Update github-actions

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
TypedDevs/bashunit	action	minor	0.45.0 → 0.49.0
github/codeql-action	action	patch	v4.37.6 → v4.37.7
metcalfc/changelog-generator	action	minor	v4.7.0 → v4.8.0
step-security/harden-runner	action	minor	v2.20.1 → v2.21.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

TypedDevs/bashunit (TypedDevs/bashunit)

v0.49.0

Compare Source

Added

• --pass-with-no-tests exits 0 when a run selects no tests, for the case where that is deliberate — a CI matrix whose shards are not all populated, or a changed-files run that touched no tests. The run still reports No tests found; only the verdict changes. It does not excuse a path that is not on disk. Same flag, same spelling, as jest, vitest, Playwright and Cypress (#​1263)
• --list-tags prints the tags of the selected files, one per line, sorted and deduplicated, and runs nothing. Tags live only in # @tag comments, so a mistyped --tag had no list to check against (#​1265)

Changed

• A test or bench path that does not exist is now named and refused before the run starts, instead of the No tests found / No benchmarks found an empty selection gives. Every genuinely-empty case keeps that message: a directory holding no tests, a --filter or --tag matching nothing, an empty --shard, --changed with no changes, and a glob the shell left unexpanded (#​1263)
• A path argument that selects nothing no longer falls back to BASHUNIT_DEFAULT_PATH. bashunit empty_dir/ ran the default suite and exited 0, reporting a pass for tests the caller never named (#​1263)
• --snapshot-report-unused and --snapshot-prune now report a snapshot whose test file was deleted or renamed — the most common way one is orphaned, and the only kind neither flag could ever see. One whose file exists but was not part of this run is still left alone. This widens what --snapshot-prune deletes (#​1194)
• A --tag matching nothing now names the tags the run saw, or says no test carries one (#​1265)
• Performance: a sequential run is about 3.9ms faster per test file, and the total runtime costs one fork and one subshell less (#​1271)
• Performance: per-test cleanup no longer reads the whole of BASHUNIT_TEMP_DIR, which is shared and survives between runs — a 100-test file went from 978ms to 542ms against 5000 leftovers, and runtime no longer grows with that directory. A file a test writes there by hand, rather than via temp_file/temp_dir, is no longer removed for it (#​1269)

Fixed

• A sequential run no longer leaks a file descriptor per test file. At the limit it stopped executing tests and reported risky while still exiting 0: 120 files under a 120-descriptor limit ran 2 assertions instead of 120 (#​1271)
• Time taken no longer reports 0ms, or a negative duration, for a runtime it could not measure — both read as real measurements. It now says unknown (#​1271)
• A run using --test-timeout no longer leaves its watchdog holding the caller's captured output for the rest of the timeout budget; a nested run under --suite did this to the run that spawned it (#​1137)
• A test that both fails an assertion and hits a shell error no longer reports the failure text with the diagnostic glued onto the end; the error message is the diagnostic alone (#​1267)
• --list under --parallel no longer prints No tests found in the middle of the ids: a listing dispatches no worker, so there is nothing to aggregate (#​1007)

v0.48.0

Compare Source

Added

• --verbose warns on Bash 3.x that coverage does not count lines run inside a subshell, so a lower percentage there explains itself (#​1112)

Changed

• Performance: --coverage is roughly 5x faster and --coverage-report-html roughly 19x — this repo went from 16.2s to 2.9s, and a 128-file HTML report from 58.7s to 3.1s (#​1092, #​1096, #​1098, #​1099, #​1102, #​1104, #​1110, #​1117)
• Performance: ./build.sh is about 1.9x faster (7.6s to 4.0s), producing a byte-identical artifact (#​1233)
• Performance: cold start makes two fewer forks, about 4ms of a 65ms startup (#​1124)
• The HTML report gained a Failures section with each failure's name, file:line and message, and its summary now counts risky and flaky tests (#​1251, #​1252)
• A --filter that matches nothing names the test it most likely meant: filters match the test function name, case-sensitively, not the humanized title in the report (#​1237)
• --env with a space in the path now says the value was split on the first space to pass bootstrap arguments, and that BASHUNIT_BOOTSTRAP takes the path whole (#​1247)
• The bootstrap error names the actual cause — missing, a directory, or not a regular file — instead of cannot read for all of them (#​1262)
• bashunit doc <filter> says No assertion matches '<filter>' instead of printing nothing (#​1201)
• install.sh destination errors no longer advise a -d flag that does not exist; the script takes positional arguments (#​1221)
• bashunit learn generates starter files that are valid bash, and verifies lessons against the learner's code rather than the hint comments in its own template (#​1256, #​1258)
• The coverage HTML report handles filenames containing |, < or & (#​1254)
• A test file that fails to source without writing to stderr reports its size, so a truncated file can be told from one whose last command failed (#​1137)
• The example/ demo is covered by the suite; nothing ran it before (#​1219)
• Docs: benchmarks are the bashunit bench [path] subcommand — -s -b and --simple --bench never existed (#​1227)
• Docs: test functions need a literal, lowercase test_ prefix; the guide's camelCase example and its case-insensitive claim were both wrong (#​1215)
• Docs: assert_equals strips ANSI codes, tabs and newlines — not spaces (#​1225)
• Docs: an empty entry in the -e/--env/--boot file assigns an empty value; it does not restore the default (#​1217)
• Docs: assert_matches costs ~2.5ms per call against ~0.065ms for assert_same, so prefer assert_contains for a fixed substring (#​1187)
• Docs: a @data_provider test shares one snapshot across all its values; use assert_match_named_snapshot "$1" for one each (#​1185)

Fixed

• bashunit --output junit produces valid XML, and --parallel --stop-on-failure no longer corrupts a machine --output stream (#​1239, #​1243)
• The HTML report escapes test titles instead of writing them into the markup (#​1249)
• --coverage-paths accepts a path containing a space, an apostrophe or a glob character; it used to break the DEBUG trap and fail passing tests (#​1245)
• A piped --parallel run no longer emits a stray \r \r, and an empty one renders its notice on its own line (#​1239)
• Duplicate test functions are detected under --parallel again; the run reported "All tests passed" over a file where one of two same-named tests never ran (#​1147)
• A @data_provider that is undefined or yields no data is reported as an error naming the provider, instead of the test vanishing behind "No tests found" (#​1145)
• A bootstrap file that fails to load reports it and exits non-zero through every path that loads one, instead of leaving the run with no tests and exit 0 (#​1179, #​1181)
• bashunit bench reports No benchmarks found and exits non-zero when the path does not exist or holds no bench_ function (#​1199)
• A report path that is a directory fails fast with is a directory, not a file instead of exiting 0 with no report written (#​1177)
• A coverage run that tracked no executable line says so and names --coverage-paths, instead of reporting Coverage 0% is below minimum N% (#​1171)
• assert_exec "cmd" --exit 1 works under --strict; set -e aborted the test before the assertion could read the code (#​1207)
• assert_equals no longer expands backslash escapes while normalizing, so C:\ and C:\\ differ and a literal \t is not a real tab (#​1108)
• assert_file_contains accepts a needle starting with a dash, and assert_file_not_contains matches literally like its counterpart (#​1108)
• The mock/spy misuse message names a helper that exists (bashunit::mock, not mock), and reports a usable-name error instead of a raw bash syntax error (#​1136, #​1229)
• A JSON test skipped for a missing jq is reported under its own name, not bashunit::assert_json::require_jq (#​1223)
• A data-provider value ending in a backslash reaches the test instead of arriving unset (#​1134)
• Coverage no longer loses hits recorded inside a command substitution; on Bash 5 a run reported 196 of 236 real hits (#​1101)
• install.sh names the real problem when the destination is unusable, and validates it before any network call (#​1197)
• bashunit init no longer adds a dead BASHUNIT_BOOTSTRAP line to .env on every run, and reports what it wrote (#​1175)
• A run survives its scratch directory going missing and says so once on stderr (#​1163, #​1167)
• A run's scratch-directory cleanup can no longer widen to every concurrent run's (#​1165)
• TAP escapes a # in a test name, so check # SKIP me is no longer read as a directive (#​1119)
• GitHub Actions annotations are percent-encoded on Bash 3.0 too (#​1121)

v0.47.0

Compare Source

Added

• --output <text|tap|json|junit> prints the JSON and JUnit reports on stdout, so a pipeline needs no temp file; --report-json still writes its file alongside (#​1018)
• bashunit::skip_if, bashunit::skip_unless, bashunit::skip_unless_command <cmd> and bashunit::skip_on <windows|macos|linux> mark a test skipped and end it, replacing bashunit::skip && return (#​1019)
• Per-test # @timeout <seconds>, # @retry <n> and # @skip [reason] annotations override the run-wide flags in both directions; a malformed value aborts the run (#​1020)
• [suite:<name>] sections in .bashunitrc name a set of paths and options; --suite <name> runs one (repeatable) and --list-suites lists them (#​1021)
• --sandbox fails a test that runs an external command it did not mock, and --sandbox-allow <cmd,...> widens the baseline allowlist (ADR-012) (#​1022)
• bashunit::mock_sequence <cmd> <answer>… answers each call with the next entry, so retry loops need no hand-rolled counter file; the last entry repeats once exhausted (#​1023)
• assert_have_never_been_called <cmd> asserts a spied command never ran, printing the recorded calls when it did (#​1023)
• assert_is_file_readable, assert_is_file_writable, assert_is_file_executable, their negatives and assert_is_file_not_empty give files the parity directories already had (#​1024)
• assert_json_key_not_exists checks that a JSON path is absent, and assert_json_length the size of an array, object or string (#​1025)
• bashunit bench --report-json <file> and --report-junit <file> write the benchmark run to disk, so a CI run leaves an artifact to store, chart and compare (#​1028)
• bashunit bench --baseline <file> fails a run when a benchmark is more than --baseline-tolerance percent (default 10) slower than the recorded one, comparing medians; --baseline-update <file> records the new reference (#​1029)
• --snapshot-prune deletes the snapshot files no test resolved, printing every path; full runs only, and never on a run with failures (#​1030)

Changed

• LCOV BRDA carries the arm's execution count instead of a 0/1 taken flag, taken from the arm's first executable line; BRF and BRH are unchanged (#​1061)
• Performance: --coverage is about 10x faster — a run over this repo's src went from 9.23s to 0.96s. The report phase classifies lines, scans declarations and branches and emits the whole LCOV report in one awk invocation per run instead of Bash loops and forks per file, hit data is grouped once, the DEBUG trap rejects untracked lines before recording, and the caches are read through the variable table (#​1056, #​1057, #​1059, #​1060, #​1084, #​1088, #​1090)

Fixed

• Coverage reports every file under --coverage-paths, not only the ones a test executed: an untouched file shows as 0/N (0%) and --coverage-min gates on that denominator. This repo reported 11 of its own 121 files. Percentages drop, because the old ones were measured over the files that ran (#​1053)
• --coverage-diff counts a changed file that no test executed, instead of skipping it and letting a brand new untested file pass a --coverage-min 90 gate. A docs-only commit still reports 100% (#​1054)
• Coverage read a statement ending in ) as a case arm, so x=$(foo) left the denominator while x=$(printf '%s\n') stayed. A ) now closes an arm only when no ( opened earlier on the line, recovering 456 executable lines of this repo's src/. Percentages move in both directions per file (#​1055)
• A brace inside a comment, a string or a heredoc no longer counts towards a function's span, so a single stray { stops swallowing every later function in the file — 11 functions in this repo's src/coverage/lines.sh were reported as 1, and END { inside an embedded awk program was reported as a function. FN, FNDA, FNF and FNH change; lines and branches do not (#​1086)

v0.46.0

Compare Source

Added

• --changed [<ref>] runs only the test files git reports as touched since <ref> (default origin/HEAD, then HEAD), covering committed, staged, unstaged and untracked changes (#​1010)
• --order-by <defined|defects|random> picks the execution order; defects runs the last run's failures first and still runs the whole suite (#​1011)
• --list (alias --dry-run) prints the tests a run would execute without running them; --list-format json emits file, function, name, line and tags, honouring every selection flag including --shard (#​1007)
• --exclude-filter <name> skips tests by name, the counterpart of --exclude-tag: repeatable, OR'd, and wins over --filter (#​1009)
• --tag accepts expressions: 'a&&b' (AND), '!a' (NOT) and 'a&&!b'; repeated --tag flags keep OR semantics and --exclude-tag still wins (#​1008)
• # @tags a b above any top-level line tags every test in the file, unioned with per-function # @tag (#​1008)
• --repeat <n> runs each selected test n times to hunt flakiness before CI does: one report line with the aggregate outcome, a failure names its iteration, and repeat wraps --retry (#​1013)
• Flaky is a first-class outcome: a test that only passed after a retry is counted separately, stays inside the pass total so the exit code is unchanged, and is carried into JUnit (<flakyFailure>), TAP, JSON, HTML and GitHub Actions with the first attempt's failure message; --fail-on-flaky turns such a run red (#​1012)
• --coverage-report-cobertura [file] writes Cobertura XML (default coverage/cobertura.xml), the format GitLab merge-request visualisation, Azure DevOps and Jenkins consume, with repo-relative filenames, per-line hits and condition-coverage on branch lines, alongside the LCOV and HTML reports (#​1017)
• --coverage-diff <ref> limits the coverage console report to lines changed since a base ref; --coverage-min then gates on that diff percentage (#​1032)
• --report-md <file> writes a Markdown run summary — verdict, counts table, failures with their message, plus coverage and slowest tests when those ran — and inside GitHub Actions appends it to $GITHUB_STEP_SUMMARY (#​1015)
• GitHub Actions annotations print to stdout automatically inside Actions, carrying the failing test's file and line so they land on the right line of the diff; --gha-annotations <auto|always|never> overrides the detection and action.yml gains an annotations input (#​1014)
• assert_between <min> <max> <actual> and assert_not_between add inclusive numeric-range assertions for integers and decimals (#​1026)
• assert_command_available <command> asserts a command, shell builtin or function resolves through command -v (#​1027)
• --verbose reports the coverage engine in use, and an explicit BASHUNIT_COVERAGE_ENGINE=xtrace the running Bash cannot honour now warns instead of being silently ignored (#​1005)

Changed

• JUnit XML: one <testsuite> per test file with its own counts, time and timestamp instead of a single flat suite, classname on every <testcase>, <failure message="..."> carrying the first informative line of the real message with type="AssertionFailed", <system-out> with the test's captured output, and aggregate totals on <testsuites>, so consumers that group by suite or classname (Jenkins, GitLab, dorny/test-reporter) get real groupings (#​1016)
• Performance: --coverage is about 1.6x to 2.3x faster; executable-line classification no longer forks grep per source line, roughly half of a coverage run's wall time on both engines (#​1005)
• bashunit test --help lists --show-skipped and --show-incomplete, both accepted by the parser but never advertised; BASHUNIT_COVERAGE_SHOW_FUNCTIONS and BASHUNIT_COVERAGE_SHOW_UNCOVERED are registered in src/config/env.sh like every other setting, and .env.example now lists all 66 settings, 19 of which were missing (#​1063)
• Docs: full audit of the reference pages against the code — docs/configuration.md gained the 17 settings it never documented, docs/command-line.md gained the assert subcommand section and real example output, and the coverage settings and diff-coverage narrative now live in one place instead of two that had drifted (#​1063)

Fixed

• Report formats are no longer empty under --parallel; --report-junit, --report-tap, --report-json, --report-html and --log-junit all recorded zero tests, because the rows were collected inside the per-test worker and nothing rebuilt them in the parent (#​1004)
• A failed assertion is no longer reported twice: bashunit::assert_that returns 1 on failure by design, so a custom assertion ending with it made the test body exit non-zero and the runner printed a spurious ✗ Error on top of the ✗ Failed. Custom assertions no longer need a trailing return 0, and a real runtime error is still reported as an error (#​1063)
• --coverage-report with no value uses coverage/lcov.info instead of aborting the run with $2: unbound variable, and no longer consumes a following flag as its filename; write the test path before it, since an optional value cannot be told apart from a path (#​1063)
• --list --list-format json reports each tag as its own array element; the emitter split the tag list on whitespace while every other consumer splits it on commas, so two tags rendered as ["slow,fileTag"] (#​1063)
• assert_within_delta rejects malformed numbers such as 1.2.3 or 5-3 as non-numeric instead of leaking a raw bc parse error or evaluating them as an expression (#​1026)
• Build: the standalone binary size budget is 544 KiB, raised from 500 KiB after ordinary feature growth crossed it; the artifact keeps its indentation rather than being minified (#​1045)

github/codeql-action (github/codeql-action)

v4.37.7

Compare Source

• Update default CodeQL bundle version to 2.26.3. #​4085

metcalfc/changelog-generator (metcalfc/changelog-generator)

v4.8.0

Compare Source

Highlights

Failed changelog generation now fails the step

If the changelog could not be generated — an unresolvable ref, any git error — the action printed an ::error:: annotation and then exited 0. The step went green, outputs.changelog was never set, and downstream steps consumed an empty string without anything indicating a problem.

It now exits non-zero.

[!WARNING]
This is a behavior change. A workflow that was quietly passing on a broken changelog will now fail. That is the point — but expect it to surface as new red builds rather than as new errors, since the errors were always being printed.

fetch: true no longer intermittently fails on shallow checkouts

The default fetch path chained two git fetch --depth=1 calls ahead of git fetch --unshallow. Each rewrites .git/shallow while the next has already read it, so git would intermittently abort with:

fatal: shallow file has changed since we read it

Because fetch: true is the default and the exit code was being discarded, this produced a silently empty changelog rather than a visible failure. It was happening in this repository's own CI.

Now a single fetch, requesting --unshallow only when the checkout is actually shallow.

Testing

make test previously ran npm test || echo "no tests available", where npm test was exit 1 — it reported success unconditionally. The project now has a real suite covering changelog.sh against live git fixtures, ref validation, the release scripts, and the built dist/ bundle as the runner executes it. Both fixes above were found by adding it.

Full changelog

• 98b1282 - 4.8.0
• 32f61b2 - fix: make the version bump scripts portable (#​466)
• f64bf35 - build(deps-dev): bump eslint from 10.1.0 to 10.8.1 (#​460)
• e5f3244 - build(deps-dev): bump brace-expansion from 5.0.5 to 5.0.7 (#​448)
• 57d0aa3 - build(deps-dev): bump globals from 17.4.0 to 17.9.0 (#​457)
• ce20209 - build(deps-dev): bump prettier from 3.8.1 to 3.9.6 (#​454)
• 89d0cce - build(deps): bump actions/attest-build-provenance from 4.1.0 to 4.2.2 (#​464)
• daae4ab - build(deps): bump the codeql-action group with 3 updates (#​461)
• 58f7ad5 - fix: fail the step when the changelog cannot be generated (#​465)
• 4ffdab6 - build(deps-dev): bump @​vercel/ncc from 0.38.4 to 0.44.1 (#​441)
• ce7d426 - ci: bump codeql-action to v4.37.1 and group its future updates (#​459)
• cbc6a25 - test: replace the no-op test target with a real suite (#​458)
• f278f3b - docs: update README example to use actions/checkout v6
• 3f3af1f - fix: bump actions to Node 24-compatible versions
• 10c0451 - fix: pin codeql-action to SHA and document supply chain security

step-security/harden-runner (step-security/harden-runner)

v2.21.0

Compare Source

What's Changed

• Support for denied endpoints in block mode. This is included in the enterprise tier. Customers can deny outbound calls, for example, to public package registries.
• Improved Support for AWS CodeBuild GitHub Actions Runners.
• Bug fixes.

Full Changelog: step-security/harden-runner@v2.20.1...v2.21.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.