build(deps): bump github/gh-aw/actions/setup from 0.86.2 to 0.87.3 by dependabot[bot] · Pull Request #8626 · RustPython/RustPython

dependabot · 2026-08-31T13:24:45Z

Bumps github/gh-aw/actions/setup from 0.86.2 to 0.87.3.

Release notes

Sourced from github/gh-aw/actions/setup's releases.

v0.87.2

🌟 Release Highlights

This release strengthens sandbox security defaults, improves package/workflow update reliability, and ships a batch of linter, docs, and CI reliability fixes.

✨ What's New

External threat detection enabled by default (#54111) — workflows now get proactive threat-detection coverage out of the box, improving baseline security posture without extra configuration.

Cloud Hypervisor adopted across 58 agentic workflows (#54346) — broader migration improves sandbox isolation and reliability for agentic runs.

Scoped ownership for package resources (#54120) and re-resolved manifests during workflow updates (#54119) — package dependencies stay accurate and correctly scoped as workflows evolve.

New manualpathconcat linter (#54307) flags manual / path concatenation, catching a common class of path-handling bugs at compile time.

Support for runner groups in custom safe jobs (#53977) gives more control over where custom safe-output jobs execute.

🐛 Bug Fixes & Improvements

Fixed the logs MCP tool silently truncating explicit date-range queries to a single stale day with no warning (#54110).

Fixed safe-output inline-backtick neutralization (#54103) and JSON-array expressions in approve-workflow-run safe outputs (#53812).

Fixed a false-positive heredoc detection on bare (( )) arithmetic in the generatedyamlheredoc linter (#53991).

Hardened command argument validation for pip/uv checks and npm lockfile execution (#53957), and added regression coverage for pip argv validation before exec (#54282).

Fixed schedule-triggered workflow false positives and improved root-cause surfacing for disabled workflows in the health monitor (#53881).

Fixed approve_workflow_run handler load failure caused by an npm minimatch require (#54281).

Fixed actionlint error from an agent job referencing needs.approval_allowlist without a declared dependency (#54028).

Restored GHES-compatible artifact action pins (#53966) and hardened post-agent cache Git commits (#53879).

📚 Documentation

Clarified lock files and workflow setup commands (#54342), documented compiler-generated job authentication (#54100), and made Copilot auth docs easier to scan (#54337).

Documented PR fast-track triage criteria (#53880) and closed non-Copilot engine parity gaps for gh aw init and custom engine frontmatter (#53834).

Added workflow wizard links to documentation (#53862) and unbloated the network and safe-outputs PR references (#54104, #53875).> Generated by 🚀 Release · auto · 16.2 AIC · ⊞ 11.7K

What's Changed

Redirect Astro wizard docs to hosted wizard by @pelikhan with @Copilot in github/gh-aw#53815

[test-parallel] Daily Go Test Parallelizer: add t.Parallel() to safe pkg/cli subtests by @github-actions[bot] in github/gh-aw#53822

Add review-agentic-workflows skill for security-first workflow review and optimization triage by @pelikhan with @Copilot in github/gh-aw#53775

Remove hidden README and docs navigation text by @pelikhan with @Copilot in github/gh-aw#53816

Add workflow wizard links to documentation by @pelikhan with @Copilot in github/gh-aw#53862

[test-parallel] test: add t.Parallel() to TestCLIProxyBashDisabledCodemod subtests by @github-actions[bot] in github/gh-aw#53845

pr-sous-chef: document GraphQL fetch for reviewThreads (fixes invalid gh pr view field) by @pelikhan with @Copilot in github/gh-aw#53833

docs: close non-Copilot engine parity gaps for gh aw init and custom engine frontmatter by @pelikhan with @Copilot in github/gh-aw#53834

Fix JSON-array expressions in approve workflow run safe outputs by @pelikhan with @Copilot in github/gh-aw#53812

[docs] docs: unbloat safe outputs PR reference by @github-actions[bot] in github/gh-aw#53875

Fix chronic Smoke Copilot AOAI dispatch failure and cap per-run AI credits by @pelikhan with @Copilot in github/gh-aw#53817

[test-parallel] Add t.Parallel() to safe codemod test files (batch after codemod_factory_test.go) by @github-actions[bot] in github/gh-aw#53887

Infer GitHub App permissions and events from resolved package workflows in add-wizard bootstrap by @pelikhan with @Copilot in github/gh-aw#53766

Document PR fast-track triage criteria by @pelikhan with @Copilot in github/gh-aw#53880

Fix schedule-triggered workflow false positives and surface disabled-workflow root cause in health monitor by @pelikhan with @Copilot in github/gh-aw#53881

[community] Update community contributions in README by @github-actions[bot] in github/gh-aw#53893

[test-parallel] test: add t.Parallel() to safe pkg/cli tests (daily batch) by @github-actions[bot] in github/gh-aw#53931

[eslint-miner] eslint: extend no-exec-interpolated-command to cover execApi parameter-alias calls by @github-actions[bot] in github/gh-aw#53947

... (truncated)

Commits

466b8ad Add npm registry access to daily-rendering-scripts-verifier network allowlist...
734f391 Add actionable guidance to shell completion rc-path errors (#54672)
d52203c Add step-level failure attribution to Detection Analysis Report (Rule 3) (#54...
6d315d0 Include file path in pkg/parser wrapper errors (#54648)
d11b06c [test-parallel] Daily Go Test Parallelizer: add t.Parallel() to safe subtests...
8dcf606 Paginate daily performance data through its 90-day window (#54679)
2512707 docs: unbloat workflow structure reference (#54676)
80a44d7 [WIP] Fix failing GitHub Actions job js-integration-live-api (#54650)
03f65d8 Add regression coverage for CLI strict-mode default (#54657)
0923f14 Fail compilation when safe-outputs step-output token references cannot resolv...
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [github/gh-aw/actions/setup](https://github.com/github/gh-aw) from 0.86.2 to 0.87.3. - [Release notes](https://github.com/github/gh-aw/releases) - [Changelog](https://github.com/github/gh-aw/blob/main/CHANGELOG.md) - [Commits](github/gh-aw@48e5fa3...466b8ad) --- updated-dependencies: - dependency-name: github/gh-aw/actions/setup dependency-version: 0.87.3 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>

codspeed · 2026-08-31T13:40:16Z

Merging this PR will not alter performance

✅ 36 untouched benchmarks

_{Comparing dependabot/github_actions/github/gh-aw/actions/setup-0.87.3 (43833af) with main (6a3a8b0)}

…8626) Bumps [github/gh-aw/actions/setup](https://github.com/github/gh-aw) from 0.86.2 to 0.87.3. - [Release notes](https://github.com/github/gh-aw/releases) - [Changelog](https://github.com/github/gh-aw/blob/main/CHANGELOG.md) - [Commits](github/gh-aw@48e5fa3...466b8ad) --- updated-dependencies: - dependency-name: github/gh-aw/actions/setup dependency-version: 0.87.3 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Aug 31, 2026

youknowone merged commit 62d2a19 into main Aug 31, 2026
20 checks passed

youknowone deleted the dependabot/github_actions/github/gh-aw/actions/setup-0.87.3 branch August 31, 2026 17:39

Navigation Menu

Uh oh!

build(deps): bump github/gh-aw/actions/setup from 0.86.2 to 0.87.3 - #8626

build(deps): bump github/gh-aw/actions/setup from 0.86.2 to 0.87.3#8626
youknowone merged 1 commit into
mainfrom
dependabot/github_actions/github/gh-aw/actions/setup-0.87.3

dependabot Bot commented on behalf of github Aug 31, 2026

Uh oh!

codspeed Bot commented Aug 31, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 31, 2026

v0.87.2

🌟 Release Highlights

✨ What's New

🐛 Bug Fixes & Improvements

📚 Documentation

What's Changed

Uh oh!

codspeed Bot commented Aug 31, 2026

Merging this PR will not alter performance

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant