[dependabot]

Bumps the github-actions group with 2 updates in the / directory: jaxxstorm/action-install-gh-release and pulumi/actions.

Updates jaxxstorm/action-install-gh-release from 3.0.0 to 4.0.0

Release notes

Sourced from jaxxstorm/action-install-gh-release's releases.

v4.0.0

Highlights

• Install binaries from nested release archives, including cargo-make's versioned wrapper directories (#63, #75, #197).
• Improve private release downloads: honor the token input first and provide actionable guidance for HTTP 404 errors (#56, #197).
• Support anonymous downloads from public repositories (#85, #201).
• Support assets without platform or architecture in their names, with isolated cache namespaces for matching modes.
• Add unit tests with enforced coverage and cargo-make integration coverage for both 0.36.12 and latest.
• Refresh dependencies and rebuild the distributed action.

Upgrade notes

• The token input now takes precedence over the GITHUB_TOKEN environment variable. Pass a cross-repository token explicitly using with.token. The default input remains ${{ github.token }}.
• asset-name selects the release asset, not the filenames inside an extracted archive. Use binaries-location to restrict the directory whose files are installed.
• Archive copy errors now fail immediately rather than continuing installation.

Usage

- uses: jaxxstorm/action-install-gh-release@v4.0.0
  with:
    repo: owner/repository

Full changelog: jaxxstorm/action-install-gh-release@v3.0.0...v4.0.0

Commits

• b82b205 chore(release): prepare v4.0.0
• 02d38c8 Merge pull request #75 from jaxxstorm/cargo_make
• cf1581d ci: invoke cargo-make through its Cargo subcommand
• 7f5d643 ci: refresh cargo-make integration tests against master
• b969cc2 Merge pull request #200 from jaxxstorm/renovate/octokit-monorepo
• 6309909 Merge pull request #199 from jaxxstorm/renovate/typescript-6.x
• e5e9422 Merge pull request #201 from jaxxstorm/fix/85-public-repo-token
• bea04da fix: explicitly support anonymous public release installs
• 5ee6b37 chore(deps): update octokit monorepo
• 917b585 chore(deps): update dependency typescript to v6.0.3
• Additional commits viewable in compare view

Updates pulumi/actions from 7.0.0 to 7.1.0

Release notes

Sourced from pulumi/actions's releases.

v7.1.0

What's Changed

• chore: update Undici, js-yaml, brace-expansion, and Handlebars to address security vulnerabilities. (#1574)
• feat: add run-program flag support. (#1386)

New Contributors

• @​leejones made their first contribution in pulumi/actions#1411
• @​vladdoster made their first contribution in pulumi/actions#1518
• @​julienp made their first contribution in pulumi/actions#1575

Full Changelog: pulumi/actions@v7.0.0...v7.1.0

Changelog

Sourced from pulumi/actions's changelog.

CHANGELOG

HEAD (Unreleased)

(none)

---

7.1.0 (2026-11-03)

• chore: update Undici, js-yaml, brace-expansion, and Handlebars to address security vulnerabilities. (#1574)
• feat: add run-program flag support. (#1386)

---

7.0.0 (2026-05-01)

• chore: update Action runtime to node 24 (#1404)
• chore: bump typescript, jest, ts-jest, @types/jest, @types/node (#1405)
• chore: update ESLint stack and migrate to flat config (#1406)

6.6.1 (2025-11-12)

• chore: Update pulumi/pulumi dependency (#1394)

6.6.0 (2025-09-29)

• feat: Strip ansi control characters from GitHub step Summary and PR comment (#1312)

6.5.0 (2025-07-17)

• revert: Remove run-program flag support (#1381)

6.4.0 (2025-07-16)

• feat: Add run-program flag support for refresh, destroy, preview, and up/update commands (#1376)

6.3.0 (2025-05-08)

• feat: support --exclude and --exclude-dependents flags

... (truncated)

Commits

• 96c7761 Merge pull request #1585 from pulumi/julienp/release-7.1.0
• f7cbffd Prepare changelog for v7.1.0
• e3e56c5 chore(dist): Update dist [automated commit]
• f05a7ba Merge pull request #1584 from pulumi/julienp/fix-esc-v4-auth
• a09facc Fix ESC v4 authentication in dist update workflow
• 4d6bebc Merge pull request #1582 from pulumi/dependabot/npm_and_yarn/npm-11fa4e993a
• 1b48fa3 Merge pull request #1566 from pulumi/dependabot/github_actions/github-actions...
• 97a09fd chore(deps): bump the github-actions group across 1 directory with 3 updates
• d56584a chore(deps): bump tslib from 2.8.1 to 2.9.1 in the npm group
• 822f2b4 chore(dist): Update dist [automated commit]
• Additional commits viewable in compare view