v1.0.2

Maintenance release: the zizmor workflow linter moves to 1.31.1 and its action to 0.7.1. No changes to the reusable workflows' inputs or behavior.

Other

• chore: Bump zizmorcore/zizmor-action from 0.6.4 to 0.7.1 in the actions group across 1 directory by @dependabot[bot] in #33
• Bump zizmor to 1.31.1 in workflow-lint by @valuecodes in #34

New Contributors

• @dependabot[bot] made their first contribution in #33

Full Changelog: v1.0.1...v1.0.2

v1.0.1

Masks the whole of GitHub's new stateless App installation tokens (including GITHUB_TOKEN) in the updates run summary, and documents how to install gitleaks for the pre-commit hook.

Fixes

• Mask whole stateless GitHub App installation tokens in run summaries by @valuecodes in #32

Other

• Say how to install gitleaks for the pre-commit hook by @valuecodes in #31

Full Changelog: v1.0.0...v1.0.1

v1.0.0

The repo is now valuecodes/maintain-kit, and secret scanning has its own reusable workflow, secret-scan.yml, which runs gitleaks at the version pinned here over the caller's full history. The dashboard and the update PRs no longer know about gitleaks: the gitleaks-script input, the gitleaks section and the gitleaks update kind are gone.

⚠ Breaking changes

GitHub does not redirect uses: references of a renamed repository, so every caller fails until it re-pins. In each caller:

1. Change uses: to valuecodes/maintain-kit/.github/workflows/dashboard.yml@<sha>, updates.yml@<sha> and workflow-lint.yml@<sha>, pinned to this release's commit.
2. Remove the gitleaks-script input if passed; an unknown input fails the call.
3. Add a secret-scan job that calls secret-scan.yml@<sha> with contents: read, delete the repo's own gitleaks script, and run a local gitleaks in the pre-commit hook.
4. Name the caller jobs maintain-kit-dashboard and maintain-kit-updates (as in the README snippets), so the runs read maintain-kit-dashboard / update-issue and maintain-kit-updates / <kind>; the PR check is secret-scan / gitleaks.
5. Close the old "Maintenance dashboard" issue and the open maintenance-updates/* PRs and delete those branches; the next run opens their replacements under the new label (maintain-kit-dashboard, maintain-kit-updates), branch (maintain-kit/<kind>) and marker.

Features

• Move secret scanning to its own workflow and rename the repo to maintain-kit by @valuecodes in #30

Full Changelog: v0.8.0...v1.0.0

v0.8.0

Update PRs now share one body layout: the same table and lockfile section for every kind. Also: failure-path tests no longer add annotations to CI runs, and saveExact moved from .npmrc to pnpm-workspace.yaml.

Features

• Make update PR bodies say the same things the same way by @valuecodes in #28

Other

• Keep failure-path tests from adding annotations to CI runs by @valuecodes in #27
• Move saveExact from .npmrc to pnpm-workspace.yaml by @valuecodes in #29

Full Changelog: v0.7.0...v0.8.0

v0.7.0

Both workflows' logic now lives in TypeScript under src/, run by Node.js as is and checked by oxlint and knip. The catalog pick that turned 26.6.5 into 26.14.13 is fixed, CI scans the git history for committed secrets with gitleaks, and the trust boundary around the scripts checkout is documented and checked before the token steps.

Features

• Move the dashboard's steps to TypeScript and add oxlint and knip by @valuecodes in #22
• Move the update steps and the audit job to TypeScript by @valuecodes in #24
• Scan this repo's git history for committed secrets with gitleaks by @valuecodes in #25
• Document the trust boundary and check the scripts checkout before the token steps by @valuecodes in #26

Fixes

• Fix the catalog pick that turned 26.6.5 into 26.14.13 by @valuecodes in #23

Full Changelog: v0.6.2...v0.7.0

v0.6.2

The run summary now explains why a lockfile resolution failed, and the resolve diagnostics mask JSON and bare token shapes.

Features

• Diagnose failed lockfile resolutions in the run summary by @valuecodes in #20

Fixes

• Mask JSON and bare token shapes in the resolve diagnostics by @valuecodes in #21

Full Changelog: v0.6.1...v0.6.2

v0.6.1

Documentation-only release: the docs now name the version file instead of repeating the exact version, and explain that bot-opened update PRs run CI once someone approves them.

What's Changed

Other

• Name the version file in docs instead of the exact version by @valuecodes in #18
• Say bot-opened update PRs run CI once approved by @valuecodes in #19

Full Changelog: v0.6.0...v0.6.1

v0.6.0

This release adds a reusable workflow that opens update PRs in caller repos.

Features

• Add a reusable workflow that opens update PRs by @valuecodes in #17

Full Changelog: v0.5.0...v0.6.0

v0.5.0

The maintenance dashboard now states each fact once and names the cause of its state in the issue title.

Features

• Say each dashboard fact once and name the cause in the title by @valuecodes in #16

Full Changelog: v0.4.0...v0.5.0

v0.4.0

The maintenance dashboard gains a supply chain section, and it now runs in this repo's CI with its state shown in the issue title.

Features

• Add a supply chain section to the maintenance dashboard by @valuecodes in #14
• Run the dashboard in CI and show its state in the issue title by @valuecodes in #15

Full Changelog: v0.3.3...v0.4.0