adds whuppi/ci* to its Dependabot ignore.
  • Added pinact to the pinned tool supply chain (PINACT_VERSION), owned by self-upgrade.yml like actionlint/zizmor.
  • Renamed the org secret RENOVATE_TOKEN → CI_ACTIONS_TOKEN (same Workflows-scope PAT; GITHUB_TOKEN still can't write .github/workflows/). secrets.sh's org scope stays — it's generic.
  • cce8645 release: v2.3.0
  • c86dbd8 ci: revert Renovate — close the composite-refs gap in the existing radar (#38)
  • c832143 ci: restore Renovate configurable log level (revert temp debug) (#37)
  • 72a8a34 ci: temp debug logging (diagnose repository-changed) (#36)
  • 6917770 ci: Renovate — commit via platform API (fix repository-changed abort) (#35)

... (truncated)

Changelog

Sourced from whuppi/ci/.github/workflows/pr-checks.yml's changelog.

2.4.0

  • The opt-in composite sweep now owns every action uses: ref, not just the composite blind spot — renamed composite-refs → action-refs. It sweeps every whuppi/ci ref (workflows + composites, uniform) to the latest release AND pins every third-party action (workflows AND composites) to the latest SHA via pinact. No more split between Dependabot and a sweep across workflow-vs-composite.
  • This leaves Dependabot owning only pub deps. Consumers drop the whole github-actions ecosystem from dependabot.yml (not just whuppi/ci*), keep sweepActions: true + CI_ACTIONS_TOKEN, and get one PR for all action bumps.
  • The label/branch changed with the rename (upgrade-action-refs / chore/action-refs); a consumer on 2.3.0's short-lived composite-refs shape just re-points its wrapper.

2.3.0

  • Reverted Renovate (added in 2.2.0). Deleted the reusable renovate.yml. The self-hosted Renovate machine — a dashboard issue, a per-consumer renovate.json5, a status-check/token-scope surface — was far more than the one gap that actually bit us: composite action.yml refs Dependabot can't see (dependabot-core#6704).
  • Closed that gap in the existing radar instead. New opt-in composite-refs job in the reusable upgrade-check.yml: sweeps every whuppi/ci ref across .github (workflows AND composites) to the latest release — uniform, so the pin never splits — and pins third-party actions inside composites to the latest SHA via pinact. Dependabot keeps pub deps + third-party actions in workflow files; the two never overlap. A consumer opts in with sweepActions: true + CI_ACTIONS_TOKEN and adds whuppi/ci* to its Dependabot ignore.
  • Added pinact to the pinned tool supply chain (PINACT_VERSION), owned by self-upgrade.yml like actionlint/zizmor.
  • Renamed the org secret RENOVATE_TOKEN → CI_ACTIONS_TOKEN (same Workflows-scope PAT; GITHUB_TOKEN still can't write .github/workflows/). secrets.sh's org scope stays — it's generic.

2.2.0

  • Added a reusable renovate.yml — self-hosted Renovate that each consumer calls from a thin wrapper (same shape as upgrade-check.yml), running against the calling repo. It reads composite action.yml (dependabot-core#6704 blind spot), so it keeps whuppi/ci refs uniform and bumps third-party actions hidden in composites. Needs a RENOVATE_TOKEN org secret (Contents + Workflows + Pull-requests + Issues: write) — Renovate must write .github/workflows/, which GITHUB_TOKEN can't.
  • secrets.sh gained an org scope for org-wide secrets (set org/KEY).
  • Removed the whuppi-ci-refs job from upgrade-check.yml. Renovate replaces it: the sweep needed a Workflows-scope token GITHUB_TOKEN couldn't provide, and Renovate reads composites natively. Consumers migrate to the renovate.yml wrapper and drop their Dependabot github-actions + pub config.

... (truncated)

Commits
  • e8b093a release: v2.4.0
  • c450cfc ci: one owner for every action ref — no workflow/composite split (#39)
  • c86dbd8 ci: revert Renovate — close the composite-refs gap in the existing radar (#38)
  • c832143 ci: restore Renovate configurable log level (revert temp debug) (#37)
  • 72a8a34 ci: temp debug logging (diagnose repository-changed) (#36)
  • 6917770 ci: Renovate — commit via platform API (fix repository-changed abort) (#35)
  • 7679737 ci: release 2.2.0 — Renovate replaces the whuppi-ci-refs sweep (#34)
  • bd10d2e ci: add central Renovate runner + renovate secrets env (#33)
  • a8ce7d6 chore: bump pinned versions (#31)
  • a1254e3 feat: sweep whuppi/ci refs to latest via upgrade-check (#32)
  • Additional commits viewable in compare view

Updates whuppi/ci/.github/workflows/release.yml from 2.0.5 to 2.4.0

Release notes

Sourced from whuppi/ci/.github/workflows/release.yml's releases.

whuppi/ci 2.4.0

  • The opt-in composite sweep now owns every action uses: ref, not just the composite blind spot — renamed composite-refs → action-refs. It sweeps every whuppi/ci ref (workflows + composites, uniform) to the latest release AND pins every third-party action (workflows AND composites) to the latest SHA via pinact. No more split between Dependabot and a sweep across workflow-vs-composite.
  • This leaves Dependabot owning only pub deps. Consumers drop the whole github-actions ecosystem from dependabot.yml (not just whuppi/ci*), keep sweepActions: true + CI_ACTIONS_TOKEN, and get one PR for all action bumps.
  • The label/branch changed with the rename (upgrade-action-refs / chore/action-refs); a consumer on 2.3.0's short-lived composite-refs shape just re-points its wrapper.
  • e8b093a release: v2.4.0
  • c450cfc ci: one owner for every action ref — no workflow/composite split (#39)

whuppi/ci 2.3.0

  • Reverted Renovate (added in 2.2.0). Deleted the reusable renovate.yml. The self-hosted Renovate machine — a dashboard issue, a per-consumer renovate.json5, a status-check/token-scope surface — was far more than the one gap that actually bit us: composite action.yml refs Dependabot can't see (dependabot-core#6704).
  • Closed that gap in the existing radar instead. New opt-in composite-refs job in the reusable upgrade-check.yml: sweeps every whuppi/ci ref across .github (workflows AND composites) to the latest release — uniform, so the pin never splits — and pins third-party actions inside composites to the latest SHA via pinact. Dependabot keeps pub deps + third-party actions in workflow files; the two never overlap. A consumer opts in with sweepActions: true + CI_ACTIONS_TOKEN and adds whuppi/ci* to its Dependabot ignore.
  • Added pinact to the pinned tool supply chain (PINACT_VERSION), owned by self-upgrade.yml like actionlint/zizmor.
  • Renamed the org secret RENOVATE_TOKEN → CI_ACTIONS_TOKEN (same Workflows-scope PAT; GITHUB_TOKEN still can't write .github/workflows/). secrets.sh's org scope stays — it's generic.
  • cce8645 release: v2.3.0
  • c86dbd8 ci: revert Renovate — close the composite-refs gap in the existing radar (#38)
  • c832143 ci: restore Renovate configurable log level (revert temp debug) (#37)
  • 72a8a34 ci: temp debug logging (diagnose repository-changed) (#36)
  • 6917770 ci: Renovate — commit via platform API (fix repository-changed abort) (#35)

... (truncated)

Changelog

Sourced from whuppi/ci/.github/workflows/release.yml's changelog.

2.4.0

  • The opt-in composite sweep now owns every action uses: ref, not just the composite blind spot — renamed composite-refs → action-refs. It sweeps every whuppi/ci ref (workflows + composites, uniform) to the latest release AND pins every third-party action (workflows AND composites) to the latest SHA via pinact. No more split between Dependabot and a sweep across workflow-vs-composite.
  • This leaves Dependabot owning only pub deps. Consumers drop the whole github-actions ecosystem from dependabot.yml (not just whuppi/ci*), keep sweepActions: true + CI_ACTIONS_TOKEN, and get one PR for all action bumps.
  • The label/branch changed with the rename (upgrade-action-refs / chore/action-refs); a consumer on 2.3.0's short-lived composite-refs shape just re-points its wrapper.

2.3.0

  • Reverted Renovate (added in 2.2.0). Deleted the reusable renovate.yml. The self-hosted Renovate machine — a dashboard issue, a per-consumer renovate.json5, a status-check/token-scope surface — was far more than the one gap that actually bit us: composite action.yml refs Dependabot can't see (dependabot-core#6704).
  • Closed that gap in the existing radar instead. New opt-in composite-refs job in the reusable upgrade-check.yml: sweeps every whuppi/ci ref across .github (workflows AND composites) to the latest release — uniform, so the pin never splits — and pins third-party actions inside composites to the latest SHA via pinact. Dependabot keeps pub deps + third-party actions in workflow files; the two never overlap. A consumer opts in with sweepActions: true + CI_ACTIONS_TOKEN and adds whuppi/ci* to its Dependabot ignore.
  • Added pinact to the pinned tool supply chain (PINACT_VERSION), owned by self-upgrade.yml like actionlint/zizmor.
  • Renamed the org secret RENOVATE_TOKEN → CI_ACTIONS_TOKEN (same Workflows-scope PAT; GITHUB_TOKEN still can't write .github/workflows/). secrets.sh's org scope stays — it's generic.

2.2.0

  • Added a reusable renovate.yml — self-hosted Renovate that each consumer calls from a thin wrapper (same shape as upgrade-check.yml), running against the calling repo. It reads composite action.yml (dependabot-core#6704 blind spot), so it keeps whuppi/ci refs uniform and bumps third-party actions hidden in composites. Needs a RENOVATE_TOKEN org secret (Contents + Workflows + Pull-requests + Issues: write) — Renovate must write .github/workflows/, which GITHUB_TOKEN can't.
  • secrets.sh gained an org scope for org-wide secrets (set org/KEY).
  • Removed the whuppi-ci-refs job from upgrade-check.yml. Renovate replaces it: the sweep needed a Workflows-scope token GITHUB_TOKEN couldn't provide, and Renovate reads composites natively. Consumers migrate to the renovate.yml wrapper and drop their Dependabot github-actions + pub config.

... (truncated)

Commits
  • e8b093a release: v2.4.0
  • c450cfc ci: one owner for every action ref — no workflow/composite split (#39)
  • c86dbd8 ci: revert Renovate — close the composite-refs gap in the existing radar (#38)
  • c832143 ci: restore Renovate configurable log level (revert temp debug) (#37)
  • 72a8a34 ci: temp debug logging (diagnose repository-changed) (#36)
  • 6917770 ci: Renovate — commit via platform API (fix repository-changed abort) (#35)
  • 7679737 ci: release 2.2.0 — Renovate replaces the whuppi-ci-refs sweep (#34)
  • bd10d2e ci: add central Renovate runner + renovate secrets env (#33)
  • a8ce7d6 chore: bump pinned versions (#31)
  • a1254e3 feat: sweep whuppi/ci refs to latest via upgrade-check (#32)
  • Additional commits viewable in compare view

Updates whuppi/ci/.github/workflows/retry.yml from 2.0.5 to 2.4.0

Release notes

Sourced from whuppi/ci/.github/workflows/retry.yml's releases.

whuppi/ci 2.4.0

  • The opt-in composite sweep now owns every action uses: ref, not just the composite blind spot — renamed composite-refs → action-refs. It sweeps every whuppi/ci ref (workflows + composites, uniform) to the latest release AND pins every third-party action (workflows AND composites) to the latest SHA via pinact. No more split between Dependabot and a sweep across workflow-vs-composite.
  • This leaves Dependabot owning only pub deps. Consumers drop the whole github-actions ecosystem from dependabot.yml (not just whuppi/ci*), keep sweepActions: true + CI_ACTIONS_TOKEN, and get one PR for all action bumps.
  • The label/branch changed with the rename (upgrade-action-refs / chore/action-refs); a consumer on 2.3.0's short-lived composite-refs shape just re-points its wrapper.
  • e8b093a release: v2.4.0
  • c450cfc ci: one owner for every action ref — no workflow/composite split (#39)

whuppi/ci 2.3.0

  • Reverted Renovate (added in 2.2.0). Deleted the reusable renovate.yml. The self-hosted Renovate machine — a dashboard issue, a per-consumer renovate.json5, a status-check/token-scope surface — was far more than the one gap that actually bit us: composite action.yml refs Dependabot can't see (dependabot-core#6704).
  • Closed that gap in the existing radar instead. New opt-in composite-refs job in the reusable upgrade-check.yml: sweeps every whuppi/ci ref across .github (workflows AND composites) to the latest release — uniform, so the pin never splits — and pins third-party actions inside composites to the latest SHA via pinact. Dependabot keeps pub deps + third-party actions in workflow files; the two never overlap. A consumer opts in with sweepActions: true + CI_ACTIONS_TOKEN and adds whuppi/ci* to its Dependabot ignore.
  • Added pinact to the pinned tool supply chain (PINACT_VERSION), owned by self-upgrade.yml like actionlint/zizmor.
  • Renamed the org secret RENOVATE_TOKEN → CI_ACTIONS_TOKEN (same Workflows-scope PAT; GITHUB_TOKEN still can't write .github/workflows/). secrets.sh's org scope stays — it's generic.
  • cce8645 release: v2.3.0
  • c86dbd8 ci: revert Renovate — close the composite-refs gap in the existing radar (#38)
  • c832143 ci: restore Renovate configurable log level (revert temp debug) (#37)
  • 72a8a34 ci: temp debug logging (diagnose repository-changed) (#36)
  • 6917770 ci: Renovate — commit via platform API (fix repository-changed abort) (#35)

... (truncated)

Changelog

Sourced from whuppi/ci/.github/workflows/retry.yml's changelog.

2.4.0

  • The opt-in composite sweep now owns every action uses: ref, not just the composite blind spot — renamed composite-refs → action-refs. It sweeps every whuppi/ci ref (workflows + composites, uniform) to the latest release AND pins every third-party action (workflows AND composites) to the latest SHA via pinact. No more split between Dependabot and a sweep across workflow-vs-composite.
  • This leaves Dependabot owning only pub deps. Consumers drop the whole github-actions ecosystem from dependabot.yml (not just whuppi/ci*), keep sweepActions: true + CI_ACTIONS_TOKEN, and get one PR for all action bumps.
  • The label/branch changed with the rename (upgrade-action-refs / chore/action-refs); a consumer on 2.3.0's short-lived composite-refs shape just re-points its wrapper.

2.3.0

  • Reverted Renovate (added in 2.2.0). Deleted the reusable renovate.yml. The self-hosted Renovate machine — a dashboard issue, a per-consumer renovate.json5, a status-check/token-scope surface — was far more than the one gap that actually bit us: composite action.yml refs Dependabot can't see (dependabot-core#6704).
  • Closed that gap in the existing radar instead. New opt-in composite-refs job in the reusable upgrade-check.yml: sweeps every whuppi/ci ref across .github (workflows AND composites) to the latest release — uniform, so the pin never splits — and pins third-party actions inside composites to the latest SHA via pinact. Dependabot keeps pub deps + third-party actions in workflow files; the two never overlap. A consumer opts in with sweepActions: true + CI_ACTIONS_TOKEN and adds whuppi/ci* to its Dependabot ignore.
  • Added pinact to the pinned tool supply chain (PINACT_VERSION), owned by self-upgrade.yml like actionlint/zizmor.
  • Renamed the org secret RENOVATE_TOKEN → CI_ACTIONS_TOKEN (same Workflows-scope PAT; GITHUB_TOKEN still can't write .github/workflows/). secrets.sh's org scope stays — it's generic.

2.2.0

  • Added a reusable renovate.yml — self-hosted Renovate that each consumer calls from a thin wrapper (same shape as upgrade-check.yml), running against the calling repo. It reads composite action.yml (dependabot-core#6704 blind spot), so it keeps whuppi/ci refs uniform and bumps third-party actions hidden in composites. Needs a RENOVATE_TOKEN org secret (Contents + Workflows + Pull-requests + Issues: write) — Renovate must write .github/workflows/, which GITHUB_TOKEN can't.
  • secrets.sh gained an org scope for org-wide secrets (set org/KEY).
  • Removed the whuppi-ci-refs job from upgrade-check.yml. Renovate replaces it: the sweep needed a Workflows-scope token GITHUB_TOKEN couldn't provide, and Renovate reads composites natively. Consumers migrate to the renovate.yml wrapper and drop their Dependabot github-actions + pub config.

... (truncated)

Commits
  • e8b093a release: v2.4.0
  • c450cfc ci: one owner for every action ref — no workflow/composite split (#39)
  • c86dbd8 ci: revert Renovate — close the composite-refs gap in the existing radar (#38)
  • c832143 ci: restore Renovate configurable log level (revert temp debug) (#37)
  • 72a8a34 ci: temp debug logging (diagnose repository-changed) (#36)
  • 6917770 ci: Renovate — commit via platform API (fix repository-changed abort) (#35)
  • 7679737 ci: release 2.2.0 — Renovate replaces the whuppi-ci-refs sweep (#34)
  • bd10d2e ci: add central Renovate runner + renovate secrets env (#33)
  • a8ce7d6 chore: bump pinned versions (#31)
  • a1254e3 feat: sweep whuppi/ci refs to latest via upgrade-check (#32)
  • Additional commits viewable in compare view

Updates whuppi/ci/.github/workflows/triage.yml from 2.0.5 to 2.4.0

Release notes

Sourced from whuppi/ci/.github/workflows/triage.yml's releases.

whuppi/ci 2.4.0

  • The opt-in composite sweep now owns every action uses: ref, not just the composite blind spot — renamed composite-refs → action-refs. It sweeps every whuppi/ci ref (workflows + composites, uniform) to the latest release AND pins every third-party action (workflows AND composites) to the latest SHA via pinact. No more split between Dependabot and a sweep across workflow-vs-composite.
  • This leaves Dependabot owning only pub deps. Consumers drop the whole github-actions ecosystem from dependabot.yml (not just whuppi/ci*), keep sweepActions: true + CI_ACTIONS_TOKEN, and get one PR for all action bumps.
  • The label/branch changed with the rename (upgrade-action-refs / chore/action-refs); a consumer on 2.3.0's short-lived composite-refs shape just re-points its wrapper.
  • e8b093a release: v2.4.0
  • c450cfc ci: one owner for every action ref — no workflow/composite split (#39)

whuppi/ci 2.3.0

  • Reverted Renovate (added in 2.2.0). Deleted the reusable renovate.yml. The self-hosted Renovate machine — a dashboard issue, a per-consumer renovate.json5, a status-check/token-scope surface — was far more than the one gap that actually bit us: composite action.yml refs Dependabot can't see (dependabot-core#6704).
  • Closed that gap in the existing radar instead. New opt-in composite-refs job in the reusable upgrade-check.yml: sweeps every whuppi/ci ref across .github (workflows AND composites) to the latest release — uniform, so the pin never splits — and pins third-party actions inside composites to the latest SHA via pinact. Dependabot keeps pub deps + third-party actions in workflow files; the two never overlap. A consumer opts in with sweepActions: true + CI_ACTIONS_TOKEN and adds whuppi/ci* to its Dependabot ignore.
  • Added pinact to the pinned tool supply chain (Description has been truncated

@dependabot
ci: bump the whuppi-ci group with 8 updates
62503e4 
Bumps the whuppi-ci group with 8 updates:

| Package | From | To |
| --- | --- | --- |
| [whuppi/ci/.github/workflows/auto-close.yml](https://github.com/whuppi/ci) | `2.0.5` | `2.4.0` |
| [whuppi/ci](https://github.com/whuppi/ci) | `2.0.5` | `2.4.0` |
| [whuppi/ci/.github/workflows/labels.yml](https://github.com/whuppi/ci) | `2.0.5` | `2.4.0` |
| [whuppi/ci/.github/workflows/pr-checks.yml](https://github.com/whuppi/ci) | `2.0.5` | `2.4.0` |
| [whuppi/ci/.github/workflows/release.yml](https://github.com/whuppi/ci) | `2.0.5` | `2.4.0` |
| [whuppi/ci/.github/workflows/retry.yml](https://github.com/whuppi/ci) | `2.0.5` | `2.4.0` |
| [whuppi/ci/.github/workflows/triage.yml](https://github.com/whuppi/ci) | `2.0.5` | `2.4.0` |
| [whuppi/ci/.github/workflows/upgrade-check.yml](https://github.com/whuppi/ci) | `2.0.5` | `2.4.0` |


