The Great PR#486
Merged
Merged
Conversation
Pin Vite to patched 8.0.x release
Harden documented checkout credentials
Render stored lock reasons as inert Markdown
Bumps the npm_and_yarn group with 1 update in the / directory: [js-yaml](https://github.com/nodeca/js-yaml). Updates `js-yaml` from 4.1.1 to 4.2.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.1...4.2.0) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.2.0 dependency-type: direct:development dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>
…check-mode-issue Fix required-check precheck bypass for legacy status contexts
…_yarn-4e38a52fea chore(deps-dev): bump js-yaml from 4.1.1 to 4.2.0 in the npm_and_yarn group across 1 directory
Migrate branch-deploy to TypeScript
Harden TypeScript-native action contracts
Add versioned release automation
Release v11.1.6
Pin js-yaml to 4.3.0
nobe4
reviewed
Jul 21, 2026
nobe4
reviewed
Jul 21, 2026
Remove redundant bundle smoke imports
Support releases in both repositories
Make fork releases opt in
Harden upstream v12 follow-ups
Expand branch-deploy edge-case tests
Protect automatic deployment lock cleanup
…-failure Complete deployments when post reporting fails
Paginate deployment label cleanup
Contributor
Author
|
@nobe4 before merging could you please confirm that Example on the repo's General settings tab 
|
…tities Fail closed on unknown check identities
Recheck stable branches from fork deployments
Preserve deployment locks in manual workflow examples
Honor check exclusions before rejecting identities
nobe4
approved these changes
Jul 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why this PR exists
This is a large PR, but the goal is simple: move
branch-deployonto a safer, smaller, and easier-to-maintain v12 foundation.I built and reviewed this foundation as 35 smaller PRs in my fork, then released it as the immutable and attested
v12.0.0release. The PR head now includes a small post-releasejs-yamlsecurity update. The current upstreammaincommit is already in this history, so this PR does not undo any upstream work.What changed
@actions/core, and several smaller packages.dist/index.jsmain and post lifecycle against a strict mock GitHub API. First-party code keeps 100% line, branch, and function coverage.js-yaml4.3.0 security pin.mainnow verifies the bundle, creates the exact version tag and immutable release, and moves thevMAJORtag after verification.Bug fixes
Migration guide
v12 includes some breaking changes. The v11 to v12 upgrade guide explains them and includes a ready-to-use prompt for coding agents.
I know this is a lot to review, and I am happy to walk through any part of it or split review by area.