chore(ci)(deps): bump softprops/action-gh-release from 2 to 3

[dependabot]

Bumps softprops/action-gh-release from 2 to 3.

Release notes

Sourced from softprops/action-gh-release's releases.

v3.0.0

3.0.0 is a major release that moves the action runtime from Node 20 to Node 24. Use v3 on GitHub-hosted runners and self-hosted fleets that already support the Node 24 Actions runtime. If you still need the last Node 20-compatible line, stay on v2.6.2.

What's Changed

Other Changes 🔄

• Move the action runtime and bundle target to Node 24
• Update @types/node to the Node 24 line and allow future Dependabot updates
• Keep the floating major tag on v3; v2 remains pinned to the latest 2.x release

v2.6.2

What's Changed

Other Changes 🔄

• chore(deps): bump picomatch from 4.0.3 to 4.0.4 by @​dependabot[bot] in softprops/action-gh-release#775
• chore(deps): bump brace-expansion from 5.0.4 to 5.0.5 by @​dependabot[bot] in softprops/action-gh-release#777
• chore(deps): bump vite from 8.0.0 to 8.0.5 by @​dependabot[bot] in softprops/action-gh-release#781

Full Changelog: softprops/action-gh-release@v2...v2.6.2

v2.6.1

2.6.1 is a patch release focused on restoring linked discussion thread creation when discussion_category_name is set. It fixes [#764](https://github.com/softprops/action-gh-release/issues/764), where the draft-first publish flow stopped carrying the discussion category through the final publish step.

If you still hit an issue after upgrading, please open a report with the bug template and include a minimal repro or sanitized workflow snippet where possible.

What's Changed

Bug fixes 🐛

• fix: preserve discussion category on publish by @​chenrui333 in softprops/action-gh-release#765

v2.6.0

2.6.0 is a minor release centered on previous_tag support for generate_release_notes, which lets workflows pin GitHub's comparison base explicitly instead of relying on the default range. It also includes the recent concurrent asset upload recovery fix, a working_directory docs sync, a checked-bundle freshness guard for maintainers, and clearer immutable-prerelease guidance where GitHub platform behavior imposes constraints on how prerelease asset uploads can be published.

If you still hit an issue after upgrading, please open a report with the bug template and include a minimal repro or sanitized workflow snippet where possible.

What's Changed

... (truncated)

Changelog

Sourced from softprops/action-gh-release's changelog.

0.1.13

• fix issue with multiple runs concatenating release bodies #145

Commits

• efb3536 release 3.0.3 (#840)
• 6441963 chore(deps): bump the npm group with 2 updates (#839)
• e5ee6bc chore(deps): bump esbuild from 0.28.1 to 0.28.2 in the npm group (#837)
• d1e6617 chore(deps): bump undici from 6.27.0 to 6.28.0 (#831)
• 6403751 chore(deps): bump the npm group with 2 updates (#835)
• 7c7184b chore(deps): bump postcss from 8.5.19 to 8.5.25 (#833)
• 0f3f0d2 chore(deps): bump brace-expansion from 5.0.8 to 5.0.9 (#832)
• 77fb938 chore(deps): bump prettier from 3.9.5 to 3.9.6 in the npm group (#830)
• 5a6f517 chore(deps): bump brace-expansion from 5.0.7 to 5.0.8 (#828)
• a3c91c9 chore(deps): bump the github-actions group with 2 updates (#825)
• Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

PR Dashboard

Generated at: 2026-09-01 09:18:15 UTC

• chore(ci)(deps): bump actions/attest-build-provenance from 1 to 4 #3001 chore(ci)(deps): bump actions/attest-build-provenance from 1 to 4 | Created: 2026-09-01 | Updated: 2026-09-01 | 18 failing / 24 total
• chore(ci)(deps): bump softprops/action-gh-release from 2 to 3 #3000 chore(ci)(deps): bump softprops/action-gh-release from 2 to 3 | Created: 2026-09-01 | Updated: 2026-09-01 | 13 failing / 25 total
• chore(ci)(deps): bump github/codeql-action from 3 to 4 #2999 chore(ci)(deps): bump github/codeql-action from 3 to 4 | Created: 2026-09-01 | Updated: 2026-09-01 | 8 failing / 25 total
• Land the formal verification harness on master (it has never run) #2727 Land the formal verification harness on master (it has never run) | Created: 2026-08-27 | Updated: 2026-08-27 | 5 failing / 24 total
• chore(deps)(deps): bump thiserror from 2.0.18 to 2.0.21 #2693 chore(deps)(deps): bump thiserror from 2.0.18 to 2.0.20 | Created: 2026-08-24 | Updated: 2026-08-28 | 3 failing / 34 total
• chore(deps)(deps): bump hyper from 1.10.1 to 1.11.1 #2692 chore(deps)(deps): bump hyper from 1.10.1 to 1.11.0 | Created: 2026-08-24 | Updated: 2026-08-28 | 3 failing / 33 total
• chore(deps)(deps): bump base64 from 0.22.1 to 0.23.1 #2691 chore(deps)(deps): bump base64 from 0.22.1 to 0.23.1 | Created: 2026-08-24 | Updated: 2026-08-28 | 3 failing / 34 total
• chore(deps)(deps): bump serde from 1.0.228 to 1.0.229 #2690 chore(deps)(deps): bump serde from 1.0.228 to 1.0.229 | Created: 2026-08-24 | Updated: 2026-08-28 | 3 failing / 34 total
• chore(deps)(deps): bump uuid from 1.23.2 to 1.26.1 #2689 chore(deps)(deps): bump uuid from 1.23.2 to 1.25.0 | Created: 2026-08-24 | Updated: 2026-08-28 | 3 failing / 34 total
• Unbreak FPGA CI and correct two unbacked hardware claims #2081 Unbreak FPGA CI and correct two unbacked hardware claims | Created: 2026-08-11 | Updated: 2026-08-20 | 5 failing / 27 total

Summary

Status	Count
Total Open PRs	10
PRs with Failing Checks	8
PRs with All Checks Green	2
READY	0
FAILING	8
PENDING	0

Seal Status

• ⚠️ STALE -- sha256(compiler.rs)=fd84214651ae != manifest seal=87e5cbd3ad94.
  The committed NMSE numbers were certified against an older compiler.rs.
  Run scripts/reseal-check.sh locally for the two-step reseal command (advisory; not a merge gate).

[github-actions]

📓 NotebookLM Notebook linked to this PR

• Notebook ID: b83263109fb055dc
• URL: https://notebooklm.google.com/notebook/b83263109fb055dc

This notebook contains session context, decisions, and artifacts for this work.

[gHashTag]

Reviewer bee X. Reviewed: a one-line major bump of a pinned action; the inputs this repo passes (subject-path / files / sarif_file) are unchanged across the major, and the job permissions the new major needs (contents / id-token / attestations write where relevant) are already declared. The only red check (compile-proofs) is unrelated to workflows. Labelled bee-reviewed. Not merged by me: the change touches .github/workflows and the reviewer token lacks the workflow scope -- awaiting the owner's merge.

[gHashTag]

@dependabot rebase

(Reviewer bee: the required check parse-ratchet never ran on this head, which dates from 2026-09-14. A rebase gives the current required checks a fresh head to run on. I will re-review the rebased diff before re-applying bee-reviewed.)

[github-actions]

📓 NotebookLM Notebook linked to this PR

• Notebook ID: b83263109fb055dc
• URL: https://notebooklm.google.com/notebook/b83263109fb055dc

This notebook contains session context, decisions, and artifacts for this work.

[github-actions]

PR Dashboard

Generated at: 2026-10-02 19:16:12 UTC

• fix(seals): baseline the four html/xml seals #5580 unsealed (Refs #5577) #5612 fix(seals): baseline the four html/xml seals #5580 unsealed (Refs #5577) | Created: 2026-10-02 | Updated: 2026-10-02 | 1 failing / 34 total
• docs(igla): re-take the corpus figures on master, 1150 specs (Refs #5497) #5610 docs(igla): re-take the corpus figures on master, 1150 specs (Refs #5497) | Created: 2026-10-02 | Updated: 2026-10-02 | 1 failing / 34 total
• feat(xilinx7): 7-series configuration packets as a .t27 spec (Closes #5608) #5609 feat(xilinx7): 7-series configuration packets as a .t27 spec (Closes #5608) | Created: 2026-10-02 | Updated: 2026-10-02 | 4 failing / 34 total
• Port gHashTag/trinity:fpga/openxc7-synth/d_clk_direct.v (Verilog, 1 module) to specs/port/trinity/fpga/openxc7-synth/d_c #5595 Port gHashTag/trinity:fpga/openxc7-synth/d_clk_direct.v (Verilog, 1 module) to specs/port/trinity/fpga/openxc7-synth/d_c | Created: 2026-10-02 | Updated: 2026-10-02 | 6 failing / 31 total
• Specify contributor key management and attribution boundaries #5473 Specify contributor key management and attribution boundaries | Created: 2026-10-01 | Updated: 2026-10-02 | 4 failing / 32 total
• The Queen's accept is the merge: dispatch.t27 says so, and its harness measures it #5452 The Queen's accept is the merge: dispatch.t27 says so, and its harness measures it | Created: 2026-10-01 | Updated: 2026-10-02 | 6 failing / 36 total
• docs(tri): mark the Solana tri-mining program and depin.prove rewards superseded by mint-on-acceptance (Closes #5412) #5413 docs(tri): mark the Solana tri-mining program and depin.prove rewards superseded by mint-on-acceptance (Closes #5412) | Created: 2026-10-01 | Updated: 2026-10-02 | 6 failing / 32 total
• Port gHashTag/BrowserOS:trios/agent-server/apps/server/src/lib/container/image-loader.ts (TypeScript, 2 functions) to sp #5320 Port gHashTag/BrowserOS:trios/agent-server/apps/server/src/lib/container/image-loader.ts (TypeScript, 2 functions) to sp | Created: 2026-09-30 | Updated: 2026-10-02 | 8 failing / 31 total
• A "using" in prose became an import; and the per-spec delta check compared strings #5215 A "using" in prose became an import; and the per-spec delta check compared strings | Created: 2026-09-29 | Updated: 2026-10-02 | 12 failing / 41 total
• Auto-loop 2026-09-29: silent-discard parser family + loop infrastructure #5084 Auto-loop 2026-09-29: silent-discard parser family + loop infrastructure | Created: 2026-09-28 | Updated: 2026-10-02 | 10 failing / 45 total
• Carry wave-loop-898's stranded work: green lean 24/24 (fixes red lean CI), mcp registry spec, research corpus #5081 Carry wave-loop-898's stranded work: green lean 24/24 (fixes red lean CI), mcp registry spec, research corpus | Created: 2026-09-28 | Updated: 2026-10-02 | 10 failing / 36 total
• chore: drop build artifacts tracked since ea15cd54c (#1399), ignore *.rlib #5078 chore: drop build artifacts tracked since ea15cd54c (#1399), ignore *.rlib | Created: 2026-09-28 | Updated: 2026-10-02 | 7 failing / 40 total
• Port gHashTag/BrowserOS:trios/agent-server/apps/server/src/api/services/queen-brief-shape.ts (TypeScript, 2 functions) t #4911 Port gHashTag/BrowserOS:trios/agent-server/apps/server/src/api/services/queen-brief-shape.ts (TypeScript, 2 functions) t | Created: 2026-09-27 | Updated: 2026-10-02 | 11 failing / 31 total
• Seals: 0 of 1072 specs verify, 928 with an unchanged spec_hash — gate it or remove it #4887 Seals: 0 of 1072 specs verify, 928 with an unchanged spec_hash — gate it or remove it | Created: 2026-09-27 | Updated: 2026-10-02 | 12 failing / 40 total
• Wave Loop 473 — compiler-backend aggregate tail / live cold-POR CCLK sweep #4801 Wave Loop 473 — compiler-backend aggregate tail / live cold-POR CCLK sweep | Created: 2026-09-24 | Updated: 2026-10-02 | 11 failing / 31 total
• Bare for statements: 2 loops recovered, and 235 of the 240 sites I cited were out of scope #4777 Bare for statements: 2 loops recovered, and 235 of the 240 sites I cited were out of scope | Created: 2026-09-24 | Updated: 2026-10-02 | 10 failing / 31 total
• Generic type parameters dropped from the declaration and kept in the body: -23 errors #4745 Generic type parameters dropped from the declaration and kept in the body: -23 errors | Created: 2026-09-24 | Updated: 2026-10-02 | 12 failing / 31 total
• Implement the 8 empty function bodies in specs/vsa/packed_vsa.t27 #4729 Implement the 8 empty function bodies in specs/vsa/packed_vsa.t27 | Created: 2026-09-24 | Updated: 2026-10-02 | 12 failing / 31 total
• Wave 684: occlusion four deep, and the two files no list ever reached #4660 Wave 684: occlusion four deep, and the two files no list ever reached | Created: 2026-09-23 | Updated: 2026-10-02 | 10 failing / 31 total
• Capture given/when/then and render them: 6540 clauses, and 169 specs share one unfilled placeholder #4642 Capture given/when/then and render them: 6540 clauses, and 169 specs share one unfilled placeholder | Created: 2026-09-23 | Updated: 2026-10-02 | 10 failing / 31 total
• Implement part 2 of 2 of the empty bodies in specs/git/diff.t27 (7 functions) #4634 Implement part 2 of 2 of the empty bodies in specs/git/diff.t27 (7 functions) | Created: 2026-09-23 | Updated: 2026-10-02 | 10 failing / 31 total
• feat(specs/skills): trinity/connect-accounts #4600 feat(specs/skills): trinity/connect-accounts | Created: 2026-09-22 | Updated: 2026-10-02 | 7 failing / 32 total
• Port part 1 of 2 of tools/check_withdrawn_live.py to specs/port/tools/check_withdrawn_live.t27 (8 functions) #4581 Port part 1 of 2 of tools/check_withdrawn_live.py to specs/port/tools/check_withdrawn_live.t27 (8 functions) | Created: 2026-09-22 | Updated: 2026-10-02 | 9 failing / 31 total
• Port part 1 of 2 of tools/check_coq_in_build.py to specs/port/tools/check_coq_in_build.t27 (8 functions) #4578 Port part 1 of 2 of tools/check_coq_in_build.py to specs/port/tools/check_coq_in_build.t27 (8 functions) | Created: 2026-09-22 | Updated: 2026-10-02 | 8 failing / 31 total
• Implement the 1 empty function body in specs/test_framework/verilog_bench_harness.t27 #4565 Implement the 1 empty function body in specs/test_framework/verilog_bench_harness.t27 | Created: 2026-09-21 | Updated: 2026-10-02 | 0 failing / 2 total
• Implement part 2 of 2 of the empty bodies in specs/vm/jit_semantics.t27 (4 functions) #4563 Implement part 2 of 2 of the empty bodies in specs/vm/jit_semantics.t27 (4 functions) | Created: 2026-09-21 | Updated: 2026-10-02 | 8 failing / 31 total
• classify: the browser could not tell a Markdown file from a broken spec (refs #2133) #4541 classify: the browser could not tell a Markdown file from a broken spec (refs #2133) | Created: 2026-09-21 | Updated: 2026-10-02 | 7 failing / 41 total
• Implement the 1 empty function body in specs/test_framework/graph_drift_detection.t27 #4536 Implement the 1 empty function body in specs/test_framework/graph_drift_detection.t27 | Created: 2026-09-21 | Updated: 2026-10-02 | 8 failing / 31 total
• Nothing builds bindings/wasm-explorer, which is how the artifact it replaces drifted in the first place #4498 Nothing builds bindings/wasm-explorer, which is how the artifact it replaces drifted in the first place | Created: 2026-09-21 | Updated: 2026-10-02 | 6 failing / 30 total
• specs/functions: payment-ai-server-process -- claim-invoice before crediting #4116 specs/functions: payment-ai-server-process -- claim-invoice before crediting | Created: 2026-09-17 | Updated: 2026-10-02 | 4 failing / 30 total
• specs/functions: crm-proactive-sweep -- one step per seller after the 502 runs #4113 specs/functions: crm-proactive-sweep -- one step per seller after the 502 runs | Created: 2026-09-17 | Updated: 2026-10-02 | 4 failing / 30 total
• Feed the swarm from CI, with fuel that does not run out #3978 Feed the swarm from CI, with fuel that does not run out | Created: 2026-09-17 | Updated: 2026-10-02 | 6 failing / 28 total
• specs: bind every tool and skill to the Queen, and name a domain lead #3833 specs: bind every tool and skill to the Queen, and name a domain lead | Created: 2026-09-15 | Updated: 2026-10-02 | 4 failing / 30 total
• specs/automation: inngest-functions-status.t27 (lastRun без проб, lastProbe отдельно) + inngest-probe-suite VERSION 2 #3593 specs/automation: inngest-functions-status.t27 (lastRun без проб, lastProbe отдельно) + inngest-probe-suite VERSION 2 | Created: 2026-09-13 | Updated: 2026-10-02 | 5 failing / 30 total
• coq(CorePhi): replace proofs that were never checked by a compiler #3343 coq(CorePhi): replace proofs that were never checked by a compiler | Created: 2026-09-06 | Updated: 2026-10-02 | 5 failing / 32 total
• chore(ci)(deps): bump actions/attest-build-provenance from 1 to 4 #3001 chore(ci)(deps): bump actions/attest-build-provenance from 1 to 4 | Created: 2026-09-01 | Updated: 2026-10-02 | 34 failing / 41 total
• chore(ci)(deps): bump softprops/action-gh-release from 2 to 3 #3000 chore(ci)(deps): bump softprops/action-gh-release from 2 to 3 | Created: 2026-09-01 | Updated: 2026-10-02 | 29 failing / 42 total
• chore(ci)(deps): bump github/codeql-action from 3 to 4 #2999 chore(ci)(deps): bump github/codeql-action from 3 to 4 | Created: 2026-09-01 | Updated: 2026-10-02 | 38 failing / 41 total
• Land the formal verification harness on master (it has never run) #2727 Land the formal verification harness on master (it has never run) | Created: 2026-08-27 | Updated: 2026-10-02 | 5 failing / 24 total

Summary

Status	Count
Total Open PRs	39
PRs with Failing Checks	37
PRs with All Checks Green	2
READY	1
FAILING	37
PENDING	0
NO CHECKS YET	0

These columns do not partition: 1 + 37 + 0 + 0 = 38, and there are 39 open PRs. A PR is being counted twice or not at all.

Seal Status

• ⚠️ STALE -- sha256(compiler.rs)=b45a356c2eb6 != manifest seal=87e5cbd3ad94.
  The committed NMSE numbers were certified against an older compiler.rs.
  Run scripts/reseal-check.sh locally for the two-step reseal command (advisory; not a merge gate).

[gHashTag]

bee review (reviewer, not author) — head aeed7c1a6521cfbbe69a059f930e534191c3d3f6

Checked:

• Diff is two uses: lines, softprops/action-gh-release@v2 -> @v3, in .github/workflows/sbom.yml and .github/workflows/sign-release.yml. No other files.
• v3.0.0 release notes: the only change is the action runtime moving from Node 20 to Node 24. There are no input renames. Both jobs run on ubuntu-latest.
• action.yml@v3.0.0 still declares files, the only input either workflow passes. Both jobs keep contents: write.
• Required checks at this head: validate, check-linked-issue and parse-ratchet are all success.
• Still mergeable after chore(ci)(deps): bump github/codeql-action from 3 to 4 #2999 was squashed; that PR touched only scorecard.yml.

Red checks not caused by this PR:

• untrusted-input is red on master (9be91c7a) and on every open PR.
• coverage is red on master.
• integrity-gate and pack-index-consistency report SHA drift in conformance/vectors/*_conformance_v0.json.
• compile-proofs fails on Coq sources (CorePhi.v: "The reference lra was not found").
  None of these touch the two workflow files changed here, and both steps run only on release events.

Label bee-reviewed re-applied after this head.

[t27-bees]

bee review: see evidence comment