[dependabot]

Bumps the github-actions group with 2 updates: pnpm/action-setup and actions/create-github-app-token.

Updates pnpm/action-setup from 6.0.5 to 6.0.8

Release notes

Sourced from pnpm/action-setup's releases.

v6.0.8

What's Changed

• docs(README): fix cache_dependency_path type by @​haines in pnpm/action-setup#257
• fix: drop patchPnpmEnv so standalone+self-update works on Windows by @​zkochan in pnpm/action-setup#258
• fix: update pnpm to 11.1.1 by @​mungodewar in pnpm/action-setup#248

New Contributors

• @​mungodewar made their first contribution in pnpm/action-setup#248

Full Changelog: pnpm/action-setup@v6.0.7...v6.0.8

v6.0.7

What's Changed

• fix: honor devEngines.packageManager.onFail=error (#252) by @​zkochan in pnpm/action-setup#254
• fix: restore inputs from state in post by @​haines in pnpm/action-setup#255
• fix: self-update bootstrap to packageManager-pinned version (#233) by @​zkochan in pnpm/action-setup#256

New Contributors

• @​haines made their first contribution in pnpm/action-setup#255

Full Changelog: pnpm/action-setup@v6.0.6...v6.0.7

v6.0.6

What's Changed

• fix: bin_dest output points to self-updated pnpm, not bootstrap by @​zkochan in pnpm/action-setup#249

Full Changelog: pnpm/action-setup@v6.0.5...v6.0.6

Commits

• 0e279bb fix: update pnpm to 11.1.1 (#248)
• 3e83581 fix: drop patchPnpmEnv so standalone+self-update works on Windows (#258)
• 551b42e docs(README): fix cache_dependency_path type (#257)
• 739bfe4 fix: self-update bootstrap to packageManager-pinned version (#233) (#256)
• f61705d chore: add CODEOWNERS
• 7a5507b fix: restore inputs from state in post (#255)
• 1155470 fix: honor devEngines.packageManager.onFail=error (#252) (#254)
• 91ab88e fix: bin_dest output points to self-updated pnpm, not bootstrap (#249)
• e578e19 fix: update pnpm to 11.0.4
• See full diff in compare view

Updates actions/create-github-app-token from 3.1.1 to 3.2.0

Release notes

Sourced from actions/create-github-app-token's releases.

v3.2.0

3.2.0 (2026-05-12)

Features

• add support for enterprise-level GitHub Apps (#263) (952a2a7)
• support full repository names in repositories input (#372) (85eb8dd)

Bug Fixes

• deps: bump @​actions/core from 3.0.0 to 3.0.1 in the production-dependencies group (#364) (43e5c34)
• validate private-key input (#376) (f24bbd8)

Changelog

Sourced from actions/create-github-app-token's changelog.

Changelog

3.2.0 (2026-05-12)

Features

• add support for enterprise-level GitHub Apps (#263) (952a2a7)
• support full repository names in repositories input (#372) (85eb8dd)

Bug Fixes

• deps: bump @​actions/core from 3.0.0 to 3.0.1 in the production-dependencies group (#364) (43e5c34)
• validate private-key input (#376) (f24bbd8)

Commits

• bcd2ba4 chore(main): release 3.2.0 (#370)
• f24bbd8 fix: validate private-key input (#376)
• 363531b docs: capitalize Git as a proper noun in README (#374)
• fd28011 docs: update procedure to configure Git (#287)
• 85eb8dd feat: support full repository names in repositories input (#372)
• c9aabb8 build(deps-dev): bump yaml from 2.8.3 to 2.8.4 in the development-dependencie...
• e02e816 build(deps-dev): bump undici from 7.24.6 to 8.2.0 (#366)
• 8d835bf build(deps-dev): bump esbuild from 0.27.4 to 0.28.0 in the development-depend...
• 952a2a7 feat: add support for enterprise-level GitHub Apps (#263)
• 43e5c34 fix(deps): bump @​actions/core from 3.0.0 to 3.0.1 in the production-dependenc...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[clawsweeper]

Codex review: needs maintainer review before merge.

Summary
The PR updates SHA-pinned pnpm/action-setup and actions/create-github-app-token versions across CI, coverage, benchmarks, and ClawSweeper dispatch workflows.

Reproducibility: not applicable. this is a workflow dependency update, not a bug report with an application reproduction path. The relevant verification is the PR diff, upstream tag resolution, and GitHub Actions check results.

Real behavior proof
Not applicable: Dependabot bot PRs do not require contributor-provided real behavior proof; the workflow check runs provide the relevant validation signal here.

Next step before merge
No repair lane is needed because there are no review findings; this is a clean bot dependency update for normal merge handling.

Security
Cleared: The diff keeps official actions pinned by full commit SHA, verifies those SHAs against release tags, and does not broaden workflow permissions, secret use, or script execution.

Review details

Best possible solution:

Merge the Dependabot bump through the normal dependency-update path after required branch protection remains green.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a workflow dependency update, not a bug report with an application reproduction path. The relevant verification is the PR diff, upstream tag resolution, and GitHub Actions check results.

Is this the best way to solve the issue?

Yes: keeping the existing workflow structure and only advancing SHA-pinned action releases is the narrowest maintainable way to apply this update.

What I checked:

• Current main still has older pins: Main still references pnpm/action-setup v6.0.5 and actions/create-github-app-token v3.1.1 in the touched workflows, so the PR is not already implemented on main. (.github/workflows/ci.yml:44, da7d5cbc29de)
• PR diff is limited to action pin updates: The downloaded PR diff changes only five uses: lines across four workflow files, matching the Dependabot dependency-bump purpose. (1a07bb0418ec)
• pnpm action release SHA verified: pnpm/action-setup tag v6.0.8 peels to 0e279bb959325dab635dd2c09392533439d90093, matching the PR's new pinned SHA. (0e279bb95932)
• GitHub App token action release SHA verified: actions/create-github-app-token tag v3.2.0 resolves to bcd2ba49218906704ab6c1aa796996da409d3eb1, matching the PR's new pinned SHA. (bcd2ba492189)
• Security-sensitive workflow context inspected: The dispatch workflow uses pull_request_target and secrets, but the PR does not alter triggers, permissions, token inputs, shell commands, or secret handling; it only advances the pinned action release SHA. (.github/workflows/clawsweeper-dispatch.yml:34, da7d5cbc29de)
• PR checks are green or intentionally skipped: The check-runs API shows coverage, benchmarks, actionlint, and all Node matrix checks completed successfully; dispatch-only runs are skipped where expected. (1a07bb0418ec)

Likely related people:

• Peter Steinberger: git blame on the touched workflow lines attributes the current pinned actions and dispatch token setup to the v0.2.1 release commit. (role: current workflow pin author; confidence: medium; commits: d3f37bc700e8; files: .github/workflows/ci.yml, .github/workflows/coverage.yml, .github/workflows/benchmarks.yml)

Codex review notes: model gpt-5.5, reasoning high; reviewed against da7d5cbc29de.