[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	pinDigest	→ 3d3c42e
actions/configure-pages	action	pinDigest	→ 45bfe01
actions/deploy-pages	action	pinDigest	→ 368f825
actions/download-artifact	action	pinDigest	→ 9000827
actions/setup-dotnet	action	pinDigest	→ a98b568
actions/setup-go	action	pinDigest	→ b7ad1da
actions/setup-node	action	pinDigest	→ 949feb2
actions/upload-artifact	action	pinDigest	→ cf430e0
actions/upload-pages-artifact	action	pinDigest	→ fc324d3
softprops/action-gh-release	action	pinDigest	→ efb3536
tuna-os/.github	workflow	pinDigest	→ 0c6ea85

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[hanthor-hive-agent]

54ed7ff

⚠️ Sentinel alert — maintainer review required

Hive flagged this PR (author @renovate[bot], head 54ed7ff90cfb) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 23 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • .github/workflows/bitlocker-fixture-controls.yml
  • .github/workflows/ci-tests.yml
  • .github/workflows/ci.yml
  • .github/workflows/e2e-gui.yml
  • .github/workflows/e2e-hosted.yml
  • .github/workflows/e2e-kvm.yml
  • .github/workflows/e2e-matrix.yml
  • .github/workflows/e2e-snapshot.yml
  • .github/workflows/lint.yml
  • .github/workflows/linux-package-execute.yml
  • .github/workflows/linux-package-runtime.yml
  • .github/workflows/native-original-user.yml
  • .github/workflows/native-rpc-capabilities.yml
  • .github/workflows/offline-image-bundle.yml
  • .github/workflows/offline-release-plan.yml
  • .github/workflows/pages.yml
  • .github/workflows/readonly-cli-status.yml
  • .github/workflows/release.yml
  • .github/workflows/soak-ledger.yml
  • .github/workflows/ste.yml
  • .github/workflows/vm-first-hosted.yml
  • .github/workflows/winget-publish.yml
  • .github/workflows/winui-preview.yml

Hive added the sentinel-alert label. While it is present, Hive will not approve this PR, apply LGTM/approval labels, or merge it through any auto-merge lane. Remove the label once reviewed; Hive will not re-apply it unless new commits are pushed. Tune paths and behaviors under sentinel in hive.yaml or the dashboard Security tab.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.