Updates `whuppi/ci/.github/workflows/auto-close.yml` from 2.0.5 to 2.4.0
- [Release notes](https://github.com/whuppi/ci/releases)
- [Changelog](https://github.com/whuppi/ci/blob/main/CHANGELOG.md)
- [Commits](whuppi/ci@v2.0.5...v2.4.0)

Updates `whuppi/ci` from 2.0.5 to 2.4.0
- [Release notes](https://github.com/whuppi/ci/releases)
- [Changelog](https://github.com/whuppi/ci/blob/main/CHANGELOG.md)
- [Commits](whuppi/ci@v2.0.5...v2.4.0)

Updates `whuppi/ci/.github/workflows/labels.yml` from 2.0.5 to 2.4.0
- [Release notes](https://github.com/whuppi/ci/releases)
- [Changelog](https://github.com/whuppi/ci/blob/main/CHANGELOG.md)
- [Commits](whuppi/ci@v2.0.5...v2.4.0)

Updates `whuppi/ci/.github/workflows/pr-checks.yml` from 2.0.5 to 2.4.0
- [Release notes](https://github.com/whuppi/ci/releases)
- [Changelog](https://github.com/whuppi/ci/blob/main/CHANGELOG.md)
- [Commits](whuppi/ci@v2.0.5...v2.4.0)

Updates `whuppi/ci/.github/workflows/release.yml` from 2.0.5 to 2.4.0
- [Release notes](https://github.com/whuppi/ci/releases)
- [Changelog](https://github.com/whuppi/ci/blob/main/CHANGELOG.md)
- [Commits](whuppi/ci@v2.0.5...v2.4.0)

Updates `whuppi/ci/.github/workflows/retry.yml` from 2.0.5 to 2.4.0
- [Release notes](https://github.com/whuppi/ci/releases)
- [Changelog](https://github.com/whuppi/ci/blob/main/CHANGELOG.md)
- [Commits](whuppi/ci@v2.0.5...v2.4.0)

Updates `whuppi/ci/.github/workflows/triage.yml` from 2.0.5 to 2.4.0
- [Release notes](https://github.com/whuppi/ci/releases)
- [Changelog](https://github.com/whuppi/ci/blob/main/CHANGELOG.md)
- [Commits](whuppi/ci@v2.0.5...v2.4.0)

Updates `whuppi/ci/.github/workflows/upgrade-check.yml` from 2.0.5 to 2.4.0
- [Release notes](https://github.com/whuppi/ci/releases)
- [Changelog](https://github.com/whuppi/ci/blob/main/CHANGELOG.md)
- [Commits](whuppi/ci@v2.0.5...v2.4.0)

---
updated-dependencies:
- dependency-name: whuppi/ci/.github/workflows/auto-close.yml
  dependency-version: 2.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: whuppi-ci
- dependency-name: whuppi/ci
  dependency-version: 2.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: whuppi-ci
- dependency-name: whuppi/ci/.github/workflows/labels.yml
  dependency-version: 2.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: whuppi-ci
- dependency-name: whuppi/ci/.github/workflows/pr-checks.yml
  dependency-version: 2.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: whuppi-ci
- dependency-name: whuppi/ci/.github/workflows/release.yml
  dependency-version: 2.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: whuppi-ci
- dependency-name: whuppi/ci/.github/workflows/retry.yml
  dependency-version: 2.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: whuppi-ci
- dependency-name: whuppi/ci/.github/workflows/triage.yml
  dependency-version: 2.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: whuppi-ci
- dependency-name: whuppi/ci/.github/workflows/upgrade-check.yml
  dependency-version: 2.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: whuppi-ci
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the ci Build, CI, or workflow change (auto) label Aug 3, 2026
@dependabot dependabot Bot added the ci Build, CI, or workflow change (auto) label Aug 3, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@chaudharydeepanshu chaudharydeepanshu Awaiting requested review from chaudharydeepanshu chaudharydeepanshu is a code owner

At least 2 approving reviews are required to merge this pull request.

Assignees

@chaudharydeepanshu chaudharydeepanshu

Labels

ci Build, CI, or workflow change (auto)

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@chaudharydeepanshu