Update github-actions

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
TypedDevs/bashunit	action	minor	0.49.0 → 0.50.1
github/codeql-action	action	patch	v4.37.7 → v4.37.8

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

TypedDevs/bashunit (TypedDevs/bashunit)

v0.50.1

Compare Source

Fixed

• tear_down_after_script runs when set_up_before_script fails, so it can release file-scoped resources acquired before the failure (#​1318)
• Under --parallel, tear_down_after_script runs after the file's own tests instead of alongside them, so a fixture it releases stays alive for the tests that read it. The same file no longer passed sequentially and failed in parallel (#​1320)
• --stop-on-failure runs tear_down_after_script for the file it halts in, so a sequential run releases what set_up_before_script acquired before the halt (#​1321)
• bashunit bench runs tear_down_after_script before it aborts on a malformed annotation, so the file releases what set_up_before_script acquired (#​1322)
• Ctrl-C runs tear_down_after_script for the file it interrupts in a sequential run, so a file-scoped resource is released. A second Ctrl-C now ends the run even if that hook never returns (#​1323)
• A test killed by --test-timeout runs its tear_down, so a per-test resource is released. Best effort within the watchdog's grace before it sends SIGKILL, so a hook cannot outlive the timeout it cleans up after (#​1324)
• A test file that fails to source sweeps its script temp files, so a bashunit::temp_file it created at top level no longer survives the run. bashunit bench already did this (#​1325)
• A malformed @timeout or @retry runs tear_down_after_script before it aborts the run, so the file releases what set_up_before_script acquired. Sequential and --parallel both leaked it (#​1329)
• Ctrl-C releases what an interrupted --parallel run acquired: the file's tear_down_after_script and the tear_down of a test in flight. The worker that owns the file's hook now handles the signal and reaches its test bodies, which a kill from the parent could not (#​1331)
• A malformed @timeout or @retry fails a --parallel run alongside a passing file. The abort happened inside the file's worker and never reached the parent, so the run printed the error and still exited 0, which kept it out of CI (#​1335)

v0.50.0

Compare Source

Added

• -u as the short form of --snapshot-update, the spelling jest and vitest both use (#​1293)

Changed

• --seed <n> now implies --random-order. Replaying a failure with the seed the header printed used to select nothing, so the run came back in defined order and green. An order named explicitly still wins, as in RSpec (#​1287)
• Performance: cold start is about 9ms faster, roughly 15%. The colour palette cost one subshell fork per colour, and every invocation paid it — --version included (#​1285)
• Performance: a --parallel run writing a report is about 1.9x faster and uses 1.8x less CPU. Each result row cost fourteen base64 forks per test, so --log-junit cost several times more than running the tests (#​1289)

Fixed

• --output json and --output junit are no longer corrupted by console text on stdout, which left the document unparseable. Four sources: an empty --parallel selection (#​1295), the blank line after a tear_down_after_script (#​1297), the duplicate-function abort, and a --parallel worker's stderr replay (#​1299)
• --parallel reports no longer count a file-level hook failure twice. JSON, JUnit, HTML and Markdown listed it as two failed tests while the console summary of the same run said one (#​1301)
• bashunit bench exits non-zero when a benchmark file fails to source or its set_up_before_script fails. It printed the error and exited 0, so the failure never reached CI, and a syntax error silently dropped every bench_ function after it (#​1303)
• --output tap escapes # in a test description, as --report-tap already did. A failing test titled ... # SKIP ... reached the consumer as a skip and left CI silently (#​1309)
• bashunit watch no longer takes an option's value as the path it polls: watch --tag slow tests/ polled a directory named slow. Options may now appear in any position (#​1291)
• The JUnit report escapes the file path; a name holding ", & or < closed the attribute early and the document stopped parsing (#​1313)
• The Cobertura report escapes XML metacharacters in a path, so GitLab, Azure and Jenkins render coverage instead of silently showing nothing (#​1311)
• GitHub Actions annotations encode : and , in their property values; a comma in a test title ended the title there and invented a property (#​1307)
• A ``` fence in a failure message no longer truncates the --report-md summary, which is appended to $GITHUB_STEP_SUMMARY (#​1305)

Security

• A test file's path is no longer evaluated as shell. The per-test EXIT trap interpolated the path into the trap string, and a trap body is re-evaluated when it fires, so a filename holding a command substitution executed it — reachable by any run over a tree whose filenames someone else controls, which is what CI does with a checked-out branch. The same mangling meant such a file's assertions never ran and it was reported risky instead of failing (#​1315)

Removed

• bashunit learn, the interactive tutorial. Nobody used it, and it was broken for most of the nine months it shipped without anyone reporting it. Learning bashunit belongs in the docs at https://bashunit.com, not in a subsystem inside the runner — which is also 6% of the distributable. Calling it now says it was removed and points there (#​1256, #​1258)

github/codeql-action (github/codeql-action)

v4.37.8

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.