chore(deps): update nsheaps + squink github actions

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
nsheaps/agents (changelog)	workflow	digest	f54467d → e78e167
nsheaps/ai-mktpl (changelog)	action	digest	f03178c → e7607fb

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • "after 10am and before 4pm every weekday"

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Plugin Version Preview

Preview only — plugin versions and marketplace.json are bumped automatically on merge to main, not in this PR. Manual bumps to higher versions are preserved. See the file annotations for the pending change on each plugin.json.

Plugin	Base	Current	Action
review-utils	0.2.11	0.2.12	Auto-bumped

Dismissed: new commits since last approval require re-review.

Dismissed: new commits since last approval require re-review.

Dismissed: new commits since last approval require re-review.

Dismissed: new commits since last approval require re-review.

Dismissed: new commits since last approval require re-review.

Dismissed: new commits since last approval require re-review.

[henry-nsheaps]

Summary

✅ Approve — safe digest refresh for two SHA-pinned third-party action references. Neither consumed action/workflow is modified in the compared ranges.

Dimension	Score	Notes
Correctness	5/5	Both target SHAs resolve; consumed files (review-dispatch.yaml, interpolate-prompt/) are not in either delta
Security	5/5	SHAs remain commit-pinned (not @main/tag), preserving the supply-chain posture documented at .github/workflows/dispatch-review.yaml:62-67
Simplicity	5/5	Two-line digest bump, nothing extra
Convention	5/5	Matches the existing @<sha> # main pinning style

How I arrived at this

File 1 — .github/workflows/dispatch-review.yaml (f54467d → e78e167)

Compared nsheaps/agents@f54467d...e78e167 via GET /repos/nsheaps/agents/compare:

• 7 commits ahead, 0 behind
• Files changed in range: .github/workflows/dispatch-review.yaml, CHANGELOG.md, mise.toml
• The reusable workflow consumed by this PR is .github/workflows/review-dispatch.yaml (different file) — not touched in the range, so caller behavior is unchanged. The dispatch-review.yaml file in the range is the template file, not the consumed reusable workflow.
• The new target e78e167 is also this PR's own base ref (current main HEAD of nsheaps/agents), confirming this is a self-reference catch-up.

Commits in range (nsheaps/agents):

• bc77cdc [sync] Update .github/workflows/dispatch-review.yaml (template sync)
• a692bb7 chore(deps): update dependency bun to v1.4.1 (#365) — mise.toml only
• 5c6a199 chore: release v0.3.158 [skip ci] — CHANGELOG.md only
• d6ca12f chore(deps): update dependency bun to v1.4.2 (#366) — mise.toml only
• 4601ee7 chore: release v0.3.159 [skip ci] — CHANGELOG.md only
• 7d1cc43 chore(deps): update dependency pipx:litellm to v1.100.0 (#367) — mise.toml only
• e78e167 chore: release v0.3.160 [skip ci] — CHANGELOG.md only

File 2 — plugins/claude-code/review-utils/actions/run-agent/action.yaml (f03178c → e7607fb)

Compared nsheaps/ai-mktpl@f03178c...e7607fb:

• 10 commits ahead, 0 behind
• Files changed in range (net diff): .github/workflows/dispatch-review.yaml, mise.toml
• The consumed action lives at .github/actions/interpolate-prompt/ — not in the modified-file set, so action body and inputs are byte-identical.

Commits in range (ai-mktpl):

• 04df06e chore(deps): update dependency gh to v2.99.0 (#821)
• d095631 [org-settings] update .github/settings.yml
• 36b15ff [sync] Update .github/workflows/dispatch-review.yaml
• b0d0ee3 [sync] Update .github/workflows/pr-status-dispatch.yaml
• 799dda8 chore: mise run lint
• 676fb5d chore(deps): update dependency gh to v2.100.0 (#824)
• c571b38 chore(deps): update dependency npm:eslint to v10.10.0 (#826)
• fb47061 [org-settings] update .github/settings.yml
• 846bffd [sync] Update .github/workflows/pr-status-dispatch.yaml
• e7607fb chore: mise run lint

Delta since my prior (dismissed/minimized) reviews

• nsheaps/agents target moved 4601ee7 → e78e167, adding two commits: 7d1cc43 (pipx:litellm v1.100.0 in mise.toml) and e78e167 (release-bot CHANGELOG.md only). Neither touches the consumed review-dispatch.yaml.
• ai-mktpl target unchanged (e7607fb); interpolate-prompt/ remains untouched.

Supply chain

Both references remain commit-SHA pinned (not tag/branch), per the deliberate choice documented at .github/workflows/dispatch-review.yaml:62-67. Pinning posture preserved.

Minor nits (not blocking)

• 📝 Renovate PR title still says "nsheaps + squink github actions", but no squink/* dependency appears in the actual change set. This is a Renovate group-config artifact (title derived from the package group name), not fixable in this PR.

Recommendation

Merge when CI is green. The Renovate automerge window (10am–4pm ET weekdays) should pick this up on its own.

🤖 Generated with Claude Code · claude-opus-4-7