build(deps): bump taiki-e/install-action from 2.87.2 to 2.87.8

[dependabot]

Bumps taiki-e/install-action from 2.87.2 to 2.87.8.

Release notes

Sourced from taiki-e/install-action's releases.

2.87.8

• Update shfmt@latest to 3.14.1.

• Update release-plz@latest to 0.3.162.

• Update protoc-gen-connect-openapi@latest to 0.26.0.

• Update dprint@latest to 0.57.4.

• Update cargo-llvm-cov@latest to 0.9.1.

• Update cargo-crap@latest to 0.5.0.

• Update cargo-binstall@latest to 1.23.0.

2.87.7

• Update wasm-bindgen@latest to 0.2.128.

• Update uv@latest to 0.12.10.

• Update tombi@latest to 1.5.2.

• Update rclone@latest to 1.75.1.

2.87.6

• Update rafn@latest to 0.1.6.

• Update editorconfig-checker@latest to 3.11.3.

• Update dprint@latest to 0.57.1.

• Update convco@latest to 0.7.2.

2.87.5

• Update vacuum@latest to 0.30.3.

• Update uv@latest to 0.12.9.

• Update typos@latest to 1.50.1.

• Update tombi@latest to 1.5.1.

• Update release-plz@latest to 0.3.161.

• Update prek@latest to 0.5.2.

• Update oxfmt@latest to 1.81.0.

• Update mise@latest to 2026.9.1.

... (truncated)

Changelog

Sourced from taiki-e/install-action's changelog.

[2.87.8] - 2026-09-07

• Update shfmt@latest to 3.14.1.

• Update release-plz@latest to 0.3.162.

• Update protoc-gen-connect-openapi@latest to 0.26.0.

• Update dprint@latest to 0.57.4.

• Update cargo-llvm-cov@latest to 0.9.1.

• Update cargo-crap@latest to 0.5.0.

• Update cargo-binstall@latest to 1.23.0.

[2.87.7] - 2026-09-06

• Update wasm-bindgen@latest to 0.2.128.

• Update uv@latest to 0.12.10.

• Update tombi@latest to 1.5.2.

• Update rclone@latest to 1.75.1.

[2.87.6] - 2026-09-05

• Update rafn@latest to 0.1.6.

• Update editorconfig-checker@latest to 3.11.3.

• Update dprint@latest to 0.57.1.

• Update convco@latest to 0.7.2.

[2.87.5] - 2026-09-04

• Update vacuum@latest to 0.30.3.

• Update uv@latest to 0.12.9.

• Update typos@latest to 1.50.1.

• Update tombi@latest to 1.5.1.

• Update release-plz@latest to 0.3.161.

• Update prek@latest to 0.5.2.

... (truncated)

Commits

• d438492 Release 2.87.8
• cf1fade Update shfmt@latest to 3.14.1
• 7161449 Update release-plz@latest to 0.3.162
• 58df4bb Update protoc-gen-connect-openapi@latest to 0.26.0
• 33e9ffe Update oxfmt manifest
• 60bf882 Update kache manifest
• 667469a Update dprint@latest to 0.57.4
• aa52fd6 Update cargo-llvm-cov@latest to 0.9.1
• 834d344 Update cargo-crap@latest to 0.5.0
• 097f1f0 Update cargo-binstall@latest to 1.23.0
• Additional commits viewable in compare view

[da2ce7]

Reviewed at fc49c2da6b8e6b4e5cbda3b819041d759cfc16c3.

Verdict: comment, not approval — CI has not run at this head.

The change itself is correct and complete: three uses: lines bumped, exact version pin preserved (no moving @v2 tag), and no 2.87.2 reference left anywhere in the tree.

Upstream check between v2.87.2 (1ed6d7be) and v2.87.7 (84f5ac31): 33 files changed, none of them action runtime code — only manifests/*.json, the action's own CI, and CHANGELOG.md. Of the three tools these workflows install, the resolved versions are unchanged:

tool	@v2.87.2	@v2.87.7
grcov	0.10.7	0.10.7
cargo-llvm-cov	0.9.0	0.9.0
cargo-nextest	0.9.143	0.9.143

(cargo-llvm-cov.json gained a 0.9.1 entry, but latest still points at 0.9.0.) So this bump is functionally inert for this repository.

Blocker — organization allowed-actions list. Three runs at this head ended in startup_failure with zero jobs created:

• Testing (pull_request) — run 34396702764
• Testing (push) — run 34396698580
• Generate Coverage Report (PR) — run 34396703553

The repository's allowed-actions list still carries the exact pattern taiki-e/install-action@v2.87.2, which does not admit @v2.87.7, so the workflows are rejected at parse time. Because no jobs are created, no check runs are either — gh pr checks 2191 lists 19 passing/skipped rows and exits 0, so this PR looks green while its three main workflows never started. Coverage is not in the list only because it triggers on push to develop; it carries the same pin and would break on the first push after merge.

Per .github/skills/dev/maintenance/update-github-workflow-actions/SKILL.md (step 4 and the Allowlist Failure Diagnosis section), the fix is on the organization side, not in this diff: a Torrust organization administrator needs to update the allowed-actions list in the organization Actions settings, replacing taiki-e/install-action@v2.87.2 with the scoped pattern taiki-e/install-action@v2.*. That unblocks this bump and every future Dependabot bump in the v2 line while keeping the exact pins in the workflows.

Once the allowlist is updated and the three runs are re-run green at this head, approval and ACK follow. Nothing is required from the author.

[da2ce7]

@dependabot rebase

[da2ce7]

@josecelano this bump needs an organisation-level change before it can be reviewed.

The torrust organisation's Actions allowlist pins taiki-e/install-action@v2.87.2 exactly. Every workflow this PR touches moves that reference to v2.87.8, so at 3ee022c2 the Testing and Generate Coverage Report (PR) workflows end in startup_failure before a single job starts — runs 34460535128, 34460529306 and 34460536235. A startup_failure emits no check run, so gh pr checks and the PR's checks box look clean while nothing has run.

Two ways to unblock it, both org settings that need an org admin:

• widen the allowlist entry to taiki-e/install-action@v2.* (or a SHA-pinned entry, if the policy prefers pins), so future dependabot bumps of this action can run CI without a settings edit each time; or
• move the pin to v2.87.8 for this bump only, and repeat at the next one.

Once the workflows can start, I will review this head fresh. For the record, the Container failure at this head (run 34460533854) is a Docker Hub pull rate limit while pulling the qbittorrent-leecher image (toomanyrequests … allowed: 44000/minute), unrelated to this diff.

[da2ce7]

@dependabot rebase

[dependabot]

Superseded by #2199.