[dependabot]

Bumps the github-actions group with 4 updates in the / directory: actions/checkout, actions/create-github-app-token, CCBR/actions and actions/add-to-project.

Updates actions/checkout from 4 to 7

Release notes

Sourced from actions/checkout's releases.

v7.0.0

What's Changed

• block checking out fork pr for pull_request_target and workflow_run by @​aiqiaoy in actions/checkout#2454
• Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @​dependabot[bot] in actions/checkout#2458
• Bump flatted from 3.3.1 to 3.4.2 by @​dependabot[bot] in actions/checkout#2460
• Bump js-yaml from 4.1.0 to 4.2.0 by @​dependabot[bot] in actions/checkout#2461
• Bump @​actions/core and @​actions/tool-cache and Remove uuid by @​dependabot[bot] in actions/checkout#2459
• upgrade module to esm and update dependencies by @​aiqiaoy in actions/checkout#2463
• Bump the minor-npm-dependencies group across 1 directory with 3 updates by @​dependabot[bot] in actions/checkout#2462
• getting ready for checkout v7 release by @​aiqiaoy in actions/checkout#2464
• update error wording by @​aiqiaoy in actions/checkout#2467

New Contributors

• @​aiqiaoy made their first contribution in actions/checkout#2454

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

• [BREAKING] backport allow-unsafe-pr-checkout to v6 by @​aiqiaoy in actions/checkout#2500
• backport fixes to releases-v6 by @​aiqiaoy in actions/checkout#2527

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

What's Changed

• Update changelog by @​ericsciple in actions/checkout#2357
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in actions/checkout#2414
• Fix checkout init for SHA-256 repositories by @​yaananth in actions/checkout#2439
• Update changelog for v6.0.3 by @​yaananth in actions/checkout#2446

New Contributors

• @​yaananth made their first contribution in actions/checkout#2414

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

• Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by @​TingluoHuang in actions/checkout#2355
• Fix tag handling: preserve annotations and explicit fetch-tags by @​ericsciple in actions/checkout#2356

Full Changelog: actions/checkout@v6.0.1...v6.0.2

v6.0.1

What's Changed

• Update all references from v5 and v4 to v6 by @​ericsciple in actions/checkout#2314
• Add worktree support for persist-credentials includeIf by @​ericsciple in actions/checkout#2327
• Clarify v6 README by @​ericsciple in actions/checkout#2328

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

• Skip running unsafe pr check if input is default by @​aiqiaoy in actions/checkout#2518
• Trim only ascii whitespace for branch by @​aiqiaoy in actions/checkout#2521
• Escape values passed to --unset by @​aiqiaoy in actions/checkout#2530
• Various dependency updates

v7.0.0

• Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in actions/checkout#2454
• Various dependency updates

v6.0.3

• Fix checkout init for SHA-256 repositories by @​yaananth in actions/checkout#2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in actions/checkout#2414

v6.0.2

• Fix tag handling: preserve annotations and explicit fetch-tags by @​ericsciple in actions/checkout#2356

v6.0.1

• Add worktree support for persist-credentials includeIf by @​ericsciple in actions/checkout#2327

v6.0.0

• Persist creds to a separate file by @​ericsciple in actions/checkout#2286
• Update README to include Node.js 24 support details and requirements by @​salmanmkc in actions/checkout#2248

v5.0.1

• Port v6 cleanup to v5 by @​ericsciple in actions/checkout#2301

v5.0.0

• Update actions checkout to use node 24 by @​salmanmkc in actions/checkout#2226

v4.3.1

• Port v6 cleanup to v4 by @​ericsciple in actions/checkout#2305

v4.3.0

• docs: update README.md by @​motss in actions/checkout#1971
• Add internal repos for checking out multiple repositories by @​mouismail in actions/checkout#1977
• Documentation update - add recommended permissions to Readme by @​benwells in actions/checkout#2043
• Adjust positioning of user email note and permissions heading by @​joshmgross in actions/checkout#2044
• Update README.md by @​nebuk89 in actions/checkout#2194
• Update CODEOWNERS for actions by @​TingluoHuang in actions/checkout#2224
• Update package dependencies by @​salmanmkc in actions/checkout#2236

v4.2.2

• url-helper.ts now leverages well-known environment variables by @​jww3 in actions/checkout#1941
• Expand unit test coverage for isGhes by @​jww3 in actions/checkout#1946

v4.2.1

• Check out other refs/* by commit if provided, fall back to ref by @​orhantoy in actions/checkout#1924

... (truncated)

Commits

• 3d3c42e prep v7.0.1 release (#2531)
• 2880268 escape values passed to --unset (#2530)
• 12cd223 trim only ascii whitespace for branch (#2521)
• 62661c4 skip running unsafe pr check if input is default (#2518)
• e8d4307 Bump the minor-actions-dependencies group with 2 updates (#2499)
• 631c942 eslint 9 (#2474)
• 4f1f4ae Bump actions/upload-artifact from 4 to 7 (#2476)
• ba09753 Bump actions/checkout from 6 to 7 (#2488)
• b9e0990 Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)
• e8cb398 Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)
• Additional commits viewable in compare view

Updates actions/create-github-app-token from 2 to 3

Release notes

Sourced from actions/create-github-app-token's releases.

v3.0.0

3.0.0 (2026-03-14)

• feat!: node 24 support (#275) (2e564a0)
• fix!: require NODE_USE_ENV_PROXY for proxy support (#342) (4451bcb)

Bug Fixes

• remove custom proxy handling (#143) (dce0ab0)

BREAKING CHANGES

• Custom proxy handling has been removed. If you use HTTP_PROXY or HTTPS_PROXY, you must now also set NODE_USE_ENV_PROXY=1 on the action step.
• Requires Actions Runner v2.327.1 or later if you are using a self-hosted runner.

v3.0.0-beta.6

3.0.0-beta.6 (2026-03-13)

Bug Fixes

• deps: bump @​actions/core from 1.11.1 to 3.0.0 (#337) (b044133)
• deps: bump minimatch from 9.0.5 to 9.0.9 (#335) (5cbc656)
• deps: bump the production-dependencies group with 4 updates (#336) (6bda5bc)
• deps: bump undici from 7.16.0 to 7.18.2 (#323) (b4f638f)

v3.0.0-beta.5

3.0.0-beta.5 (2026-03-13)

• fix!: require NODE_USE_ENV_PROXY for proxy support (#342) (d53a1cd)

BREAKING CHANGES

• Custom proxy handling has been removed. If you use HTTP_PROXY or HTTPS_PROXY, you must now also set NODE_USE_ENV_PROXY=1 on the action step.

v3.0.0-beta.4

3.0.0-beta.4 (2026-03-13)

Bug Fixes

• deps: bump @​octokit/auth-app from 7.2.1 to 8.0.1 (#257) (bef1eaf)
• deps: bump @​octokit/request from 9.2.3 to 10.0.2 (#256) (5d7307b)
• deps: bump glob from 10.4.5 to 10.5.0 (#305) (5480f43)
• deps: bump p-retry from 6.2.1 to 7.1.0 (#294) (dce3be8)

... (truncated)

Changelog

Sourced from actions/create-github-app-token's changelog.

Changelog

Commits

• bcd2ba4 chore(main): release 3.2.0 (#370)
• f24bbd8 fix: validate private-key input (#376)
• 363531b docs: capitalize Git as a proper noun in README (#374)
• fd28011 docs: update procedure to configure Git (#287)
• 85eb8dd feat: support full repository names in repositories input (#372)
• c9aabb8 build(deps-dev): bump yaml from 2.8.3 to 2.8.4 in the development-dependencie...
• e02e816 build(deps-dev): bump undici from 7.24.6 to 8.2.0 (#366)
• 8d835bf build(deps-dev): bump esbuild from 0.27.4 to 0.28.0 in the development-depend...
• 952a2a7 feat: add support for enterprise-level GitHub Apps (#263)
• 43e5c34 fix(deps): bump @​actions/core from 3.0.0 to 3.0.1 in the production-dependenc...
• Additional commits viewable in compare view

Updates CCBR/actions from 0.2 to 0.7

Release notes

Sourced from CCBR/actions's releases.

actions 0.7.0

• Add R package-aware release handling to draft-release and post-release. (#170, @​kelly-sovacool, @​copilot)
• Update example workflows to limit concurrency which saves runtime. (#172, @​kelly-sovacool)
• Bump actions versions.
• Minor documentation improvements.
• Use the CCBR-bot as the committer in auto-format so changes will trigger other workflows. (#171, @​kelly-sovacool)

actions 0.6.2

• Fix changed-files JSON output handling and improve error messages. (#162, #163, @​kelly-sovacool)
• build-docker updates:
  • Fix when run on forks: do not attempt to push to dockerhub if necessary secrets are not set. (#164, @​kelly-sovacool)
  • New output: push_success reports whether the docker image was pushed successfully. (#167, @​kelly-sovacool)
  • Only build if the image on dockerhub does not exist or is older than the dockerfile timestamp. (#166, @​kelly-sovacool)
• Minor documentation improvements. (#165, @​kelly-sovacool)

