[renovate]

This PR contains the following updates:

Package	Type	Update	Change
JorisJonkers-dev/github-workflows	workflow	minor	v0.14.1 → v0.34.2
JorisJonkers-dev/github-workflows	workflow	minor	v0.16.1 → v0.34.2
JorisJonkers-dev/github-workflows	workflow	patch	v0.34.0 → v0.34.2
JorisJonkers-dev/github-workflows	workflow	minor	v0.33.0 → v0.34.2

---

Release Notes

JorisJonkers-dev/github-workflows

v0.34.2

Compare Source

Bug Fixes

• image publishes write the Docker cache only on a default-branch push (#​191) (d8a226f)

v0.34.1

Compare Source

Bug Fixes

• only a push to the default branch saves the Gradle, Node, Docker and mise caches (#​189) (6861b39)

v0.34.0

Compare Source

Features

• publish fragments with deploy-kit 0.26.1 (#​187) (8220ea2)

v0.33.0

Compare Source

Features

• images carry their software's version, and one shared step writes the images lock (#​184) (f5cb7d9), closes #​183
• publish fragments with deploy-kit 0.25.0 (#​185) (68082c8)

v0.32.1

Compare Source

Bug Fixes

• the mutation report runs Stryker for real and stays short (#​180) (7fef8b6), closes #​167

v0.32.0

Compare Source

Features

• publish fragments with deploy-kit 0.23.0 (#​178) (e2ce940)

v0.31.0

Compare Source

Features

• publish fragments with deploy-kit 0.21.0 (#​176) (33c6c89)

v0.30.0

Compare Source

Features

• publish fragments with deploy-kit 0.20.0 (#​174) (f855c4b)

v0.29.0

Compare Source

Features

• publish fragments with deploy-kit 0.19.2 (#​172) (8a0fd08)

v0.28.0

Compare Source

Features

• publish fragments with deploy-kit 0.19.0 (#​170) (9211c9b)

v0.27.3

Compare Source

Bug Fixes

• a Stryker run that tested no mutant is not reported as survivors (#​168) (19c3daa)

v0.27.2

Compare Source

Bug Fixes

• mutants in package main are tested, not reported as survived (#​165) (a4ea90b)

v0.27.1

Compare Source

Bug Fixes

• the mutation report runs gremlins and Stryker the way each actually works (#​163) (e47e025)

v0.27.0

Compare Source

Features

• publish fragments with deploy-kit 0.18.0 (#​161) (98cca73)

v0.26.0

Compare Source

Features

• a quarantine check that fails the build once a quarantine runs out (#​159) (429a72d)

v0.25.0

Compare Source

Features

• a mutation report on the lines a pull request changes (#​157) (686eacd)

v0.24.0

Compare Source

Features

• publish fragments with deploy-kit 0.17.0 (#​153) (1c2f2f1)

v0.23.0

Compare Source

⚠ BREAKING CHANGES

• run deploy-kit in Publish Fragment at the version this repository pins (#​150)

Features

• run deploy-kit in Publish Fragment at the version this repository pins (#​150) (12c4b58)

v0.22.0

Compare Source

Features

• decide which path buckets a pull request reaches, as a shared action and workflow (#​147) (e4724be)

v0.21.0

Compare Source

Features

• publish-fragment: title the estate's delivery run with the release that started it (#​144) (65e7556)

v0.20.0

Compare Source

Features

• validate a fragment beside the published fragments it references (#​139) (a131d44)

Bug Fixes

• accept a fragment only when a repository of this owner signed it (#​142) (174a54a)
• publish the Platform document's fragment under its dotted project (#​143) (a819810)
• verify a fragment's signature before validating beside it (#​141) (d303857)

v0.19.0

Compare Source

Features

• pack the project's share of the images lock in publish-fragment (#​138) (a4689fa)
• publish-fragment workflow and the render-diff step for deploy-kit projects (#​136) (0bb656a)

v0.18.0

Compare Source

Features

• budget: price runs from the Actions API when billing is unreachable (#​132) (4d0f476), closes #​126
• budget: warn before the org runs out of Actions minutes (#​128) (3256457), closes #​126

Bug Fixes

• budget: make the billing permission opt-in so it degrades instead of dying (#​131) (12dd0fb), closes #​126
• budget: refuse to report a percentage the watchdog cannot substantiate (#​133) (010c41c), closes #​126
• budget: request the billing permission and say so when it is missing (#​130) (a7f77c0), closes #​126

v0.17.0

Compare Source

Features

• add-to-project: add a manual recovery hatch (#​111) (744261c)
• add-to-project: add an org-wide backfill scope (#​124) (592d6df), closes #​122
• hygiene: add an advisory org-wide repository hygiene sweep (#​125) (345d473), closes #​123

Bug Fixes

• leak-scan: exclude the action's own checkout from the deny-list scan (#​109) (5dfb39d)
• leak-scan: repair four rules that could never fire (#​127) (300e8af)
• renovate: drop the deprecated match keys that break config validation (#​112) (d9027a8)

v0.16.1

Compare Source

Bug Fixes

• deploy-check: write an explicit boolean for provenance in the contract (#​104) (10b9b90)

v0.16.0

Compare Source

Features

• deploy-check: let a workload with no HTTP surface opt out of health (#​100) (2733754)

v0.15.2

Compare Source

Bug Fixes

• reusable: pin the self-checkout to a literal instead of an empty context (#​98) (7d19693)

v0.15.1

Compare Source

Bug Fixes

• deploy-check: resolve the context to a file instead of a package root (#​95) (c15011b)

v0.15.0

Compare Source

Features

• deploy-check: replace the duplicated render script with one tested package (#​94) (7fbbe54)

Bug Fixes

• deploy-artifact: report an unsupported raw-manifests guard honestly (#​92) (e59679c)

v0.14.2

Compare Source

Bug Fixes

• deploy-preview: render each fragment to a file so previews stop failing (#​90) (1a8c957)

---

Configuration

📅 Schedule: (in timezone Etc/UTC)

• Branch creation
  • "after 02:00 and before 06:00 every weekday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Deploy Preview — auth-api

Environments: production
Context ref: ghcr.io/jorisjonkers-dev/cluster-deploy-context-public@sha256:95dc39fc695694c8fb4b0c538d7fe13038d407c7302c3725c98f0496c6a83499
Workloads: 1 | Routes: 1 | Gatus endpoints: 1

Image refs

• auth-api: ghcr.io/jorisjonkers-dev/auth-api/auth-api@sha256:0000000000000000000000000000000000000000000000000000000000000000

SC-11 Readiness Scorecard

	Check	Status	Detail
✅	schema_pinned	pass
✅	context_pinned	pass
✅	no_latest_images	pass
✅	health_declared	pass
✅	route_owner_authmode_declared	pass
✅	rollback_retention_acknowledged	pass
✅	no_raw_secrets	pass
➖	stateful_policy_declared	not_applicable	deployment declares no stateful workloads
➖	raw_manifests_guarded	not_applicable	no workload enables rawManifests
➖	npm_signatures_verified	not_applicable	provenance is only evaluated when publishing an artifact

pass = ready · fail = blocks deployment · not_applicable = check does not apply

➖ 3 check(s) not applicable: stateful_policy_declared, raw_manifests_guarded, npm_signatures_verified

---

Updated by deploy-check on push to this PR.