[dependabot]

Bumps the github-actions group with 29 updates in the / directory:

Package	From	To
actions/checkout	2.8.0	7.0.1
actions/setup-node	2.1.2	7.1.0
actions/setup-dotnet	1.10.1	6.1.0
nick-fields/retry	2.9.0	4.0.0
actions/upload-artifact	4.6.2	7.0.2
azure/login	1.6.1	3.1.0
actions/create-github-app-token	2.2.2	3.3.0
actions/setup-python	3.1.4	7.1.0
pnpm/action-setup	4.3.0	6.1.1
richardsimko/update-tag	1.0.7	3.0.0
ncipollo/release-action	1.10.0	1.21.0
jossef/action-set-json-field	1	2
nick-invision/retry	2.9.0	4.0.0
actions/github-script	6.4.1	9.0.0
github/codeql-action/init	3.38.2	4.39.3
github/codeql-action/autobuild	3.38.2	4.39.3
github/codeql-action/analyze	3.38.2	4.39.3
getsentry/action-github-app-token	2.0.0	4.0.0
renovatebot/github-action	36.0.0	46.3.12
actions/download-artifact	4.3.0	8.0.2
codecov/codecov-action	3.1.6	7.1.1
amannn/action-semantic-pull-request	3.4.0	6.1.1
trufflesecurity/trufflehog	3.99.0	3.99.8
ayachensiyuan/get-action-job-id	1.5	1.7
peter-evans/create-pull-request	7.0.11	8.1.1
docker/login-action	3.7.0	4.7.0
docker/setup-buildx-action	3.12.0	4.4.1
docker/metadata-action	5.10.0	6.2.0
docker/build-push-action	5.4.0	7.4.0

Updates actions/checkout from 2.8.0 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

• skip running unsafe pr check if input is default by @​aiqiaoy in actions/checkout#2518
• trim only ascii whitespace for branch by @​aiqiaoy in actions/checkout#2521
• escape values passed to --unset by @​aiqiaoy in actions/checkout#2530
• Various dependency updates

Full Changelog: actions/checkout@v7...v7.0.1

v7.0.0

What's Changed

• block checking out fork pr for pull_request_target and workflow_run by @​aiqiaoy in actions/checkout#2454
• Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @​dependabot[bot] in actions/checkout#2458
• Bump flatted from 3.3.1 to 3.4.2 by @​dependabot[bot] in actions/checkout#2460
• Bump js-yaml from 4.1.0 to 4.2.0 by @​dependabot[bot] in actions/checkout#2461
• Bump @​actions/core and @​actions/tool-cache and Remove uuid by @​dependabot[bot] in actions/checkout#2459
• upgrade module to esm and update dependencies by @​aiqiaoy in actions/checkout#2463
• Bump the minor-npm-dependencies group across 1 directory with 3 updates by @​dependabot[bot] in actions/checkout#2462
• getting ready for checkout v7 release by @​aiqiaoy in actions/checkout#2464
• update error wording by @​aiqiaoy in actions/checkout#2467

New Contributors

• @​aiqiaoy made their first contribution in actions/checkout#2454

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

• [BREAKING] backport allow-unsafe-pr-checkout to v6 by @​aiqiaoy in actions/checkout#2500
• backport fixes to releases-v6 by @​aiqiaoy in actions/checkout#2527

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

What's Changed

• Update changelog by @​ericsciple in actions/checkout#2357
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in actions/checkout#2414
• Fix checkout init for SHA-256 repositories by @​yaananth in actions/checkout#2439
• Update changelog for v6.0.3 by @​yaananth in actions/checkout#2446

New Contributors

• @​yaananth made their first contribution in actions/checkout#2414

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

• Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by @​TingluoHuang in actions/checkout#2355

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

• Skip running unsafe pr check if input is default by @​aiqiaoy in actions/checkout#2518
• Trim only ascii whitespace for branch by @​aiqiaoy in actions/checkout#2521
• Escape values passed to --unset by @​aiqiaoy in actions/checkout#2530
• Various dependency updates

v7.0.0

• Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in actions/checkout#2454
• Various dependency updates

v6.0.3

• Fix checkout init for SHA-256 repositories by @​yaananth in actions/checkout#2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in actions/checkout#2414

v6.0.2

• Fix tag handling: preserve annotations and explicit fetch-tags by @​ericsciple in actions/checkout#2356

v6.0.1

• Add worktree support for persist-credentials includeIf by @​ericsciple in actions/checkout#2327

v6.0.0

• Persist creds to a separate file by @​ericsciple in actions/checkout#2286
• Update README to include Node.js 24 support details and requirements by @​salmanmkc in actions/checkout#2248

v5.0.1

• Port v6 cleanup to v5 by @​ericsciple in actions/checkout#2301

v5.0.0

• Update actions checkout to use node 24 by @​salmanmkc in actions/checkout#2226

v4.3.1

• Port v6 cleanup to v4 by @​ericsciple in actions/checkout#2305

v4.3.0

• docs: update README.md by @​motss in actions/checkout#1971
• Add internal repos for checking out multiple repositories by @​mouismail in actions/checkout#1977
• Documentation update - add recommended permissions to Readme by @​benwells in actions/checkout#2043
• Adjust positioning of user email note and permissions heading by @​joshmgross in actions/checkout#2044
• Update README.md by @​nebuk89 in actions/checkout#2194
• Update CODEOWNERS for actions by @​TingluoHuang in actions/checkout#2224
• Update package dependencies by @​salmanmkc in actions/checkout#2236

v4.2.2

• url-helper.ts now leverages well-known environment variables by @​jww3 in actions/checkout#1941
• Expand unit test coverage for isGhes by @​jww3 in actions/checkout#1946

v4.2.1

• Check out other refs/* by commit if provided, fall back to ref by @​orhantoy in actions/checkout#1924

... (truncated)

Commits

• 3d3c42e prep v7.0.1 release (#2531)
• 2880268 escape values passed to --unset (#2530)
• 12cd223 trim only ascii whitespace for branch (#2521)
• 62661c4 skip running unsafe pr check if input is default (#2518)
• e8d4307 Bump the minor-actions-dependencies group with 2 updates (#2499)
• 631c942 eslint 9 (#2474)
• 4f1f4ae Bump actions/upload-artifact from 4 to 7 (#2476)
• ba09753 Bump actions/checkout from 6 to 7 (#2488)
• b9e0990 Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)
• e8cb398 Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)
• Additional commits viewable in compare view

Updates actions/setup-node from 2.1.2 to 7.1.0

Release notes

Sourced from actions/setup-node's releases.

v7.1.0

What's Changed

Enhancements:

• Add support for mise.toml file by @​gperdomor in actions/setup-node#1421
• Support absolute paths in node-version-file by @​v-mahabaleshwars in actions/setup-node#1633

Bug fixes:

• Add Node version validation and manifest fetch retry by @​v-jitenderpalsingh in actions/setup-node#1580

Documentation updates:

• README.md: bump actions/checkout to latest version 7 by @​deining in actions/setup-node#1578
• docs: add V7 ESM migration and NODE_AUTH_TOKEN behavior change by @​v-gowridurgad in actions/setup-node#1593
• Fixed cache recommendation syntax by @​SubJunk in actions/setup-node#1603

Dependency updates:

• Update workflow pins and migrate Node matrices to modern versions by @​v-HarithaVattikuti in actions/setup-node#1583
• Upgrade @​actions/cache to 6.2.0 by @​philip-gai in actions/setup-node#1584
• Pin @​types/node to v24 by @​v-priyagupta108 in actions/setup-node#1585
• Override brace-expansion to 5.0.8 by @​v-priyagupta108 with @​Copilot in actions/setup-node#1599
• Upgrade actions/checkout from 7.0.0 to 7.0.1 by @​dependabot in actions/setup-node#1598
• Upgrade prettier from 3.8.4 to 3.9.6 by @​dependabot in actions/setup-node#1590
• Upgrade @​vercel/ncc from 0.44.0 to 0.45.0 by @​dependabot in actions/setup-node#1610
• Upgrade pnpm/action-setup from 6.0.9 to 6.0.10 by @​dependabot in actions/setup-node#1602
• Upgrade baseline-browser-mapping from 2.10.38 to 2.11.22 by @​dependabot in actions/setup-node#1629
• Upgrade @​types/semver from 7.7.1 to 7.8.0 by @​dependabot in actions/setup-node#1616
• Upgrade @​typescript-eslint/parser from 8.62.0 to 8.70.0 by @​dependabot in actions/setup-node#1615
• Upgrade pnpm/action-setup from 6.0.10 to 6.1.0 by @​dependabot in actions/setup-node#1631
• Upgrade jest-each from 30.4.1 to 30.5.2 by @​dependabot in actions/setup-node#1636
• Upgrade eslint-plugin-n from 18.1.0 to 18.3.0 by @​dependabot in actions/setup-node#1638
• Update dependencies and add license files by @​v-HarithaVattikuti in actions/setup-node#1642
• Upgrade eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0 by @​dependabot in actions/setup-node#1635

New Contributors

• @​v-jitenderpalsingh made their first contribution in actions/setup-node#1580
• @​philip-gai made their first contribution in actions/setup-node#1584
• @​gperdomor made their first contribution in actions/setup-node#1421
• @​SubJunk made their first contribution in actions/setup-node#1603

Full Changelog: actions/setup-node@v7.0.0...v7.1.0

v7.0.0

What's Changed

Enhancements:

• Add cache-primary-key and cache-matched-key as outputs by @​gowridurgad in actions/setup-node#1577
• Migrate to ESM and upgrade dependencies by @​gowridurgad in actions/setup-node#1574

... (truncated)

Commits

• 949feb2 Bump eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0 (#1635)
• 7207c4f chore: update dependencies and add license files (#1642)
• 54337e0 Bump eslint-plugin-n from 18.1.0 to 18.3.0 (#1638)
• fb54fa8 Bump jest-each from 30.4.1 to 30.5.2 (#1636)
• 7f84f1d Bump pnpm/action-setup from 6.0.10 to 6.1.0 (#1631)
• 0c54c7b Bump @​typescript-eslint/parser from 8.62.0 to 8.70.0 (#1615)
• a829419 Bump @​types/semver from 7.7.1 to 7.8.0 (#1616)
• 680d1e4 Support absolute paths in node-version-file (#1633)
• db0fb3a Bump baseline-browser-mapping from 2.10.38 to 2.11.22 (#1629)
• 94196ee Bump pnpm/action-setup from 6.0.9 to 6.0.10 (#1602)
• Additional commits viewable in compare view

Updates actions/setup-dotnet from 1.10.1 to 6.1.0

Release notes

Sourced from actions/setup-dotnet's releases.

v6.1.0

What's Changed

Enhancements

• Add check-latest input to reuse a locally installed .NET SDK and skip network calls by @​v-mahabaleshwars in actions/setup-dotnet#774
• Add skip-lts-prepass input to optimize .NET SDK installation process by @​v-chiranjib-swain in actions/setup-dotnet#791
• Add fallback install directory when default is not writable by @​v-priyagupta108 in actions/setup-dotnet#785

Documentation

• Document sdk.version validation for rollForward in global.json by @​v-priyagupta108 in actions/setup-dotnet#763
• Docs: Add Microsoft docs link for dotnet-quality options by @​v-priyagupta108 in actions/setup-dotnet#773
• Docs: Updating Documentation in README by @​v-lmvysakh in actions/setup-dotnet#776
• Clarify dotnet-quality behavior for multiple SDK versions by @​v-mahabaleshwars in actions/setup-dotnet#780

Dependency Updates

• Fix security vulnerabilities by @​v-HarithaVattikuti in actions/setup-dotnet#767
• ci: make validation caches read-only by @​philip-gai in actions/setup-dotnet#777
• Bump actions/checkout from 7.0.0 to 7.0.1 by @​dependabot in actions/setup-dotnet#764
• Bump browserslist from 4.28.2 to 4.28.8 by @​dependabot in actions/setup-dotnet#781
• Bump eslint from 10.5.0 to 10.11.0 by @​dependabot in actions/setup-dotnet#772
• Bump eslint-plugin-jest from 29.15.2 to 29.16.6 by @​dependabot in actions/setup-dotnet#771
• Bump undici from 6.28.0 to 6.29.1 by @​dependabot in actions/setup-dotnet#784
• Bump actions/checkout from 7.0.0 to 7.0.1 by @​dependabot in actions/setup-dotnet#788
• Bump handlebars from 4.7.9 to 4.7.10 by @​dependabot in actions/setup-dotnet#792
• Bump brace-expansion by @​dependabot in actions/setup-dotnet#790
• Prepare v6.1.0 release with updated cache dependency by @​v-HarithaVattikuti in actions/setup-dotnet#798

New Contributors

• @​v-lmvysakh made their first contribution in actions/setup-dotnet#776
• @​v-chiranjib-swain made their first contribution in actions/setup-dotnet#791

Full Changelog: actions/setup-dotnet@v6.0.0...v6.1.0

v6.0.0

What's Changed

• Migrate to ESM and upgrade dependencies by @​priyagupta108 in actions/setup-dotnet#752
• Bump actions/checkout from 6.0.3 to 7.0.0 by @​dependabot[bot] in actions/setup-dotnet#751
• chore(deps): bump @​actions/cache to 6.2.0 by @​philip-gai in actions/setup-dotnet#756

New Contributors

• @​philip-gai made their first contribution in actions/setup-dotnet#756

Full Changelog: actions/setup-dotnet@v5...v6.0.0

v5.4.0

What's Changed

Enhancements

... (truncated)

Commits

• 0f4a354 Prepare v6.1.0 release with updated cache dependency (#798)
• 6ec5c6b Add fallback install directory when default is not writable (#785)
• 62573f4 Bump brace-expansion (#790)
• 67290a9 Bump handlebars from 4.7.9 to 4.7.10 (#792)
• 0072421 Bump actions/checkout from 7.0.0 to 7.0.1 (#788)
• 9ead317 Bump undici from 6.28.0 to 6.29.1 (#784)
• 349aa19 Add skip-lts-prepass input to optimize .NET SDK installation process (#791)
• e2cf7c6 Bump eslint-plugin-jest from 29.15.2 to 29.16.6 (#771)
• 7576362 Bump eslint from 10.5.0 to 10.11.0 (#772)
• 074373f Add check-latest input to reuse a locally installed .NET SDK and skip network...
• Additional commits viewable in compare view

Updates nick-fields/retry from 2.9.0 to 4.0.0

Release notes

Sourced from nick-fields/retry's releases.

v4.0.0

4.0.0 (2026-03-20)

v3.0.2

3.0.2 (2025-02-25)

Fixed an issue with the automated release that prevented #146 from being properly released

What's Changed

• Bump action versions, fix tag step in release, regen js by @​nick-fields in nick-fields/retry#149
• Bump semantic-release packages by @​nick-fields in nick-fields/retry#150

Full Changelog: nick-fields/retry@v...v3.0.2

v3.0.1

What's Changed

• fix: group log lines for each attempt by @​raja-anbazhagan in nick-fields/retry#146

New Contributors

• @​raja-anbazhagan made their first contribution in nick-fields/retry#146

Full Changelog: nick-fields/retry@v...v3.0.1

Upgrade to node 20

Upgrades action to node 20 to fix warnings

Commits

• ad98453 Merge pull request #165 from nick-fields/nrf/node24
• 16b9199 major: upgrade to node24
• 9417ab4 Merge pull request #148 from xavier2k6/nf_retry_p1
• 07cd61d Merge branch 'master' into nf_retry_p1
• ce71cc2 Merge pull request #150 from nick-fields/nrf/bump-sem-rels
• b3eed5a patch: bump semantic-release packages
• d6b241c Merge branch 'master' into nf_retry_p1
• 41b1e1a Bump action versions, fix tag step in release, regen js (#149)
• 8d92921 Bump ci_cd workflow actions
• 3610882 refactor: update actions from nick-invision to nick-fields (#147)
• Additional commits viewable in compare view

Updates actions/upload-artifact from 4.6.2 to 7.0.2

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.2

What's Changed

• Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
• Updates @​actions/artifact to v6.3.1.

New Contributors

• @​tunc-d made their first contribution in actions/upload-artifact#821

Full Changelog: actions/upload-artifact@v7.0.1...v7.0.2

v7.0.1

What's Changed

• Update the readme with direct upload details by @​danwkennedy in actions/upload-artifact#795
• Readme: bump all the example versions to v7 by @​danwkennedy in actions/upload-artifact#796
• Include changes in typespec/ts-http-runtime 0.3.5 by @​yacaovsnc in actions/upload-artifact#797

Full Changelog: actions/upload-artifact@v7...v7.0.1

v7.0.0

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

• Add proxy integration test by @​Link- in actions/upload-artifact#754
• Upgrade the module to ESM and bump dependencies by @​danwkennedy in actions/upload-artifact#762
• Support direct file uploads by @​danwkennedy in actions/upload-artifact#764

New Contributors

• @​Link- made their first contribution in actions/upload-artifact#754

Full Changelog: actions/upload-artifact@v6...v7.0.0

v6.0.0

v6 - What's new

[!IMPORTANT] actions/upload-artifact@v6 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

... (truncated)

Commits

• cf430e0 Merge pull request #822 from actions/tunc-d-prepare-upload-v7-0-2
• c2acded chore: prepare v7.0.2 release
• 4687c1b Merge pull request #821 from actions/tunc-d-upload-artifact-package-bump
• 8cbe1be Bump @​actions/artifact to 6.3.1
• 043fb46 Merge pull request #797 from actions/yacaovsnc/update-dependency
• 634250c Include changes in typespec/ts-http-runtime 0.3.5
• e454baa Readme: bump all the example versions to v7 (#796)
• 74fad66 Update the readme with direct upload details (#795)
• bbbca2d Support direct file uploads (#764)
• 589182c Upgrade the module to ESM and bump dependencies (#762)
• Additional commits viewable in compare view

Updates azure/login from 1.6.1 to 3.1.0

Release notes

Sourced from azure/login's releases.

Azure Login Action v3.1.0

What's Changed

• Pin GitHub Actions to full-length commit SHAs by @​danfiedler-msft in Azure/login#636
• Add the ability to prevent the masking of clientId by @​the-coding-cuzzy in Azure/login#634
• Automate release tagging via deploy key + self-pin bump by @​MaddyMicrosoft in Azure/login#638
• docs: document immutable release model and correct branch reference by @​MaddyMicrosoft in Azure/login#640
• ci: reduce scheduled test frequency and clarify workflow names by @​MaddyMicrosoft in Azure/login#639
• Bump js-yaml from 3.14.2 to 3.15.2 by @​dependabot[bot] in Azure/login#643
• Bump browserslist from 4.21.4 to 4.28.8 by @​dependabot[bot] in Azure/login#637
• Add max-context-population input to override Azure PowerShell MaxCont… by @​MaddyMicrosoft in Azure/login#642

New Contributors

• @​danfiedler-msft made their first contribution in Azure/login#636
• @​the-coding-cuzzy made their first contribution in Azure/login#634

Full Changelog: Azure/login@v3.0.2...v3.1.0

Azure Login Action v3.0.2

What's Changed

Security & hardening

• Refactor PowerShell login to a static param()-bound script — eliminates string-interpolation in the AzPS login path so credential/config values can never be re-parsed as PowerShell (injection-safe by construction) by @​MaddyMicrosoft in Azure/login#607
• Pin third-party GitHub Actions to commit SHAs — supply-chain hardening for the CI/release workflows by @​MaddyMicrosoft in Azure/login#615
• Add admin-gated Release workflow — reproducible, approval-gated release + rollback pipeline by @​MaddyMicrosoft in Azure/login#610

Telemetry

• Emit the real action ref in telemetry via GITHUB_ACTION_REF — corrects the previously stale hard-coded value so usage reports the version consumers actually pin by @​MaddyMicrosoft in Azure/login#614

Dependencies

• Cap @actions/exec and @actions/core below the ESM-only 3.x majors (keeps the CommonJS ncc build working) by @​MaddyMicrosoft in Azure/login#628
• Harden Dependabot config for the CommonJS ncc build by @​MaddyMicrosoft in Azure/login#622
• Bump the github-actions group across 1 directory with 7 updates by @​MaddyMicrosoft in Azure/login#621
• Bump uuid and @actions/core by @​dependabot in Azure/login#589
• Bump brace-expansion from 1.1.12 to 1.1.18 by @​dependabot in Azure/login#616
• Bump picomatch from 2.3.1 to 2.3.2 by @​dependabot in Azure/login#582

Maintenance & docs

• Cleanup package.json and Dependabot config by @​MaddyMicrosoft in Azure/login#608
• Workflows/CI hygiene by @​MaddyMicrosoft in Azure/login#609
• Docs uplift by @​MaddyMicrosoft in Azure/login#620
• Add version support policy and security update guidance by @​Alex-AZPS in Azure/login#604

Full Changelog: Azure/login@v3.0.1...v3.1.0

Azure Login Action v3.0.1

What's Changed

• Escape single quotes in PowerShell login script inputs by @​MaddyMicrosoft in Azure/login#599

Full Changelog: https://github.com/Azure/login/commits/v3.0.1

... (truncated)

Commits

• a641126 prepare release v3.1.0
• 3c5b5ce Add max-context-population input to override Azure PowerShell MaxCont… (#642)
• fcd0340 Bump browserslist from 4.21.4 to 4.28.8 (#637)
• 5a8018f Bump js-yaml from 3.14.2 to 3.15.2 (#643)
• a23dddf ci: reduce scheduled test frequency and clarify workflow names (#639)
• 4c016e0 docs: document immutable release model and correct branch reference (#640)
• 63f3c38 Automate release tagging via deploy key + self-pin bump (#638)
• 92a0b67 Add the ability to prevent the masking of clientId (#634)
• 5cb857d Pin GitHub Actions to full-length commit SHAs (#636)
• d90bae5 Cap @​actions/exec and @​actions/core below the ESM-only 3.x majors (#628)
• Additional commits viewable in compare view

Updates actions/create-github-app-token from 2.2.2 to 3.3.0

Release notes

Sourced from actions/create-github-app-token's releases.

v3.3.0

3.3.0 (2026-10-12)

Features

• update permission inputs (#399) (a47236f)

Bug Fixes

• deps: bump nested undici from 6.24.0 to 6.29.0 (#403) (12461a3)
• deps: bump the production-dependencies group across 1 directory with 3 updates (#395) (a69c19d)

v3.2.0

3.2.0 (2026-05-12)

Features

• add support for enterprise-level GitHub Apps (#263) (952a2a7)
• support full repository names in repositories input (#372) (85eb8dd)

Bug Fixes

• deps: bump @​actions/core from 3.0.0 to 3.0.1 in the production-dependencies group (#364) (43e5c34)
• validate private-key input (#376) (f24bbd8)

v3.1.1

3.1.1 (2026-04-11)

Bug Fixes

• improve error message when app identifier is empty (#362) (07e2b76), closes #249

v3.1.0

3.1.0 (2026-04-11)

Bug Fixes

• deps: bump p-retry from 7.1.1 to 8.0.0 (#357) (3bbe07d)

Features

• add client-id input and deprecate app-id (#353) (e6bd4e6)
• update permission inputs (#358) (076e948)

... (truncated)

Changelog

Sourced from actions/create-github-app-token's changelog.

Changelog

3.3.0 (2026-10-12)

Features

• update permission inputs (#399) (a47236f)

Bug Fixes

• deps: bump nested undici from 6.24.0 to 6.29.0 (#403) (12461a3)
• deps: bump the production-dependencies group across 1 directory with 3 updates (#395) (a69c19d)

3.2.0 (2026-05-12)

Features

• add support for enterprise-level GitHub Apps (#263) (952a2a7)
• support full repository names in repositories input (#372) (85eb8dd)

Bug Fixes

• deps: bump @​actions/core from 3.0.0 to 3.0.1 in the production-dependencies group (#364) (43e5c34)
• validate private-key input (#376) (f24bbd8)

Commits

• 64ab729 chore(main): release 3.3.0 (#402)
• f3a828e ci: create signed dist commits in release workflow (

[github-actions]

⏭️ VscUse Test Plan — Skipped

Branch diff: dependabot/github_actions/github-actions-df8a2f96a7 → dev

All changed files are test / doc / CI only — no product code was modified.
VscUse UI tests are not required for this PR.

[teamstoolkitworkflowapp]

Waza Compare Result

Baseline: evals/results/baseline.json
Latest: evals/results/latest.json

Evaluation Comparison Report

Failed to parse compare JSON output.

[github-actions]

⏭️ VscUse Test Plan — Skipped

Branch diff: dependabot/github_actions/github-actions-df8a2f96a7 → dev

All changed files are test / doc / CI only — no product code was modified.
VscUse UI tests are not required for this PR.

[github-actions]

⏭️ VscUse Test Plan — Skipped

Branch diff: dependabot/github_actions/github-actions-df8a2f96a7 → dev

All changed files are test / doc / CI only — no product code was modified.
VscUse UI tests are not required for this PR.

[github-actions]

⏭️ VscUse Test Plan — Skipped

Branch diff: dependabot/github_actions/github-actions-df8a2f96a7 → dev

All changed files are test / doc / CI only — no product code was modified.
VscUse UI tests are not required for this PR.

[github-actions]

⏭️ VscUse Test Plan — Skipped

Branch diff: dependabot/github_actions/github-actions-df8a2f96a7 → dev

All changed files are test / doc / CI only — no product code was modified.
VscUse UI tests are not required for this PR.

[github-actions]

⏭️ VscUse Test Plan — Skipped

Branch diff: dependabot/github_actions/github-actions-df8a2f96a7 → dev

All changed files are test / doc / CI only — no product code was modified.
VscUse UI tests are not required for this PR.

[github-actions]

⏭️ VscUse Test Plan — Skipped

Branch diff: dependabot/github_actions/github-actions-df8a2f96a7 → dev

All changed files are test / doc / CI only — no product code was modified.
VscUse UI tests are not required for this PR.