Skip to content

ci: bump softprops/action-gh-release from 2.2.2 to 3.0.0 - #59

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/softprops/action-gh-release-3.0.0
Open

ci: bump softprops/action-gh-release from 2.2.2 to 3.0.0#59
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/softprops/action-gh-release-3.0.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Apr 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps softprops/action-gh-release from 2.2.2 to 3.0.0.

Release notes

Sourced from softprops/action-gh-release's releases.

v3.0.0

3.0.0 is a major release that moves the action runtime from Node 20 to Node 24. Use v3 on GitHub-hosted runners and self-hosted fleets that already support the Node 24 Actions runtime. If you still need the last Node 20-compatible line, stay on v2.6.2.

What's Changed

Other Changes 🔄

  • Move the action runtime and bundle target to Node 24
  • Update @types/node to the Node 24 line and allow future Dependabot updates
  • Keep the floating major tag on v3; v2 remains pinned to the latest 2.x release

v2.6.2

What's Changed

Other Changes 🔄

Full Changelog: softprops/action-gh-release@v2...v2.6.2

v2.6.1

2.6.1 is a patch release focused on restoring linked discussion thread creation when discussion_category_name is set. It fixes [#764](https://github.com/softprops/action-gh-release/issues/764), where the draft-first publish flow stopped carrying the discussion category through the final publish step.

If you still hit an issue after upgrading, please open a report with the bug template and include a minimal repro or sanitized workflow snippet where possible.

What's Changed

Bug fixes 🐛

v2.6.0

2.6.0 is a minor release centered on previous_tag support for generate_release_notes, which lets workflows pin GitHub's comparison base explicitly instead of relying on the default range. It also includes the recent concurrent asset upload recovery fix, a working_directory docs sync, a checked-bundle freshness guard for maintainers, and clearer immutable-prerelease guidance where GitHub platform behavior imposes constraints on how prerelease asset uploads can be published.

If you still hit an issue after upgrading, please open a report with the bug template and include a minimal repro or sanitized workflow snippet where possible.

What's Changed

... (truncated)

Changelog

Sourced from softprops/action-gh-release's changelog.

3.0.0

3.0.0 is a major release that moves the action runtime from Node 20 to Node 24. Use v3 on GitHub-hosted runners and self-hosted fleets that already support the Node 24 Actions runtime. If you still need the last Node 20-compatible line, stay on v2.6.2.

What's Changed

Other Changes 🔄

  • Move the action runtime and bundle target to Node 24
  • Update @types/node to the Node 24 line and allow future Dependabot updates
  • Keep the floating major tag on v3; v2 remains pinned to the latest 2.x release

2.6.2

What's Changed

Other Changes 🔄

2.6.1

2.6.1 is a patch release focused on restoring linked discussion thread creation when discussion_category_name is set. It fixes [#764](https://github.com/softprops/action-gh-release/issues/764), where the draft-first publish flow stopped carrying the discussion category through the final publish step.

If you still hit an issue after upgrading, please open a report with the bug template and include a minimal repro or sanitized workflow snippet where possible.

What's Changed

Bug fixes 🐛

2.6.0

2.6.0 is a minor release centered on previous_tag support for generate_release_notes, which lets workflows pin GitHub's comparison base explicitly instead of relying on the default range. It also includes the recent concurrent asset upload recovery fix, a working_directory docs sync, a checked-bundle freshness guard for maintainers, and clearer immutable-prerelease guidance where GitHub platform behavior imposes constraints on how prerelease asset uploads can be published.

If you still hit an issue after upgrading, please open a report with the bug template and include a minimal repro or sanitized workflow snippet where possible.

What's Changed

... (truncated)

Commits
  • b430933 release: cut v3.0.0 for Node 24 upgrade (#670)
  • c2e35e0 chore(deps): bump the npm group across 1 directory with 7 updates (#783)
  • 3bb1273 release 2.6.2
  • c34030f chore: bump node to 24.14.1
  • 8975bd0 chore(deps): bump vite from 8.0.0 to 8.0.5 (#781)
  • f71937f chore(deps): bump brace-expansion from 5.0.4 to 5.0.5 (#777)
  • 3f0d239 chore(deps): bump picomatch from 4.0.3 to 4.0.4 (#775)
  • 153bb8e release 2.6.1
  • 569deb8 fix: preserve discussion category when publishing releases (#765)
  • 26e8ad2 release 2.6.0
  • Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot @github

dependabot Bot commented on behalf of github Apr 18, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: ci, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot Bot mentioned this pull request Apr 18, 2026
Closed
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Apr 18, 2026

Copy link
Copy Markdown

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.

