[renovate]

This PR contains the following updates:

Package	Type	Update	Change
stefanzweifel/git-auto-commit-action (changelog)	action	digest	4a55954 → d0b0110

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • "after 10am and before 4pm"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[henry-nsheaps]

### ✅ Approve — digest matches upstream `v7`, changes are benign

• ✅ New digest d0b0110 matches upstream refs/tags/v7 exactly
• ✅ Four intervening commits are benign (CHANGELOG, README, dead-code removal, .git-as-file bugfix)
• ✅ # v7 suffix comment remains accurate
• ✅ Matches repo convention (pinDigests: true for github-actions in renovate.json)
• ✅ No follow-ups

Click to expand for full details

Change under review

Single-line digest bump in .github/workflows/check.yaml:65 for stefanzweifel/git-auto-commit-action:

- uses: stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d # v7
+ uses: stefanzweifel/git-auto-commit-action@d0b01107b5db882071f96de5dd4b54961ea93f4c # v7

Verification

Confirmed the new digest is the current v7 tag:

$ gh api repos/stefanzweifel/git-auto-commit-action/git/refs/tags/v7
object.sha = d0b01107b5db882071f96de5dd4b54961ea93f4c  ✓

Compared old → new digest (ahead_by: 4, behind_by: 0):

SHA	Author	Subject
53ee9ba	stefanzweifel	Update CHANGELOG
4b4693c	Jack Bayliss	README: Update actions (#413)
9264814	Zhiwei Liang	Remove unused gitStatusMessage variable (#415)
d0b0110	Stefan Zweifel	Accept repositories where .git is a file (#417, fix #416)

The only behavioral change is #417, which switches a [ -d ".git" ] check to [ -e ".git" ] so submodules, linked worktrees, and --separate-git-dir clones are accepted. The action is used here on a vanilla actions/checkout of this repo, so this neither helps nor hurts the current call site — it is a strict improvement for the general case.

Repository conventions

renovate.json sets pinDigests: true for matchManagers: ["github-actions"], and the file consistently uses <digest> # <tag> elsewhere (jdx/mise-action, nsheaps/github-actions/.github/actions/checkout-as-app). This bump follows that convention.

Security

Pinned to a full-length commit SHA, so the mutable v7 tag cannot silently repoint this call site. New digest is the exact tip of upstream v7 at review time. No workflow permission changes.

Scoring rationale

• Quality 95% — trivial, correct, mechanical.
• Security 95% — SHA pinning preserved; verified against upstream.
• Simplicity 100% — one-line change, nothing to simplify.
• Confidence 98% — direct verification against the upstream tag ref and commit log; the 2% is standard caution around third-party action supply chain.

Follow-ups:

• None.

---

Workflow run · git-auto-commit-action v7 tag · compare 4a55954...d0b0110 · PR #417 (behavioral change)