chore(deps): bump the github-actions group with 4 updates

[dependabot]

Bumps the github-actions group with 4 updates: orhun/git-cliff-action, github/gh-aw, taiki-e/install-action and actions/stale.

Updates orhun/git-cliff-action from 4.7.0 to 4.7.1

Commits

• c93ef52 chore(version): update git-cliff to 2.12.0
• 2032a55 docs(readme): add an example how to execute arbitrary git-cliff commands (#70)
• See full diff in compare view

Updates github/gh-aw from 0.45.0 to 0.49.4

Release notes

Sourced from github/gh-aw's releases.

v0.49.4

🔧 Release Highlights

This maintenance release delivers targeted bug fixes for Playwright integration and internal test reliability improvements.

🐛 Bug Fixes & Improvements

• Playwright --no-sandbox argument fix — Corrected the --no-sandbox flag handling so Playwright workflows launch reliably in sandboxed GitHub Actions runners. (#17861)
• Shell quoting for awf --allow-domains/--block-domains — Fixed SC1003 shell quoting issue: domain arguments are now correctly double-quoted, preventing unexpected word-splitting in firewall rules. (#17861)
• Test isolation for workflow ID env vars — GITHUB_RUN_ID and GH_AW_WORKFLOW_ID are now cleared between test cases in messages.test.cjs, eliminating intermittent test failures caused by leaked state. (#17857)

---

For complete details, see CHANGELOG.

Generated by Release

---

What's Changed

• fix(tests): clear GITHUB_RUN_ID/GH_AW_WORKFLOW_ID in messages.test.cjs beforeEach by @​Copilot in github/gh-aw#17857
• [specs] Update layout specification - 2026-02-23 by @​github-actions[bot] in github/gh-aw#17860
• [docs] Update glossary - weekly full scan by @​github-actions[bot] in github/gh-aw#17877
• Fix SC1003: use double quotes for awf --allow-domains/--block-domains arguments; fix playwright --no-sandbox arg by @​Copilot in github/gh-aw#17861

Full Changelog: github/gh-aw@v0.49.3...v0.49.4

v0.49.3

🌟 Release Highlights

This release brings a new workflow control option to quiet bot comments, improved engine icons, and reliability fixes for download scripts — plus two community-requested improvements.

✨ What's New

• Silence activation comments — The new activation-comments: false frontmatter flag lets you disable the bot comments gh-aw posts when activating or falling back on a workflow. Useful for keeping issue/PR comment threads clean. (#17834)
• Engine icons for Claude, Codex & Gemini — Local icon assets are now bundled for Claude, Codex, and Gemini alongside a Gemini author entry, giving workflow UIs a consistent visual identity across all supported engines. (#17837)
• Community contributor celebration in release highlights — The release highlight generator now cross-references community-labeled issues with merged PRs and explicitly calls out the issue authors. (#17842)

🐛 Bug Fixes & Improvements

• web-fetch MCP fix — The web-fetch MCP server was incorrectly generating a container format instead of the expected command/args structure, preventing it from initializing. (#17822)
• Duplicate code detector — The detector now correctly emits a noop safe output when no duplication is found, avoiding spurious failures. (#17836)
• Retry on transient download failures — Install scripts now pass --retry 3 --retry-delay 5 to curl when downloading the Copilot CLI and AWF binary, automatically recovering from the occasional 502 on public runners. (#17841)

📚 Documentation

• Clarified that CLAUDE_CODE_OAUTH_TOKEN is not a supported authentication method. (#17835)
• Updated reference documentation with the latest features. (#17830)

... (truncated)

Changelog

Sourced from github/gh-aw's changelog.

Changelog

All notable changes to this project will be documented in this file.

v0.40.1 - 2026-02-03

Move from githubnext/gh-aw to github/gh-aw

If you were a former user of the githubnext Agentic Workflows you might have to re-register the extension to reflect the new location. As the gh-aw project moved from githubnext to github please delete the old channel and register the new one.

Example:

gh extension list
NAME   REPO              VERSION
gh aw  githubnext/gh-aw  v0.36.0
gh extension upgrade --all
[aw]: already up to date
gh extension remove gh-aw
gh extension install github/gh-aw
✓ Installed extension github/gh-aw
gh extension list
NAME   REPO          VERSION
gh aw  github/gh-aw  v0.40.1

Bug Fixes

Handle 502 Bad Gateway errors in assign_to_agent handler by treating them as success. The cloud gateway may return 502 errors during agent assignment, but the assignment typically succeeds despite the error. The handler now logs 502 errors for troubleshooting but does not fail the workflow.

Add discussion interaction to smoke workflows and serialize the discussion

flag in safe-outputs handler config.

Smoke workflows now select a random discussion and post thematic comments to validate discussion comment functionality. The compiler now emits the "discussion": true flag in GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG when a workflow requests discussion output, and lock files include discussions: write permission where applicable.

Add discussion interaction to smoke workflows; compiler now serializes the discussion flag into the safe-outputs handler config so workflows can post comments to discussions. Lock files include discussions: write where applicable.

Smoke workflows pick a random discussion and post a thematic comment (copilot: playful, claude: comic-book, codex: mystical oracle, opencode: space mission). This is a non-breaking tooling/workflow change.

Add discussion interaction to smoke workflows; deprecate the discussion flag and

... (truncated)

Commits

• bf34f99 Fix SC1003: use double quotes for awf --allow-domains/--block-domains argumen...
• 069d9f5 docs: update glossary with Lockdown Mode, AWF, and Sandbox terms (#17877)
• 2fd8b78 docs: update layout specification for 2026-02-23 (#17860)
• d06df78 fix(tests): clear GITHUB_RUN_ID/GH_AW_WORKFLOW_ID in messages.test.cjs before...
• cb678b4 Add --retry 3 with delay to curl downloads to handle transient 502s (#17841)
• 2f34639 feat: add activation-comments to disable activation/fallback bot comments (...
• 4094506 feat(release): celebrate community issue authors in release highlights (#17842)
• bc1b728 fix(duplicate-code-detector): require noop when no duplication found (#17836)
• 42b6879 Add Gemini author and local icons for Claude, Codex, and Gemini (#17837)
• 6125b4b docs: clarify CLAUDE_CODE_OAUTH_TOKEN is not supported (#17835)
• Additional commits viewable in compare view

Updates taiki-e/install-action from 2.67.30 to 2.68.8

Release notes

Sourced from taiki-e/install-action's releases.

2.68.8

• Update cargo-nextest@latest to 0.9.129.

• Update mise@latest to 2026.2.19.

• Update tombi@latest to 0.7.32.

2.68.7

• Update mise@latest to 2026.2.18.

• Update wasm-bindgen@latest to 0.2.111.

2.68.6

• Update wasm-bindgen@latest to 0.2.110.

2.68.5

• Update wasm-bindgen@latest to 0.2.109.

2.68.4

• Update cargo-nextest@latest to 0.9.128.

2.68.3

• Update mise@latest to 2026.2.17.

• Update cargo-tarpaulin@latest to 0.35.2.

• Update syft@latest to 1.42.1.

2.68.2

• Update uv@latest to 0.10.4.

• Update tombi@latest to 0.7.31.

• Update rclone@latest to 1.73.1.

2.68.1

• Update mise@latest to 2026.2.15.

• Update tombi@latest to 0.7.30.

• Update knope@latest to 0.22.3.

2.68.0

• Support gungraun-runner. (#1520, thanks @​gamma0987)

• Update uv@latest to 0.10.3.

• Update typos@latest to 1.43.5.

• Update tombi@latest to 0.7.29.

... (truncated)

Changelog

Sourced from taiki-e/install-action's changelog.

Changelog

All notable changes to this project will be documented in this file.

This project adheres to Semantic Versioning.

[Unreleased]

[2.68.8] - 2026-02-23

• Update cargo-nextest@latest to 0.9.129.

• Update mise@latest to 2026.2.19.

• Update tombi@latest to 0.7.32.

[2.68.7] - 2026-02-22

• Update mise@latest to 2026.2.18.

• Update wasm-bindgen@latest to 0.2.111.

[2.68.6] - 2026-02-21

• Update wasm-bindgen@latest to 0.2.110.

[2.68.5] - 2026-02-20

• Update wasm-bindgen@latest to 0.2.109.

[2.68.4] - 2026-02-20

• Update cargo-nextest@latest to 0.9.128.

[2.68.3] - 2026-02-19

• Update mise@latest to 2026.2.17.

• Update cargo-tarpaulin@latest to 0.35.2.

• Update syft@latest to 1.42.1.

[2.68.2] - 2026-02-18

• Update uv@latest to 0.10.4.

... (truncated)

Commits

• cfdb446 Release 2.68.8
• 350f13b Update cargo-nextest@latest to 0.9.129
• 8ba6ecc Update mise@latest to 2026.2.19
• cf80594 Update tombi@latest to 0.7.32
• f92912f Release 2.68.7
• 4970026 Update mise@latest to 2026.2.18
• 6043f02 Update wasm-bindgen@latest to 0.2.111
• 470679b Release 2.68.6
• 6d8a751 Update wasm-bindgen@latest to 0.2.110
• 71b4839 Release 2.68.5
• Additional commits viewable in compare view

Updates actions/stale from 10.1.1 to 10.2.0

Release notes

Sourced from actions/stale's releases.

v10.2.0

What's Changed

Bug Fix

• Fix checking state cache (fix #1136) and switch to Octokit helper methods by @​itchyny in actions/stale#1152

Dependency Updates

• Upgrade js-yaml from 4.1.0 to 4.1.1 by @​dependabot in actions/stale#1304
• Upgrade lodash from 4.17.21 to 4.17.23 by @​dependabot in actions/stale#1313
• Upgrade actions/cache from 4.0.3 to 5.0.2 and actions/github from 5.1.1 to 7.0.0 by @​chiranjib-swain in actions/stale#1312

New Contributors

• @​itchyny made their first contribution in actions/stale#1152

Full Changelog: actions/stale@v10...v10.2.0

Commits

• b5d41d4 build(deps-dev): bump lodash from 4.17.21 to 4.17.23 (#1313)
• dcd2b94 Fix punycode and url.parse Deprecation Warnings (#1312)
• d6f8a33 build(deps-dev): bump js-yaml from 4.1.0 to 4.1.1 (#1304)
• a21a081 Fix checking state cache (fix #1136), also switch to octokit methods (#1152)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies, github-actions. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

Benchmark Results

No benchmarks configured. Add benchmarks to benches/ directory.

Full results available in CI artifacts.

[github-actions]

Code Coverage Report

Overall Coverage: 0%

Summary

Filename                      Regions    Missed Regions     Cover   Functions  Missed Functions  Executed       Lines      Missed Lines     Cover    Branches   Missed Branches     Cover
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
client.rs                        1444                67    95.36%         118                13    88.98%         923                35    96.21%           0                 0         -
format.rs                        2172                 3    99.86%         132                 1    99.24%        1292                 1    99.92%           0                 0         -
main.rs                           326               241    26.07%          14                 8    42.86%         225               168    25.33%           0                 0         -
mcp/analytics.rs                  408                 2    99.51%          24                 0   100.00%         331                 0   100.00%           0                 0         -
mcp/mod.rs                        144                55    61.81%          23                15    34.78%         128                65    49.22%           0                 0         -
mcp/prompts.rs                   1908                33    98.27%         126                 6    95.24%        1043                12    98.85%           0                 0         -
mcp/resources.rs                 1317                20    98.48%          93                 1    98.92%         865                 6    99.31%           0                 0         -
mcp/tools.rs                     2146                90    95.81%         116                18    84.48%        1333                47    96.47%           0                 0         -
models.rs                        1079                31    97.13%          78                10    87.18%         762                14    98.16%           0                 0         -
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
TOTAL                           10944               542    95.05%         724                72    90.06%        6902               348    94.96%           0                 0         -

Full HTML report available in CI artifacts.