⬆️ Bump github-actions

[renovate-bot]

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	patch	v7.0.0 → v7.0.1
dorny/paths-filter	action	patch	v4.0.2 → v4.0.3
re-actors/alls-green	action	minor	v1.2.2 → v1.3.0

---

Release Notes

actions/checkout (actions/checkout)

v7.0.1

Compare Source

• Bump github/codeql-action from 3 to 4 by @​dependabot[bot] in #​2475
• Bump actions/setup-node from 4 to 6 by @​dependabot[bot] in #​2477
• Bump docker/build-push-action from 6.5.0 to 7.2.0 by @​dependabot[bot] in #​2478
• Bump docker/login-action from 3.3.0 to 4.2.0 by @​dependabot[bot] in #​2479
• Bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​2488
• Bump actions/upload-artifact from 4 to 7 by @​dependabot[bot] in #​2476
• eslint 9 by @​dependabot[bot] in #​2474
• Bump the minor-actions-dependencies group with 2 updates by @​dependabot[bot] in #​2499
• skip running unsafe pr check if input is default by @​aiqiaoy in #​2518
• trim only ascii whitespace for branch by @​aiqiaoy in #​2521
• escape values passed to --unset by @​aiqiaoy in #​2530

dorny/paths-filter (dorny/paths-filter)

v4.0.3

Compare Source

• Document safe handling of file list outputs in workflows
• Escape multi-line filenames in list-files shell and csv output
• Add 'some-with-excludes' predicate quantifier
• Add contents permission to PR example
• Scope base-ignored warning to API path
• Update outputs in readme to account for the 'every' predicate-quantifier

re-actors/alls-green (re-actors/alls-green)

v1.3.0

Compare Source

Sometimes these releases take time. Cherish it.

🛡️ What's Unmessed

[!caution]

There was a small command injection risk in prior versions. I consider it very low because of the specifics of the action use case. But still, do upgrade, okay?

@​illera88💰 fixed this template injection bug in #​37 by passing inputs via env vars.

See GHSA-gj76-h2ch-5m76 for more detail that was first reported by @​Corbynx010💰 while I was at EuroPython.

✨ What's Improved

I did a bunch of internal refactoring including hints of what @​max-sixty💰 reported in #​23. And took a small patch of @​krokofant💰 in. This involved a bunch of preparatory infra work with testing infra.

One notable improvement is that now thanks to @​tomasr8💰's and @​hugovk💰's UX suggestions in #​31, the gate status output is colored in the console and should be easier to scan in the log output per line. They entries now have leading ✓/❌ acceptance marks and the actual incoming job outcomes are labeled with 🟢/🔴/⬜/⚫.

🐛 What's Fixed

The job-statuses summary could print "Some of the allowed to be skipped jobs did not succeed" based on the wrong condition — it's now tied to allowed-skips as intended, not allowed-failures.

💪 New Contributors

• @​Corbynx010💰 lurked in GHSA-gj76-h2ch-5m76 before everyone else 😉
• @​illera88 made their first contribution in #​37 and GHSA-gj76-h2ch-5m76
• @​krokofant and @​max-sixty first contributed in #​23
• @​tomasr8 and @​hugovk in #​31

🪞 Full Diff: re-actors/alls-green@v1.2.2...v1.3.0

🧔‍♂️ Release Manager: @​webknjaz 🇺🇦

💬 Discuss on Bluesky 🦋, on Mastodon 🐘 and on GitHub.

---

Configuration

📅 Schedule: (in timezone UTC)

• Branch creation
  • Between 12:00 AM and 04:59 AM, only on Wednesday (* 0-4 * * 3)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.