actions 0.6.1

• Fix changed-files: do not use pip cache with setup-python since the repo is not checked out. (#158, @​kelly-sovacool)
• Fix forgotten actions that were missed when previously bumping to the latest versions in anticipation of the node.js 20 deprecation. (#159, @​kelly-sovacool)

actions 0.6.0

• New action: changed-files to detect files that changed matching a pattern. (#152, @​kelly-sovacool)
  • Can compare the most recent commit only or the entire PR changes by setting the comparison-mode option. (#156, @​kelly-sovacool)
• Bump actions versions to the latest release in anticipation of the node.js 20 deprecation. (#149, @​kelly-sovacool)
• Improve build-docker example workflows to prevent excessive docker updates. (#153, @​kelly-sovacool)

actions 0.5.3

• Improve maintain-milestones:
  • Only close the immediately prior year's milestones after May of the current year for performance reviews. (#145, @​kelly-sovacool)
  • Use a toggle to control dry-run mode. (#146, @​kelly-sovacool)

actions 0.5.2

• New action sync-copilot-instructions synchronizes the copilot instructions file across CCBR repos. (#132, @​kelly-sovacool, @​kopardev)
• New action maintain-milestones manages issue milestones across repositories. (#127, @​kopardev, @​kelly-sovacool)
• Improve documentation for the CLI. (#135, @​kelly-sovacool)
• Improve post-release PR title. (#142, @​kelly-sovacool)

actions 0.5.1

• fix build-docker to properly use the path to the print versions script and support dockerfiles with entrypoints set. (#126, @​kelly-sovacool)

actions 0.5.0

• fix build-docker - refactor the print versions script to use bash so it can run even if python isn't installed. (#111, @​kelly-sovacool)
• post-release - update sliding tags instead of branches. (#119, @​kelly-sovacool)

... (truncated)

Changelog

Sourced from CCBR/actions's changelog.

actions development version

actions 0.8.0

New

• Create ccbr_actions docker image and show how to use it in example workflows. (#190, @​kelly-sovacool, @​copilot)
  • Resolve GITHUB_WORKSPACE at runtime and register it as a safe Git directory in container jobs, working around actions/runner#2058 and actions/checkout#1169. (#214, @​kelly-sovacool, @​copilot)
  • Default composite actions to Python 3.14, matching the ccbr_actions container runtime. (#214, @​kelly-sovacool, @​copilot)
• Allow draft-release to handle first-release repos and fail fast on required files. (#179, @​kelly-sovacool, @​copilot)
• New action: review-pre-commit-pr to automatically review pre-commit.ci autoupdate PRs and approve them when only rev: version bumps are present, or request a human reviewer otherwise. (#189, @​kelly-sovacool, @​copilot)
  • Add a workflow_dispatch trigger to the review-pre-commit-pr example workflow to re-scan and review open pre-commit.ci autoupdate PRs on demand, and skip re-review of already-approved PRs. (#208, @​kelly-sovacool, @​copilot)
  • Handle case where a moving vX.Y tag replaces a more specific vX.Y.Z tag pointing at the same commit. (#219, @​kelly-sovacool, @​copilot)

Fixes

• Clarify ccbr-actions-version behavior for containerized actions and document the CCBR_ACTIONS_VERSION build argument used by build-docker. (#221, @​kelly-sovacool, @​copilot)
• Fixes for the draft-release action:
  • Fix draft-release to accept a manually provided version when conventional commits do not determine a version bump. (#213, @​kelly-sovacool, @​copilot)
  • Fix the draft-release example workflow docs (correct typo, Python 3.14, actions/checkout@v7) and rename examples/R-CMD-check.yaml to .yml so it appears in the published examples docs. (#215, @​kelly-sovacool)
  • Match the dev_header in draft-release changelogs case-insensitively so capitalized headers (e.g. ## Development version) are updated correctly. (#220, @​kelly-sovacool, @​copilot)
• Set up testing infrastructure for github actions and related fixes: (#216, @​kelly-sovacool, @​copilot)
  • Includes host/container integration coverage, dry-run support for release actions, actionlint validation, and contract tests for example workflows.
  • Fix container detection in draft-release, post-release, changed-files, mkdocs-mike, and review-pre-commit-pr: the CCBR_ACTIONS_DOCKER variable baked into the ccbr_actions image is not visible to the env context, so Python/R setup steps (including cache: pip, which fails in container jobs) were still running inside the container. Detection now happens in a shell step whose output gates the setup steps. (#216, @​kelly-sovacool)
  • Fix build-docker: the push_success output now reports false when pushing is disabled. (#216, @​kelly-sovacool, @​copilot)
  • Fix draft-release and post-release: the dry-run input rendered as lowercase true/false in the Python step, raising NameError. (#216, @​kelly-sovacool, @​copilot)
  • New dry-run input for mkdocs-mike to print the mike deploy command instead of deploying the docs website. (#216, @​kelly-sovacool)

