[mergeraptor]

This PR contains the following updates:

Package	Type	Update	Change
oras-project/setup-oras	action	patch	v2.0.2 → v2.0.3

---

Release Notes

oras-project/setup-oras

v2.0.3

Compare Source

Highlights

• Support ORAS CLI version(s): 1.3.5, 1.3.6

What's Changed

• chore(deps): Bump @​types/node from 26.6.2 to 26.6.4 by @​dependabot[bot] in #​208
• docs: remove transient 1.3.4 note from RELEASING.md by @​SatvikMishra08 in #​209
• chore: pin create-pull-request action to commit SHA by @​Brilly-Bohyun in #​213
• docs: update usage examples and document version pinning by @​Brilly-Bohyun in #​215
• docs: document immutable releases and floating tag rules by @​Brilly-Bohyun in #​218
• ci: pin remaining GitHub Actions to commit SHAs by @​Brilly-Bohyun in #​219
• ci: check auto-release workflow names by @​Brilly-Bohyun in #​220
• chore(deps): Bump @​types/node from 26.6.4 to 26.6.5 by @​dependabot[bot] in #​221
• chore: update releases.json for 1.3.6,1.3.5 by @​github-actions[bot] in #​222

New Contributors

• @​SatvikMishra08 made their first contribution in #​209

Full Changelog: oras-project/setup-oras@v2.0.2...v2.0.3

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[jeefy]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please assign ahmedadan after the PR has been reviewed.
You can assign the PR to them by writing /assign @ahmedadan in a comment when ready.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[hivecommons-hive]

bb9c7a8

ℹ️ Sentinel notice — informational; author is trusted (allow-listed bot), merge is not blocked

Hive flagged this PR (author @mergeraptor[bot], head bb9c7a8f2600) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 1 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • .github/workflows/build.yml

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

[hivecommons-hive]

Summary: This automated update bumps the helper that installs the ORAS tool in the build workflow from version 2.0.2 to 2.0.3. The new version is pinned to an exact commit, and I checked that the commit really is the one the 2.0.3 release points at. It is safe to land; the only note is that a nearby explanatory comment is now out of date.

---

docs-currency

• .github/workflows/build.yml:826-827 and :918-919 (low, advisory): the comments above both bumped steps say "setup-oras v2.0.1's built-in release table stops at ORAS 1.3.3, so pin the release ... by URL and checksum." Per the v2.0.3 release notes (PR body), the action's release table now includes 1.3.5 and 1.3.6, so the stated reason for the explicit url:/checksum: pin no longer holds. The pin itself is harmless and still works; either refresh the comment (e.g. "pinned by URL+checksum for reproducibility") or drop url:/checksum: in favour of version: 1.3.6 in a follow-up. Not blocking.

No findings from: correctness, security, intent-alignment, style.

Confidence: 5/5 (safe)

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[jeefy]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please assign ahmedadan after the PR has been reviewed.
You can assign the PR to them by writing /assign @ahmedadan in a comment when ready.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[Danathar]

Merging by hand (human-merge path: workflow change, so the hive holds it for a person). Reviewed: bumps oras-project/setup-oras from v2.0.2 to v2.0.3, still pinned by full SHA; verified 5e2f2482 is upstream's v2.0.3 tag (upstream changes: new oras release data and a rebuilt dist bundle). Required checks green.