[lightningspirit]

Summary

Dependabot cannot update SYSBOX_VERSION in test.yml. A new workflow, Sysbox release check, runs every Monday at 06:00 UTC (and on demand):

• It compares SYSBOX_VERSION with the latest nestybox/sysbox release.
• If the release is newer, it opens the issue Update Sysbox to vX.Y.Z with the new version and the SHA-256 of the amd64 package, ready to paste into test.yml.
• If an open issue with that title exists, it does nothing.

It opens an issue, not a PR: PRs that GITHUB_TOKEN creates do not start workflows, so the required sysbox check would never run.

The logic is in .github/scripts/sysbox-release-check.sh (with DRY_RUN=true for tests). shellcheck in the sysbox job now checks it too. The workflow uses only actions/checkout, which the org policy allows.

Test plan

• shellcheck: no findings.
• Current version (0.7.1 = latest): prints "Up to date." and opens no issue.
• Simulated old version (0.7.0), DRY_RUN=true: correct issue text, and the SHA-256 is the same as in test.yml.
• CI sysbox job passes.
• After the merge: run the workflow by hand once. It must print "Up to date.".

🤖 Generated with Claude Code