v0.2.90

Changelog

Bug fixes

• 1f4b48f fix: close cache upload and container attach leaks
• 2bfe1c1 fix(artifacts): make v4 URL signatures unambiguous and parse the workflow
• b9d3535 fix(artifacts): harden the artifact server
• eae8221 fix: overwrite read-only files when copying an action
• 1ef687e fix: dispatch the gh-act tag run by id
• b961a56 fix: exempt backlog issues from the stale workflow
• 5d34ab3 fix: address triage review comments
• a34fa0c fix: bump golang.org/x/crypto to v0.56.0 to fix SSH deadlock DoS advisories (supersedes v0.52.0) (#6133)

Other

• 58317c0 chore: bump VERSION to 0.2.90
• 62994da ci: keep sharded test-linux and correct the golangci pin comment
• b3534b0 ci: address review notes and scan with Go 1.26.10
• c2bf3f4 ci: acknowledge intentional zizmor trigger exceptions
• 9916e4f chore: remove local action cache captured during tests
• eb59aa8 ci: harden workflows and move fixtures off EOL Debian
• fcf3ffa test: clear ACT_TEST_LINUX_SHARD when asserting sharding is off
• c060d21 ci: let Dockerfile suffixes use spaces
• 79cd048 ci: keep the Actions artifact URL out of test-linux
• 0dafad1 ci: expose Actions cache credentials and skip fixture builds off Linux
• 617c662 ci: shard test-linux and cache fixture images
• e1cd3ee build(deps): clear open Go Dependabot alerts
• 0301b13 ci: tighten approval auto-merge permissions and concurrency
• 3a74ece ci: resolve fork pull requests for approval auto-merge
• 8536521 ci: tag gh-act from master so promote environment secrets are reachable
• 9a46b94 ci: authenticate promote and gh-act tags with the release app
• fe22388 ci: auto-merge after an approval from a writer
• 2506039 ci: rerun Dependabot auto-merge when drafts are ready
• b59d01a ci: replace Mergify with native GitHub automation
• 64f3e1d chore: add CodeRabbit review configuration
• f9563e8 chore: tighten issue and pull request triage
• 29d3714 build(deps): bump github.com/moby/sys/user from 0.4.0 to 0.4.1 (#6210)
• fb52a49 chore: fast tests, no-op promote, and cheaper CI (#6214)