chore(deps): update projectbluefin/actions digest to 9c69981

[mergeraptor]

This PR contains the following updates:

Package	Type	Update	Change
projectbluefin/actions (changelog)	workflow	digest	eb4c546 → 9c69981

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[kubestellar-hive]

🛑 Fix loop escalated — human attention needed

This PR has failed CI on 1 distinct fix attempts (new commits, still red). The hive has stopped dispatching further automated fixes for it.

Failing checks: contract

Raw failure evidence (from check-run annotations):

contract: Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: extractions/setup-crate@4993624604c307fbca528d28a3c8b60fa5ecc859. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners
contract: Process completed with exit code 1.

Remove the needs-human label after addressing the root cause to return the PR to the automated fix lane.

[mergeraptor]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[hanthor]

A digest bump is carrying an unrelated package-policy change

The PR describes exactly one change: projectbluefin/actions digest eb4c546 → 9c69981. The diff is 5 files, and one of them is packages/utah.toml:

@@ -102,7 +102,10 @@ packages = [
 packages = [
     "evolution-ews-core",
+    "firefox",
     "fish",
+    "grub2-efi-x64-cdboot",
+    "pipewire-libs-extra",
     "tailscale",
     "zsh",
 ]

That is the [unavailable] list — it changes which packages Utah stops trying to install. It has nothing to do with an action digest, it is not mentioned in the PR body, and Renovate did not author it. #29 and #30 carry the byte-identical hunk, which is how you can tell it came from the branch base rather than from the update.

Why it is there, and why it is now wrong

This branch is based on 0a5cbd2a, while main is at 636b48e3. In the interim main picked up those same three packages, and tailscale moved out of [unavailable]. Current main:

$ python3 -c "import tomllib;print(tomllib.load(open('packages/utah.toml','rb'))['unavailable']['packages'])"
['evolution-ews-core', 'firefox', 'fish', 'grub2-efi-x64-cdboot', 'pipewire-libs-extra', 'zsh']

Six entries, no tailscale. So merging this branch as-is would re-add tailscale to [unavailable], silently dropping it from the image — and system_files/shared/usr/share/ublue-os/privileged-setup.hooks.d/10-tailscale.sh expects it to be there. That is a functional regression smuggled in by a dependency bump.

This is presumably why mergeable_state is dirty: the branch conflicts with main and cannot merge without a rebase.

What this needs

Rebase onto 636b48e3. After a rebase the packages/utah.toml hunk should vanish entirely — main already contains those three entries — and the PR should reduce to the workflow-file digest changes it claims to be.

If any packages/utah.toml change survives the rebase, it wants its own PR with a rationale, since [unavailable] entries carry tracking issues by convention in that file.

Also worth checking before merge

The automerge label is on this PR. Given the branch carries an undeclared manifest change and is currently conflicted, automerge on a stale Renovate branch is the mechanism that would land the tailscale regression without anyone reading it. The needs-human label is doing the right thing here; please keep it until after the rebase.

Verify the target digest. projectbluefin/actions@9c699818ddf1043b8f5af8b862f59f783c6c7bda is consumed by reusable-build.yml, reusable-sync-branches.yml and the promote/release workflows — it is the whole build topology. Worth a look at the eb4c546...9c69981 compare before merging, since a digest bump here changes more behaviour than a typical action update.

CI cannot validate this right now anyway. main@636b48e is red at Containerfile:81 (install: cannot create regular file '/usr/local/libexec/utah-install-packages', run 34654001732). #56 needs to land first for a green build to be achievable at all.

Same applies to #29 and #30, which carry the identical stray hunk.

---

Generated by Claude Code

[hanthor]

Picking this up because of the needs-human label. Short version: this PR has been overtaken on every axis and should be rebased or closed rather than reviewed as-is.

1. The digest it proposes is long stale. 9c69981 is an ancestor of projectbluefin/actions main, roughly 40 commits behind the current tip 4d3b97e. The sibling bumps elsewhere in the org are already targeting 4d3b97e (projectbluefin/finpilot#361, projectbluefin/common#1111, and projectbluefin/review#622, which I merged earlier today). Landing 9c69981 here would just queue up another bump immediately.

2. mergeable_state: dirty — it conflicts with main, last touched 2026-09-11.

3. Its non-workflow payload is already on main. The diff adds firefox, grub2-efi-x64-cdboot and pipewire-libs-extra to the [unavailable] table in packages/utah.toml. main (636b48e) already carries those entries along with their written justifications — the firefox block explaining that the factory carries mozjs140 but not the browser build is there in full. So that part of this PR is redundant, and it is very likely the source of the conflict.

Worth noting for its own sake: this started life as a four-file workflow-digest bump and acquired a fifth file, a package-availability change, somewhere along the way. I flagged the same shape on projectbluefin/server#172 today, where CI pushes a freedesktop-sdk point-release bump into whatever renovate/* branch is open. A chore(deps): update ... digest title is a poor advertisement for a package-contract change, and both of these PRs carry the automerge label.

Recommendation: tick the rebase box in the description. Renovate will re-resolve to the current tip and drop the now-redundant toml hunk, and the result should be a clean four-file workflow-only diff that is quick to review. Closing also works — the body says closing suppresses future reminders for this update, and a fresh PR for the current digest would supersede it anyway — but rebasing keeps the automation on the rails.

Not posting a formal review verdict, since there is nothing here worth verifying until it is rebased.

---

Generated by Claude Code

[Danathar]

Closing per hanthor's assessment above, re-verified today: the proposed digest 9c69981 is well behind main's current eb4c546, the PR conflicts with main (CONFLICTING), and the three packages it adds to packages/utah.toml are already there. Renovate will open a fresh bump against the current tip.