chore(deps): update github actions (#351)

renovate[bot] · web-flow · commit f4587405fe99 · 2026-07-14T12:54:34.000+01:00
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [peaceiris/actions-gh-pages](https://redirect.github.com/peaceiris/actions-gh-pages) | action | minor | `v4.0.0` → `v4.1.0` | | [softprops/action-gh-release](https://redirect.github.com/softprops/action-gh-release) | action | minor | `v2.4.1` → `v2.6.2` | | [ytanikin/pr-conventional-commits](https://redirect.github.com/ytanikin/pr-conventional-commits) | action | minor | `1.4.2` → `1.5.2` | --- ### Release Notes <details> <summary>peaceiris/actions-gh-pages (peaceiris/actions-gh-pages)</summary> ### [`v4.1.0`](https://redirect.github.com/peaceiris/actions-gh-pages/releases/tag/v4.1.0): actions-github-pages v4.1.0 [Compare Source](https://redirect.github.com/peaceiris/actions-gh-pages/compare/v4...v4.1.0) See [CHANGELOG.md](https://redirect.github.com/peaceiris/actions-gh-pages/blob/v4.1.0/CHANGELOG.md) for more details. #### What's Changed - Actions examples: update to modern versions of actions by [@&#8203;clintonsteiner](https://redirect.github.com/clintonsteiner) in [#&#8203;1117](https://redirect.github.com/peaceiris/actions-gh-pages/pull/1117) - chore: update Node runtime and dependencies by [@&#8203;peaceiris](https://redirect.github.com/peaceiris) in [#&#8203;1147](https://redirect.github.com/peaceiris/actions-gh-pages/pull/1147) - ci: harden GitHub Actions workflows by [@&#8203;peaceiris](https://redirect.github.com/peaceiris) in [#&#8203;1156](https://redirect.github.com/peaceiris/actions-gh-pages/pull/1156) #### New Contributors - [@&#8203;clintonsteiner](https://redirect.github.com/clintonsteiner) made their first contribution in [#&#8203;1117](https://redirect.github.com/peaceiris/actions-gh-pages/pull/1117) **Full Changelog**: <peaceiris/actions-gh-pages@v4.0.0...v4.1.0> </details> <details> <summary>softprops/action-gh-release (softprops/action-gh-release)</summary> ### [`v2.6.2`](https://redirect.github.com/softprops/action-gh-release/releases/tag/v2.6.2) [Compare Source](https://redirect.github.com/softprops/action-gh-release/compare/v2.6.1...v2.6.2)  #### What's Changed ##### Other Changes 🔄 - chore(deps): bump picomatch from 4.0.3 to 4.0.4 by [@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&#8203;775](https://redirect.github.com/softprops/action-gh-release/pull/775) - chore(deps): bump brace-expansion from 5.0.4 to 5.0.5 by [@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&#8203;777](https://redirect.github.com/softprops/action-gh-release/pull/777) - chore(deps): bump vite from 8.0.0 to 8.0.5 by [@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&#8203;781](https://redirect.github.com/softprops/action-gh-release/pull/781) **Full Changelog**: <softprops/action-gh-release@v2...v2.6.2> ### [`v2.6.1`](https://redirect.github.com/softprops/action-gh-release/releases/tag/v2.6.1) [Compare Source](https://redirect.github.com/softprops/action-gh-release/compare/v2.6.0...v2.6.1) `2.6.1` is a patch release focused on restoring linked discussion thread creation when `discussion_category_name` is set. It fixes `#764`, where the draft-first publish flow stopped carrying the discussion category through the final publish step. If you still hit an issue after upgrading, please open a report with the bug template and include a minimal repro or sanitized workflow snippet where possible. #### What's Changed ##### Bug fixes 🐛 - fix: preserve discussion category on publish by [@&#8203;chenrui333](https://redirect.github.com/chenrui333) in [#&#8203;765](https://redirect.github.com/softprops/action-gh-release/pull/765) ### [`v2.6.0`](https://redirect.github.com/softprops/action-gh-release/releases/tag/v2.6.0) [Compare Source](https://redirect.github.com/softprops/action-gh-release/compare/v2.5.3...v2.6.0) `2.6.0` is a minor release centered on `previous_tag` support for `generate_release_notes`, which lets workflows pin GitHub's comparison base explicitly instead of relying on the default range. It also includes the recent concurrent asset upload recovery fix, a `working_directory` docs sync, a checked-bundle freshness guard for maintainers, and clearer immutable-prerelease guidance where GitHub platform behavior imposes constraints on how prerelease asset uploads can be published. If you still hit an issue after upgrading, please open a report with the bug template and include a minimal repro or sanitized workflow snippet where possible. #### What's Changed ##### Exciting New Features 🎉 - feat: support previous\_tag for generate\_release\_notes