@dependabot
ci: bump softprops/action-gh-release from 2.2.2 to 3.0.0
80ac7a6 
Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 2.2.2 to 3.0.0.
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](softprops/action-gh-release@da05d55...b430933)

---
updated-dependencies:
- dependency-name: softprops/action-gh-release
  dependency-version: 3.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/softprops/action-gh-release-3.0.0 branch from 0e04eb0 to 80ac7a6 Compare April 18, 2026 22:11
nsportsman added a commit that referenced this pull request Apr 19, 2026
@nsportsman @claude
ci: add explicit permissions to external-contribution.yml caller
0bdbce6 
Reusable workflows cannot elevate GITHUB_TOKEN beyond what the caller
grants. Without an explicit permissions block at the caller, the notify
job falls back to org/repo default token permissions — which may be
read-only, causing issue/PR comment writes to fail with 'Resource not
accessible by integration'.

Declaring permissions at both workflow and job level mirrors the pattern
used in security.yml (contents: read, security-events: write) and
aligns the caller's granted permissions with what the reusable workflow
internally declares it needs.

Raised by chatgpt-codex-connector P1 review on augustus #68, julius #63,
titus #174, and P2 reviews on brutus #59, nerva #206.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
nsportsman added a commit that referenced this pull request Apr 19, 2026
@nsportsman @claude
ci: migrate external-contribution.yml to centralized reusable workflow (
71dc8e4 
#63)

* ci: migrate external-contribution.yml to centralized reusable workflow

Switch from praetorian-inc/external-contrib-action@v2 (which requires
a repo-level ORG_MEMBER_CHECK_PAT PAT secret) to the centralized
praetorian-inc/public-workflows/external-contrib-notify.yml@v2.0.1
reusable workflow, which uses an org-level GitHub App
(EXTERNAL_CONTRIB_APP_ID / EXTERNAL_CONTRIB_APP_PRIVATE_KEY) for
membership checks.

Fixes the "ORG_MEMBER_CHECK_PAT environment variable is required"
failure that was surfacing on PRs (seen on julius #62, same root
cause across all consumers still on the old workflow).

All per-repo secret plumbing is replaced by 'secrets: inherit', which
forwards the org-level secrets the reusable workflow reads directly.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* ci: add explicit permissions to external-contribution.yml caller

Reusable workflows cannot elevate GITHUB_TOKEN beyond what the caller
grants. Without an explicit permissions block at the caller, the notify
job falls back to org/repo default token permissions — which may be
read-only, causing issue/PR comment writes to fail with 'Resource not
accessible by integration'.

Declaring permissions at both workflow and job level mirrors the pattern
used in security.yml (contents: read, security-events: write) and
aligns the caller's granted permissions with what the reusable workflow
internally declares it needs.

Raised by chatgpt-codex-connector P1 review on augustus #68, julius #63,
titus #174, and P2 reviews on brutus #59, nerva #206.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@nsportsman nsportsman Awaiting requested review from nsportsman nsportsman is a code owner automatically assigned from praetorian-inc/praetorian-guard-core-team
@peter-kwan peter-kwan Awaiting requested review from peter-kwan peter-kwan is a code owner automatically assigned from praetorian-inc/praetorian-guard-core-team
@MarioBartolome MarioBartolome Awaiting requested review from MarioBartolome MarioBartolome is a code owner automatically assigned from praetorian-inc/praetorian-guard-core-team
@jmukund jmukund Awaiting requested review from jmukund jmukund is a code owner automatically assigned from praetorian-inc/praetorian-guard-core-team
@noah-tutt-praetorian noah-tutt-praetorian Awaiting requested review from noah-tutt-praetorian noah-tutt-praetorian is a code owner automatically assigned from praetorian-inc/praetorian-guard-core-team
@jeff-olson jeff-olson Awaiting requested review from jeff-olson jeff-olson is a code owner automatically assigned from praetorian-inc/praetorian-guard-core-team
@josephwhenry josephwhenry Awaiting requested review from josephwhenry josephwhenry is a code owner automatically assigned from praetorian-inc/praetorian-guard-core-team

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants