chore(deps): update fro-bot/agent to v0.96.1 - #3717
Merged
Merged
Conversation
This was referenced Jul 26, 2026
fro-bot
Bot
force-pushed
the
renovate/github-actions
branch
from
July 29, 2026 21:30
20743a5 to
f6f4e7e
Compare
fro-bot
Bot
changed the title
fro-bot
Bot
force-pushed
the
renovate/github-actions
branch
from
July 31, 2026 07:26
f6f4e7e to
e8d85eb
Compare
fro-bot
Bot
changed the title
This was referenced Aug 1, 2026
fro-bot
Bot
force-pushed
the
renovate/github-actions
branch
from
August 4, 2026 07:19
e8d85eb to
97559ef
Compare
fro-bot
Bot
changed the title
fro-bot
Bot
force-pushed
the
renovate/github-actions
branch
from
August 4, 2026 18:55
97559ef to
29d0c05
Compare
fro-bot
Bot
force-pushed
the
renovate/github-actions
branch
from
August 4, 2026 19:00
29d0c05 to
3186ef4
Compare
marcusrbrown
approved these changes
Aug 4, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v0.94.1→v0.96.1Release Notes
fro-bot/agent (fro-bot/agent)
v0.96.1Compare Source
Bug Fixes
Documentation
v0.96.0Compare Source
What's new
Trusted same-repo PR mention runs now have a way to deliver their work. Previously, when an
OWNER,MEMBER, orCOLLABORATORtriggered the agent via anissue_commenton a pull request, the GitHub credential was intentionally withheld from the model's shell — a security boundary that also meant the agent could make changes but had no path to commit them. This release adds a brokered push: after a successful mention run, the action reconstructs the net workspace diff against the trusted head SHA captured at run start, then writes it to the PR branch as a bot-authored commit through the Git Data API. The push credential never reaches the model.The delivery path is built with several hard constraints. Writes are restricted to an allowlist (
src/**,packages/*/src/**,docs/**, and top-level architecture docs); config, scripts, CI, and manifests are denied. Authorization is verified twice — once from the event and once live at delivery time — and the PR identity, branch, and head SHA are re-resolved immediately before the write so a moved target always fails closed. A 100-file cap and path/size validation apply throughout.The brokered push step is bounded by a 2-minute wall-clock budget. Without this, the sequential git subprocess and GitHub API calls (permission check, PR re-resolve,
createCommit) ran with only the job-level timeout as a backstop. On expiry the run fails loudly via the existing single-comment error path — never a silent skip. AnAbortSignalis threaded into all octokit calls so network stalls cancel promptly rather than consuming the full budget. The git subprocess cannot observe the signal, so the outer race is the hard bound for a stalled subprocess. #1304 #1307Full changelog
0.96.0 (2026-07-31)
Features
Build System
Bug Fixes
Documentation
Continuous Integration
Miscellaneous Chores
v0.95.1Compare Source
Build System
Bug Fixes
Documentation
Miscellaneous Chores
v0.95.0Compare Source
What's new
The agent now defaults to OpenCode harness build
1.18.5+harness.3a55d7d2, updating both the action default and the workspace executor Docker image to the same build so both surfaces run identical patched OpenCode.The 1.18.5 base brings improved Claude adaptive-thinking model detection and effort variants, more accurate preservation of OpenAI Responses phases and streaming metadata, and fixes for Mistral and MiniMax providers. Searched symlink paths are now included in grep results. All existing headless SDK, SSE, session, tool, and permission contracts are unchanged. Future harness releases flow into both surfaces automatically via this mechanism, replacing Renovate tracking which cannot order
+harness.<sha>build-metadata tags. #1286 #1288The provider authentication fast-fail contract is now documented. When a provider raises
ProviderAuthErroror signalsauth_unavailable, the agent fast-fails rather than hanging to timeout, and the sticky terminal-provider state is shared consistently across SSE, polling, and quota handling paths. The new solution document captures the trust boundary rules around no-leak prevention and cross-links the quota, deadline-outcome, and response-file precedents. #1285Full changelog
0.95.0 (2026-07-25)
Features
Build System
Documentation
Miscellaneous Chores
v0.94.4Compare Source
What's new
When model credentials expired mid-run, OpenCode could report a provider authentication failure in two forms: a
ProviderAuthErrorSSE event, or a polling response withaction.reason: auth_unavailable. Previously, the Action recognized only the event form; the polling form was treated as normal activity and the run continued until the execution deadline, replacing an actionable auth error with a generic timeout.The Action now detects both forms and stops continuation retries immediately on either. A first-terminal-writer-wins guard ensures that whichever signal arrives first — auth failure or deadline — remains authoritative, preventing the two from racing and producing a misleading result. When a trusted routed event provides a bound delivery target, one provider-neutral failure comment is posted; provider-controlled message text, credentials, and route hints are never rendered.
#1283
Full changelog
0.94.4 (2026-07-24)
Bug Fixes
Miscellaneous Chores
v0.94.3Compare Source
What's new
Structured provider error payloads could be silently collapsed to
[object Object]when surfaced as text, and a missing response artifact could mask the real execution error rather than expose it. The action now preserves the structured failure and posts one trusted fallback comment — bound to the same trusted routed target and using static error copy — when a failed comment or review run cannot produce its response artifact.Several SDK waits (session creation, prompt execution, polling, retries) previously operated on independent clocks, allowing a stalled run to consume the entire job window with no controlled abort. A single absolute deadline now spans all of those phases; SSE teardown and title cleanup still run, but they complete within that same bound so a hung stream can no longer prevent the terminal outcome from being reported. #1277
Full changelog
0.94.3 (2026-07-24)
Build System
Bug Fixes
Documentation
Continuous Integration
v0.94.2Compare Source
Build System
Bug Fixes
Continuous Integration
Configuration
📅 Schedule: (in timezone America/Phoenix)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.