Skip to content

ci(deps): bump the actions-minor-patch group across 1 directory with 2 updates#474

Merged
c-vigo merged 2 commits intodevfrom
dependabot/github_actions/dev/actions-minor-patch-d7ad8a5a21
Apr 2, 2026
Merged

ci(deps): bump the actions-minor-patch group across 1 directory with 2 updates#474
c-vigo merged 2 commits intodevfrom
dependabot/github_actions/dev/actions-minor-patch-d7ad8a5a21

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Mar 30, 2026 •
edited
Loading

Bumps the actions-minor-patch group with 2 updates in the / directory: github/codeql-action and sigstore/cosign-installer.

Updates github/codeql-action from 4.34.1 to 4.35.1

Release notes

Sourced from github/codeql-action's releases.

v4.35.1

v4.35.0

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

  • The Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. #3789
  • Python analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. #3794

4.35.1 - 27 Mar 2026

4.35.0 - 27 Mar 2026

4.34.1 - 20 Mar 2026

  • Downgrade default CodeQL bundle version to 2.24.3 due to issues with a small percentage of Actions and JavaScript analyses. #3762

4.34.0 - 20 Mar 2026

  • Added an experimental change which disables TRAP caching when improved incremental analysis is enabled, since improved incremental analysis supersedes TRAP caching. This will improve performance and reduce Actions cache usage. We expect to roll this change out to everyone in March. #3569
  • We are rolling out improved incremental analysis to C/C++ analyses that use build mode none. We expect this rollout to be complete by the end of April 2026. #3584
  • Update default CodeQL bundle version to 2.25.0. #3585

4.33.0 - 16 Mar 2026

  • Upcoming change: Starting April 2026, the CodeQL Action will skip collecting file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses. Pull request analyses will log a warning about this upcoming change. #3562

    To opt out of this change:

    • Repositories owned by an organization: Create a custom repository property with the name github-codeql-file-coverage-on-prs and the type "True/false", then set this property to true in the repository's settings. For more information, see Managing custom properties for repositories in your organization. Alternatively, if you are using an advanced setup workflow, you can set the CODEQL_ACTION_FILE_COVERAGE_ON_PRS environment variable to true in your workflow.
    • User-owned repositories using default setup: Switch to an advanced setup workflow and set the CODEQL_ACTION_FILE_COVERAGE_ON_PRS environment variable to true in your workflow.
    • User-owned repositories using advanced setup: Set the CODEQL_ACTION_FILE_COVERAGE_ON_PRS environment variable to true in your workflow.

  • Fixed a bug which caused the CodeQL Action to fail loading repository properties if a "Multi select" repository property was configured for the repository. #3557

  • The CodeQL Action now loads custom repository properties on GitHub Enterprise Server, enabling the customization of features such as github-codeql-disable-overlay that was previously only available on GitHub.com. #3559

  • Once private package registries can be configured with OIDC-based authentication for organizations, the CodeQL Action will now be able to accept such configurations. #3563

  • Fixed the retry mechanism for database uploads. Previously this would fail with the error "Response body object should not be disturbed or locked". #3564

  • A warning is now emitted if the CodeQL Action detects a repository property whose name suggests that it relates to the CodeQL Action, but which is not one of the properties recognised by the current version of the CodeQL Action. #3570

4.32.6 - 05 Mar 2026

  • Update default CodeQL bundle version to 2.24.3. #3548

4.32.5 - 02 Mar 2026

  • Repositories owned by an organization can now set up the github-codeql-disable-overlay custom repository property to disable improved incremental analysis for CodeQL. First, create a custom repository property with the name github-codeql-disable-overlay and the type "True/false" in the organization's settings. Then in the repository's settings, set this property to true to disable improved incremental analysis. For more information, see Managing custom properties for repositories in your organization. This feature is not yet available on GitHub Enterprise Server. #3507
  • Added an experimental change so that when improved incremental analysis fails on a runner — potentially due to insufficient disk space — the failure is recorded in the Actions cache so that subsequent runs will automatically skip improved incremental analysis until something changes (e.g. a larger runner is provisioned or a new CodeQL version is released). We expect to roll this change out to everyone in March. #3487

... (truncated)

Commits
  • c10b806 Merge pull request #3782 from github/update-v4.35.1-d6d1743b8
  • c5ffd06 Update changelog for v4.35.1
  • d6d1743 Merge pull request #3781 from github/henrymercer/update-git-minimum-version
  • 65d2efa Add changelog note
  • 2437b20 Update minimum git version for overlay to 2.36.0
  • ea5f719 Merge pull request #3775 from github/dependabot/npm_and_yarn/node-forge-1.4.0
  • 45ceeea Merge pull request #3777 from github/mergeback/v4.35.0-to-main-b8bb9f28
  • 24448c9 Rebuild
  • 7c51060 Update changelog and version after v4.35.0
  • b8bb9f2 Merge pull request #3776 from github/update-v4.35.0-0078ad667
  • Additional commits viewable in compare view

Updates sigstore/cosign-installer from 4.1.0 to 4.1.1

Release notes

Sourced from sigstore/cosign-installer's releases.

v4.1.1

What's Changed

Full Changelog: sigstore/cosign-installer@v4.1.0...v4.1.1

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Mar 30, 2026
@dependabot dependabot Bot requested a review from c-vigo as a code owner March 30, 2026 02:29
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Mar 30, 2026
@dependabot
ci(deps): bump the actions-minor-patch group with 2 updates
7333374 
Bumps the actions-minor-patch group with 2 updates: [github/codeql-action](https://github.com/github/codeql-action) and [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer).


