[dependabot]

Bumps the github-actions group with 1 update: pullfrog/pullfrog.

Updates pullfrog/pullfrog from 0.1.102 to 0.1.111

Release notes

Sourced from pullfrog/pullfrog's releases.

v0.1.111

Auto-merge now merges past checks that aren't required, a run with the shell disabled no longer gets a gh tool, and a batch of fixes covers checkout, re-reviews, timeouts and OpenCode runs.

[!IMPORTANT] Two changes can surface on upgrade:

• Auto-merge no longer waits on checks that aren't required. An approved PR whose only pending or failing checks are optional is merged directly, so mark a check as required if it must pass (c412380)
• With the shell disabled, the agent gets no gh tool and no gh token (c412380)

Auto-merge

Change	Link
GitHub's unstable state is handled like clean: the PR is merged directly on a protected base, pinned to the reviewed commit. It used to end with auto-merge failed: … unstable status and the PR left open	c412380
The run's own pullfrog check is finished before the handoff. Its in_progress state alone could hold the PR in unstable	c412380
A base branch with no protection gets a comment, Approved, but not merged: the base branch has no branch protection. It used to be skipped silently	c412380

Checkout and re-reviews

Change	Link
A repo with Git LFS objects the runner cannot download checks out, and the agent sees the pointer files. Checkout used to fail on smudge filter lfs failed	c412380
A failed checkout no longer dispatches the re-review again and again, and a stale refs/pull/N/head is detected and the head fetched by SHA	c412380
An incremental review fetches the previous head by SHA. It used to go through a temporary branch whose creation could be refused with a 403	c412380
The history-deepening fetch asks only for the commits it needs. It used to fetch every branch	c412380
checkout_pr waits for background setup to restore files it changed, instead of refusing over a dirty tree	c412380

Reviews and timeouts

Change	Link
A run whose time limit fires after its review is posted finishes as a success. It used to fail with agent run timed out	c412380
Post-run reflection is skipped within 5 minutes of the time limit	c412380
A review subagent is stopped after 20 minutes, or within 5 minutes of the run's limit, and the review is submitted with what it found	c412380
A review whose submit returned a 5xx but was published anyway is kept instead of failing the run	c412380
Reading review threads costs 1 GraphQL point a page, down from 51 or more	c412380

Other fixes

Area	What changed	Link
Startup	Startup no longer reads the repository with the workflow's GITHUB_TOKEN. A restricted or invalid job token failed the run with Bad credentials	c412380
Node	On Node below 24, such as behind a Volta shim, the CLI re-runs itself on the action's own Node	c412380
npm	Every npm call goes through the resolved npm, including the browser install and the package-manager fallback	c412380
Tools	get_commit_info names its diff file from the commit SHA. A ref with a slash failed with ENOENT	c412380
Tools	The shell and gh tool timeouts leave headroom over the longest command timeout, so the command's own timeout fires first	c412380
Errors	GitHub's 5xx HTML pages are collapsed in tool errors, which are capped at 20K characters, and an empty GraphQL response is retried	c412380
OpenCode	Per-step snapshots are off, and the model listing no longer leaves a lock the server then waits on	c412380
OpenCode	external_directory allows the run's own temp directory rather than a literal /tmp/*	c412380
OpenCode	OpenCode Go's usage-limit messages end the run with the reset time. The run used to sit idle until the activity timeout	c412380

... (truncated)

Commits

• 8d51c15 release: bump action to 0.1.111
• c412380 Audit fixes: 31 run-audit and log-audit findings, from webhook replay dedup t...
• a07b041 subscriptions: store the live ChatGPT plan from wham/usage and recheck exhaus...
• 9acb864 console: lead a Codex / ChatGPT subscription's label with its plan, read from...
• 895164f release: keep 0.1.110's action lockfile at main's resolution (undo the hook's...
• 4bf4f28 console, docs: name the ChatGPT subscription card "Codex / ChatGPT"
• a14f285 bootstrap: pass npx an exact pullfrog version so npm < 11.2 and prefer-offlin...
• 5f11566 chore(models): bump resolved versions (#1581)
• 35e7da0 console, docs: name the Claude subscription "Claude", not "Claude Pro/Max", s...
• 096274d codenav: compiler-grade navigation as a shell CLI, behind a review rollout (#...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions