[dependabot]

Bumps the github-actions group with 5 updates:

Package	From	To
actions/upload-code-coverage	1.4.2	1.4.4
actions/upload-artifact	7.0.1	7.0.2
actions/download-artifact	8.0.1	8.0.2
jdx/mise-action	4.2.0	5.2.0
actions/deploy-pages	5.0.0	5.0.1

Updates actions/upload-code-coverage from 1.4.2 to 1.4.4

Release notes

Sourced from actions/upload-code-coverage's releases.

v1.4.4

Fixed

• Non-default branch pushes no longer associate coverage with an unrelated fork pull request that uses the same branch name. (#33)
• When a pushed branch has multiple open pull requests, the action prefers the pull request targeting the default branch. If no unique default-branch target exists, the upload skips successfully instead of selecting arbitrarily or failing CI. (#33)

Documentation

• Document the action's Bash, Python 3.9+, and conditional GitHub CLI runner requirements, including when pull-requests: read is required. (#29)

Maintenance

• Add regression tests that prevent shell-injection protections from being reintroduced. (#32)

Full Changelog: actions/upload-code-coverage@v1.4.3...v1.4.4

v1.4.3

Fixed

• Non-default branch pushes without an open pull request now skip successfully instead of attempting an upload that the API rejects. (#30)
• GitHub CLI failures during pull request discovery now produce an actionable error instead of being silently treated as no matching pull request. (#27)

Full Changelog: actions/upload-code-coverage@v1.4.2...v1.4.3

Changelog

Sourced from actions/upload-code-coverage's changelog.

Changelog

Unreleased

v1.4.4 - 2026-10-01

Fixed

• Non-default branch pushes no longer associate coverage with an unrelated fork pull request that uses the same branch name.
• When a pushed branch has multiple open pull requests, the action prefers the pull request targeting the default branch. If no unique default-branch target exists, the upload skips successfully instead of selecting arbitrarily or failing CI.

v1.4.3 - 2026-09-28

Fixed

• Non-default branch pushes without an open pull request now skip successfully instead of attempting an upload that the API rejects.
• GitHub CLI failures during pull request discovery now produce an actionable error instead of being silently treated as no matching pull request.

Commits

• 2b21a77 Merge pull request #34 from actions/cassiomarques/release-v1.4.4
• c7f2f13 Prepare v1.4.4 release
• cd112d6 Merge pull request #33 from actions/cassiomarques/scope-push-pr-lookup
• 19923c1 Address pull request review feedback
• 9706dd2 Merge pull request #29 from actions/docs/runner-requirements
• 891aec1 Merge branch 'main' into docs/runner-requirements
• 60531d5 Prefer default-branch PR for ambiguous pushes
• 713d268 Scope push PR lookup to repository
• 1f899d9 Merge pull request #32 from actions/cassiomarques/shell-injection-regression-...
• 6e4a64d Test shell injection protections
• Additional commits viewable in compare view

Updates actions/upload-artifact from 7.0.1 to 7.0.2

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.2

What's Changed

• Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
• Updates @​actions/artifact to v6.3.1.

New Contributors

• @​tunc-d made their first contribution in actions/upload-artifact#821

Full Changelog: actions/upload-artifact@v7.0.1...v7.0.2

Commits

• cf430e0 Merge pull request #822 from actions/tunc-d-prepare-upload-v7-0-2
• c2acded chore: prepare v7.0.2 release
• 4687c1b Merge pull request #821 from actions/tunc-d-upload-artifact-package-bump
• 8cbe1be Bump @​actions/artifact to 6.3.1
• See full diff in compare view

Updates actions/download-artifact from 8.0.1 to 8.0.2

Release notes

Sourced from actions/download-artifact's releases.

v8.0.2

What's Changed

• Update the readme by @​danwkennedy in actions/download-artifact#473
• Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
• Update @​actions/artifact to 6.3.1 by @​tunc-d in actions/download-artifact#492
• Prepare download-artifact v8.0.2 by @​tunc-d in actions/download-artifact#493

New Contributors

• @​tunc-d made their first contribution in actions/download-artifact#492

Full Changelog: actions/download-artifact@v8.0.1...v8.0.2

Commits

• 9000827 Merge pull request #493 from actions/tunc-d-prepare-download-v8-0-2
• e455989 Prepare download-artifact v8.0.2
• a00b90c Merge pull request #492 from actions/tunc-d-download-artifact-package-bump
• 29bb7ce Update @​actions/artifact to 6.3.1
• 484a0b5 Update the readme (#473)
• See full diff in compare view

Updates jdx/mise-action from 4.2.0 to 5.2.0

Release notes

Sourced from jdx/mise-action's releases.

v5.2.0: Periodic cache rebuilds, signed packslip verification, and monorepo installs

The default cache key now rolls over every 30 days, so long-lived caches pick up newer mise releases. The action also checks the downloaded mise binary against the release's signed packslip, and it runs mise install --monorepo automatically in monorepos. Existing caches miss once after you upgrade, because the default cache key format has changed.

Added

• The cache is rebuilt every 30 days by default. GitHub never evicts a cache that keeps getting hits. Before this release, an active repo could keep the same mise binary and tools for months, until a config file changed. The default cache key now includes a period suffix (-p<N>), so the cache is rebuilt from scratch at least once per period. All repos roll over on the same calendar boundary. Use the new cache_max_age_days input to change the period, or set it to 0 to keep the old key that never expires. Custom cache_key templates can use the new {{cache_period}} variable, which {{default}} already includes. A custom key that doesn't use it behaves as before. On self-hosted runners that keep mise data between runs, you may also need auto_update: true to pick up a newer mise. (#689 by @​jdx, fixes #688)

  - uses: jdx/mise-action@v5
    with:
      cache_max_age_days: 14 # default 30; 0 disables periodic rebuilds

• Throttled cache restores and saves can be retried. Before this release, when GitHub's cache service returned HTTP 429, the action gave up right away: a restore counted as a miss and a save was skipped. The new cache_restore_retry_budget and cache_save_retry_budget inputs set how long the action may wait. Each retry waits for the Retry-After value plus some random jitter. Once the budget runs out, the action falls back to the old behavior. Retries apply to the main cache, the post-step save and the binary cache. Real cache misses and reservation conflicts are never retried. Both budgets default to 0s (no retries). @actions/cache doesn't report 429 errors directly, so the action detects throttling from its warning messages. If those messages change in a future @actions/cache release, throttling won't be detected and nothing will be retried. (#692 by @​jdx, fixes #691)

  - uses: jdx/mise-action@v5
    with:
      cache_restore_retry_budget: 60s
      cache_save_retry_budget: 120s

• The latest mise binary can fall back to a second download source. When the action downloads the latest mise version, it can fall back between GitHub and mise.jdx.dev if the first source fails. The fetch_from_github setting decides which source it tries first. Pinned versions and minimum_release_age installs are only downloaded from GitHub. The binary is still checked against the signed checksums for the resolved version, whichever source it came from. (#692 by @​jdx)
• The mise binary is checked against its signed packslip. If a mise release includes packslip.sigstore.json, the action checks the downloaded binary against it. The bundle must be signed by mise's release workflow for that exact tag. After a successful check, the log shows Verified <asset> against the signed packslip. If the check fails, the install stops instead of falling back to a weaker check. Releases without a packslip use the existing minisign and SHASUMS256 check. An explicit sha256 input still takes precedence. (#693 by @​jdx)
• Monorepo-aware installs. If your mise config sets [monorepo].config_roots, the action now adds --monorepo to mise install, so tools configured anywhere in the monorepo get installed. Repos without that setting aren't affected. To opt out, set monorepo: false. (#679 by @​zeitlinger)

Fixed

• Tool directories that mise moves to the front of PATH are now exported. The action used to find mise's PATH changes by comparing mise's PATH with the runner's. If a tool's bin directory was already on the runner's PATH, such as ~/.cargo/bin, mise only moved it to the front, so the action didn't export it. Later steps then found the mise shim first. For example, rustup resolved to the shim instead of ~/.cargo/bin/rustup. The action now asks mise for its entries with mise env --paths and exports them in the order mise reports. This fix needs a mise version that supports --paths. With older versions, the action uses the old comparison. (#685 by @​jdx)

Documentation

• The new "Release workflows" section of the README says that jobs that publish releases shouldn't restore caches. A lower-trust workflow that can write to default-branch caches could otherwise slip files into a release. In those jobs, use cache: false or GitHub's cache-mode: none. (#682 by @​jdx)
• The README explains how to cache mise's downloads, keyed on mise.lock, instead of installed tools. It includes a Windows example that sets MISE_CACHE_DIR from ${{ runner.temp }}, because actions/cache doesn't expand %TEMP%. (#686, #690 by @​zeitlinger)

Breaking Changes

• The default cache key has a new format, so the first run after upgrading is a cache miss and saves a fresh cache. After that, the cache is rebuilt every 30 days by default. To keep the old cache key that never expires, set cache_max_age_days: 0. Workflows that set a custom cache_key without {{default}} or {{cache_period}} aren't affected.

Full Changelog: jdx/mise-action@v5.1.2...v5.2.0

v5.1.2: mise_dir now sets MISE_DATA_DIR; auto_update handles a locked mise binary

The mise_dir input now also sets where mise installs tools, so those tools end up in the cache. With auto_update: true, the action no longer crashes on Windows when the mise binary is still in use.

Fixed

• mise_dir now exports MISE_DATA_DIR. Before this release, mise_dir moved the mise binary and the cache path, but mise kept installing tools to ~/.local/share/mise. The saved cache didn't include the tools. On runners where ~/.local isn't writable, the step failed with EACCES: permission denied. When mise_dir is set, the action now exports MISE_DATA_DIR=<mise_dir>, so tools are installed into the directory that gets cached. If your workflow sets a different MISE_DATA_DIR, the mise_dir input overrides it. If mise_dir isn't set, nothing changes. mise's state directory (~/.local/state/mise) stays where it is. If that path also can't be written, set MISE_STATE_DIR yourself. (#672 by @​jdx, fixes #668)

  - uses: jdx/mise-action@v5
    with:
      mise_dir: ${{ runner.tool_cache }}/mise/data

• auto_update no longer crashes when it can't replace mise.exe. On Windows, the step used to fail with a bare EPERM: operation not permitted, unlink '…\mise.exe' if another process was still using the binary. Now, if version isn't pinned and the existing binary passes verification against its recorded version, the action prints a warning and continues with that version. In any other case, the step fails with a message that says the file is in use and how to fix it. A pinned version never quietly keeps an older binary. (#665 by @​jdx, fixes #664)

... (truncated)

Changelog

Sourced from jdx/mise-action's changelog.

Changelog

---

5.2.1 - 2026-10-16

🐛 Bug Fixes

• require the signed packslip for mise 2026.9.3 and later (#695) by @​jdx in #695

---

5.2.0 - 2026-10-16

🚀 Features

• (cache) rebuild the cache every 30 days by default (#689) by @​jdx in #689
• (cache) retry throttled cache restores and saves (#692) by @​jdx in #692
• verify the mise binary against its signed packslip (#693) by @​jdx in #693

🐛 Bug Fixes

• export the PATH entries mise reports with mise env --paths (#685) by @​jdx in #685

🔍 Other Changes

• Use monorepo install when configured (#679) by @​zeitlinger in #679
• Change minimum age for auto-merging release PRs by @​jdx in b511e8d

📚 Documentation

• tell release workflows not to use the cache (#682) by @​jdx in #682
• explain caching mise downloads instead of installs (#686) by @​zeitlinger in #686
• use resolved Windows downloads cache path (#690) by @​zeitlinger in #690

⚙️ Miscellaneous Tasks

• stop restoring caches in release jobs (#683) by @​jdx in #683
• replace prettier with oxfmt (#694) by @​jdx in #694

---

5.1.2 - 2026-10-12

🐛 Bug Fixes

• continue with the existing mise when auto-update cannot replace it (#665) by @​jdx in #665
• export mise_dir as MISE_DATA_DIR so mise installs tools there (#672) by @​jdx in #672

📚 Documentation

• explain MISE_ENABLE_TOOLS in GitHub Actions (#667) by @​zeitlinger in #667
• update the Rust cache section for mise 2026.9.2 (#670) by @​jdx in #670

... (truncated)

Commits

• 9b200bc chore: release v5.2.0 (#680)
• b511e8d Change minimum age for auto-merging release PRs
• 887d1f4 docs: use resolved Windows downloads cache path (#690)
• 93c62ad chore: replace prettier with oxfmt (#694)
• 04716d4 feat: verify the mise binary against its signed packslip (#693)
• 5108104 feat(cache): retry throttled cache restores and saves (#692)
• d401260 docs: explain caching mise downloads instead of installs (#686)
• e7cf35f feat(cache): rebuild the cache every 30 days by default (#689)
• cd02696 fix: export the PATH entries mise reports with mise env --paths (#685)
• 6784481 docs: tell release workflows not to use the cache (#682)
• Additional commits viewable in compare view

Updates actions/deploy-pages from 5.0.0 to 5.0.1

Release notes

Sourced from actions/deploy-pages's releases.

v5.0.1

Changelog

• Add backoff and jitter to deployment polling @​yoannchaudet (#444)
• Improve deployment request test coverage @​adwitiyagoyal (#440)

---

See details of all code changes since previous release.

⚠️ For use with products other than GitHub.com, such as GitHub Enterprise Server, please consult the compatibility table.

Commits

• 368f825 Merge pull request #444 from actions/yoannchaudet-deployment-polling-backoff
• 7e97763 Validate deployment polling intervals
• 0143e11 Add backoff and jitter to deployment polling
• 5e98f10 Merge pull request #440 from actions/user/adwitiya
• 8b0625a Improve deployment request test coverage
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: NVIDIA/elements/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 4d787602-e563-474c-8718-b634d5f8892c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml