ci(deps): bump ci-dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	patch	v6.0.2 → v6.0.3
actions/setup-node	action	minor	v6.1.0 → v6.4.0
benc-uk/workflow-dispatch	action	minor	v1.2.4 → v1.3.2
benc-uk/workflow-dispatch	action	patch	v1.3.1 → v1.3.2
dependabot/fetch-metadata	action	minor	v2.4.0 → v2.5.0
googleapis/release-please-action	action	patch	v4.4.0 → v4.4.1
lewagon/wait-on-check-action	action	minor	v1.4.1 → v1.8.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

actions/checkout (actions/checkout)

v6.0.3

Compare Source

• Fix checkout init for SHA-256 repositories by @​yaananth in #​2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in #​2414

actions/setup-node (actions/setup-node)

v6.4.0

Compare Source

What's Changed

Dependency updates:

• Upgrade @​actions dependencies by @​Copilot in #​1525
• Update Node.js versions in versions.yml and bump package to v6.4.0 by @​priya-kinthali in #​1533

New Contributors

• @​Copilot made their first contribution in #​1525

Full Changelog: actions/setup-node@v6...v6.4.0

v6.3.0

Compare Source

What's Changed

Enhancements:

• Support parsing devEngines field by @​susnux in #​1283

When using node-version-file: package.json, setup-node now prefers devEngines.runtime over engines.node.

Dependency updates:

• Fix npm audit issues by @​gowridurgad in #​1491
• Replace uuid with crypto.randomUUID() by @​trivikr in #​1378
• Upgrade minimatch from 3.1.2 to 3.1.5 by @​dependabot in #​1498

Bug fixes:

• Remove hardcoded bearer for mirror-url @​marco-ippolito in #​1467
• Scope test lockfiles by package manager and update cache tests by @​gowridurgad in #​1495

New Contributors

• @​susnux made their first contribution in #​1283

Full Changelog: actions/setup-node@v6...v6.3.0

v6.2.0

Compare Source

What's Changed

Documentation

• Documentation update related to absence of Lockfile by @​mahabaleshwars in #​1454
• Correct mirror option typos by @​MikeMcC399 in #​1442
• Readme update on checkout version v6 by @​deining in #​1446
• Readme typo fixes @​munyari in #​1226
• Advanced document update on checkout version v6 by @​aparnajyothi-y in #​1468

Dependency updates:

• Upgrade @​actions/cache to v5.0.1 by @​salmanmkc in #​1449

New Contributors

• @​mahabaleshwars made their first contribution in #​1454
• @​MikeMcC399 made their first contribution in #​1442
• @​deining made their first contribution in #​1446
• @​munyari made their first contribution in #​1226

Full Changelog: actions/setup-node@v6...v6.2.0

benc-uk/workflow-dispatch (benc-uk/workflow-dispatch)

v1.3.2

Compare Source

What's changed since v1.3.1

Added

• New wait-interval-seconds input to control how often the action polls when wait-for-completion: true. (#​98)

Fixed

• Pass X-GitHub-Api-Version: 2026-03-10 on the dispatch and run-status REST calls. Removes the GitHub REST API deprecation warning emitted on every run and makes behaviour deterministic against future default-version changes. (#​103, fixes #​99)

Docs

• Document the existing sync-status input. (#​93)
• Document wait-interval-seconds in the README. (#​100)
• Fix typo in README for the wait-for-completion option. (#​101)

Notes

• No breaking changes. No changes to action.yaml inputs/outputs beyond what was already in v1.3.1.
• The floating v1 and v1.3 tags have been moved to point at v1.3.2.

Full changelog: benc-uk/workflow-dispatch@v1.3.1...v1.3.2

v1.3.1

Compare Source

Features

• New sync-status input — when used with wait-for-completion, mirrors the triggered workflow's conclusion (failure/cancelled) back to this action's status (#​84)
• Alternate ref default for PRs — automatically uses github.head_ref when running in a pull request context, avoiding refs/pull/.../merge errors (#​79)

Bug Fixes

• Safer JSON input parsing — invalid inputs JSON now logs an error instead of throwing an unhandled exception (#​84)
• Improved timeout handling — timeout now sets a distinct timed_out status and emits a warning instead of silently breaking (#​84)
• Improved warning message formatting for workflow run timeout

Internal Changes & Chores

• Replaced console.log calls with core.info for proper Actions log integration (#​84)
• Removed stale ref/inputs parameters from the workflow list API call (#​84)
• Expanded CI test matrix from 3 sequential steps to 9 parallel test jobs covering workflow lookup, output assertions, wait-for-completion, sync-status, and error handling (#​84)
• Added CI path filters to skip docs-only changes (#​84)
• Changed echo-3 test fixture from workflow_call to workflow_dispatch with deterministic failure (#​84)
• Removed unused .vscode/settings.json (#​84)
• Added .github/copilot-instructions.md (#​84)
• General project chores

Documentation Updates

• No documentation updates in this release

v1.3.0: - It's been a long time coming...

Compare Source

What's Changed

• After 6 years GitHub finally added a way to return the run-id from the workflow_dispatch API, this means I can return the run-id and link URLs from this action 😎
• It also means the requested wait-for-completion option is now possible! 🥳 (with optional wait-timeout-seconds too)
• Mucho internal modernization, switched to esbuild, packages updated and Node v24 is the new default 👀

Merges

• 2026 refresh by @​benc-uk in #​83

Full Changelog: benc-uk/workflow-dispatch@v1.2...v1.3.0

v1.3

Compare Source

dependabot/fetch-metadata (dependabot/fetch-metadata)

v2.5.0

Compare Source

What's Changed

• Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 by @​dependabot[bot] in #​628
• Bump the dev-dependencies group with 11 updates by @​dependabot[bot] in #​629
• Bump actions/create-github-app-token from 2.0.6 to 2.1.1 by @​dependabot[bot] in #​635
• Bump actions/create-github-app-token from 2.1.1 to 2.1.4 by @​dependabot[bot] in #​638
• Bump actions/checkout from 4 to 5 by @​dependabot[bot] in #​636
• Bump actions/setup-node from 4 to 5 by @​dependabot[bot] in #​637
• Bump actions/setup-node from 5 to 6 by @​dependabot[bot] in #​639
• Bump actions/create-github-app-token from 2.1.4 to 2.2.0 by @​dependabot[bot] in #​643
• Bump actions/checkout from 5 to 6 by @​dependabot[bot] in #​642
• Bump actions/create-github-app-token from 2.2.0 to 2.2.1 by @​dependabot[bot] in #​648
• Bump js-yaml from 3.14.1 to 3.14.2 by @​dependabot[bot] in #​644
• Bump express from 5.1.0 to 5.2.1 by @​dependabot[bot] in #​645
• Bump @​modelcontextprotocol/sdk from 1.11.2 to 1.24.0 by @​dependabot[bot] in #​647
• v2.5.0 by @​fetch-metadata-action-automation[bot] in #​631

Full Changelog: dependabot/fetch-metadata@v2...v2.5.0

googleapis/release-please-action (googleapis/release-please-action)

v4.4.1

Compare Source

Bug Fixes

• bump release-please from 17.1.3 to 17.3.0 (#​1183) (ef9c274)

lewagon/wait-on-check-action (lewagon/wait-on-check-action)

v1.8.0

Compare Source

Added

• Add a wait-for-duplicates option to require every check with a duplicate name to succeed

v1.7.0

Compare Source

Fixed

• Fix the failure exit codes

v1.6.1

Compare Source

Added

• Pin the ruby/setup-ruby version

v1.6.0

Compare Source

Added

• Add checks-discovery-timeout option

v1.5.0

Compare Source

Added

• Add fail-on-no-checks option

Fixed

• Bump rexml to 3.4.2

---

Configuration

📅 Schedule: (in timezone Asia/Tokyo)

• Branch creation
  • Between 10:00 AM and 10:59 AM, on day 1 of the month (* 10 1 * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.