Updates `github/codeql-action` from 4.34.1 to 4.35.1
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@3869755...c10b806)

Updates `sigstore/cosign-installer` from 4.1.0 to 4.1.1
- [Release notes](https://github.com/sigstore/cosign-installer/releases)
- [Commits](sigstore/cosign-installer@ba7bc0a...cad07c2)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.35.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-minor-patch
- dependency-name: sigstore/cosign-installer
  dependency-version: 4.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title ci(deps): bump the actions-minor-patch group with 2 updates ci(deps): bump the actions-minor-patch group across 1 directory with 2 updates Apr 2, 2026
@dependabot dependabot Bot force-pushed the dependabot/github_actions/dev/actions-minor-patch-d7ad8a5a21 branch from 467bbd4 to 7333374 Compare April 2, 2026 11:19
@c-vigo c-vigo enabled auto-merge April 2, 2026 12:08
@c-vigo c-vigo merged commit 857e6e6 into dev Apr 2, 2026
11 checks passed
@c-vigo c-vigo deleted the dependabot/github_actions/dev/actions-minor-patch-d7ad8a5a21 branch April 2, 2026 12:14
@c-vigo c-vigo mentioned this pull request Apr 2, 2026
Merged
7 tasks
c-vigo added a commit that referenced this pull request Apr 2, 2026
@c-vigo
chore: merge dev dependabot patches into release (#478)
5db48cd 
## Description

Merge `dev` into `release/0.3.2` to apply latest Dependabot GitHub
Actions SHA pin bumps.

## Type of Change

- [x] `chore` -- Maintenance task (deps, config, etc.)

## Changes Made

Fast-forward merge of 3 commits from `dev` (PR #474) bumping GitHub
Actions SHA pins:

- `github/codeql-action` from `4.34.1` to `4.35.1` (ci.yml, codeql.yml,
scorecard.yml, security-scan.yml, and workspace templates)
- `sigstore/cosign-installer` from `4.1.0` to `4.1.1`
(promote-release.yml, release.yml)

Plus a changelog entry documenting the batch.

## Changelog Entry

### Changed

- **Dependabot dependency update batch**
([#474](#474))
  - Bump `github/codeql-action` from `4.34.1` to `4.35.1`
  - Bump `sigstore/cosign-installer` from `4.1.0` to `4.1.1`

## Testing

- [x] No functional changes -- SHA pin updates only
- [x] Pre-commit hooks pass locally

## Checklist

- [x] My code follows the project's style guidelines
- [x] I have performed a self-review of my code
- [x] I have updated `CHANGELOG.md` in the `[Unreleased]` section (and
pasted the entry above)
- [x] My changes generate no new warnings or errors

## Additional Notes

Chore maintenance -- no linked issue.

Refs: N/A (chore, no issue)
This was referenced Apr 5, 2026
Merged
Merged
vig-os-release-app Bot added a commit to vig-os/devcontainer-smoke-test that referenced this pull request Apr 5, 2026
@vig-os-release-app
chore: release 0.3.2 (#119)
765d96d 
# Release 0.3.2

This PR prepares release 0.3.2 for merge to main.

## [0.3.2] - TBD

### Added

- **Downstream `promote-release.yml` workspace template**
([#463](vig-os/devcontainer#463))
- Add `assets/workspace/.github/workflows/promote-release.yml` as the
counter-party to root `promote-release.yml`: validate draft release and
release PR, publish the release, merge to `main`, best-effort git RC tag
cleanup (no GHCR/cosign/smoke-test gate)
- Document in `docs/DOWNSTREAM_RELEASE.md` and align
`docs/RELEASE_CYCLE.md` Phase 5 for consumer vs upstream paths
- **Optional draft pre-release for downstream release candidates**
([#463](vig-os/devcontainer#463))
- Workspace `release.yml` adds `create-release` (`workflow_dispatch`,
default `false`); `release-publish.yml` creates a draft GitHub
pre-release only when set for `candidate` runs
- Smoke-test `repository-dispatch.yml` passes `create-release=true` when
triggering downstream `release.yml`
- `just publish-candidate` forwards `create-release` in `justfile.gh`
and the workspace template copy

### Changed

- **RELEASE_APP permissions and GHCR cleanup token model**
([#463](vig-os/devcontainer#463))
- Document Packages read/write on the org for `promote-release` cleanup,
align the app table in `docs/RELEASE_CYCLE.md`, and explain why cleanup
uses the GitHub App token instead of `GITHUB_TOKEN`
- **Promote-release cleans up stale RC artifacts after merge**
([#463](vig-os/devcontainer#463))
- Best-effort job deletes GHCR package versions for `${VERSION}-rc*` and
`sha256-*`-only orphans, and deletes remote git RC tags for that base
version when no GitHub Release exists; does not fail the workflow on
error
- **Downstream release helper recipes via GitHub justfile import**
([#373](vig-os/devcontainer#373))
- Move `prepare-release`, `finalize-release`, `publish-candidate`, and
`reset-changelog` into `justfile.gh` so downstream workspace templates
expose these release helpers by default
- Keep root recipe availability (including `pull`) through `import
'justfile.gh'` while consolidating release helper ownership in the
GitHub-focused recipe file; the workspace template copy omits the `pull`
recipe
- **Split final release into publish and promote phases**
([#456](vig-os/devcontainer#456))
- Final `release.yml` publishes versioned GHCR tags and a draft GitHub
Release but no longer updates `:latest`
- New `promote-release.yml` runs after downstream smoke-test publishes
its final release: updates `:latest`, publishes the draft release,
merges the release PR to `main`
- Add `just promote-release` in `justfile.gh` (and workspace template
copy)
- **Smoke-test dispatch fails fast when deploy PR checks fail**
([#381](vig-os/devcontainer#381))
- `wait-deploy-merge` in
`assets/smoke-test/.github/workflows/repository-dispatch.yml` exits as
soon as all required checks have completed with failures instead of
waiting for the merge poll timeout (`gh pr checks --required`)
- **Nightly CI schedule**
([#461](vig-os/devcontainer#461))
- `ci.yml` adds a `schedule` trigger at 04:00 UTC that checks out `dev`
and runs all test suites; checkout `ref` and `vcs-ref` are resolved
correctly for scheduled runs
- **Scheduled security scan pulls GHCR `:latest` instead of rebuilding**
([#461](vig-os/devcontainer#461))
- Runs nightly at 05:00 UTC, pulls the published image, gates on fixable
HIGH/CRITICAL vulnerabilities, auto-creates a deduplicated GitHub issue
on failure, and uploads SARIF under `container-image-latest`
- **Dependabot dependency update batch**
([#474](vig-os/devcontainer#474))
  - Bump `github/codeql-action` from `4.34.1` to `4.35.1`
  - Bump `sigstore/cosign-installer` from `4.1.0` to `4.1.1`
- **Simplify `just pull` in `justfile.gh`**
([#482](vig-os/devcontainer#482))
- Pull `ghcr.io/vig-os/devcontainer` by tag; drop redundant shell
fallback, per-recipe `repo` argument, and unused `REGISTRY_TEST` TLS
path (imported `justfile.gh` cannot reference root `repo`)

### Removed

- **One-time GHCR/git RC prune script**
([#463](vig-os/devcontainer#463))
- Remove `scripts/prune-ghcr-tags.sh`; RC and `sha256-*` orphan cleanup
remains in root `promote-release.yml`
- **Downstream RC pre-release gate from release validate job**
([#463](vig-os/devcontainer#463))
- Removed dead `if: false` steps from `release.yml`; downstream final
release is verified only in `promote-release.yml` before promote

### Fixed

- **Prepare-release changelog commits silently skipped due to FILE_PATHS
delimiter mismatch**
([#483](vig-os/devcontainer#483))
- Change `FILE_PATHS` from space-separated to comma-separated in all
`commit-action` steps of `prepare-release.yml` so the action correctly
commits both `CHANGELOG.md` and
`assets/workspace/.devcontainer/CHANGELOG.md`
- Join finalization changed files with commas in `release.yml` (`Collect
finalization files`) so `commit-action` receives multiple paths
correctly
- **`publish-candidate` recipe sends unknown `create-release` input**
([#479](vig-os/devcontainer#479))
- Remove `create-release` parameter and `-f` flag from upstream
`justfile.gh`; the input was added to the downstream workflow only but
the recipe was updated in both places
- **Image tests expect current `just` minor**
([#479](vig-os/devcontainer#479))
- Align `EXPECTED_VERSIONS["just"]` with the latest `just` release
installed by the Containerfile (1.49.x)
- **Git commit now falls back to nano when editor config is unusable**
([#383](vig-os/devcontainer#383))
- `setup-git-conf.sh` now validates the effective Git editor and sets
`core.editor=nano` only when the configured editor is missing or invalid
in-container
- Add integration regression coverage to ensure invalid editor settings
are corrected during setup
- **Release finalize no longer races sync-issues; CHANGELOG TBD verified
after reset**
([#455](vig-os/devcontainer#455))
- Run `sync-issues` after capturing finalize SHA so downstream
build/publish use the finalized commit
@vig-os-release-app vig-os-release-app Bot mentioned this pull request Apr 7, 2026
Merged
vig-os-release-app Bot added a commit to vig-os/devcontainer-smoke-test that referenced this pull request Apr 7, 2026
@vig-os-release-app
chore: release 0.3.2 (#122)
c6a21a5 
# Release 0.3.2

This PR prepares release 0.3.2 for merge to main.

## [0.3.2] - TBD

### Added

- **Downstream `promote-release.yml` workspace template**
([#463](vig-os/devcontainer#463))
- Add `assets/workspace/.github/workflows/promote-release.yml` as the
counter-party to root `promote-release.yml`: validate draft release and
release PR, publish the release, merge to `main`, best-effort git RC tag
cleanup (no GHCR/cosign/smoke-test gate)
- Document in `docs/DOWNSTREAM_RELEASE.md` and align
`docs/RELEASE_CYCLE.md` Phase 5 for consumer vs upstream paths
- **Optional draft pre-release for downstream release candidates**
([#463](vig-os/devcontainer#463))
- Workspace `release.yml` adds `create-release` (`workflow_dispatch`,
default `false`); `release-publish.yml` creates a draft GitHub
pre-release only when set for `candidate` runs
- Smoke-test `repository-dispatch.yml` passes `create-release=true` when
triggering downstream `release.yml`
- `just publish-candidate` forwards `create-release` in `justfile.gh`
and the workspace template copy

### Changed

- **RELEASE_APP permissions and GHCR cleanup token model**
([#463](vig-os/devcontainer#463))
- Document Packages read/write on the org for `promote-release` cleanup,
align the app table in `docs/RELEASE_CYCLE.md`, and explain why cleanup
uses the GitHub App token instead of `GITHUB_TOKEN`
- **Promote-release cleans up stale RC artifacts after merge**
([#463](vig-os/devcontainer#463))
- Best-effort job deletes GHCR package versions for `${VERSION}-rc*` and
`sha256-*`-only orphans, and deletes remote git RC tags for that base
version when no GitHub Release exists; does not fail the workflow on
error
- **Downstream release helper recipes via GitHub justfile import**
([#373](vig-os/devcontainer#373))
- Move `prepare-release`, `finalize-release`, `publish-candidate`, and
`reset-changelog` into `justfile.gh` so downstream workspace templates
expose these release helpers by default
- Keep root recipe availability (including `pull`) through `import
'justfile.gh'` while consolidating release helper ownership in the
GitHub-focused recipe file; the workspace template copy omits the `pull`
recipe
- **Split final release into publish and promote phases**
([#456](vig-os/devcontainer#456))
- Final `release.yml` publishes versioned GHCR tags and a draft GitHub
Release but no longer updates `:latest`
- New `promote-release.yml` runs after downstream smoke-test publishes
its final release: updates `:latest`, publishes the draft release,
merges the release PR to `main`
- Add `just promote-release` in `justfile.gh` (and workspace template
copy)
- **Smoke-test dispatch fails fast when deploy PR checks fail**
([#381](vig-os/devcontainer#381))
- `wait-deploy-merge` in
`assets/smoke-test/.github/workflows/repository-dispatch.yml` exits as
soon as all required checks have completed with failures instead of
waiting for the merge poll timeout (`gh pr checks --required`)
- **Scheduled security scan pulls GHCR `:latest` instead of rebuilding**
([#461](vig-os/devcontainer#461))
- Runs nightly at 05:00 UTC, pulls the published image, gates on fixable
HIGH/CRITICAL vulnerabilities, auto-creates a deduplicated GitHub issue
on failure, and uploads SARIF under `container-image-latest`
- **Dependabot dependency update batch**
([#474](vig-os/devcontainer#474))
  - Bump `github/codeql-action` from `4.34.1` to `4.35.1`
  - Bump `sigstore/cosign-installer` from `4.1.0` to `4.1.1`
- **Dependabot dependency update batch**
([#488](vig-os/devcontainer#488),
[#489](vig-os/devcontainer#489))
  - Bump `@devcontainers/cli` from `0.84.1` to `0.85.0`
  - Bump `docker/login-action` from `4.0.0` to `4.1.0`
- **Simplify `just pull` in `justfile.gh`**
([#482](vig-os/devcontainer#482))
- Pull `ghcr.io/vig-os/devcontainer` by tag; drop redundant shell
fallback, per-recipe `repo` argument, and unused `REGISTRY_TEST` TLS
path (imported `justfile.gh` cannot reference root `repo`)

### Removed

- **One-time GHCR/git RC prune script**
([#463](vig-os/devcontainer#463))
- Remove `scripts/prune-ghcr-tags.sh`; RC and `sha256-*` orphan cleanup
remains in root `promote-release.yml`
- **Downstream RC pre-release gate from release validate job**
([#463](vig-os/devcontainer#463))
- Removed dead `if: false` steps from `release.yml`; downstream final
release is verified only in `promote-release.yml` before promote
- **Nightly full CI schedule from `ci.yml`**
([#492](vig-os/devcontainer#492))
- Remove the `schedule` trigger and schedule-only checkout overrides; CI
remains on pull requests and `workflow_dispatch` only
  - Nightly GHCR `:latest` scan in `security-scan.yml` is unchanged

### Fixed

- **Prepare-release changelog commits silently skipped due to FILE_PATHS
delimiter mismatch**
([#483](vig-os/devcontainer#483))
- Change `FILE_PATHS` from space-separated to comma-separated in all
`commit-action` steps of `prepare-release.yml` so the action correctly
commits both `CHANGELOG.md` and
`assets/workspace/.devcontainer/CHANGELOG.md`
- Join finalization changed files with commas in `release.yml` (`Collect
finalization files`) so `commit-action` receives multiple paths
correctly
- **`publish-candidate` recipe sends unknown `create-release` input**
([#479](vig-os/devcontainer#479))
- Remove `create-release` parameter and `-f` flag from upstream
`justfile.gh`; the input was added to the downstream workflow only but
the recipe was updated in both places
- **Image tests expect current `just` minor**
([#479](vig-os/devcontainer#479))
- Align `EXPECTED_VERSIONS["just"]` with the latest `just` release
installed by the Containerfile (1.49.x)
- **Git commit now falls back to nano when editor config is unusable**
([#383](vig-os/devcontainer#383))
- `setup-git-conf.sh` now validates the effective Git editor and sets
`core.editor=nano` only when the configured editor is missing or invalid
in-container
- Add integration regression coverage to ensure invalid editor settings
are corrected during setup
- **Release finalize no longer races sync-issues; CHANGELOG TBD verified
after reset**
([#455](vig-os/devcontainer#455))
- Run `sync-issues` after capturing finalize SHA so downstream
build/publish use the finalized commit
@vig-os-release-app vig-os-release-app Bot mentioned this pull request Apr 7, 2026
Merged
vig-os-release-app Bot added a commit to vig-os/devcontainer-smoke-test that referenced this pull request Apr 7, 2026
@vig-os-release-app
chore: release 0.3.2 (#125)
72aa60d 
# Release 0.3.2

This PR prepares release 0.3.2 for merge to main.

## [0.3.2] - TBD

### Added

- **Downstream `promote-release.yml` workspace template**
([#463](vig-os/devcontainer#463))
- Add `assets/workspace/.github/workflows/promote-release.yml` as the
counter-party to root `promote-release.yml`: validate draft release and
release PR, publish the release, merge to `main`, best-effort git RC tag
cleanup (no GHCR/cosign/smoke-test gate)
- Document in `docs/DOWNSTREAM_RELEASE.md` and align
`docs/RELEASE_CYCLE.md` Phase 5 for consumer vs upstream paths
- **Optional draft pre-release for downstream release candidates**
([#463](vig-os/devcontainer#463))
- Workspace `release.yml` adds `create-release` (`workflow_dispatch`,
default `false`); `release-publish.yml` creates a draft GitHub
pre-release only when set for `candidate` runs
- Smoke-test `repository-dispatch.yml` passes `create-release=true` when
triggering downstream `release.yml`
- `just publish-candidate` forwards `create-release` in `justfile.gh`
and the workspace template copy

### Changed

- **RELEASE_APP permissions and GHCR cleanup token model**
([#463](vig-os/devcontainer#463))
- Document Packages read/write on the org for `promote-release` cleanup,
align the app table in `docs/RELEASE_CYCLE.md`, and explain why cleanup
uses the GitHub App token instead of `GITHUB_TOKEN`
- **Promote-release cleans up stale RC artifacts after merge**
([#463](vig-os/devcontainer#463))
- Best-effort job deletes GHCR package versions for `${VERSION}-rc*` and
`sha256-*`-only orphans, and deletes remote git RC tags for that base
version when no GitHub Release exists; does not fail the workflow on
error
- **Downstream release helper recipes via GitHub justfile import**
([#373](vig-os/devcontainer#373))
- Move `prepare-release`, `finalize-release`, `publish-candidate`, and
`reset-changelog` into `justfile.gh` so downstream workspace templates
expose these release helpers by default
- Keep root recipe availability (including `pull`) through `import
'justfile.gh'` while consolidating release helper ownership in the
GitHub-focused recipe file; the workspace template copy omits the `pull`
recipe
- **Split final release into publish and promote phases**
([#456](vig-os/devcontainer#456))
- Final `release.yml` publishes versioned GHCR tags and a draft GitHub
Release but no longer updates `:latest`
- New `promote-release.yml` runs after downstream smoke-test publishes
its final release: updates `:latest`, publishes the draft release,
merges the release PR to `main`
- Add `just promote-release` in `justfile.gh` (and workspace template
copy)
- **Smoke-test dispatch fails fast when deploy PR checks fail**
([#381](vig-os/devcontainer#381))
- `wait-deploy-merge` in
`assets/smoke-test/.github/workflows/repository-dispatch.yml` exits as
soon as all required checks have completed with failures instead of
waiting for the merge poll timeout (`gh pr checks --required`)
- **Scheduled security scan pulls GHCR `:latest` instead of rebuilding**
([#461](vig-os/devcontainer#461))
- Runs nightly at 05:00 UTC, pulls the published image, gates on fixable
HIGH/CRITICAL vulnerabilities, auto-creates a deduplicated GitHub issue
on failure, and uploads SARIF under `container-image-latest`
- **Dependabot dependency update batch**
([#474](vig-os/devcontainer#474))
  - Bump `github/codeql-action` from `4.34.1` to `4.35.1`
  - Bump `sigstore/cosign-installer` from `4.1.0` to `4.1.1`
- **Dependabot dependency update batch**
([#488](vig-os/devcontainer#488),
[#489](vig-os/devcontainer#489))
  - Bump `@devcontainers/cli` from `0.84.1` to `0.85.0`
  - Bump `docker/login-action` from `4.0.0` to `4.1.0`
- **Simplify `just pull` in `justfile.gh`**
([#482](vig-os/devcontainer#482))
- Pull `ghcr.io/vig-os/devcontainer` by tag; drop redundant shell
fallback, per-recipe `repo` argument, and unused `REGISTRY_TEST` TLS
path (imported `justfile.gh` cannot reference root `repo`)
- **prepare-changelog finalize adds GitHub release link to version
headings** ([#496](vig-os/devcontainer#496))
@vig-os-release-app vig-os-release-app Bot mentioned this pull request Apr 8, 2026
Merged
vig-os-release-app Bot added a commit to vig-os/devcontainer-smoke-test that referenced this pull request Apr 8, 2026
@vig-os-release-app
chore: release 0.3.2 (#128)
f10b7d3 
# Release 0.3.2

This PR prepares release 0.3.2 for merge to main.

## [0.3.2] - TBD

### Added

- **Downstream `promote-release.yml` workspace template**
([#463](vig-os/devcontainer#463))
- Add `assets/workspace/.github/workflows/promote-release.yml` as the
counter-party to root `promote-release.yml`: validate draft release and
release PR, publish the release, merge to `main`, best-effort git RC tag
cleanup (no GHCR/cosign/smoke-test gate)
- Document in `docs/DOWNSTREAM_RELEASE.md` and align
`docs/RELEASE_CYCLE.md` Phase 5 for consumer vs upstream paths
- **Optional draft pre-release for downstream release candidates**
([#463](vig-os/devcontainer#463))
- Workspace `release.yml` adds `create-release` (`workflow_dispatch`,
default `false`); `release-publish.yml` creates a draft GitHub
pre-release only when set for `candidate` runs
- Smoke-test `repository-dispatch.yml` passes `create-release=true` when
triggering downstream `release.yml`
- `just publish-candidate` forwards `create-release` in `justfile.gh`
and the workspace template copy

### Changed

- **RELEASE_APP permissions and GHCR cleanup token model**
([#463](vig-os/devcontainer#463))
- Document Packages read/write on the org for `promote-release` cleanup,
align the app table in `docs/RELEASE_CYCLE.md`, and explain why cleanup
uses the GitHub App token instead of `GITHUB_TOKEN`
- **Promote-release cleans up stale RC artifacts after merge**
([#463](vig-os/devcontainer#463))
- Best-effort job deletes GHCR package versions for `${VERSION}-rc*` and
`sha256-*`-only orphans, and deletes remote git RC tags for that base
version when no GitHub Release exists; does not fail the workflow on
error
- **Downstream release helper recipes via GitHub justfile import**
([#373](vig-os/devcontainer#373))
- Move `prepare-release`, `finalize-release`, `publish-candidate`, and
`reset-changelog` into `justfile.gh` so downstream workspace templates
expose these release helpers by default
- Keep root recipe availability (including `pull`) through `import
'justfile.gh'` while consolidating release helper ownership in the
GitHub-focused recipe file; the workspace template copy omits the `pull`
recipe
- **Split final release into publish and promote phases**
([#456](vig-os/devcontainer#456))
- Final `release.yml` publishes versioned GHCR tags and a draft GitHub
Release but no longer updates `:latest`
- New `promote-release.yml` runs after downstream smoke-test publishes
its final release: updates `:latest`, publishes the draft release,
merges the release PR to `main`
- Add `just promote-release` in `justfile.gh` (and workspace template
copy)
- **Smoke-test dispatch fails fast when deploy PR checks fail**
([#381](vig-os/devcontainer#381))
- `wait-deploy-merge` in
`assets/smoke-test/.github/workflows/repository-dispatch.yml` exits as
soon as all required checks have completed with failures instead of
waiting for the merge poll timeout (`gh pr checks --required`)
- **Scheduled security scan pulls GHCR `:latest` instead of rebuilding**
([#461](vig-os/devcontainer#461))
- Runs nightly at 05:00 UTC, pulls the published image, gates on fixable
HIGH/CRITICAL vulnerabilities, auto-creates a deduplicated GitHub issue
on failure, and uploads SARIF under `container-image-latest`
- **Dependabot dependency update batch**
([#474](vig-os/devcontainer#474))
  - Bump `github/codeql-action` from `4.34.1` to `4.35.1`
  - Bump `sigstore/cosign-installer` from `4.1.0` to `4.1.1`
- **Dependabot dependency update batch**
([#488](vig-os/devcontainer#488),
[#489](vig-os/devcontainer#489))
  - Bump `@devcontainers/cli` from `0.84.1` to `0.85.0`
  - Bump `docker/login-action` from `4.0.0` to `4.1.0`
- **Simplify `just pull` in `justfile.gh`**
([#482](vig-os/devcontainer#482))
- Pull `ghcr.io/vig-os/devcontainer` by tag; drop redundant shell
fallback, per-recipe `repo` argument, and unused `REGISTRY_TEST` TLS
path (imported `justfile.gh` cannot reference root `repo`)
- **prepare-changelog finalize adds GitHub release link to version
headings** ([#496](vig-os/devcontainer#496))
c-vigo added a commit that referenced this pull request Apr 8, 2026
@c-vigo
chore: release 0.3.2 (#486)
99d4273 
# [Release
0.3.2](https://github.com/vig-os/devcontainer/releases/tag/0.3.2) -
2026-04-08

This PR prepares release 0.3.2 for merge to main.

## [0.3.2](https://github.com/vig-os/devcontainer/releases/tag/0.3.2) -
2026-04-08

### Added

- **Downstream `promote-release.yml` workspace template**
([#463](#463))
- Add `assets/workspace/.github/workflows/promote-release.yml` as the
counter-party to root `promote-release.yml`: validate draft release and
release PR, publish the release, merge to `main`, best-effort git RC tag
cleanup (no GHCR/cosign/smoke-test gate)
- Document in `docs/DOWNSTREAM_RELEASE.md` and align
`docs/RELEASE_CYCLE.md` Phase 5 for consumer vs upstream paths
- **Optional draft pre-release for downstream release candidates**
([#463](#463))
- Workspace `release.yml` adds `create-release` (`workflow_dispatch`,
default `false`); `release-publish.yml` creates a draft GitHub
pre-release only when set for `candidate` runs
- Smoke-test `repository-dispatch.yml` passes `create-release=true` when
triggering downstream `release.yml`
- `just publish-candidate` forwards `create-release` in `justfile.gh`
and the workspace template copy

### Changed

- **RELEASE_APP permissions and GHCR cleanup token model**
([#463](#463))
- Document Packages read/write on the org for `promote-release` cleanup,
align the app table in `docs/RELEASE_CYCLE.md`, and explain why cleanup
uses the GitHub App token instead of `GITHUB_TOKEN`
- **Promote-release cleans up stale RC artifacts after merge**
([#463](#463))
- Best-effort job deletes GHCR package versions for `${VERSION}-rc*` and
`sha256-*`-only orphans, and deletes remote git RC tags for that base
version when no GitHub Release exists; does not fail the workflow on
error
- **Downstream release helper recipes via GitHub justfile import**
([#373](#373))
- Move `prepare-release`, `finalize-release`, `publish-candidate`, and
`reset-changelog` into `justfile.gh` so downstream workspace templates
expose these release helpers by default
- Keep root recipe availability (including `pull`) through `import
'justfile.gh'` while consolidating release helper ownership in the
GitHub-focused recipe file; the workspace template copy omits the `pull`
recipe
- **Split final release into publish and promote phases**
([#456](#456))
- Final `release.yml` publishes versioned GHCR tags and a draft GitHub
Release but no longer updates `:latest`
- New `promote-release.yml` runs after downstream smoke-test publishes
its final release: updates `:latest`, publishes the draft release,
merges the release PR to `main`
- Add `just promote-release` in `justfile.gh` (and workspace template
copy)
- **Smoke-test dispatch fails fast when deploy PR checks fail**
([#381](#381))
- `wait-deploy-merge` in
`assets/smoke-test/.github/workflows/repository-dispatch.yml` exits as
soon as all required checks have completed with failures instead of
waiting for the merge poll timeout (`gh pr checks --required`)
- **Scheduled security scan pulls GHCR `:latest` instead of rebuilding**
([#461](#461))
- Runs nightly at 05:00 UTC, pulls the published image, gates on fixable
HIGH/CRITICAL vulnerabilities, auto-creates a deduplicated GitHub issue
on failure, and uploads SARIF under `container-image-latest`
- **Dependabot dependency update batch**
([#474](#474))
  - Bump `github/codeql-action` from `4.34.1` to `4.35.1`
  - Bump `sigstore/cosign-installer` from `4.1.0` to `4.1.1`
- **Dependabot dependency update batch**
([#488](#488),
[#489](#489))
  - Bump `@devcontainers/cli` from `0.84.1` to `0.85.0`
  - Bump `docker/login-action` from `4.0.0` to `4.1.0`
- **Simplify `just pull` in `justfile.gh`**
([#482](#482))
- Pull `ghcr.io/vig-os/devcontainer` by tag; drop redundant shell
fallback, per-recipe `repo` argument, and unused `REGISTRY_TEST` TLS
path (imported `justfile.gh` cannot reference root `repo`)
- **prepare-changelog finalize adds GitHub release link to version
headings** ([#496](#496))
- `finalize_release_date` writes `##
[X.Y.Z](https://github.com/owner/repo/releases/tag/X.Y.Z) - date`;
repository slug comes from `GITHUB_REPOSITORY` (set in Actions) or from
`prepare-changelog finalize ... --github-repository owner/repo`
  - `unprepare` recognizes linked `## [semver](url) - …` headings

### Removed

- **One-time GHCR/git RC prune script**
([#463](#463))
- Remove `scripts/prune-ghcr-tags.sh`; RC and `sha256-*` orphan cleanup
remains in root `promote-release.yml`
- **Downstream RC pre-release gate from release validate job**
([#463](#463))
- Removed dead `if: false` steps from `release.yml`; downstream final
release is verified only in `promote-release.yml` before promote
- **Nightly full CI schedule from `ci.yml`**
([#492](#492))
- Remove the `schedule` trigger and schedule-only checkout overrides; CI
remains on pull requests and `workflow_dispatch` only
  - Nightly GHCR `:latest` scan in `security-scan.yml` is unchanged

### Fixed

- **Prepare-release changelog commits silently skipped due to FILE_PATHS
delimiter mismatch**
([#483](#483))
- Change `FILE_PATHS` from space-separated to comma-separated in all
`commit-action` steps of `prepare-release.yml` so the action correctly
commits both `CHANGELOG.md` and
`assets/workspace/.devcontainer/CHANGELOG.md`
- Join finalization changed files with commas in `release.yml` (`Collect
finalization files`) so `commit-action` receives multiple paths
correctly
- **`publish-candidate` recipe sends unknown `create-release` input**
([#479](#479))
- Remove `create-release` parameter and `-f` flag from upstream
`justfile.gh`; the input was added to the downstream workflow only but
the recipe was updated in both places
- **Image tests expect current `just` minor**
([#479](#479))
- Align `EXPECTED_VERSIONS["just"]` with the latest `just` release
installed by the Containerfile (1.49.x)
- **Git commit now falls back to nano when editor config is unusable**
([#383](#383))
- `setup-git-conf.sh` now validates the effective Git editor and sets
`core.editor=nano` only when the configured editor is missing or invalid
in-container
- Add integration regression coverage to ensure invalid editor settings
are corrected during setup
- **Release finalize no longer races sync-issues; CHANGELOG TBD verified
after reset**
([#455](#455))
- Run `sync-issues` after capturing finalize SHA so downstream
build/publish use the finalized commit
- Fail finalize if `CHANGELOG.md` still contains `## [version] - TBD`
after `git reset --hard`
- **generate-docs pre-commit runs when CHANGELOG.md changes**
([#455](#455))
- Keeps README “Latest Version” and other generated docs aligned with
the changelog
- **prepare-release tolerates GitHub API ref propagation and reliable
CHANGELOG rollback**
([#453](#453))
- Poll until the new release branch ref resolves before `commit-action`
commits to it
- Fetch dev `CHANGELOG.md` by resolved commit SHA during rollback so
Contents API staleness does not skip the rollback commit
- **sync-main-to-dev sync job no longer depends on dev's setup-env**
([#459](#459))
- Inline the same `retry` shell helper used by `setup-env` so the job
works when `main`'s workflow expects helpers not yet on `dev`
- **CI container build avoids shared-runner Docker Hub rate limits**
([#473](#473))
- `build-image` logs in to `docker.io` before `setup-buildx-action` when
`DOCKERHUB_USERNAME` and `DOCKERHUB_TOKEN` secrets are set; `ci.yml` and
`release.yml` pass them
  - Omitting secrets (e.g. forks) keeps prior anonymous-pull behavior
- **Release finalize commit blocked by Release protection ruleset**
([#487](#487))
- Generate a dedicated Commit App token (`COMMIT_APP_ID`) for the
`commit-action` step in the `finalize` job of `release.yml`, matching
the pattern used by `prepare-release.yml` and other workflows; the
previous Release App token lacked ruleset bypass
- **Release finalize installs just for doc generation**
([#494](#494))
- Remove `install-just: 'false'` from the finalize job `setup-env` step
so `docs/generate.py` can run `just --list`
- `get_just_help()` exits non-zero on failure instead of writing
placeholder content into generated docs
- **Release rollback and CI `retry` exit codes**
([#500](#500))
- `retry` shell helper now propagates the command's non-zero exit code
when all attempts fail
- Release rollback creates a fast-forward revert commit via the Git API
instead of force-pushing, compatible with branch protection on
`release/*`
- Rollback Git Data API steps authenticate with the Commit app token
(same as finalize) so protected `release/*` ref updates are not blocked
- Canonical `retry()` implementation lives in
`.github/scripts/retry.sh`; `setup-env` and BATS source it so CI and
tests stay aligned (`sync-main-to-dev.yml` keeps an inline copy
documented as in sync)
- **Release rollback restores release PR body after finalize**
([#502](#502))
- `rollback` job in `release.yml` restores the PR description from
pre-finalization `CHANGELOG.md` (TBD / prepare-release format) using
RELEASE_APP when `release_kind` is final, after branch rollback; failure
issue and job summary report the step outcome
- **Final release notes extraction after linked changelog headings**
([#504](#504))
- Publish job `awk` matches `## [VERSION]` prefix so finalized `##
[X.Y.Z](url) - date` headings produce GitHub Release notes (regression
after prepare-changelog linked headings in #496)

### Security

- **Nightly vulnerability gate for published container image**
([#461](#461))
- Scheduled security scan now fails on fixable HIGH/CRITICAL CVEs and
auto-files a GitHub issue, replacing the previous non-blocking weekly
scan
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@c-vigo c-vigo c-vigo approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@c-vigo