[renovate]

This PR contains the following updates:

Package	Type	Update	Change
suzuki-shunsuke/pinact-action	action	major	v1.4.0 → v3.1.0

---

Release Notes

suzuki-shunsuke/pinact-action

v3.1.0

Compare Source

Issues | Pull Requests | suzuki-shunsuke/pinact-action@v3.0.0...v3.1.0 | Base revision

This release includes all changes in v3.0.1.

Features

#​1217 Sign JSON Web Tokens with AWS KMS

A GitHub App private key stored in GitHub Secrets never expires, and anyone who obtains it can generate access tokens as long as the key stays registered.
You can now keep the private key in AWS KMS instead. The key can never be exported, and only the JSON Web Token signing is delegated to KMS.

- uses: suzuki-shunsuke/pinact-action@v3.1.0
  with:
    client_id: ${{vars.APP_CLIENT_ID}}
    aws_kms_key_id: ${{vars.KMS_KEY_ID}}
    aws_role_to_assume: ${{vars.AWS_ROLE_ARN}}

New inputs:

purpose	app	Securefix app
identify the app	client_id (new) or app_id	securefix_client_id (new) or securefix_app_id
KMS key	aws_kms_key_id	securefix_aws_kms_key_id
IAM role	aws_role_to_assume	securefix_aws_role_to_assume
region	aws_region	securefix_aws_region

• client_id and securefix_client_id can be used instead of app_id and securefix_app_id. GitHub recommends the Client ID. When both are set, the Client ID takes precedence.
• aws_role_to_assume assumes the IAM role with the GitHub OIDC token inside the action, so the AWS credentials are never exported to later steps of the job. The job needs the permission id-token: write. If it's not set, the standard AWS credential environment variables are used, so aws-actions/configure-aws-credentials also works.
• The securefix_ role and region fall back to the unprefixed ones.

Existing workflows using app_id and app_private_key need no change.

Fixes

#​1227 Install pinact when the caller has no aqua configuration

In a repository without its own aqua configuration, the action failed before running pinact:

ERR aqua failed exe_name=pinact error="command is not found"

The action's bundled aqua configuration wasn't found correctly, so the action only worked when the caller's repository had an aqua configuration to fall back to.
This has been broken since the action was rewritten in JavaScript (#​838).

Behavior change

If app_private_key or aws_kms_key_id is set without client_id or app_id, the action now fails with an error.
Previously it silently ignored the private key and used default_github_token.

Others

• Update pinact used by the action from v4.1.1 to v5.0.2. The action passes flags with two dashes, so pinact v5's breaking change about single-dash long flags doesn't affect it. If pinact is already installed on the runner, the installed one is used as before.
• #​1302 #​1303 Update aqua installed by the action from v2.62.3 to v2.65.2, and let Renovate keep it up to date
• Update reviewdog used by the action from v0.21.0 to v0.21.2
• #​1222 Update @​suzuki-shunsuke/github-app-token to ^0.1.0
• #​1278 Use the shared workflows for building and releasing JavaScript Actions

v3.0.1

Compare Source

[!WARNING]
This release has a bug. If pinact isn't installed and the caller repository has no aqua configuration, the action fails with aqua exec -- pinact reporting command is not found.
Please use v3.1.0 or later.
#​1209 #​1227

Fixes

#​1183 Fail the step when pinact errors in skip_push + review mode

Previously, when skip_push and review were enabled, pinact's exit code was ignored and the step's result was decided entirely by reviewdog.
If pinact stopped part way through (e.g. a GitHub API error), reviewdog received partial or empty results and the step passed even though nothing was verified.

Now the step fails when pinact exits with 3 or above.
Violations (exit codes 1 and 2) are still reported by reviewdog and governed by reviewdog_fail_level as before.
reviewdog still runs before the step fails, so the findings pinact did produce are posted to the pull request.

#​1181 Report the pinact failure reason based on its exit code

The error message now tells why pinact failed instead of a fixed GitHub Actions aren't pinned. or pinact run failed:

• 1: GitHub Actions aren't pinned.
• 2: pinact found problems that it can't fix automatically.
• 3: pinact failed due to a GitHub API error or an internal error.
• Others: pinact failed with an unexpected exit code N.

Only the messages changed. The set of runs that fail is the same as before.

Others

• #​1198 Update @​aquaproj/aqua-installer to 0.0.3. This removes the vulnerable nested undici@5.29.0 from dependencies.
• #​1179 Update aqua installed by the action from v2.56.1 to v2.62.3
• Update pinact used by the action from v4.0.0 to v4.1.1

v3.0.0

Compare Source

Issues | Pull Requests | suzuki-shunsuke/pinact-action@v2.0.0...v3.0.0 | Base revision

This release is largely driven by the update to pinact v4.0.0.
Please also refer to the pinact v4.0.0 release notes.

⚠️ Breaking Changes

#​1065 Upgrade pinact to v4.0.0
#​1065 Behavior change when skip_push: true

Behavior change when skip_push: true

Previously, this was equivalent to a -check mode. It has been changed to
simply skip committing.
By default, a commit is created.

With skip_push: true, fix: true, the code is fixed but not committed.
A subsequent step can create the commit on its own.
This is useful when you want to bundle the pinact changes with other
modifications into a single commit.

With skip_push: true, fix: false, validation is performed just like the
previous skip_push: true behavior.

Features

#​1065 Added inputs to support more pinact options

• files: lets you specify target files (positional arguments of pinact run)
• fix (--fix option)
• no_api (--no-api option)
• verify_min_age (--verify-min-age option)
• branch_to_tags (--branch-to-tags option)
• config (--config option)
• diff_file (--diff-file option)

v2.0.0

Compare Source

Issues | Pull Requests | suzuki-shunsuke/pinact-action@v1.4.0...v2.0.0 | Base revision

⚠️ Breaking Changes

Node.js 24 is required.

Node.js 20 was deprecated.
https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.