[dependabot]

Bumps unbraind/pm-github/.github/workflows/pm-github-sync.yml from 2026.11.02 to 2026.11.04.

Release notes

Sourced from unbraind/pm-github/.github/workflows/pm-github-sync.yml's releases.

pm-github v2026.11.04

Changelog

2026.11.4 - 2026-11-04

Fixed

• Make repeated gated imports byte-identical for closed items (pm-github-repeat-noop)
• Reusable workflows fail after pm package install when callers pin zero-padded release tags like v2026.11.02 (pm-github-4gak)
• Allow public technical forms in the tracker privacy gate (pm-github-01n8)
• Resolve an unrelated unreachable commit identity reported by whole-store privacy checks (pm-github-privacy-store-followup)

Other

• Bound coverage aggregation memory and compare default-heap CI behavior (pm-github-vhi6)
• Approve or amend the noreply identity on the normalize-release-tag-version branch commit (pm-github-8mkc)

Changelog

Sourced from unbraind/pm-github/.github/workflows/pm-github-sync.yml's changelog.

Changelog

2026.11.11 - 2026-11-11

Fixed

• The gated sync holds a runner for up to two hours while it waits for caller CI it competes with for the same pool (pm-github-fxhd)
• Explain scheduled install mismatches and preserve redacted command failure diagnostics (pm-github-o9r7)
• Packed projection fixture cleanup can mask its own test outcome (pm-github-mes8)

Security

• Reusable Dependabot merge workflow with complete commit provenance (pm-github-dependabot-merge)

2026.11.4 - 2026-11-04

Fixed

• Make repeated gated imports byte-identical for closed items (pm-github-repeat-noop)
• Reusable workflows fail after pm package install when callers pin zero-padded release tags like v2026.11.02 (pm-github-4gak)
• Allow public technical forms in the tracker privacy gate (pm-github-01n8)
• Resolve an unrelated unreachable commit identity reported by whole-store privacy checks (pm-github-privacy-store-followup)

Other

• Bound coverage aggregation memory and compare default-heap CI behavior (pm-github-vhi6)
• Approve or amend the noreply identity on the normalize-release-tag-version branch commit (pm-github-8mkc)

2026.11.1 - 2026-11-01

Fixed

• Scheduled closeout reads required checks from the branch summary instead of failing every fleet caller (pm-github-6g0m)

2026.10.30 - 2026-10-30

Fixed

• Make scheduled closeout and sync refusals actionable (pm-github-3it2)

2026.10.29 - 2026-10-29

Added

• Capture selected GitHub discussion passages as reviewed native Decisions (pm-github-selected-discussion-decisions)

2026.10.28 - 2026-10-28

Added

... (truncated)

Commits

• eb89c6a Release pm-github v2026.11.04
• cd364c9 Close tracker items delivered by merged pull requests (#220)
• 4642609 Close tracker items delivered by merged pull requests (#219)
• 459677e Let the import privacy gate pass public technical forms without opening new l...
• ceaecfe Bound the c8 coverage merge with its incremental mode and a 3 GiB heap (#215)
• e369497 chore(deps-dev): bump eslint (#217)
• 02d15d6 Override minimatch to 11.0.1 or later for GHSA-g3hv-75wg-m249 (#216)
• aed65b4 Normalize zero-padded release tags before the reusable workflows verify the i...
• 10e9fdd Keep real closure dates and transaction identity when re-importing closed iss...
• 10d21ba Track the issues the blind issue watch missed (2026-10-27 to 11-02) (#211)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Summary by cubic

Bumps the pm-github-sync.yml reusable workflow from v2026.11.02 to v2026.11.04.

This update fixes reusable workflow failures when callers pin zero-padded release tags like v2026.11.02, makes repeated gated imports byte-identical for closed items, lets public technical forms pass the import privacy gate, and resolves an unreachable commit identity flagged by store privacy checks.

^{Written for commit d4c5a7d. Summary will update on new commits.}

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 2f2f8171-63e2-4dc8-a4d3-1c208585634a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn