## Summary
Roll up the remaining net changes from the open Dependabot updates:
- release-drafter/release-drafter 7.7.0 (#990)
- github/codeql-action 4.37.4 (#987, #988, #989)
- zizmorcore/zizmor-action 0.6.1 (#986)
- @actions/cache 6.2.0 (#975)
- @biomejs/biome 2.5.4 (#974)
- undici 8.7.0 (#973)
The Jest 30.4.2 (#905) and @renovatebot/pep440 5.0.0 (#907) updates are
already present on main and require no additional changes.
This also updates the Biome schema, applies the formatter changes from
Biome 2.5.4, and regenerates the published bundles.
## Testing
- `npm run all`
- `actionlint`
- `git diff --check`
Refs: pi-session 019ff01b-f917-73c1-950e-2966956f263c
## Summary
- disable `enable-cache: auto` for `pull_request_target`,
`workflow_run`, and `release` events
- disable automatic caching for tag pushes while leaving branch pushes
unchanged
- preserve explicit `enable-cache: true` as an override
- run a `workflow_run` integration fixture with `act` in pull request CI
and verify caching is disabled
- document the behavior and update the published bundles
## Testing
- `npm run all`
- `actionlint .github/workflows/test.yml
__tests__/workflows/workflow-run.yml`
- `uvx zizmor __tests__/workflows/workflow-run.yml`
Closes#984
Refs: pi-session 019fec42-9b26-714e-a359-830ac4401ecd
## Summary
Roll up the remaining dependency changes from Dependabot PRs:
- #966: update `actions/setup-node` from 6.4.0 to 7.0.0
- #965: update `js-yaml` from 4.1.1 to 5.2.1
- #964: update `@types/node` from 26.0.1 to 26.1.1
- #963: update `esbuild` from 0.28.0 to 0.28.1
PRs #907 and #905 require no net changes because `@renovatebot/pep440`
5.0.0 and Jest 30.4.2 are already on `main`.
## Validation
- `npm run all`
Refs: pi-session 019f854e-4714-73ad-8de2-e79900f41b4d
## Summary
- update all CodeQL actions from 4.36.2 to 4.37.0
- update `smol-toml` from 1.6.1 to 1.7.0
- update `@types/node` from 25.5.0 to 26.0.1
- update `@vercel/ncc` from 0.44.0 to 0.44.1
- regenerate bundled action artifacts
Supersedes #950, #951, #952, #957, #958, and #959. The updates from #905
and #907 are already present on `main`.
Refs: pi-session 019f796d-a374-7a76-a8e4-1699b89ec8e6
## Summary
- roll up remaining open Dependabot updates for zizmor-action,
@actions/cache, @biomejs/biome, and @vercel/ncc
- update Biome schema and migrate recommended rules to the new preset
field
- regenerate dist bundles
## Validation
- npm run check
- npm run all
Refs: pi-session 019f4055-b39c-778f-9d9f-092115939c33
## Summary
- Roll up open Dependabot npm and GitHub Actions updates
- Update Biome schema to 2.4.16
- Regenerate bundled dist artifacts
## Validation
- npm run all
Refs: pi-session 019f3160-c4af-7606-b4be-648e0abff131
Rolls up the current open Dependabot npm updates:
- #848 esbuild from 0.27.4 to 0.27.5
- #847 undici from 7.24.2 to 8.0.0
- #846 ts-jest from 29.4.6 to 29.4.9
- #841 @biomejs/biome from 2.4.7 to 2.4.10, including the matching
biome.json schema URL update
- #834 smol-toml from 1.6.0 to 1.6.1
Validation:
- npm run all
## Summary
Adds a new `quiet` input (default: `false`) that suppresses `info`-level
log output when set to `true`. Only warnings and errors are shown.
Contributes to: #868
## Summary
Add a new boolean input `download-from-astral-mirror` (default: `true`)
that controls whether uv is downloaded from the Astral mirror or
directly from GitHub Releases.
When set to `false`, the mirror rewrite is skipped entirely and the
download goes straight to GitHub Releases.
Closes: #870
## Summary
- add top-level uncaughtException and unhandledRejection handlers for
the save-cache entrypoint
- report unexpected post-action failures through core.setFailed with
stack/context
- regenerate the committed save-cache bundle
Kevin Stillhammer