by [@&#8203;pocesar](https://redirect.github.com/pocesar) in [#&#8203;372](https://redirect.github.com/softprops/action-gh-release/pull/372) ##### Bug fixes 🐛 - fix: recover concurrent asset metadata 404s by [@&#8203;chenrui333](https://redirect.github.com/chenrui333) in [#&#8203;760](https://redirect.github.com/softprops/action-gh-release/pull/760) ##### Other Changes 🔄 - docs: clarify reused draft release behavior by [@&#8203;chenrui333](https://redirect.github.com/chenrui333) in [#&#8203;759](https://redirect.github.com/softprops/action-gh-release/pull/759) - docs: clarify working\_directory input by [@&#8203;chenrui333](https://redirect.github.com/chenrui333) in [#&#8203;761](https://redirect.github.com/softprops/action-gh-release/pull/761) - ci: verify dist bundle freshness by [@&#8203;chenrui333](https://redirect.github.com/chenrui333) in [#&#8203;762](https://redirect.github.com/softprops/action-gh-release/pull/762) - fix: clarify immutable prerelease uploads by [@&#8203;chenrui333](https://redirect.github.com/chenrui333) in [#&#8203;763](https://redirect.github.com/softprops/action-gh-release/pull/763) ### [`v2.5.3`](https://redirect.github.com/softprops/action-gh-release/releases/tag/v2.5.3) [Compare Source](https://redirect.github.com/softprops/action-gh-release/compare/v2.5.2...v2.5.3)  `2.5.3` is a patch release focused on the remaining path-handling and release-selection bugs uncovered after `2.5.2`. It fixes `#639`, `#571`, `#280`, `#614`, `#311`, `#403`, and `#368`. It also adds documentation clarifications for `#541`, `#645`, `#542`, `#393`, and `#411`, where the current behavior is either usage-sensitive or constrained by GitHub platform limits rather than an action-side runtime bug. If you still hit an issue after upgrading, please open a report with the bug template and include a minimal repro or sanitized workflow snippet where possible. #### What's Changed ##### Bug fixes 🐛 - fix: prefer token input over GITHUB\_TOKEN by [@&#8203;chenrui333](https://redirect.github.com/chenrui333) in [#&#8203;751](https://redirect.github.com/softprops/action-gh-release/pull/751) - fix: clean up duplicate drafts after canonicalization by [@&#8203;chenrui333](https://redirect.github.com/chenrui333) in [#&#8203;753](https://redirect.github.com/softprops/action-gh-release/pull/753) - fix: support Windows-style file globs by [@&#8203;chenrui333](https://redirect.github.com/chenrui333) in [#&#8203;754](https://redirect.github.com/softprops/action-gh-release/pull/754) - fix: normalize refs-tag inputs by [@&#8203;chenrui333](https://redirect.github.com/chenrui333) in [#&#8203;755](https://redirect.github.com/softprops/action-gh-release/pull/755) - fix: expand tilde file paths by [@&#8203;chenrui333](https://redirect.github.com/chenrui333) in [#&#8203;756](https://redirect.github.com/softprops/action-gh-release/pull/756) ##### Other Changes 🔄 - docs: clarify token precedence by [@&#8203;chenrui333](https://redirect.github.com/chenrui333) in [#&#8203;752](https://redirect.github.com/softprops/action-gh-release/pull/752) - docs: clarify GitHub release limits by [@&#8203;chenrui333](https://redirect.github.com/chenrui333) in [#&#8203;758](https://redirect.github.com/softprops/action-gh-release/pull/758) - documentation clarifications for empty-token handling, `preserve_order`, and special-character asset filename behavior **Full Changelog**: <softprops/action-gh-release@v2...v2.5.3> ### [`v2.5.2`](https://redirect.github.com/softprops/action-gh-release/releases/tag/v2.5.2) [Compare Source](https://redirect.github.com/softprops/action-gh-release/compare/v2.5.1...v2.5.2)  `2.5.2` is a patch release focused on the remaining release-creation and prerelease regressions in the `2.5.x` bug-fix cycle. It fixes `#705`, fixes `#708`, fixes `#740`, fixes `#741`, and fixes `#722`. Regression testing covers the shared-tag race, prerelease event behavior, dotfile asset labels, same-filename concurrent uploads, and blocked-tag cleanup behavior. If you still hit an issue after upgrading, please open a report with the bug template and include a minimal repro or sanitized workflow snippet where possible. #### What's Changed ##### Bug fixes 🐛 - fix: canonicalize releases after concurrent create by [@&#8203;chenrui333](https://redirect.github.com/chenrui333) in [#&#8203;746](https://redirect.github.com/softprops/action-gh-release/pull/746) - fix: preserve prereleased events for prereleases by [@&#8203;chenrui333](https://redirect.github.com/chenrui333) in [#&#8203;748](https://redirect.github.com/softprops/action-gh-release/pull/748) - fix: restore dotfile asset labels by [@&#8203;chenrui333](https://redirect.github.com/chenrui333) in [#&#8203;749](https://redirect.github.com/softprops/action-gh-release/pull/749) - fix: handle upload already\_exists races across workflows by [@&#8203;api2062](https://redirect.github.com/api2062) in [#&#8203;745](https://redirect.github.com/softprops/action-gh-release/pull/745) - fix: clean up orphan drafts when tag creation is blocked by [@&#8203;chenrui333](https://redirect.github.com/chenrui333) in [#&#8203;750](https://redirect.github.com/softprops/action-gh-release/pull/750) #### New Contributors - [@&#8203;api2062](https://redirect.github.com/api2062) made their first contribution in [#&#8203;745](https://redirect.github.com/softprops/action-gh-release/pull/745) **Full Changelog**: <softprops/action-gh-release@v2...v2.5.2> ### [`v2.5.1`](https://redirect.github.com/softprops/action-gh-release/releases/tag/v2.5.1) [Compare Source](https://redirect.github.com/softprops/action-gh-release/compare/v2.5.0...v2.5.1)  `2.5.1` is a patch release focused on regressions introduced in `2.5.0` and on release lookup reliability. It fixes `#713`, addresses `#703`, and fixes `#724`. Regression testing shows that current `master` no longer reproduces the finalize-race behavior reported in `#704` and `#709`. #### What's Changed ##### Bug fixes 🐛 - fix: fetch correct asset URL after finalization; test; some refactoring by [@&#8203;pzhlkj6612](https://redirect.github.com/pzhlkj6612) in [#&#8203;738](https://redirect.github.com/softprops/action-gh-release/pull/738) - fix: release marked as 'latest' despite make\_latest: false by [@&#8203;Boshen](https://redirect.github.com/Boshen) in [#&#8203;715](https://redirect.github.com/softprops/action-gh-release/pull/715) - fix: use getReleaseByTag API instead of iterating all releases by [@&#8203;kim-em](https://redirect.github.com/kim-em) in [#&#8203;725](https://redirect.github.com/softprops/action-gh-release/pull/725) ##### Other Changes 🔄 - dependency updates, including the ESM/runtime compatibility refresh in [#&#8203;731](https://redirect.github.com/softprops/action-gh-release/pull/731) #### New Contributors - [@&#8203;autarch](https://redirect.github.com/autarch) made their first contribution in [#&#8203;716](https://redirect.github.com/softprops/action-gh-release/pull/716) - [@&#8203;pzhlkj6612](https://redirect.github.com/pzhlkj6612) made their first contribution in [#&#8203;738](https://redirect.github.com/softprops/action-gh-release/pull/738) - [@&#8203;Boshen](https://redirect.github.com/Boshen) made their first contribution in [#&#8203;715](https://redirect.github.com/softprops/action-gh-release/pull/715) - [@&#8203;kim-em](https://redirect.github.com/kim-em) made their first contribution in [#&#8203;725](https://redirect.github.com/softprops/action-gh-release/pull/725) **Full Changelog**: <softprops/action-gh-release@v2...v2.5.1> ### [`v2.5.0`](https://redirect.github.com/softprops/action-gh-release/releases/tag/v2.5.0) [Compare Source](https://redirect.github.com/softprops/action-gh-release/compare/v2.4.2...v2.5.0)  #### What's Changed ##### Exciting New Features 🎉 - feat: mark release as draft until all artifacts are uploaded by [@&#8203;dumbmoron](https://redirect.github.com/dumbmoron) in [#&#8203;692](https://redirect.github.com/softprops/action-gh-release/pull/692) ##### Other Changes 🔄 - chore(deps): bump the npm group across 1 directory with 5 updates by [@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&#8203;697](https://redirect.github.com/softprops/action-gh-release/pull/697) - chore(deps): bump actions/checkout from 5.0.0 to 5.0.1 in the github-actions group by [@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&#8203;689](https://redirect.github.com/softprops/action-gh-release/pull/689) #### New Contributors - [@&#8203;dumbmoron](https://redirect.github.com/dumbmoron) made their first contribution in [#&#8203;692](https://redirect.github.com/softprops/action-gh-release/pull/692) **Full Changelog**: <softprops/action-gh-release@v2.4.2...v2.5.0> ### [`v2.4.2`](https://redirect.github.com/softprops/action-gh-release/releases/tag/v2.4.2) [Compare Source](https://redirect.github.com/softprops/action-gh-release/compare/v2.4.1...v2.4.2) #### What's Changed ##### Exciting New Features 🎉 - feat: Ensure generated release notes cannot be over 125000 characters by [@&#8203;BeryJu](https://redirect.github.com/BeryJu) in [#&#8203;684](https://redirect.github.com/softprops/action-gh-release/pull/684) ##### Other Changes 🔄 - dependency updates #### New Contributors - [@&#8203;BeryJu](https://redirect.github.com/BeryJu) made their first contribution in [#&#8203;684](https://redirect.github.com/softprops/action-gh-release/pull/684) **Full Changelog**: <softprops/action-gh-release@v2.4.1...v2.4.2> </details> <details> <summary>ytanikin/pr-conventional-commits (ytanikin/pr-conventional-commits)</summary> ### [`v1.5.2`](https://redirect.github.com/ytanikin/pr-conventional-commits/releases/tag/1.5.2) [Compare Source](https://redirect.github.com/ytanikin/pr-conventional-commits/compare/1.5.1...1.5.2) #### What's Changed - fix: build(deps): bump minimatch from 3.1.2 to 3.1.5 by [@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&#8203;54](https://redirect.github.com/ytanikin/pr-conventional-commits/pull/54) **Full Changelog**: <ytanikin/pr-conventional-commits@1.5.1...1.5.2> ### [`v1.5.1`](https://redirect.github.com/ytanikin/pr-conventional-commits/releases/tag/1.5.1) [Compare Source](https://redirect.github.com/ytanikin/pr-conventional-commits/compare/1.5.0...1.5.1) #### What's Changed - fix(ci/Docker): Update entrypoint to absolute path for the action entrypoint by [@&#8203;gerardbosch](https://redirect.github.com/gerardbosch) in [#&#8203;52](https://redirect.github.com/ytanikin/pr-conventional-commits/pull/52) **Full Changelog**: <ytanikin/pr-conventional-commits@1.5.0...1.5.1> ### [`v1.5.0`](https://redirect.github.com/ytanikin/pr-conventional-commits/releases/tag/1.5.0) [Compare Source](https://redirect.github.com/ytanikin/pr-conventional-commits/compare/1.4.2...1.5.0) #### What's Changed - build(deps): bump form-data from 3.0.1 to 3.0.4 by [@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&#8203;44](https://redirect.github.com/ytanikin/pr-conventional-commits/pull/44) - fix: Error message for parameter `ticket_key_regex` by [@&#8203;gerardbosch](https://redirect.github.com/gerardbosch) in [#&#8203;49](https://redirect.github.com/ytanikin/pr-conventional-commits/pull/49) - ci: Switch to Docker action by [@&#8203;gerardbosch](https://redirect.github.com/gerardbosch) in [#&#8203;50](https://redirect.github.com/ytanikin/pr-conventional-commits/pull/50) #### New Contributors - [@&#8203;gerardbosch](https://redirect.github.com/gerardbosch) made their first contribution in [#&#8203;49](https://redirect.github.com/ytanikin/pr-conventional-commits/pull/49) **Full Changelog**: <ytanikin/pr-conventional-commits@1.4.2...1.5.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/DiamondLightSource/python-copier-template).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
diff --git a/.github/workflows/_docs.yml b/.github/workflows/_docs.yml
@@ -48,7 +48,7 @@ jobs:
         if: github.ref_type == 'tag' || github.ref_name == 'main'
         # We pin to the SHA, not the tag, for security reasons.
         # https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#using-third-party-actions
-        uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e # v4.0.0
+        uses: peaceiris/actions-gh-pages@84c30a85c19949d7eee79c4ff27748b70285e453 # v4.1.0
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           publish_dir: .github/pages
diff --git a/.github/workflows/_example.yml b/.github/workflows/_example.yml
@@ -28,7 +28,7 @@ jobs:
       - name: Publish example
         # We pin to the SHA, not the tag, for security reasons.
         # https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#using-third-party-actions
-        uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e # v4.0.0
+        uses: peaceiris/actions-gh-pages@84c30a85c19949d7eee79c4ff27748b70285e453 # v4.1.0
         with:
           deploy_key: ${{ secrets.EXAMPLE_DEPLOY_KEY }}
           publish_dir: /tmp/example
diff --git a/.github/workflows/_release.yml b/.github/workflows/_release.yml
@@ -23,7 +23,7 @@ jobs:
       - name: Create GitHub Release
         # We pin to the SHA, not the tag, for security reasons.
         # https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#using-third-party-actions
-        uses: softprops/action-gh-release@6da8fa9354ddfdc4aeace5fc48d7f679b5214090 # v2.4.1
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2
         with:
           prerelease: ${{ contains(github.ref_name, 'a') || contains(github.ref_name, 'b') || contains(github.ref_name, 'rc') }}
           files: "*"
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: PR Conventional Commit Validation
-        uses:  ytanikin/pr-conventional-commits@1.4.2
+        uses:  ytanikin/pr-conventional-commits@1.5.2
         with:
           task_types: '["feat","fix","docs","test","ci","refactor","perf","chore","revert"]'
           add_label: 'false'
