build(deps): bump igorjs/gh-actions-clean-workflow from 3 to 8

[dependabot]

Bumps igorjs/gh-actions-clean-workflow from 3 to 8.

Release notes

Sourced from igorjs/gh-actions-clean-workflow's releases.

v8

Breaking

• Removed the deprecated days_old input. It had been silently ignored since v7.0.1 (the action always used runs_older_than). Use runs_older_than instead.
• Removed the deprecated result output. It had never been written since v7.0.1; the metrics output has always been runs-deleted. Use runs-deleted instead.

Fixed

• A bare 403 now fails fast with an actionable message instead of retrying for up to four minutes. Only a 403 carrying a Retry-After header (GitHub's secondary rate limit signal) is treated as a rate limit.
• Confirmed token validation handles GitHub's new stateless ghs_ installation token format.

Added

• A second, non-coverage-gated E2E/stress test suite (test/e2e/) that spawns the real compiled dist/index.js against a local mock GitHub API server, proving pagination, retry, and circuit-breaker logic survive esbuild bundling. A new e2e-tests CI job runs it on every push/PR (not yet a required check, pending a soak-in period).

See CHANGELOG.md for the full "Upgrading from v7 to v8" guide.

Full Changelog: igorjs/gh-actions-clean-workflow@v7.0.1...v8

v7.0.1

Fixed

• Token validation now accepts ghs_ installation tokens in the new JWT stateless format (dots and dashes in token body), rolled out by GitHub on 2026-04-27. Validation now checks only the token prefix per GitHub's 2026-04-24 guidance, treating the body as opaque.
• Corrected documented rate-limit delay from 100ms to 350ms to match actual behaviour.
• Workflow name validation now accepts dots, allowing names like Node.js CI or ci.build.

v7

v7.0.1 is available — see the v7.0.1 release for fixes included in this major version line.

Added

• Workflow Filtering: new workflow_names parameter to filter deletions by specific workflow names (comma-separated)
• Dry Run Mode: new dry_run parameter to preview deletions without deleting runs
• Metrics Outputs: 9 new action outputs for monitoring and alerting (total-runs-found, runs-deleted, runs-failed, total-api-requests, successful-requests, failed-requests, retry-attempts, rate-limit-hits, circuit-breaker-trips)
• Circuit Breaker Pattern: opens after 5 consecutive failures, recovers after 60 seconds, transitions through CLOSED/OPEN/HALF_OPEN states
• Automatic Retry Logic: exponential backoff for transient failures

v6

BREAKING CHANGES:

• deprecated parameter days_old in favour of runs_older_than by @​igorjs in igorjs/gh-actions-clean-workflow@d68f860
• refactor to keep the minimum num of runs regardless how old they are by @​igorjs in igorjs/gh-actions-clean-workflow#114
• fixes runs_to_keep: should keeps runs per workflow by @​igorjs in igorjs/gh-actions-clean-workflow#113

What's Changed

• chore(deps): bump igorjs/gh-actions-clean-workflow from 4 to 5 by @​dependabot in igorjs/gh-actions-clean-workflow#107
• chore(deps-dev): bump @​octokit/types from 12.6.0 to 13.5.0 by @​dependabot in igorjs/gh-actions-clean-workflow#108
• chore(deps-dev): bump eslint from 8.57.0 to 9.2.0 by @​dependabot in igorjs/gh-actions-clean-workflow#110
• chore(deps-dev): bump eslint from 9.2.0 to 9.4.0 by @​dependabot in igorjs/gh-actions-clean-workflow#111
• chore(deps-dev): bump eslint from 9.4.0 to 9.5.0 by @​dependabot in igorjs/gh-actions-clean-workflow#112
• chore(deps-dev): bump @​eslint/js from 9.5.0 to 9.6.0 by @​dependabot in igorjs/gh-actions-clean-workflow#115

... (truncated)

Changelog

Sourced from igorjs/gh-actions-clean-workflow's changelog.

[8] - 2026-08-29

Fixed

• A 403 response is no longer always treated as a rate limit. Only a 403 carrying a Retry-After header (GitHub's secondary rate limit signal) is retried; a bare 403 (typically a missing actions: write scope) now fails fast with an actionable message instead of retrying for up to four minutes.
• Confirmed token validation is ready for GitHub's new stateless installation token format (ghs_-prefixed JWT, ~520 characters, two dots), rolled out via the X-GitHub-Stateless-S2S-Token override header per GitHub's 2026-05-15 changelog. Removed the unused MIN_TOKEN_LENGTH constant, which was dead code left over from before validation became prefix-only, and added a regression test pinning acceptance of a token at the new length and dot count.

Removed

• Breaking: Removed the deprecated days_old input. It had been silently ignored since v7.0.1 (the action always used runs_older_than); GitHub Actions now warns on the undeclared input instead of accepting it silently. Use runs_older_than instead.
• Breaking: Removed the deprecated result output. It had never been written since v7.0.1; the metrics output has always been runs-deleted. Use runs-deleted instead.

[7.0.1] - 2026-06-25

Fixed

• Token validation now accepts ghs_ installation tokens in the new JWT stateless format (dots and dashes in token body), rolled out by GitHub on 2026-04-27. Validation now checks only the token prefix per GitHub's 2026-04-24 guidance, treating the body as opaque.
• Corrected documented rate-limit delay from 100ms to 350ms to match actual behaviour.
• Workflow name validation now accepts dots, allowing names like Node.js CI or ci.build.

Commits

• b910eb3 chore(release): add v8 changelog and upgrade guide (#336)
• 45be35e fix(ci): allow api.github.com in e2e harden-runner egress (#335)
• 65648a4 ci: add non-blocking e2e-tests job and document suites (#334)
• 36740c8 test(e2e): add subprocess smoke test for dist build (#333)
• 9bf6295 feat(e2e): add local mock GitHub API server for e2e tests (#332)
• c78091a test: add sustained stress scenarios for retry, circuit breaker (#331)
• b6a9317 test(api): add boundary and stress test scenarios (#330)
• eac7219 test: add stress-test helpers, exclude e2e from vitest run (#329)
• 6d7f8be refactor: convert CircuitState enum to erasable union type (#328)
• a129e8a chore: remove dead HTTP_STATUS.NOT_FOUND, harden index-signature access, use ...
• Additional commits viewable in compare view