[mergeraptor]

This PR contains the following updates:

Package	Type	Update	Change
projectbluefin/actions (changelog)	workflow	digest	46001bf → 3adf119

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[github-actions]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: danathar

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS [danathar]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[hivecommons-hive]

8191a51

ℹ️ Sentinel notice — informational; author is trusted (allow-listed bot), merge is not blocked

Hive flagged this PR (author @mergeraptor[bot], head 8191a513b154) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 4 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • .github/workflows/build.yml
  • .github/workflows/execute-release.yml
  • .github/workflows/promote-testing-to-main.yml
  • .github/workflows/sync-main-to-testing.yml

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

[Danathar]

This moves the five reusable-workflow pins from 46001bf to 3adf119. That's 3 commits on projectbluefin/actions main, with nothing behind:

• #754: setup-runner caches Ubuntu packages and installs verified cache hits offline.
• #756: logs why a cache hit falls back online.
• #755: upgrade-test boots a previous pinned image.

The same actions range is already approved on common#1664, where both image builds passed with the new setup-runner. Here, the build_main/build_kernel image jobs that use setup-runner were still running when I posted, and they gate the merge.

[hivecommons-hive]

Hive will not merge this PR: it changes path(s) listed in auto_merge.human_merge_paths for this repo, so a person must merge it.

• .github/workflows/build.yml
• .github/workflows/execute-release.yml
• .github/workflows/promote-testing-to-main.yml

Hive added the hold label. A maintainer should review and merge this PR by hand.