Bump saadmk11/github-actions-version-updater from 0.9.0 to 1.0.1 in the github-actions group

[dependabot]

Bumps the github-actions group with 1 update: saadmk11/github-actions-version-updater.

Updates saadmk11/github-actions-version-updater from 0.9.0 to 1.0.1

Release notes

Sourced from saadmk11/github-actions-version-updater's releases.

Release v1.0.1

Version: v1.0.1

• #74: When update_version_with is release-commit-sha, write the matching release tag as an inline # tag comment (exactly two spaces before #) so SHA-to-SHA diffs stay human-readable. Version-like comments are updated; custom comments are left alone.
• #125: Document classic and fine-grained personal access token permissions.

Release v1.0.0

Version: v1.0.0

v1 is a rewrite. The GitHub Action is now a composite Action that installs and runs the update-gha CLI. Action input names are the same. How files are found, how pins are rewritten, and what the runner needs are not.

Breaking

• No Docker image. v0 ran in a container. v1 runs on the job with bash and uv; it installs CPython 3.14 into an isolated venv and does not change the job's python on PATH. Self-hosted runners need bash and outbound network. They do not need Docker.
• CLI requires Python 3.12+ if you install update-gha yourself.
• Which workflow files are scanned. v0 asked the GitHub “list workflows” API (usually the workflows registered on the default branch), then opened those paths plus extra_workflow_locations. v1 never calls that API. It reads .github/workflows and any extra paths from the checkout. After a normal actions/checkout of the same commit, the set is the same. It can differ if the checkout is sparse, or if the current branch has workflow files that are not on the default branch (v1 will see those; v0 often would not).
• What gets rewritten in a file. v0 parsed uses: to decide which pins to bump, then ran a regex over the whole file. The same owner/repo@v3 string in a comment, a run: script, or a URL could change too. v1 only edits the uses: value. Comments and scripts stay as they are. That is usually what you want; it is a break only if you relied on those extra replacements.
• What is committed and how named branches are pushed. v0 ran git add . and force-pushed named PR branches with -f. v1 stages only the workflow files it changed, and force-pushes named branches with --force-with-lease.

Added

• Installable package update-gha (pip install update-gha / uvx update-gha).
• Optional update-gha --pull-request (needs the [action] extra, or GHA_UPDATE_CREATE_PULL_REQUEST).
• Config from CLI flags, then GHA_UPDATE_* env vars, then [tool.update-gha] in pyproject.toml.
• Action output GHA_UPDATE_PR_NUMBER is unchanged. pull-request-number is an extra alias.

Changelog

Sourced from saadmk11/github-actions-version-updater's changelog.

Version: v1.0.1

• #74: When update_version_with is release-commit-sha, write the matching release tag as an inline # tag comment (exactly two spaces before #) so SHA-to-SHA diffs stay human-readable. Version-like comments are updated; custom comments are left alone.
• #125: Document classic and fine-grained personal access token permissions.

Version: v1.0.0

v1 is a rewrite. The GitHub Action is now a composite Action that installs and runs the update-gha CLI. Action input names are the same. How files are found, how pins are rewritten, and what the runner needs are not.

Breaking

• No Docker image. v0 ran in a container. v1 runs on the job with bash and uv; it installs CPython 3.14 into an isolated venv and does not change the job's python on PATH. Self-hosted runners need bash and outbound network. They do not need Docker.
• CLI requires Python 3.12+ if you install update-gha yourself.
• Which workflow files are scanned. v0 asked the GitHub “list workflows” API (usually the workflows registered on the default branch), then opened those paths plus extra_workflow_locations. v1 never calls that API. It reads .github/workflows and any extra paths from the checkout. After a normal actions/checkout of the same commit, the set is the same. It can differ if the checkout is sparse, or if the current branch has workflow files that are not on the default branch (v1 will see those; v0 often would not).
• What gets rewritten in a file. v0 parsed uses: to decide which pins to bump, then ran a regex over the whole file. The same owner/repo@v3 string in a comment, a run: script, or a URL could change too. v1 only edits the uses: value. Comments and scripts stay as they are. That is usually what you want; it is a break only if you relied on those extra replacements.
• What is committed and how named branches are pushed. v0 ran git add . and force-pushed named PR branches with -f. v1 stages only the workflow files it changed, and force-pushes named branches with --force-with-lease.

Added

• Installable package update-gha (pip install update-gha / uvx update-gha).
• Optional update-gha --pull-request (needs the [action] extra, or GHA_UPDATE_CREATE_PULL_REQUEST).
• Config from CLI flags, then GHA_UPDATE_* env vars, then [tool.update-gha] in pyproject.toml.
• Action output GHA_UPDATE_PR_NUMBER is unchanged. pull-request-number is an extra alias.

Commits

• a5ab9b5 Merge pull request #127 from saadmk11/release-v1.0.1
• 4ce8a32 Prepare the v1.0.1 release.
• aa525a3 Merge pull request #126 from saadmk11/docs-trim-access-token-docs
• 15c3130 Drop troubleshooting asides from the access token docs.
• a9603d1 Merge pull request #125 from saadmk11/docs-access-token-permissions
• 713ec68 Document classic and fine-grained PAT permissions.
• 4dfc3a7 Merge pull request #124 from saadmk11/issue-74-sha-pin-tag-comments
• 7fcb1ef Add release tag comments when pinning commit SHAs.
• b55e54b Update README.md
• ce303d1 Merge pull request #122 from saadmk11/v1-update-gha
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions