chore(deps): bump actions/checkout from 4 to 7 - #174
Closed
dependabot[bot] wants to merge 132 commits into
Closed
Conversation
- 4-crate Cargo workspace (core, api, cli, mcp) - SQLite schema: accounts, posts, schedules, comments, analytics, media, rate_tracking - Axum HTTP server with 20+ route handlers (stubbed) - Clap CLI with 7 command groups (account, post, schedule, comment, analytics, media, token-check) - MCP server (stdio JSON-RPC) with 13 tools declared - DESIGN.md: full architecture specification - Dockerfile (cargo-chef multi-stage) - GitHub Actions CI (fmt, clippy, test, build)
… API, CLI, MCP - titen-core: Threads Graph API client (publish, insights, comments, token refresh) - titen-core: Scheduler (tokio-cron-scheduler) for scheduled posts - titen-core: Sentiment engine (stub + keyword-based) - titen-core: S3 storage via reqwest (generic S3-compatible) - titen-api: All route handlers wired to real store/Threads operations - titen-api: API key auth middleware (X-API-Key header) - titen-api: Extracted lib.rs for CLI re-use - titen-cli: All commands call API via reqwest client - titen-cli: Added api.rs helper module - titen-mcp: Full tools/call dispatch to store operations (10 tools) - All clippy clean, fmt clean, compiles with zero warnings
- titen-core: 44 unit tests (sentiment, error, models, compute_summary) - titen-api: 15 integration tests (accounts/posts/schedules CRUD) - README.md: full docs with setup, CLI, API, MCP, Docker - Crate-level /// docs for all 4 crates - All 59 tests pass, clippy clean, fmt clean
- Fix container/publish URLs: me -> /{threads_user_id}/threads*
- Fix insights: use /{id}/insights?metric= edge format
- Add reply management: create, hide, sentiment
- Add carousel support (3-step container flow)
- Add topic_tag, link_attachment, gif_attachment params
- Add user insights endpoint
- Add user profile retrieval
- Add publishing limit check
- Add keyword search
- Add new models: ContainerStatus, UserProfile, PublishingLimit,
InsightMetric, UserInsightMetric, LinkTotalValue, CreateReply
- Update API routes and MCP tools for all new features
- From<Vec<InsightMetric>> impl for backwards-compatible Insights
- New config module with env var consts, default values, helper fns - Default DB path: ~/.codecoradev/titen/titen.db (auto-creates dir) - Default host: 0.0.0.0, port: 7845, URL: http://localhost:7845 - All 4 binaries (api, cli, cli/serve, mcp) now import from one source - Eliminates 4x duplicated hardcoded defaults
…esh tokens - Remove refresh_token from Account/CreateAccount/UpdateAccount/DB (Threads API uses access_token only for refresh, no separate token) - Add 002 + 003 migrations (drop refresh_token, add app_secret) - Auto-resolve user_id + username from /me when adding account - Auto-exchange short-lived → long-lived token when app_secret provided - Add ensure_valid_token() auto-refresh guard (refresh if expiring/expired) - Add exchange_long_lived_token() for short→long exchange - Add resolve_account() to fetch user_id+username from access_token - Simplify CLI: accounts add --token [TOKEN] (username/user_id optional) - Clean up DRY: remove all refresh_token references from store queries
- Multi-stage Rust build (builder → slim runtime) - Exposes titen-api (7845), titen-cli, titen-mcp binaries - docker-compose with volume mount for persistent DB - Health check at /health (skip auth) for Traefik/CF Tunnel
- Fix binary name: titen-cli -> titen (matches Cargo output) - Add VERSION ARG + OCI labels to Dockerfile - Add production image comment to docker-compose.yml - Add GitHub Actions release workflow (verify-main -> build 3 arch -> release + Docker push GHCR/DockerHub) - Add binaries/ to .gitignore - Matches uteke Docker pattern (CI binary download, multi-stage, non-root, healthcheck)
- Split Check & Lint into separate Check, Format, Clippy jobs - Add --all-targets to check and clippy - Add RUST_BACKTRACE=1 - Remove toolchain pin (use stable like uteke) - Remove build dependency on check/test (all parallel) - Add push trigger on main branch
- Remove unused imports: routing::{delete, post} (used as methods, not functions)
- Remove unused import: tower::ServiceExt
- Prefix unused variable with underscore: _account
feat: fix Docker files + add release workflow
- Security: cargo-audit + trivy daily scan (matches uteke pattern) - Cora AI code review on PR to develop/main - Triggers: push, PR, schedule (06:00 UTC), manual dispatch
feat: add security + code review workflows
- Fix SQL injection in list_posts() and list_schedules(): replace format!() string interpolation with parameterized ? binds - Fix timing attack on API key auth: replace == with subtle::ConstantTimeEq constant-time comparison - Fix access_token exposure in API responses: add safe_account_json() helper, strip token from create/update/refresh - Fix CORS permissive() default: add TITEN_CORS_ORIGINS env var (comma-separated), fallback to permissive - Fix migration crash on restart: all 14 CREATE INDEX now use IF NOT EXISTS Verified: build clean, 59 tests pass, clippy -D warnings, fmt ok
fix: security hardening — SQL injection, timing attack, token leak, CORS
Release workflow extracts Linux binaries to binaries/ directory before Docker build, but .dockerignore was blocking COPY binaries/ in Dockerfile.
fix: remove binaries/ from .dockerignore for CI Docker builds
libssl3t64 is a Trixie-only package, not available in Bookworm. Matches uteke Dockerfile which uses trixie-slim.
fix: upgrade Dockerfile base to debian:trixie-slim
* fix(security): production security hardening — P1+P2+P3 partial P1 — Production Blockers: - Startup guard: TITEN_ENV=prod or TRAEFIK_ENABLED=true enforces API key + encryption - TITEN_REQUIRE_ENCRYPTION defaults to true in production mode - Auth cookie Secure flag auto-detected from X-Forwarded-Proto header P2 — Security Hardening: - Rate limiting on /api/auth/login (5 attempts/15min per IP, auto-reset) - Upload size limit 10MB (DefaultBodyLimit on protected routes) - Error message leakage: internal errors logged server-side only, generic messages to client - SQLite WAL mode + busy_timeout=5000ms for concurrent access - RUST_LOG default changed from debug to info - API key via query param removed (header+cookie only) P3 — Should Fix (partial): - Swagger UI disabled in production unless TITEN_ENABLE_SWAGGER=true - CORS tightened: explicit methods + headers instead of Any - SQLite connection pool: max_connections=5, acquire_timeout=5s Files changed: - crates/titen-api/src/server.rs — startup guards, WAL, CORS, swagger, body limit - crates/titen-api/src/routes/auth.rs — rate limiting, secure cookie auto-detect - crates/titen-api/src/routes/media.rs — error leakage fix - .env.example — production mode docs * fix(security): P3 remaining — media auth, MIME validation, SSRF guard, bun audit P3.1: /media/* static files behind api_key_auth middleware P3.4: Magic bytes validation for uploads (JPEG/PNG/GIF/WebP/MP4/WebM) P3.5: bun audit job in CI for frontend dependency scanning P3.7: Branch protection — required status checks + linear history P3.8: URL validation (HTTPS-only, block internal/private IPs) * feat(web): P4 media UX — drag-drop upload, lightbox, multi-file, copy URL - Drag-and-drop zone with visual feedback - Lightbox preview dialog for images & videos - Multiple file upload support - Copy URL button per media item - Type-aware preview (image/video/file placeholder) - Video player in lightbox Note: Media picker for post creation deferred — no post create form exists yet. * fix(ci): bun audit exit code — only fail on high/critical vulns bun audit --level high exits 1 even when only low/moderate vulns exist. Filter output to only fail on actual high+ vulnerabilities. --------- Co-authored-by: ajianaz <ajianaz@users.noreply.github.com>
…d URLs, pagination (#143) * feat: P5 polish — dashmap rate limiter, opaque sessions, presigned URLs, pagination, parallel upload, CI coverage P5.1: Replace std::sync::Mutex<HashMap> with dashmap::DashMap for login rate limiter — eliminates lock contention under concurrent auth attempts. P5.2: Add backend pagination (limit/offset + total count) to media listing API. Frontend now paginates 20 items per page with Previous/Next controls. P5.3: Implement S3 presigned URL generation using existing SigV4 primitives. Private buckets can now serve time-limited URLs without exposing credentials. P5.4: Replace raw API key in session cookie with opaque session token. Cookie now stores HMAC-randomized token mapped to API key server-side via DashMap. Auto-expires after 7 days. Reduces key exposure window. P5.6: Parallel multi-file upload using Promise.allSettled with concurrency limit of 3. Sequential uploads replaced with concurrent transfers. P5.7: Add CI coverage job using cargo-llvm-cov with Codecov upload. * fix: address cora review findings — 256-bit token entropy, graceful RNG error handling CRITICAL: generate_session_token() was hashing 256-bit random bytes through DefaultHasher (u64 output = 64 bits). Now hex-encodes the full 32 bytes for complete 256-bit entropy in the session token. MAJOR: getrandom::fill().expect() could panic the server process on RNG failure. Now returns Result<>, propagated as Option<String> through issue_session(). Login handler returns 500 gracefully. All 78 tests pass. Clippy clean. FE build clean. * fix: address CodeCora PR review — clamp limit/offset before DB query, simplify session validation Finding 1 (Major): MediaFilter limit/offset was clamped in the handler for display purposes but the original unclamped filter was passed to list_media/count_media. A client requesting limit=99999 would get all records while the response claimed limit=1000. Now constructs a clamped MediaFilter before the DB query. Finding 2 (Medium): Session handler redundantly compared validate_session() result against state.api_key via ct_eq. This defeats the purpose of opaque sessions — if the API key rotates, all sessions invalidate immediately. Simplified to trust validate_session() since the session was issued after key verification at login time. --------- Co-authored-by: ajianaz <ajianaz@users.noreply.github.com>
…onsistently (#144) CodeCora finding (storage.rs): canonical query string only encoded the credential value while leaving other values as literals. While current values (AWS4-HMAC-SHA256, host) are alphanumeric no-ops, the pattern is fragile. Now all values pass through url_encode() for consistency and future-proofing. Co-authored-by: ajianaz <ajianaz@users.noreply.github.com>
#131: form-hint → form-helper (4 occurrences in schedules page) #130: Remove redundant .btn prefix from btn-success/btn-secondary/btn-danger/btn-ghost (PostDetail, ScheduleDetail) #128: Extract scoped modal styles to global .detail-* classes in app.css — eliminate DRY violation between PostDetail and ScheduleDetail #132: Extract 33 static inline styles to utility classes (47→14 remaining, 13 are dynamic template expressions) Verified: cargo check + clippy + fmt + test (11 suites ok) + bun run build Co-authored-by: ajianaz <ajianaz@users.noreply.github.com>
Co-authored-by: ajianaz <ajianaz@users.noreply.github.com>
Backend registered /health without /api prefix, but SvelteKit proxy forwards /api/health from the frontend client. Added /api/health route alias pointing to the same handler. Bumps to 0.6.1. Co-authored-by: ajianaz <ajianaz@users.noreply.github.com>
The LICENSE file and Cargo.toml already declared Apache-2.0, but the README badge and License section still referenced AGPL-3.0-only. This resolves the license discrepancy flagged in the BMAD architecture review (GAP-1, CRITICAL). ## What - README badge: AGPL-3.0 → Apache-2.0 - README License section: AGPL-3.0-only → Apache-2.0 ## Why License discrepancy is a legal blocker for adoption. AGPL-3.0 (strong copyleft) and Apache-2.0 (permissive) are fundamentally different licenses. The actual LICENSE file is Apache-2.0 — the README was wrong. ## Changes - README.md line 4: badge URL updated - README.md line 430: license text updated ## Testing - grep -rni agpl → 0 matches across all project files - LICENSE file unchanged (already Apache-2.0) - Cargo.toml unchanged (already Apache-2.0) Co-authored-by: ajianaz <ajianaz@users.noreply.github.com>
## What Replace the in-memory DashMap session store with SQLite-backed persistence. Sessions now survive server restarts instead of logging out all users. ## Why Every server restart (deploy, crash, maintenance) invalidated all user sessions because they lived only in process memory. This is a poor UX for a production service — users must re-login after every deploy. ## Changes - Add migration 011_sessions_table.sql (sessions: token, api_key, expires_at) - Register migration 011 in store.rs migrate() with "already exists" tolerance - auth.rs: replace static DashMap with static SqlitePool (OnceLock) - init_session_pool(pool) — called during server startup - issue_session() — async, INSERT into sessions table - validate_session() — async, SELECT with expiry check - logout_session() — new, DELETE from sessions table - Keep token generation (256-bit hex) and 7-day TTL unchanged - Keep MAX_SESSIONS cleanup (DELETE WHERE expires_at < now) - server.rs: update middleware to await validate_session - server.rs: call init_session_pool(pool) after migration - auth.rs: logout handler now deletes session server-side before clearing cookie - auth.rs: session() handler awaits validate_session - LOGIN_ATTEMPTS DashMap unchanged (rate limiter stays in-memory) ## Testing - cargo fmt --check: clean - cargo clippy --all-targets -D warnings: clean - cargo test: 62 passed, 0 failed Co-authored-by: ajianaz <ajianaz@users.noreply.github.com>
…guide (#150) ## What Add comprehensive contributing guide covering: - Quick start setup (Rust, Bun, SQLite prerequisites) - Project structure (4-crate workspace + SvelteKit frontend) - Coding standards (Rust edition 2024, clippy -D warnings, Svelte 5 runes) - Git conventions (branch naming, Conventional Commits, squash merge) - Pre-commit hook workflow (fmt → clippy → cora review) - CI checks table (9 checks all PRs must pass) - Testing guide (unit, integration, in-memory SQLite pattern) - Database migration instructions - MCP tool addition guide - Security considerations - CLA requirement ## Why No contributing documentation existed. New contributors had to reverse-engineer the workflow from CI configs and pre-commit hooks. This document codifies all conventions in one place. ## Changes - New file: CONTRIBUTING.md (130 lines) ## Testing - Markdown rendered correctly in GitHub preview - All referenced paths verified against actual repo structure Co-authored-by: ajianaz <ajianaz@users.noreply.github.com>
…-RPC protocol (#151) ## What Add comprehensive test suite for titen-mcp crate (previously had ZERO tests despite 29 tool handlers and 1562 LOC). ## Why The MCP server is the primary differentiator of Titen — it exposes 29 tools for AI agents via JSON-RPC over stdio. Having no test coverage for this critical component was a HIGH risk identified in the BMAD assessment. ## Changes - New file: crates/titen-mcp/src/tests.rs (29 unit tests) - JSON-RPC protocol: error codes, null/string IDs, parse errors - Tool list completeness: all 29 tools present, each with name+description+schema - Argument extraction: account_id, post_id, int args, missing args - Caption length validation (#136): at-limit, over-limit, unicode counting - Tool name routing: unknown tools produce error, known tools route correctly - MCP response wrapping: success content, error isError flag - SSRF protection: localhost, internal TLDs, private IPs (v4+v6) - Magic bytes validation: JPG, PNG, GIF, WebP, too-short, unknown ext - New file: crates/titen-mcp/tests/mcp_integration.rs (24 integration tests) - Account: empty DB, create+list, multiple accounts, not-found - Post: empty, create+get, create+list, filtered by account, delete, not-found - Schedule: empty, create+get, create+list, cancel, approve, reject, not-found - Comment: insert+list, empty post, nonexistent post - Media: empty list, Mentions: empty list, Trend: no snapshots - Modified: crates/titen-mcp/src/main.rs (add #[cfg(test)] mod declaration) ## Testing cargo test -p titen-mcp → 53 passed (29 unit + 24 integration), 0 failed Co-authored-by: ajianaz <ajianaz@users.noreply.github.com>
* test: add CLI test suite covering 27 argument parsing tests ## What Add comprehensive test suite for titen-cli crate (previously had ZERO tests despite 648+ LOC across 8 subcommand modules). ## Why The CLI is the primary interface for managing Titen from the terminal. No test coverage meant any clap arg refactor could silently break the UX. ## Changes - **New: `crates/titen-cli/src/lib.rs`** — library facade exposing Cli/Commands and all command modules for integration testing - **New: `crates/titen-cli/tests/cli_parsing.rs`** (27 tests) - Serve: all-args, defaults, short flags (-p, --host) - Account: list, add full (5 fields), add minimal (token only), remove, refresh - Post: create, list, list with filters, delete - Schedule: list, create, upcoming, cancel - Comment: fetch, list - Analytics: posts with date range, trend - Media: list, upload, delete - TokenCheck: standalone subcommand - Error cases: unknown subcommand, missing required args - **Modified: `crates/titen-cli/src/main.rs`** — use titen_cli lib facade - **Modified: all 6 command modules** — add #[derive(Debug)] to action enums ## Testing cargo test -p titen-cli → 27 passed, 0 failed * fix: restore -H short flag for serve host arg Use -H instead of -h to avoid clap built-in help conflict (-h is reserved for --help in clap derive by default). --------- Co-authored-by: ajianaz <ajianaz@users.noreply.github.com>
## What - Enhanced /health: now checks DB connectivity (SELECT 1) and reports uptime - New /ready: deep readiness check — DB ping w/ latency, encryption mode, active sessions - New /metrics: JSON stats — account/post/schedule/comment/session counts + system info - Auth middleware skips /ready and /metrics (public endpoints) - OpenAPI docs updated with new paths ## Why BMAD v0.7-5 identified observability gap — health was shallow (always "ok"), no way to verify DB connectivity or get basic system stats. Critical for Docker healthcheck reliability and debugging. ## Changes - crates/titen-core/src/store.rs: Add db_ping(), count_sessions(), count_accounts(), count_posts(), count_schedules(), count_comments() helper methods - crates/titen-api/src/server.rs: Enhanced health_check, new readiness_check + metrics handlers, START_TIME static for uptime, auth bypass for /ready + /metrics - crates/titen-api/src/openapi.rs: Register readiness_check + metrics paths ## Testing - cargo test -p titen-core: 62 tests pass (no regressions) - cargo test -p titen-api: 5 tests pass (no regressions) - cargo check: clean compile Co-authored-by: ajianaz <ajianaz@users.noreply.github.com>
…0.7-7) (#154) ## What ### Backup/Restore CLI (v0.7-6) - New `titen backup` command — uses SQLite VACUUM INTO for consistent snapshot - New `titen restore` command — restore from backup file with safety net - Default backup filename: titen-backup-YYYYMMDD-HHMMSS.db - Restore creates pre-restore backup before overwriting - Confirmation prompt unless --yes flag ### Error Sanitization (v0.7-7) - New ApiError newtype wrapper implementing axum IntoResponse - Maps TitenError variants to appropriate HTTP status codes: - 404 for NotFound variants (safe to expose IDs) - 409 for AccountAlreadyExists - 400 for InvalidRequest - 401 for TokenExpired/TokenRefreshFailed - 429 for RateLimitExceeded - 500 for DatabaseError/StorageError/SentimentError/ConfigError (SANITIZED) - 502 for ThreadsApiError (SANITIZED) - Sensitive variants log full error via tracing::error! but return generic message - 11 tests covering all error type mappings ## Why - Backup/restore is critical for any database-backed app — especially before upgrades - Error responses were leaking internal details (SQL fragments, file paths, connection strings) - BMAD v0.7 security audit identified error sanitization as P1 priority ## Changes | File | Change | |------|--------| | crates/titen-cli/src/main.rs | +backup_database() and restore_database() functions | | crates/titen-cli/src/lib.rs | +Backup and Restore CLI subcommands | | crates/titen-cli/Cargo.toml | +sqlx dependency | | crates/titen-api/src/error.rs | New file — ApiError newtype + IntoResponse impl | | crates/titen-api/src/lib.rs | +pub mod error | ## Testing - cargo test --workspace: ALL PASS (62 core + 27 CLI + 11 API error + others) - cargo check: clean compile - clippy clean Co-authored-by: ajianaz <ajianaz@users.noreply.github.com>
…-8b) (#155) ## What - SQLite pool max_connections now reads from TITEN_DB_MAX_CONNECTIONS env var - Defaults to 5 if unset or invalid (backward compatible) ## Why - Production deployments may need more/fewer connections based on load - Hardcoded value was inflexible for different deployment scenarios ## Testing - cargo test -p titen-api: ALL PASS Co-authored-by: ajianaz <ajianaz@users.noreply.github.com>
Co-authored-by: ajianaz <ajianaz@users.noreply.github.com>
* fix: security hardening — 7 audit findings (#157-#163) ## What - #157: Escape single quotes in VACUUM INTO path (SQL injection fix) - #158: Default bind 127.0.0.1 instead of 0.0.0.0 - #159: Normalize auth bypass path (trim trailing slash) - #160: /metrics requires auth unless TITEN_PUBLIC_METRICS=true - #161: Restore warning to stop server first - #162: Pre-restore backup uses timestamp instead of fixed name - #163: Remove CLA requirement from CONTRIBUTING.md ## Why Cora + GHAS review bots flagged these issues on PRs #150-#154. SQL injection and default bind were critical/medium security concerns. ## Changes - crates/titen-cli/src/main.rs: VACUUM escape + restore warning + timestamp - crates/titen-cli/src/lib.rs: default host 127.0.0.1 - crates/titen-api/src/server.rs: path normalization + metrics auth toggle - crates/titen-cli/tests/cli_parsing.rs: update default host assertion - CONTRIBUTING.md: remove CLA section ## Testing - cargo test --workspace: ALL PASS (0 failures) - cargo clippy: 0 warnings * fix: address Cora review — path allowlist + OnceLock for env var - Replace quote escaping with strict character allowlist for VACUUM INTO path (alphanumeric + / - _ . only). Reject unsafe paths with clear error. - Use OnceLock for TITEN_PUBLIC_METRICS to avoid env scan on every request. * fix: allow spaces in backup path validation allowlist * fix: add Windows path support (\, :) to backup validation allowlist * docs: add CRITICAL comment on SQL injection prevention in allowlist --------- Co-authored-by: ajianaz <ajianaz@users.noreply.github.com>
Co-authored-by: ajianaz <ajianaz@users.noreply.github.com>
* feat(v0.7.1): token auto-refresh in MCP + titen status command Token expiry auto-refresh: - Add ensure_valid_token call to 7 MCP handlers that hit Threads API - Handlers: get_user_profile, get_publishing_limit, fetch_comments, get_post_insights, fetch_mentions, search_keyword, reply_to_comment - Previously only scheduler refreshed tokens — MCP would fail on expired tokens titen status command: - New CLI command showing system overview via direct SQLite access - Displays: version, DB info, account counts, token health, content counts - Per-account token expiry with remaining time - Health summary: HEALTHY / WARNING / DEGRADED - No server required — reads DB directly Test: test_status added to CLI parsing suite (28 tests pass) * fix: surface DB errors instead of unwrap_or_default in status command CodeCora review: unwrap_or_default/unwrap_or(0) silently hides DB errors, reporting 0 counts even when accounts exist. Replace with ? operator for proper error propagation. * fix: ensure pool.close() always runs in status command CodeCora review: early return via ? operator skips pool.close(), potentially leaving SQLite WAL/journal files locked. Restructured to extract query logic into query_status_data() helper, then always close pool before propagating errors. --------- Co-authored-by: ajianaz <ajianaz@users.noreply.github.com>
Restructure CONTRIBUTING.md to match Uteke's mature format — adds 'What makes a good contribution', 'Keep changes focused', 'Discuss first', 'What Titen is not', and FAQ sections. Preserves Titen-specific content (frontend/bun workflow, multi-crate architecture, MCP tools, token encryption, database migrations). Update issue templates to Uteke format — structured OS dropdown, version input field, 'willing to contribute' dropdown on feature requests. Keep Titen component list (titen-core/api/cli/mcp/web). Fix PR template Cora link to cora-cli repo. Add dependabot.yml for cargo, github-actions, and docker ecosystem weekly updates. Co-authored-by: ajianaz <ajianaz@users.noreply.github.com>
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
🔍 Cora AI Code ReviewReview powered by cora-code · BYOK · MIT |
Author
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
dependabot
Bot
deleted the
dependabot/github_actions/actions/checkout-7
branch
August 20, 2026 08:08
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps actions/checkout from 4 to 7.
Release notes
Sourced from actions/checkout's releases.
... (truncated)
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
3d3c42eprep v7.0.1 release (#2531)2880268escape values passed to --unset (#2530)12cd223trim only ascii whitespace for branch (#2521)62661c4skip running unsafe pr check if input is default (#2518)e8d4307Bump the minor-actions-dependencies group with 2 updates (#2499)631c942eslint 9 (#2474)4f1f4aeBump actions/upload-artifact from 4 to 7 (#2476)ba09753Bump actions/checkout from 6 to 7 (#2488)b9e0990Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)e8cb398Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)