Skip to content

build(deps): bump the actions group with 2 updates - #154

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-fb043a1aa9
Closed

build(deps): bump the actions group with 2 updates#154
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-fb043a1aa9

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 13, 2026

Copy link
Copy Markdown
Contributor

Bumps the actions group with 2 updates: WireCatLabs/cli-base/.github/workflows/release-checks.yml and WireCatLabs/cli-base/.github/workflows/release-start.yml.

Updates WireCatLabs/cli-base/.github/workflows/release-checks.yml from 0.85.1 to 0.96.0

Changelog

Sourced from WireCatLabs/cli-base/.github/workflows/release-checks.yml's changelog.

Changelog

Notable changes to @wirecat/cli-base (published as @wirecat/cli-core up to 0.20.0), one section per version, newest first. Versions follow semantic versioning; before 1.0.0 a minor release may change the API. Versions before 0.8.0 are in the git tags.

Every entry says what changed as a caller sees it, why, and what to watch for — the rules are docs/dev/CONVENTIONS.md.

0.99.0 — 13.11.2026

Changed — may break callers

  • same-entity-schema and same-error-reason fail cli-dev audit --family. 0.98.0 printed them as warnings. A parity-group difference of these two rules names no CLI list (entity hit, reason ai.address-refused=model.address-refused), because which CLIs share an entity or a reason changes with each release; its review_after, not a stale check, retires it. The 11 differences measured on 13.11.2026 are declared until 27.11.2026 (in messengers and gcal-shared), so no published CLI fails today; a new one does. Watch for: from 27.11.2026 the audit warns about them, and from 11.12.2026 it fails until each is aligned (cli-core 0.650.0 aligns the address reason) or its date is moved with a reason.

Added

  • PARITY_GROUPS' shared-roots group takes asterisk-cli (its command is pbx), compared like beeline on commands, doctor, skill, mcp and upgrade, and WC-CI-9 reserves 02:48 UTC for its monthly run. cli-dev repo-check then passes for asterisk-cli without its own config/parity-groups.json.

  • cli-dev manifest adds the hosts the shared packages reach for every CLI. network.hosts now also lists registry.npmjs.org (the update check, doctor online, cli-core's runtime download), huggingface.co, *.huggingface.co and *.hf.co (the local models for search, speech and pictures, and the hosts Hugging Face redirects its files to), github.com and *.githubusercontent.com (the ONNX runtime and the speech detector from GitHub releases), so Desktop shows them. Exported as SHARED_HOSTS from @wirecat/cli-base/wcat/manifest. Watch for: every CLI's generate:check fails after the bump until pnpm generate rewrites contracts/wirecat.json; a CLI that listed one of these hosts itself may drop it.

Fixed

  • cli-dev audit --family passes a CLI on cli-core 0.648.0. cli-core 0.648.0 marks the commands it mounts origin: "cli-core" in commands --json, while the contract it compares them with keeps the origin they were written with, so shared-command-contract failed on all of them (88 in b24). The cli-core mark now counts as the contract's own origin; any other change of origin still fails. With its contracts clean again, a CLI's shared commands that the published max, tg and wa still word as an older cli-core did (doctor reports) are accepted as inherited, as before.
  • undeclared-host skips a URL inside a sentence. Help links in printed text, API descriptions and markdown links are never fetched; only a URL that starts a string counts now, and schemas.openxmlformats.org joins the XML namespace names that are skipped by name. drive's baseline drops 9 of its 11 hosts and mail's overrides 6 of 17. Help links and OAuth scopes kept alone in a string still need an override: nothing tells them apart from a request's address.
  • raw-network accepts fetch destructured in an arrow's or a method's parameter (({ env, fetch }) =>,

... (truncated)

Commits
  • 9262997 chore(release): 0.96.0 (#564)
  • 2a52d67 feat(standards): --from <person> in the flag vocabulary (#563)
  • 5113b0d fix(testing): refuse the owner's real home under vitest even without the setu...
  • c1f6e98 chore(release): 0.95.0 (#561)
  • 0e81747 fix(ci): coverage takes each test shard's latest attempt (#560)
  • 5dfb058 chore(release): 0.94.0 (#559)
  • 3b669c4 feat(standards): meta.ranking, what a hosted model did to a search's order (#...
  • e45d46e chore(deps): Bump github/codeql-action/autobuild from 4.39.1 to 4.39.3 (#476)
  • 134fe83 chore(deps): Bump github/codeql-action/upload-sarif from 4.39.1 to 4.39.2 (#477)
  • 472392f chore(deps): Bump github/codeql-action/analyze from 4.39.1 to 4.39.2 (#478)
  • Additional commits viewable in compare view

Updates WireCatLabs/cli-base/.github/workflows/release-start.yml from 0.85.1 to 0.96.0

Changelog

Sourced from WireCatLabs/cli-base/.github/workflows/release-start.yml's changelog.

Changelog

Notable changes to @wirecat/cli-base (published as @wirecat/cli-core up to 0.20.0), one section per version, newest first. Versions follow semantic versioning; before 1.0.0 a minor release may change the API. Versions before 0.8.0 are in the git tags.

Every entry says what changed as a caller sees it, why, and what to watch for — the rules are docs/dev/CONVENTIONS.md.

0.99.0 — 13.11.2026

Changed — may break callers

  • same-entity-schema and same-error-reason fail cli-dev audit --family. 0.98.0 printed them as warnings. A parity-group difference of these two rules names no CLI list (entity hit, reason ai.address-refused=model.address-refused), because which CLIs share an entity or a reason changes with each release; its review_after, not a stale check, retires it. The 11 differences measured on 13.11.2026 are declared until 27.11.2026 (in messengers and gcal-shared), so no published CLI fails today; a new one does. Watch for: from 27.11.2026 the audit warns about them, and from 11.12.2026 it fails until each is aligned (cli-core 0.650.0 aligns the address reason) or its date is moved with a reason.

Added

  • PARITY_GROUPS' shared-roots group takes asterisk-cli (its command is pbx), compared like beeline on commands, doctor, skill, mcp and upgrade, and WC-CI-9 reserves 02:48 UTC for its monthly run. cli-dev repo-check then passes for asterisk-cli without its own config/parity-groups.json.

  • cli-dev manifest adds the hosts the shared packages reach for every CLI. network.hosts now also lists registry.npmjs.org (the update check, doctor online, cli-core's runtime download), huggingface.co, *.huggingface.co and *.hf.co (the local models for search, speech and pictures, and the hosts Hugging Face redirects its files to), github.com and *.githubusercontent.com (the ONNX runtime and the speech detector from GitHub releases), so Desktop shows them. Exported as SHARED_HOSTS from @wirecat/cli-base/wcat/manifest. Watch for: every CLI's generate:check fails after the bump until pnpm generate rewrites contracts/wirecat.json; a CLI that listed one of these hosts itself may drop it.

Fixed

  • cli-dev audit --family passes a CLI on cli-core 0.648.0. cli-core 0.648.0 marks the commands it mounts origin: "cli-core" in commands --json, while the contract it compares them with keeps the origin they were written with, so shared-command-contract failed on all of them (88 in b24). The cli-core mark now counts as the contract's own origin; any other change of origin still fails. With its contracts clean again, a CLI's shared commands that the published max, tg and wa still word as an older cli-core did (doctor reports) are accepted as inherited, as before.
  • undeclared-host skips a URL inside a sentence. Help links in printed text, API descriptions and markdown links are never fetched; only a URL that starts a string counts now, and schemas.openxmlformats.org joins the XML namespace names that are skipped by name. drive's baseline drops 9 of its 11 hosts and mail's overrides 6 of 17. Help links and OAuth scopes kept alone in a string still need an override: nothing tells them apart from a request's address.
  • raw-network accepts fetch destructured in an arrow's or a method's parameter (({ env, fetch }) =>,

... (truncated)

Commits
  • 9262997 chore(release): 0.96.0 (#564)
  • 2a52d67 feat(standards): --from <person> in the flag vocabulary (#563)
  • 5113b0d fix(testing): refuse the owner's real home under vitest even without the setu...
  • c1f6e98 chore(release): 0.95.0 (#561)
  • 0e81747 fix(ci): coverage takes each test shard's latest attempt (#560)
  • 5dfb058 chore(release): 0.94.0 (#559)
  • 3b669c4 feat(standards): meta.ranking, what a hosted model did to a search's order (#...
  • e45d46e chore(deps): Bump github/codeql-action/autobuild from 4.39.1 to 4.39.3 (#476)
  • 134fe83 chore(deps): Bump github/codeql-action/upload-sarif from 4.39.1 to 4.39.2 (#477)
  • 472392f chore(deps): Bump github/codeql-action/analyze from 4.39.1 to 4.39.2 (#478)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the actions group with 2 updates
e44a3a1 
Bumps the actions group with 2 updates: [WireCatLabs/cli-base/.github/workflows/release-checks.yml](https://github.com/wirecatlabs/cli-base) and [WireCatLabs/cli-base/.github/workflows/release-start.yml](https://github.com/wirecatlabs/cli-base).


Updates `WireCatLabs/cli-base/.github/workflows/release-checks.yml` from 0.85.1 to 0.96.0
- [Release notes](https://github.com/wirecatlabs/cli-base/releases)
- [Changelog](https://github.com/WireCatLabs/cli-base/blob/main/CHANGELOG.md)
- [Commits](WireCatLabs/cli-base@34a442b...9262997)

Updates `WireCatLabs/cli-base/.github/workflows/release-start.yml` from 0.85.1 to 0.96.0
- [Release notes](https://github.com/wirecatlabs/cli-base/releases)
- [Changelog](https://github.com/WireCatLabs/cli-base/blob/main/CHANGELOG.md)
- [Commits](WireCatLabs/cli-base@34a442b...9262997)

---
updated-dependencies:
- dependency-name: WireCatLabs/cli-base/.github/workflows/release-checks.yml
  dependency-version: 0.96.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: WireCatLabs/cli-base/.github/workflows/release-start.yml
  dependency-version: 0.96.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Nov 13, 2026
@leemour leemour mentioned this pull request Nov 13, 2026
Merged
leemour added a commit that referenced this pull request Nov 13, 2026
@leemour @claude
chore(deps): cli-core 0.651.0, cli-base 0.99.0, family audit through …
b831a6d 
…cli-dev (#156)

* chore(deps): cli-core 0.651.0, cli-base 0.99.0, family audit through cli-dev

- Pin @wirecat/cli-core 0.651.0 and @wirecat/cli-base 0.99.0, so a CLI made
  from the template starts on them. cli-testing stays on 0.7.0.
- Refresh contracts/help.snap: cli-core 0.651.0 lists pbx on the first screen.
  mcp-tools.json and mcp-catalogue.json are unchanged.
- audit:commands and CI run `cli-dev audit --family --cli dist/bin/clidev.js`
  inside scripts/sandboxed.ts in place of scripts/audit.sh. template.json no
  longer keeps scripts/audit.sh in step; the file waits in CLEANUP.md.
- config/parity-groups.json: one dated difference (review_after 2026-11-27),
  same-error-reason meeting-project.stale. cli-core 0.651.0 makes it conflict,
  while the published CLIs still give configuration_error. None of cli-base
  0.99.0's 11 shared rows name clidev, so none is copied.
- Move every cli-base reusable workflow pin to v0.99.0 (release-checks and
  release-start were on v0.85.1; their workflow_call inputs are unchanged).
  Covers Dependabot #154.
- Changelog fragment changes/chore-round-2026-11-13.md.

Rules: WC-CI-7 (cancel setting left as is), WC-TEST-14.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* chore(ci): family audit as mail, gcal and beeline run it; pin cli-base by commit

- CI runs `pnpm exec cli-dev audit --family --cli dist/bin/clidev.js
  --differences lint/audit-differences.json`, the line mail, gcal and beeline
  use, so the next template upgrade in each CLI takes it without asking.
  audit:commands runs the same inside scripts/sandboxed.ts.
- Delete scripts/audit.sh: nothing calls it any more.
- lint/audit-differences.json starts empty, so a new CLI gets a valid file
  whatever parity groups it joins. The template's own meeting-project.stale
  row stays in config/parity-groups.json, which new CLIs do not get, so no
  dated row reaches them.
- The v0.99.0 pins named the annotated tag object (7018773), which Actions
  cannot resolve; they now name its commit (32ebca3).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
@leemour

leemour commented Nov 13, 2026

Copy link
Copy Markdown
Member

Covered by #156, which moves every cli-base reusable workflow pin (release-checks, release-start, node-ci, changelog-guard) to v0.99.0, past the 0.96.0 proposed here.

@leemour leemour closed this Nov 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@leemour