chore(deps): bump taiki-e/install-action from 2.87.2 to 2.87.6

[dependabot]

Bumps taiki-e/install-action from 2.87.2 to 2.87.6.

Release notes

Sourced from taiki-e/install-action's releases.

2.87.6

• Update rafn@latest to 0.1.6.

• Update editorconfig-checker@latest to 3.11.3.

• Update dprint@latest to 0.57.1.

• Update convco@latest to 0.7.2.

2.87.5

• Update vacuum@latest to 0.30.3.

• Update uv@latest to 0.12.9.

• Update typos@latest to 1.50.1.

• Update tombi@latest to 1.5.1.

• Update release-plz@latest to 0.3.161.

• Update prek@latest to 0.5.2.

• Update oxfmt@latest to 1.81.0.

• Update mise@latest to 2026.9.1.

• Update martin@latest to 1.15.0.

• Update git-cliff@latest to 2.14.1.

• Update cargo-zigbuild@latest to 0.23.4.

• Update cargo-deb@latest to 3.8.0.

• Update biome@latest to 2.5.12.

2.87.4

• Update uv@latest to 0.12.8.

• Update protoc@latest to 3.36.1.

• Update coreutils@latest to 0.11.0.

2.87.3

• Update zizmor@latest to 1.30.0.

• Update ubi@latest to 0.12.0.

• Update protoc-gen-connect-openapi@latest to 0.25.8.

... (truncated)

Changelog

Sourced from taiki-e/install-action's changelog.

[2.87.6] - 2026-09-05

• Update rafn@latest to 0.1.6.

• Update editorconfig-checker@latest to 3.11.3.

• Update dprint@latest to 0.57.1.

• Update convco@latest to 0.7.2.

[2.87.5] - 2026-09-04

• Update vacuum@latest to 0.30.3.

• Update uv@latest to 0.12.9.

• Update typos@latest to 1.50.1.

• Update tombi@latest to 1.5.1.

• Update release-plz@latest to 0.3.161.

• Update prek@latest to 0.5.2.

• Update oxfmt@latest to 1.81.0.

• Update mise@latest to 2026.9.1.

• Update martin@latest to 1.15.0.

• Update git-cliff@latest to 2.14.1.

• Update cargo-zigbuild@latest to 0.23.4.

• Update cargo-deb@latest to 3.8.0.

• Update biome@latest to 2.5.12.

[2.87.4] - 2026-09-02

• Update uv@latest to 0.12.8.

• Update protoc@latest to 3.36.1.

• Update coreutils@latest to 0.11.0.

[2.87.3] - 2026-09-01

• Update zizmor@latest to 1.30.0.

... (truncated)

Commits

• 7b8d471 Release 2.87.6
• a67fcd1 Update wasm-bindgen manifest
• efe69d3 Update uv manifest
• ce51454 Update tombi manifest
• e3284bd Update rafn@latest to 0.1.6
• 50bb7c8 Update editorconfig-checker@latest to 3.11.3
• 2e1a951 Update dprint@latest to 0.57.1
• 2d664e3 Update convco@latest to 0.7.2
• 5f8ff1a ci: Disable debian 11
• 5bf6ce0 Release 2.87.5
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[da2ce7]

The patch itself is correct and complete, but this cannot merge as it stands: the repository allowed-actions policy still carries the old exact pin, so every workflow that uses this action now fails before any job starts.

Blockers

The allowed-actions policy does not permit taiki-e/install-action@v2.87.6.

gh api repos/torrust/torrust-tracker/actions/permissions/selected-actions returns a patterns_allowed list whose only entry for this action is the exact pin taiki-e/install-action@v2.87.2. On head a90c3bb, the two triggered workflows that use the action both ended in startup_failure (Testing for push and for pull_request, and Generate Coverage Report (PR)), while every triggered workflow that does not use it (Docs Lint, OS Compatibility, Container) started normally. The same testing.yaml, differing only in this one line, started successfully on develop at 2026-09-08T15:45:11Z, so the changed pin is the discriminator. AGENTS.md (Git Workflow) requires that PRs pass all CI status checks before merge; merging now would land a develop whose test and coverage workflows do not start.

Worth flagging for whoever triages this: these three runs produce no check runs at all, so gh pr checks 2180 and the PR checks list look clean. The failures are visible only in the workflow-run list.

The fix is a settings change, not a change to this diff. Per .github/skills/dev/maintenance/update-github-workflow-actions/SKILL.md (Allowlist Failure Diagnosis), an administrator replaces the exact entry with the scoped pattern taiki-e/install-action@v2.* and re-runs the failed workflows. The skill's Delivery Policy is explicit that the workflow pin must not be weakened to a moving major tag to work around this, and the version format in this PR is already what the policy asks for.

Suggestions

• Adopting taiki-e/install-action@v2.* once ends a recurring cost rather than fixing a one-off. .github/dependabot.yaml polls GitHub Actions daily, so every future patch bump repeats this startup failure for as long as the policy names an exact version. The same list already uses mozilla-actions/sccache-action@*, so the wildcard style is established. The .github/dependabot.yaml header comment already records the coupling; the policy entry is what has drifted from it.

Nits

• The head branch lives in torrust/torrust-tracker, while AGENTS.md (Git Workflow) states that PRs targeting develop must come from a fork branch, and the workflow-actions skill's Delivery Policy says the same. Dependabot cannot satisfy that constraint. Nothing to change here; the exception is worth recording in AGENTS.md so the rule and the practice agree.

Verification

• Diff scope. git diff --stat develop...<head>: 3 files changed, 3 insertions, 3 deletions. Only the uses: line changes, at coverage.yaml:51, generate_coverage_pr.yaml:46, testing.yaml:80. git diff --check is clean.
• Consistency and version format. git grep -n 'taiki-e/install-action' <head> -- .github shows all three workflow references at @v2.87.6, none left at v2.87.2, and no moving @v2 tag. The one remaining v2.87.2-era string is the illustrative example inside the workflow-actions skill document, which is documentation and correctly untouched. A sweep of all 15 workflow files confirms these three are the only consumers of the action.
• Upstream 2.87.3 (2026-09-01): manifest updates for zizmor 1.30.0, ubi 0.12.0, protoc-gen-connect-openapi 0.25.8, mise, kingfisher, dprint.
• Upstream 2.87.4 (2026-09-02): manifest updates for uv 0.12.8, protoc 3.36.1, coreutils 0.11.0.
• Upstream 2.87.5 (2026-09-04): thirteen manifest updates (vacuum, uv, typos, tombi, release-plz, prek, oxfmt, mise, martin, git-cliff, cargo-zigbuild, cargo-deb, biome) plus bumps to the action's own internal CI workflows.
• Upstream 2.87.6 (2026-09-05): manifest updates for rafn 0.1.6, editorconfig-checker 3.11.3, dprint 0.57.1, convco 0.7.2, plus wasm-bindgen, uv and tombi manifest refreshes and a change disabling Debian 11 in the action's own test matrix.
• Tools this repository installs are untouched. Across all 53 commits in v2.87.2...v2.87.6 and all four release bodies, a case-insensitive search for grcov, llvm-cov and nextest returns 0 matches, so grcov, cargo-llvm-cov and cargo-nextest resolve exactly as before. No security advisory and no behaviour change in the range; the only security strings in the range are Debian archive URLs quoted in the Debian 11 CI commit.
• PR metadata. Title is a valid Conventional Commits line. Base branch is develop. The body explains the change and links release notes, changelog and compare view. Labels Continuous Integration and Dependencies match .github/dependabot.yaml. No linked issue, which is right here: AGENTS.md asks for an issue reference only when the PR implements or closes one.
• Signing. The head commit carries a GPG signature from GitHub's signer, key B5690EEEBB952194. A local git log --format='%G?' reports E purely because that public key is not in this checkout's keyring; commits already on develop report the same status for the maintainer key 58508C7950C7B7A2. AGENTS.md (Essential Rules, GPG commit signing) is satisfied.
• CI, re-polled at 2026-09-08T19:54:55Z. Testing (push), Testing (pull_request) and Generate Coverage Report (PR): startup_failure. Docs Lint (push and pull_request): success. OS Compatibility: 8 of 11 jobs green, the three macOS jobs still running. Container / Test (Docker) (release): still running. The Docker E2E job of issue #2179 does not appear at all, because the workflow that contains it never started.
• Allowlist evidence. No job containing the Install Tools step ever reached the running state, so there is no positive evidence that the policy permits the new reference. The direct read of the repository actions policy shows that it does not.

[dependabot]

Superseded by #2191.