chore(deps): bump the github-actions-minor-patch group with 2 updates

[dependabot]

Bumps the github-actions-minor-patch group with 2 updates: rvagg/depsound-action and rvagg/depsound-action/post.

Updates rvagg/depsound-action from 0.3.3 to 0.3.6

Release notes

Sourced from rvagg/depsound-action's releases.

v0.3.6

Full Changelog: rvagg/depsound-action@v0.3.5...v0.3.6

v0.3.5

Full Changelog: rvagg/depsound-action@v0.3.4...v0.3.5

v0.3.4

Full Changelog: rvagg/depsound-action@v0.3.3...v0.3.4

Commits

• 7c7eb2b chore: release v0.3.6
• e99724b chore: pin self-references to v0.3.5
• 0214569 chore: release v0.3.5
• 4e8c346 chore: pin self-references to v0.3.4
• ee3236b chore: release v0.3.4
• 98133ea chore: pin self-references to v0.3.3
• See full diff in compare view

Updates rvagg/depsound-action/post from 0.3.3 to 0.3.6

Release notes

Sourced from rvagg/depsound-action/post's releases.

v0.3.6

Full Changelog: rvagg/depsound-action@v0.3.5...v0.3.6

v0.3.5

Full Changelog: rvagg/depsound-action@v0.3.4...v0.3.5

v0.3.4

Full Changelog: rvagg/depsound-action@v0.3.3...v0.3.4

Commits

• 7c7eb2b chore: release v0.3.6
• e99724b chore: pin self-references to v0.3.5
• 0214569 chore: release v0.3.5
• 4e8c346 chore: pin self-references to v0.3.4
• ee3236b chore: release v0.3.4
• 98133ea chore: pin self-references to v0.3.3
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

depsound · 2 dependency changes · no signals tripped

• gha:rvagg/depsound-action/post e64e9937f8f5 → 7c7eb2bfc936: no content change: the scoped action at post/ is byte-identical; the version moved, what installs did not · sha pin both sides · composite unchanged · 2 nested actions
• gha:rvagg/depsound-action e64e9937f8f5 → 7c7eb2bfc936: sha pin both sides · composite unchanged · 4 files +6/-6 · no new runner capability · 2 nested actions

Checked: the published artifact diff, pin grade, execution model, runner capability references (grep, evadable). Not checked: runtime behaviour, intent (an obfuscated payload reads as ordinary code), the permissions, secrets and trigger at each callsite, self-hosted runner reach, publish provenance. No known-CVE scan for 2 of these: OSV indexes no advisories for that ecosystem.

This is a starting point, not a pass. Run locally for full analysis and grep-able workspace (trees + stats.json) for agent investigation:

printf '%s\n' \
  'gha:rvagg/depsound-action e64e9937f8f5d7017446ce4f2375705e6c05a517 7c7eb2bfc936dc8242f0592f6d7c4f9835510380' \
  'gha:rvagg/depsound-action/post e64e9937f8f5d7017446ce4f2375705e6c05a517 7c7eb2bfc936dc8242f0592f6d7c4f9835510380' \
  | go run github.com/rvagg/depsound/cmd/depsound@v0.33.0 bulk

Or hand this PR to an agent: point it at the PR and the review skill for a proceed/hold call.

_{depsound · full report + logs}

[github-actions]

🎉 This PR is included in version 2.1.18 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