From 3f091dd12889d531c18952fdaff590232e7a4244 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 29 Oct 2026 14:54:13 +0000 Subject: [PATCH] build(deps): bump the github-actions group across 1 directory with 2 updates Bumps the github-actions group with 2 updates in the / directory: [actions/setup-node](https://github.com/actions/setup-node) and [actions/create-github-app-token](https://github.com/actions/create-github-app-token). Updates `actions/setup-node` from 7.0.0 to 7.1.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/820762786026740c76f36085b0efc47a31fe5020...949feb2413d6458794dcd2491c4babbbce0c15c1) Updates `actions/create-github-app-token` from 3.2.0 to 3.3.0 - [Release notes](https://github.com/actions/create-github-app-token/releases) - [Changelog](https://github.com/actions/create-github-app-token/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/create-github-app-token/compare/bcd2ba49218906704ab6c1aa796996da409d3eb1...64ab729a6294000f5aa4a4bc0b73d1f32bc45510) --- updated-dependencies: - dependency-name: actions/create-github-app-token dependency-version: 3.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: actions/setup-node dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions ... Signed-off-by: dependabot[bot] --- .github/workflows/ci.yml | 12 ++++++------ .github/workflows/dependabot.yml | 4 ++-- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 2734a9b..51280e5 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -25,7 +25,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: "22" cache: npm @@ -60,7 +60,7 @@ jobs: contents: read steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: "22" cache: npm @@ -75,7 +75,7 @@ jobs: contents: read steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: "22" cache: npm @@ -90,7 +90,7 @@ jobs: contents: read steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: "22" cache: npm @@ -141,7 +141,7 @@ jobs: # The default job token's github-actions[bot] identity can never bypass branch protection, by GitHub's own design (a deliberate anti-privilege-escalation restriction, not something any permissions: grant can lift) -- so wherever branch protection exists on main, its push of the CHANGELOG.md/tag commit needs a bypass identity. This repository's own sync App (vars.EXADEV_APP_ID/secrets.EXADEV_SYNC_PRIVATE_KEY) has already pushed directly to this repo's own main before, via the bidirectional-sync workflow this repository used to run before its consolidation pass -- confirming that App already has contents: write here -- so it's reused rather than provisioning a second App for the same purpose. As of this repository going through the pre-public consolidation pass, it has no branch protection at all (a GitHub Free private-repo plan limitation -- the rulesets/branch-protection APIs both 403 with "Upgrade to GitHub Pro or make this repository public"), so this bypass identity is not load-bearing yet; it is wired up now so nothing needs to change the day branch protection is actually configured, matching the App-bypass pattern a protected main branch needs regardless of which repository runs it. - name: Mint ExaDev sync App installation token id: app-token - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 with: app-id: ${{ vars.EXADEV_APP_ID }} private-key: ${{ secrets.EXADEV_SYNC_PRIVATE_KEY }} @@ -151,7 +151,7 @@ jobs: fetch-depth: 0 # actions/checkout wires this into git's own credential config, so every subsequent plain `git push` in this job (the version tag, the CHANGELOG.md commit, and move-major-tag.mts's tag move) authenticates as the App, not just this one checkout. token: ${{ steps.app-token.outputs.token }} - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: "22" cache: npm diff --git a/.github/workflows/dependabot.yml b/.github/workflows/dependabot.yml index 61d48e5..bf2092e 100644 --- a/.github/workflows/dependabot.yml +++ b/.github/workflows/dependabot.yml @@ -111,7 +111,7 @@ jobs: ref: ${{ github.event.pull_request.head.ref }} fetch-depth: 0 - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: "22" cache: npm @@ -181,7 +181,7 @@ jobs: - name: Mint this repository's own sync App installation token id: app-token - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 with: # Hardcoded app-id, not vars.EXADEV_APP_ID: this job can run under Dependabot's restricted permissions, and GitHub has no Dependabot-scoped variables store at all -- repos/{owner}/{repo}/dependabot/variables 404s, confirmed directly, not assumed -- so a vars.* read would always resolve empty here regardless of anything set in the Actions store. The App ID isn't sensitive (it's a public identifier for the App's installation, the same kind of value GitHub shows in its own UI), so hardcoding it removes the dependency on a store that doesn't exist for this context, rather than working around it. Value confirmed live: `gh api repos/ExaDev/claude-code-action/actions/variables/EXADEV_APP_ID`. app-id: "2852966"