actions 0.7.2

• New commands list-rulesets and copy-ruleset, plus a copy-ruleset action, for copying GitHub rulesets between repositories. (#183, @​kelly-sovacool, @​copilot)
• Fix build-docker action: fix bash suffix conditional so an empty suffix (and main) leaves the docker tag unchanged. (#199, @​kelly-sovacool)

actions 0.7.1

• Fix draft-release to preserve custom keys in CITATION.cff in R packages. (#180, @​kelly-sovacool)

actions 0.7.0

• Add R package-aware release handling to draft-release and post-release. (#170, @​kelly-sovacool, @​copilot)
• Update example workflows to limit concurrency which saves runtime. (#172, @​kelly-sovacool)
• Bump actions versions.
• Minor documentation improvements.
• Use the CCBR-bot as the committer in auto-format so changes will trigger other workflows. (#171, @​kelly-sovacool)

actions 0.6.2

• Fix changed-files JSON output handling and improve error messages. (#162, #163, @​kelly-sovacool)
• build-docker updates:

... (truncated)

Commits

• e3fa967 chore: 🤖 prepare release v0.7.2
• b1aeb5b [pre-commit.ci] pre-commit autoupdate (#202)
• 8ab4457 [pre-commit.ci] pre-commit autoupdate (#200)
• d0554f4 chore: 🤖 sync copilot instructions - 2026-08-12 (#201)
• 7a4ba8d chore(deps): bump the github-actions group across 10 directories with 10 upda...
• dc53149 Merge pull request #193 from CCBR/pre-commit-ci-update-config
• c08c012 fix(build-docker): handle empty suffix (#199)
• 2593541 Merge branch 'main' into pre-commit-ci-update-config
• 5ad7d55 chore: setup Pixi for dev deps (#197)
• 3c689b3 chore(dependabot): manage all composite and example github actions workflows ...
• Additional commits viewable in compare view

Updates actions/add-to-project from 1.0.2 to 2.0.0

Release notes

Sourced from actions/add-to-project's releases.

v2

What's Changed

• Update instructions for fine grained PAT by @​talune in actions/add-to-project#596
• build(deps-dev): bump prettier from 3.2.5 to 3.3.2 by @​dependabot[bot] in actions/add-to-project#594
• build(deps-dev): bump eslint-plugin-github from 4.10.2 to 5.0.1 by @​dependabot[bot] in actions/add-to-project#593
• Resolve Regular Expression syntax checking errors by @​talune in actions/add-to-project#598
• build(deps-dev): bump typescript from 5.4.5 to 5.5.2 by @​dependabot[bot] in actions/add-to-project#595
• build(deps-dev): bump ts-jest from 29.1.5 to 29.3.0 by @​dependabot[bot] in actions/add-to-project#675
• Batch updating some dependencies for vulns by @​TylerDixon in actions/add-to-project#679
• build(deps): bump undici from 5.28.4 to 5.28.5 by @​dependabot[bot] in actions/add-to-project#662
• build(deps-dev): bump eslint-plugin-prettier from 5.1.3 to 5.2.5 by @​dependabot[bot] in actions/add-to-project#682
• Have dependabot also run builds as another commit when creating PRs by @​TylerDixon in actions/add-to-project#684
• build(deps): bump @​octokit/request-error from 5.1.1 to 6.1.7 by @​dependabot[bot] in actions/add-to-project#683
• build(deps): bump @​octokit/request from 8.4.1 to 9.2.2 by @​dependabot[bot] in actions/add-to-project#681
• Bump eslint-plugin-jest from 28.6.0 to 28.11.0 by @​dependabot[bot] in actions/add-to-project#685
• Bump @​types/node from 16.18.101 to 22.13.14 by @​dependabot[bot] in actions/add-to-project#686
• Bump @​types/jest from 29.5.12 to 29.5.14 by @​dependabot[bot] in actions/add-to-project#687
• Bump @​vercel/ncc from 0.38.1 to 0.38.3 by @​dependabot[bot] in actions/add-to-project#688
• Bump ts-jest from 29.3.0 to 29.3.2 by @​dependabot[bot] in actions/add-to-project#694
• chore: removes sourcemap-register from build step by @​andrialexandrou in actions/add-to-project#696
• Bump @​octokit/plugin-paginate-rest from 9.2.2 to 13.0.1 by @​dependabot[bot] in actions/add-to-project#699
• Bump ts-jest from 29.3.2 to 29.4.0 by @​dependabot[bot] in actions/add-to-project#703
• Bump @​types/node from 22.13.14 to 24.0.12 by @​dependabot[bot] in actions/add-to-project#709
• Potential fix for code scanning alert no. 6: Workflow does not contain permissions by @​wiinci in actions/add-to-project#715
• Potential fix for code scanning alert no. 5: Workflow does not contain permissions by @​wiinci in actions/add-to-project#716
• Potential fix for code scanning alert no. 7: Workflow does not contain permissions by @​wiinci in actions/add-to-project#717
• Fix code scanning alert:missing regex anchor by @​wiinci in actions/add-to-project#719
• Add Missing Languages to CodeQL Advanced Configuration by @​KyFaSt in actions/add-to-project#710
• Bump @​octokit/request from 9.2.2 to 10.0.3 by @​dependabot[bot] in actions/add-to-project#705
• Bump concurrently from 8.2.2 to 9.2.0 by @​dependabot[bot] in actions/add-to-project#707
• Bump prettier from 3.3.2 to 3.6.2 by @​dependabot[bot] in actions/add-to-project#721
• Bump concurrently from 9.2.0 to 9.2.1 by @​dependabot[bot] in actions/add-to-project#722
• Bump @​types/node from 24.0.12 to 24.5.2 by @​dependabot[bot] in actions/add-to-project#730
• Bump actions/checkout from 4 to 5 by @​dependabot[bot] in actions/add-to-project#714
• Bump actions/setup-node from 4 to 5 by @​dependabot[bot] in actions/add-to-project#726
• build(deps-dev): bump @​typescript-eslint/parser from 7.14.1 to 7.18.0 by @​dependabot[bot] in actions/add-to-project#616
• Bump ts-jest from 29.4.1 to 29.4.5 by @​dependabot[bot] in actions/add-to-project#742
• Bump js-yaml from 3.14.1 to 3.14.2 by @​dependabot[bot] in actions/add-to-project#750
• Bump actions/upload-artifact from 4 to 5 by @​dependabot[bot] in actions/add-to-project#748
• Bump github/codeql-action from 3 to 4 by @​dependabot[bot] in actions/add-to-project#741
• Bump jest and @​types/jest by @​dependabot[bot] in actions/add-to-project#743
• Bump actions/setup-node from 5 to 6 by @​dependabot[bot] in actions/add-to-project#744
• Consolidate ESLint 9 and TypeScript ESLint 8 dependency updates by @​Copilot in actions/add-to-project#751
• Bump @​octokit/request-error from 6.1.8 to 7.1.0 by @​dependabot[bot] in actions/add-to-project#757
• Bump globals from 15.15.0 to 16.5.0 by @​dependabot[bot] in actions/add-to-project#756
• Bump @​octokit/plugin-paginate-rest from 13.1.1 to 14.0.0 by @​dependabot[bot] in actions/add-to-project#754
• Bump @​vercel/ncc from 0.38.3 to 0.38.4 by @​dependabot[bot] in actions/add-to-project#753
• Bump actions/checkout from 5 to 6 by @​dependabot[bot] in actions/add-to-project#752
• Bump eslint from 9.39.1 to 9.39.2 by @​dependabot[bot] in actions/add-to-project#759
• Bump ts-jest from 29.4.5 to 29.4.6 by @​dependabot[bot] in actions/add-to-project#760

... (truncated)

Commits

• 5afcf98 Merge pull request #712 from salmanmkc/node24
• ffed68f Merge main and update action runtime to Node 24
• 27022a1 Merge pull request #777 from actions/dependabot/npm_and_yarn/types/node-25.5.0
• cc89d2e Merge pull request #778 from actions/dependabot/npm_and_yarn/globals-17.4.0
• ef8e6ff Merge pull request #779 from actions/dependabot/npm_and_yarn/eslint-plugin-je...
• eb406b3 Merge pull request #780 from actions/dependabot/npm_and_yarn/handlebars-4.7.9
• bb8d4d7 Bump handlebars from 4.7.8 to 4.7.9
• a6fcf8b Bump eslint-plugin-jest from 29.12.1 to 29.15.1
• b35f5d3 Bump globals from 17.0.0 to 17.4.0
• 036fea0 Bump @​types/node from 25.0.3 to 25.5.0
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions