Update github-actions

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
TypedDevs/bashunit	action	minor	0.39.1 → 0.42.0
astral-sh/setup-uv	action	minor	v8.2.0 → v8.3.2
cbrgm/mastodon-github-action	action	patch	v2.2.1 → v2.2.2
github/codeql-action	action	minor	v4.36.2 → v4.37.1
shivammathur/setup-php	action	patch	v2.37.1 → 2.37.2
softprops/action-gh-release	action	patch	v3.0.1 → v3.0.2
step-security/harden-runner	action	minor	v2.19.4 → v2.20.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

TypedDevs/bashunit (TypedDevs/bashunit)

v0.42.0

Compare Source

Fixed

• A failing set_up_before_script/set_up now fails every test in the file with the hook's error, keeps the totals consistent, and lets the suite continue — a strict test file can no longer abort the whole run mid-suite (#​836)
• Run-mode flags (--parallel, --simple, --strict, --retry, --seed, report paths, …) no longer leak through the environment into nested bashunit runs, so a script under test that calls bashunit gets default behavior; BASHUNIT_*=… configuration is unchanged (#​834, #​837)
• install.sh fails fast: a failed download, clone, build or copy aborts with a clear error instead of reporting success, and a failed beta clone no longer runs build.sh in the caller's directory (#​840)
• ./build.sh --verify exits non-zero when the built binary fails the suite, and the verification run no longer crashes mid-suite from tests resolving repo paths against the build folder (#​834)
• ./bashunit bench works again from a repository checkout (the dev entrypoint never sourced src/benchmark.sh) (#​834)
• Snapshot placeholders (::ignore::) now work on systems without perl; multi-line placeholders still need perl (#​823)
• Runs no longer leak a scratch directory under $TMPDIR/bashunit/run/ — it is removed on exit, including --version/--help, subcommands and Ctrl-C (#​811)
• bashunit::helper::get_function_line_number no longer disables extdebug for its caller (#​808)
• --test-timeout no longer intermittently reports a fast test as timed out; the watchdog signals by pid and skips a test that already completed

Added

• watch subcommand no longer fails when neither inotifywait nor fswatch is installed — it falls back to pure-shell polling (interval via BASHUNIT_WATCH_INTERVAL, default 2s) instead of exiting (#​779)
• Shell tab-completion scripts for bash and zsh under completions/ (subcommands, test flags with value hints, assertion names), kept in sync by an anti-drift CI test (#​778)
• --rerun-failed (BASHUNIT_RERUN_FAILED) replays only the previously failing tests, recorded in .bashunit/last-failed; composes with --filter/--tag/--parallel and falls back to the full suite when empty (add .bashunit/ to .gitignore) (#​776)
• Optional nightly coverage.yml workflow publishes a shields.io coverage badge from --coverage over the unit suite; schedule/manual only, never gates merges (#​754)
• --jobs auto / -j auto caps parallel concurrency at the CPU core count (portable across Linux/macOS/BSD); the default stays unlimited (#​766)

Changed

• build.sh hardened: runs under set -euo pipefail, derives the embed list from the entrypoint's source order (single source of truth), guards against duplicate embeds and missing doc markers, drops eval, and gates every build behind bash -n (#​834)
• bashunit doc no longer forks an echo | sed pipe per line of the assertion docs: a single awk pass prints the same bytes in ~50ms instead of ~5s (#​832)
• Multi-file runs are no longer quadratic in file count; bashunit's own 63-file unit suite: ~64s -> ~22s sequential, ~26s -> ~7s parallel (#​829)
• Major performance work with no behaviour change (near fork-free hot paths, cached snapshot/--tag scans, single-pass failure rendering). On bash 3.2: 100x10 assert_equals ~1.50s -> ~0.76s, 500 snapshot assertions ~7.5s -> ~3.0s, 100 tagged tests ~2.92s -> ~0.68s, acceptance suite ~61s -> ~17s (#​761-#​764, #​772-#​775, #​798, #​801-#​807, #​809, #​810, #​813, #​817)
• Per-test timing now defaults to auto (BASHUNIT_SHOW_EXECUTION_TIME=true|false|auto): shown only when the clock is fork-free, avoiding perl forks on bash 3.2; --profile/--verbose/reports still measure (see adrs/adr-008-auto-skip-per-test-timing.md) (#​765)
• assert_equals/assert_same failures with multiline values now render a git word-diff below the header (requires git, opt out with BASHUNIT_NO_DIFF=true, respects --no-color); machine reports keep the raw values (#​777)

v0.41.0

Compare Source

Added

• --retry <n> / BASHUNIT_RETRY re-runs a failed test up to N times; passes if any attempt passes, annotates retried tests, and works with --parallel and --stop-on-failure (#​737)
• --random-order with --seed <n> / BASHUNIT_SEED randomizes test file and function order to surface inter-test coupling; prints the seed for reproducible replay and works with --parallel (#​738)
• --shard <index>/<total> runs a deterministic, non-overlapping subset of the test files to split a suite across parallel CI runners; composes with --parallel (#​739)
• --report-tap <file> writes a TAP v13 report to a file (complements the streaming --output tap) (#​740)
• --report-json <file> writes results as JSON (summary counts + per-test records); no jq dependency (#​741)
• assert_file_permissions <mode> <file> asserts a file's octal permission mode; portable across GNU/BSD stat (#​742)
• assert_array_length <n> <array> asserts an array has exactly n elements (#​743)
• assert_within_delta <expected> <actual> <delta> asserts a number is within a tolerance; supports floats (#​744)

Fixed

• watch subcommand failed with bashunit::watch::run: command not found in the released binary because src/watch.sh was missing from the build; it is now bundled (#​735)

Changed

• Faster test execution by removing subprocess forks from hot paths (no behaviour change)

v0.40.0

Compare Source

Added

• --test-timeout <seconds> flag and BASHUNIT_TEST_TIMEOUT env var to abort a test that runs longer than N seconds, mark it failed and continue. Disabled by default; no external timeout needed, works on Bash 3.2+ (#​721)

Fixed

• A non-zero test exit no longer leaks into later tests in the same file (per-test exit code is now reset)
• Coverage now counts backslash line-continuation lines as covered (#​722)
• Spying/mocking the printf builtin no longer breaks coverage collection: the buffer is flushed with builtin printf (#​724)

Changed

• URLs now point to the new primary domain bashunit.com (old bashunit.typeddevs.com redirects)
• Docs site deploys to GitHub Pages on the bashunit.com custom domain (deploy-gh-pages.yml)

Removed

• Weekly-downloads chart on the docs homepage (non-portable data source)

astral-sh/setup-uv (astral-sh/setup-uv)

v8.3.2

Compare Source

v8.3.1

Compare Source

v8.3.0

Compare Source

cbrgm/mastodon-github-action (cbrgm/mastodon-github-action)

v2.2.2

Compare Source

What's Changed

• patch(deps): update patch versions to v1.26.4 by @​renovate[bot] in #​228
• chore(deps): update docker digests to v3.24 by @​renovate[bot] in #​229
• ci(tools): update build tools to v1.9.0 by @​renovate[bot] in #​230
• ci(tools): update build tools to v7 by @​renovate[bot] in #​231
• ci(tools): update build tools by @​renovate[bot] in #​232

Full Changelog: cbrgm/mastodon-github-action@v2...v2.2.2

github/codeql-action (github/codeql-action)

v4.37.1

Compare Source

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #​3956
• Update default CodeQL bundle version to 2.26.1. #​4019

v4.37.0

Compare Source

• Update default CodeQL bundle version to 2.26.0. #​3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@​ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #​3973

v4.36.3

Compare Source

No user facing changes.

shivammathur/setup-php (shivammathur/setup-php)

v2.37.2

Compare Source

Changelog

• Fixed macOS setup by marking shivammathur/php and shivammathur/extensions as trusted taps.

• Switched to Visual Studio 18 (vs18) builds for PHP 8.6 on Windows.

• Improved looking up environment variables.

• Tightened security in internal GitHub action workflows.

• Updated Node.js dependencies.

For the complete list of changes, please refer to the Full Changelog

Follow for updates

softprops/action-gh-release (softprops/action-gh-release)

v3.0.2

Compare Source

3.0.2 is a patch release focused on release reliability and compatibility. It
reuses existing draft releases when publishing prereleases, supports replacing
release assets on Gitea, hardens streamed asset uploads, and provides clearer
release-creation diagnostics. It also includes TypeScript, coverage, and tooling
maintenance merged since 3.0.1.

This release fixes #​795, #​438, and #​803. The upload transport hardening covers the
historical failure reported in #​790, although current hosted Node 24 runners did
not reproduce it naturally. The diagnostics work is related to #​786 and does not
claim a reproducible release-creation fix.

What's Changed

Exciting New Features 🎉

• feat: improve release error reporting and test coverage by @​chenrui333 in #​813

Bug fixes 🐛

• fix: publish existing draft releases as prereleases by @​godfengliang in #​801
• fix: upload small checksum assets reliably by @​chenrui333 in #​815
• fix: replace existing release assets on Gitea by @​chenrui333 in #​816
• fix: clarify release creation 404 errors by @​chenrui333 in #​817

Other Changes 🔄

• chore(deps): upgrade TypeScript to 7 by @​chenrui333 in #​812
• chore(deps): remove unused TypeScript tooling by @​chenrui333 in #​814
• dependency, Node 24 pin, and CI maintenance merged since 3.0.1

step-security/harden-runner (step-security/harden-runner)

v2.20.0

Compare Source

What's Changed

• Support for block policy for MacOS and Windows GitHub-hosted runners
• Support for Bitrise MacOS GitHub Actions runners
• HTTPS monitoring support for Bun for Linux runners (enterprise tier)

Full Changelog: step-security/harden-runner@v2.19.4...v2.20.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.