[dependabot]

Bumps the github-actions group with 2 updates: docker/login-action and pullfrog/pullfrog.

Updates docker/login-action from 4.6.0 to 4.7.0

Release notes

Sourced from docker/login-action's releases.

v4.7.0

• Preserve explicit ECR settings in registry-auth by @​crazy-max in docker/login-action#1089
• Use registry hosts for scoped credentials by @​crazy-max in docker/login-action#1088
• Raise Docker Hub OIDC max expiry to 6 hours by @​crazy-max in docker/login-action#1068
• Log Docker Hub OIDC token exchange progress by @​crazy-max in docker/login-action#1061
• Bump @​aws-sdk/client-ecr and @​aws-sdk/client-ecr-public to 3.1154.0 in docker/login-action#1093
• Bump @​docker/actions-toolkit from 0.94.0 to 0.107.0 in docker/login-action#1100
• Bump @​humanfs/node from 0.16.7 to 0.16.8 in docker/login-action#1077
• Bump csv-parse from 7.0.1 to 7.0.3 in docker/login-action#1078
• Bump handlebars from 4.7.9 to 4.7.10 in docker/login-action#1091
• Bump js-yaml from 5.2.2 to 5.5.0 in docker/login-action#1066
• Bump postcss from 8.5.22 to 8.5.26 in docker/login-action#1071
• Bump postcss-selector-parser from 7.1.1 to 7.1.6 in docker/login-action#1092
• Bump source-map-js from 1.2.1 to 1.2.2 in docker/login-action#1090
• Bump undici from 6.27.0 to 6.29.1 in docker/login-action#1085
• Bump uuid from 14.0.1 to 14.0.3 in docker/login-action#1096

Full Changelog: docker/login-action@v4.6.0...v4.7.0

Commits

• 81c6f93 Merge pull request #1100 from docker/dependabot/npm_and_yarn/docker/actions-t...
• 1b16c8d Merge pull request #1096 from docker/dependabot/npm_and_yarn/uuid-14.0.3
• ac86b5e [dependabot skip] chore: update generated content
• 1476d84 build(deps): bump @​docker/actions-toolkit from 0.94.0 to 0.107.0
• 503cee6 Merge pull request #1095 from docker/dependabot/github_actions/actions/create...
• f093535 Merge pull request #1099 from docker/dependabot/github_actions/codecov/codeco...
• d5ae7f1 Merge pull request #1098 from docker/dependabot/github_actions/docker/bake-ac...
• 6f97507 Merge pull request #1097 from docker/dependabot/github_actions/docker/bake-ac...
• 006d61f Merge pull request #1094 from docker/dependabot/github_actions/codeql-actions...
• 93f5f52 Merge pull request #1093 from docker/dependabot/npm_and_yarn/aws-sdk-dependen...
• Additional commits viewable in compare view

Updates pullfrog/pullfrog from 0.1.101 to 0.1.107

Release notes

Sourced from pullfrog/pullfrog's releases.

v0.1.107

A fix for OpenCode runs that failed at random with Model not found on newly released models, and model aliases that runs now take from Pullfrog's server instead of the action release.

New models on OpenCode

A run on a model released after the OpenCode build Pullfrog installs, such as openai/gpt-luna resolving to gpt-6-luna, could fail with Model not found. Whether it failed depended on whether OpenCode's background download of its model list finished before the run listed its models. The runner now downloads that list before the first listing. When the download fails, the run says so instead of reporting a missing model (19d0296, fixes #114):

OpenCode couldn't download its model list, so it didn't recognize `openai/gpt-luna`.

Model aliases from Pullfrog's server

A run now resolves model aliases such as anthropic/claude-opus or openrouter/gpt-luna with the alias list Pullfrog's server sends at startup, the same list the console's model picker shows. A new model, a retired id or a changed effort level reaches runs when Pullfrog deploys, without a new action release (d3af456).

Area	What changed
Effort levels	The levels offered for each model follow what its provider publishes for it, refreshed hourly.
Provider model ids	The OpenCode Zen, OpenCode Go, OpenRouter and Vercel ids behind an alias follow the id each provider lists for that model.
Free OpenCode Zen models	A free model that Zen stops serving or marks deprecated runs as Big Pickle, and leaves the model picker.
CLI versions	A run whose Claude Code, Codex or OpenCode version differs from the one the server's list was written for keeps the list built into its own release, and logs kept the bundled model registry.

---

Full Changelog: pullfrog/pullfrog@v0.1.106...v0.1.107

v0.1.106

• Re-reviews of a rebased PR cover only what changed. The previous version of the PR is replayed onto its new base before the two are compared. Content the base already has drops out of the re-review, such as a stacked parent PR that was squash-merged or main's own edits next to the PR's lines.
• Self-hosted runners with a broken bundled npm can install the agent again. The agent CLI now installs with the same npm that launched Pullfrog. On some self-hosted runners every run failed with Failed to install dependencies: … Cannot find module '../lib/cli.js'.
• Cancelled runs on self-hosted runners no longer leave their temp directory behind. The post step now removes the /tmp/pullfrog-* tree a cancelled or timed-out run leaves, which could fill a tmpfs /tmp (#82, by Bnjoroge1).

v0.1.105

Named OpenAI-compatible endpoints, a pullfrog run command that starts a run from the terminal, and the effort input for OpenCode models outside the catalog.

Named OpenAI-compatible endpoints

An organization can keep several OpenAI-compatible endpoints and pick one per repository or per run, without entering its values again (#98). A named endpoint runs as the model openai-compatible/<name> from five variables of its own, stored in the Pullfrog console or set in the workflow:

env:
  OPENAI_COMPATIBLE_VLLM_A_BASE_URL: https://vllm-a.internal.example.com/v1
  OPENAI_COMPATIBLE_VLLM_A_API_KEY: ${{ secrets.VLLM_A_KEY }}
  OPENAI_COMPATIBLE_VLLM_A_MODEL: qwen3-coder
  OPENAI_COMPATIBLE_VLLM_A_CONTEXT: "128000"
  OPENAI_COMPATIBLE_VLLM_A_MAX_OUTPUT: "16384"

A run on a named endpoint uses only that endpoint's values and reports a missing one by its own name. The unnamed endpoint keeps the bare OPENAI_COMPATIBLE_* names. Setup is in the OpenAI-compatible guide.

Other changes

... (truncated)

Commits

• 8302038 release: bump action to 0.1.107
• b868dc1 Custom GitHub App: an Enterprise org registers its own App through the manife...
• d3af456 Serve the model registry from run-context, and read effort ladders live from ...
• 19d0296 Seed opencode's model catalog before the first opencode models, so new mode...
• fac403e fix: remove the shared temp directory in the post hook (#82)
• 8569baa release: bump action to 0.1.106
• 4f58b46 Re-review deltas replay the old version onto the new base; agent CLI installs...
• dd8cf7d release: bump action to 0.1.105
• 5c97ced Named OpenAI-compatible endpoints: several per org, each picked as openai-com...
• 51fbcc6 pullfrog/pullfrog takes no outside PRs: CONTRIBUTING.md sends contributors to...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.