chore(release): pending release v0.31.0#339
Merged
marcusrbrown merged 13 commits intoreleasefrom Mar 22, 2026
Merged
Conversation
Co-authored-by: fro-bot[bot] <109017866+fro-bot[bot]@users.noreply.github.com>
…#338) GitHub API rejects users and teams restrictions on user-owned repos (only org repos support them). Removing the empty arrays from all three branch protection blocks fixes the update-repo-settings error.
The update-repository-settings action deep-merges config over the current GitHub state. Even with users/teams removed from YAML, the action reads them from the existing protection and sends them back. GitHub rejects users/teams on user-owned repos (bfra-me/.github#1837). Workaround: remove bypass_pull_request_allowances from all branches. Manage fro-bot app bypass via GitHub UI until upstream is fixed.
fix(settings): use literal branch name v0 instead of glob pattern v? The update-repository-settings action passes branch names directly to the GitHub API, which requires literal names. The glob pattern v? was treated as a literal branch name, causing a 'Branch not found' error.
Co-authored-by: fro-bot[bot] <109017866+fro-bot[bot]@users.noreply.github.com>
Co-authored-by: fro-bot[bot] <109017866+fro-bot[bot]@users.noreply.github.com>
Co-authored-by: fro-bot[bot] <109017866+fro-bot[bot]@users.noreply.github.com>
…st_allowances (#345) bfra-me/.github#1837 was fixed in update-repository-settings@0.1.3 (shipped in v4.13.4). The action now strips users/teams from bypass_pull_request_allowances on user-owned repos before sending to the API. Restores bypass config: - main: apps: [] (no bypass — OpenSSF Scorecard compliance) - v0: apps: [fro-bot] (release workflow bypass) - release: apps: [fro-bot] (release workflow bypass)
Co-authored-by: fro-bot[bot] <109017866+fro-bot[bot]@users.noreply.github.com>
3 tasks
* feat: add execution deduplication to prevent redundant agent runs Skip agent execution when it already ran for the same PR or issue within a configurable window (default 10 minutes). Uses @actions/cache sentinel files scoped per entity to track recent completions. New dedup phase runs between routing and acknowledge. Configurable via dedup-window action input (milliseconds, 0 = disabled). Fail-open design: cache miss or error always proceeds. Tolerates ±60s clock skew between runners. 1024 tests, 0 lint errors, 0 type errors. * fix: move dedup sentinel dir from /tmp to ~/.cache to satisfy CodeQL CodeQL flagged insecure temp file creation in /tmp (predictable path). Move sentinel base dir to os.homedir()/.cache/fro-bot-dedup/ which is deterministic across runs but not under the OS temp directory.
fro-bot
bot
changed the title
Co-authored-by: fro-bot[bot] <109017866+fro-bot[bot]@users.noreply.github.com>
Co-authored-by: fro-bot[bot] <109017866+fro-bot[bot]@users.noreply.github.com>
marcusrbrown
approved these changes
Mar 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pending Release: v0.31.0
This PR tracks changes pending release. Released on the next auto-release cycle (Sunday/Wednesday) or via manual dispatch.
Merge this PR to trigger a release. Releases also run automatically on Sunday/Wednesday at 20:00 UTC, or via manual workflow dispatch.
Commits Since Last Release
Auto-generated by the release pipeline. Updated: 2026-03-22 07:43 UTC