chore(deps): bump the github-actions group across 1 directory with 2 updates by dependabot[bot] · Pull Request #49 · hongkongkiwi/rusty-commit

dependabot · 2026-03-30T01:10:06Z

Bumps the github-actions group with 2 updates in the / directory: rhysd/actionlint and lewagon/wait-on-check-action.

Updates rhysd/actionlint from 1.7.10 to 1.7.11

Release notes

Sourced from rhysd/actionlint's releases.

v1.7.11
Support the case() function in ${{ }} expressions which was recently added to GitHub Actions. (#612, #614, thanks @heppu)
env:
  # ERROR: case() requires an odd number of arguments
  ENVIRONMENT: |-
    ${{ case(
      github.ref == 'refs/heads/main', 'production',
      github.ref == 'refs/heads/staging', 'staging'
    ) }}
Support new macos-26-large and windows-2025-vs2026 runner labels. See the GitHub's announce for more details. (#615, thanks @hugovk and @muzimuzhi)
Enable Artifact attestations for the released binaries. From v1.7.11 gh command can verify the integrity of the downloaded binaries as follows. The verification is highly recommended in terms of supply chain security. (#608, thanks @takaram)
$ gh release download --repo rhysd/actionlint --pattern '*_darwin_amd64.tar.gz' v1.7.11
$ gh attestation verify --repo rhysd/actionlint actionlint_1.7.11_darwin_amd64.tar.gz
Loaded digest sha256:17ffc17fed8f0258ef6ad4aed932d3272464c7ef7d64e1cb0d65aa97c9752107 for file://actionlint_1.7.11_darwin_amd64.tar.gz
Loaded 1 attestation from GitHub API
The following policy criteria will be enforced:

Predicate type must match:................ https://slsa.dev/provenance/v1
Source Repository Owner URI must match:... https://github.com/rhysd
Source Repository URI must match:......... https://github.com/rhysd/actionlint
Subject Alternative Name must match regex: (?i)^https://github.com/rhysd/actionlint/
OIDC Issuer must match:................... https://token.actions.githubusercontent.com

✓ Verification succeeded!
The following 1 attestation matched the policy criteria

Attestation #1

Build repo:..... rhysd/actionlint
Build workflow:. .github/workflows/release.yaml@refs/tags/v1.7.11
Signer repo:.... rhysd/actionlint
Signer workflow: .github/workflows/release.yaml@refs/tags/v1.7.11
Report path filters with ./ as error because they never match anything. (#521)
on:
  push:
    paths:
      # ERROR: This never matches anything. `foo/bar.txt` is correct.
      - ./foo/bar.txt
Fix comparing matrix items when an item is a super set of another item. (#523, #613, thanks @michaelgruenewald)

Fix stack overflow crash by a recursive anchor in matrix items. (#610)

Fix an unassigned variable false positive from shellcheck by disabling SC2153 rule. (#573)

Reduce the number of memory allocations on resolving anchors.

Update the popular actions data set to the latest.

Update Go dependencies to the latest.

... (truncated)

Changelog

Sourced from rhysd/actionlint's changelog.

v1.7.11 - 2026-02-14
Support the case() function in ${{ }} expressions which was recently added to GitHub Actions. (#612, #614, thanks @heppu)
env:
  # ERROR: case() requires an odd number of arguments
  ENVIRONMENT: |-
    ${{ case(
      github.ref == 'refs/heads/main', 'production',
      github.ref == 'refs/heads/staging', 'staging'
    ) }}
Support new macos-26-large and windows-2025-vs2026 runner labels. See the GitHub's announce for more details. (#615, thanks @hugovk and @muzimuzhi)
Enable Artifact attestations for the released binaries. From v1.7.11 gh command can verify the integrity of the downloaded binaries as follows. The verification is highly recommended in terms of supply chain security. (#608, thanks @takaram)
$ gh release download --repo rhysd/actionlint --pattern '*_darwin_amd64.tar.gz' v1.7.11
$ gh attestation verify --repo rhysd/actionlint actionlint_1.7.11_darwin_amd64.tar.gz
Loaded digest sha256:17ffc17fed8f0258ef6ad4aed932d3272464c7ef7d64e1cb0d65aa97c9752107 for file://actionlint_1.7.11_darwin_amd64.tar.gz
Loaded 1 attestation from GitHub API
The following policy criteria will be enforced:

Predicate type must match:................ https://slsa.dev/provenance/v1
Source Repository Owner URI must match:... https://github.com/rhysd
Source Repository URI must match:......... https://github.com/rhysd/actionlint
Subject Alternative Name must match regex: (?i)^https://github.com/rhysd/actionlint/
OIDC Issuer must match:................... https://token.actions.githubusercontent.com

✓ Verification succeeded!
The following 1 attestation matched the policy criteria

Attestation #1

Build repo:..... rhysd/actionlint
Build workflow:. .github/workflows/release.yaml@refs/tags/v1.7.11
Signer repo:.... rhysd/actionlint
Signer workflow: .github/workflows/release.yaml@refs/tags/v1.7.11
Report path filters with ./ because they never match anything. (#521)
on:
  push:
    paths:
      # ERROR: This never matches anything. `foo/bar.txt` is correct.
      - ./foo/bar.txt
Fix comparing matrix items when an item is a super set of another item. (#523, #613, thanks @michaelgruenewald)

Fix stack overflow crash by a recursive anchor in matrix items. (#610)

Fix a unassigned variable false positive from shellcheck by disabling SC2153 rule. (#573)

Reduce the number of memory allocations on resolving anchors.

Update the popular actions data set to the latest.

... (truncated)

Commits

393031a bump up version to v1.7.11
63589e8 add link to the release note of the version in playground heading
58a2626 remove legacy Homebrew formula
d22c104 fix test script for download script to check error case failures
50d2134 describe how to download and verify artifact using gh (fix #617)
226bb4a update playground npm deps including jsdom v28
1e85edb disable SC2153 shellcheck rule to avoid unassigned variable false positive (f...
8776d64 Merge pull request #619 from takaram/patch-1
e3eb8cb reduce memory allocations on resolving anchors
db08cec Fix variable name in release workflow
Additional commits viewable in compare view

Updates lewagon/wait-on-check-action from 1.5.0 to 1.6.0

Release notes

Sourced from lewagon/wait-on-check-action's releases.

v1.6.0

Added

Add checks-discovery-timeout option (#139)

Changelog

Sourced from lewagon/wait-on-check-action's changelog.

v1.6.0 - 2026-03-29

Added

Add checks-discovery-timeout option

Commits

a08fbe2 Bump version: 1.5.0 → 1.6.0
9499267 Add v1.6.0 changelog notes (#141)
fa9c37b Add checks-discovery-timeout documentation (#140)
e183d72 fix/wait for check discovery (#139)
8ad3eaf Bump faraday from 2.3.0 to 2.14.1 (#136)
93f8133 Set repo-token as required and validate required inputs (#135)
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Summary by cubic

Update CI workflow actions to improve linting and make check waiting more reliable. Bumps rhysd/actionlint to 1.7.11 and lewagon/wait-on-check-action to 1.6.0.

Dependencies
- rhysd/actionlint: 1.7.10 → 1.7.11 — adds case() expression support and fixes false positives.
- lewagon/wait-on-check-action: 1.5.0 → 1.6.0 — improves check discovery and adds a discovery timeout option.

^{Written for commit 843582d. Summary will update on new commits.}

…updates Bumps the github-actions group with 2 updates in the / directory: [rhysd/actionlint](https://github.com/rhysd/actionlint) and [lewagon/wait-on-check-action](https://github.com/lewagon/wait-on-check-action). Updates `rhysd/actionlint` from 1.7.10 to 1.7.11 - [Release notes](https://github.com/rhysd/actionlint/releases) - [Changelog](https://github.com/rhysd/actionlint/blob/main/CHANGELOG.md) - [Commits](rhysd/actionlint@v1.7.10...v1.7.11) Updates `lewagon/wait-on-check-action` from 1.5.0 to 1.6.0 - [Release notes](https://github.com/lewagon/wait-on-check-action/releases) - [Changelog](https://github.com/lewagon/wait-on-check-action/blob/master/CHANGELOG.md) - [Commits](lewagon/wait-on-check-action@v1.5.0...v1.6.0) --- updated-dependencies: - dependency-name: rhysd/actionlint dependency-version: 1.7.11 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: lewagon/wait-on-check-action dependency-version: 1.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-03-30T01:10:07Z

Labels

The following labels could not be found: github-actions. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

github-actions · 2026-03-30T01:10:29Z

🤖 Auto-rebase successful