[dependabot]

Bumps the github-actions group with 1 update: rust-lang/crates-io-auth-action.

Updates rust-lang/crates-io-auth-action from 1.0.5 to 1.0.6

Release notes

Sourced from rust-lang/crates-io-auth-action's releases.

v1.0.6

What's Changed

update dependencies

Full Changelog: rust-lang/crates-io-auth-action@v1.0.5...v1.0.6

Commits

• 3268eb4 Merge pull request #278 from marcoienibot/chore/update-dependencies-2026-10
• e901356 chore(deps): update dependencies and GitHub Actions
• 9c067fc Merge pull request #277 from rust-lang/renovate/msw-3.x
• 9b55005 chore(deps): update dependency msw to v3
• 4920f09 Merge pull request #276 from rust-lang/renovate/major-github-actions
• 04dcccb chore(deps): update github actions
• 82864bf Merge pull request #274 from rust-lang/renovate/major-vitest-monorepo
• 2bd8e07 chore(deps): update dependency vitest to v5
• f14f407 Merge pull request #271 from rust-lang/renovate/github-actions
• 0205d6c chore(deps): update github actions
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues found.

Scanned Files

• .github/workflows/publish-crate.yml

[zoeyrose]

Back to draft until the merge-readiness gate passes: Repairing reviewed publication-workflow pin validation; independent security review and CI required before readiness.

[zoeyrose]

Reviewed head: 3f48036; base: d298b1b.

Goal: restore Dependabot validation for crates-io-auth-action 1.0.5 → 1.0.6 while preserving the complete reviewed publication workflow boundary. The repair updates the workflow digest and negative-test pin literal after independent policy review. It does not change workflow conditions, permissions, environment, source/artifact checks, concurrency, immutable history or coordinate-global upload-intent handling.

A fresh-context independent Astra reviewer inspected the entire diff, affected publication/checker code, failure paths, tests and documentation, plus the exact upstream c6f97d4..3268eb4 action delta including production sources, metadata, complete normalized bundle changes and embedded WASM. No actionable P0–P3 findings. Main/post action behavior and entrypoints are unchanged; bundled Undici advances 6.26.0 → 6.29.1. Both WASM payloads are byte-identical. The v1.0.6 tag and successful upstream CI run 39634613629 match 3268eb413133e2960fa4ae0e963ca76380c54cd9, including Package reproducibility and Action Test.

Validation: strict workflow checker and all 103 Python policy/publication/upload/release/access/rendezvous tests passed; git diff --check passed. Reviewer independently reran the 13 workflow policy tests and executed actual main/post bundles with fake credentials and mocked transport, covering audience/token masking/output/state/revoke and failure behavior. The supplementary local smoke used Node 22, while exact upstream Node 24 CI provides runtime evidence. Full local tools/validate.sh was attempted but stops because buf is unavailable; required Protocol validation must pass on this head before ready. No registry upload or real OIDC exchange was executed. Existing original-head dependency-review log reported no vulnerabilities or denied packages; new-head evidence will be checked after CI.

[github-actions]

🎉 This PR is included in version 2.22.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