ci: bump softprops/action-gh-release from 3.0.2 to 3.0.3

[dependabot]

Bumps softprops/action-gh-release from 3.0.2 to 3.0.3.

Release notes

Sourced from softprops/action-gh-release's releases.

v3.0.3

3.0.3 is a maintenance release with updated dependencies. It also safely classifies malformed GitHub API errors to avoid secondary failures (#822).

What's Changed

Bug fixes 🐛

• fix: safely classify GitHub API errors by @​chenrui333 in softprops/action-gh-release#822

Other Changes 🔄

• dependency updates

Changelog

Sourced from softprops/action-gh-release's changelog.

3.0.3

3.0.3 is a maintenance release with updated dependencies. It also safely classifies malformed GitHub API errors to avoid secondary failures (#822).

What's Changed

Bug fixes 🐛

• fix: safely classify GitHub API errors by @​chenrui333 in softprops/action-gh-release#822

Other Changes 🔄

• dependency updates

3.0.2

3.0.2 is a patch release focused on release reliability and compatibility. It reuses existing draft releases when publishing prereleases, supports replacing release assets on Gitea, hardens streamed asset uploads, and provides clearer release-creation diagnostics. It also includes TypeScript, coverage, and tooling maintenance merged since 3.0.1.

This release fixes #795, #438, and #803. The upload transport hardening covers the historical failure reported in #790, although current hosted Node 24 runners did not reproduce it naturally. The diagnostics work is related to #786 and does not claim a reproducible release-creation fix.

What's Changed

Exciting New Features 🎉

• feat: improve release error reporting and test coverage by @​chenrui333 in softprops/action-gh-release#813

Bug fixes 🐛

• fix: publish existing draft releases as prereleases by @​godfengliang in softprops/action-gh-release#801
• fix: upload small checksum assets reliably by @​chenrui333 in softprops/action-gh-release#815
• fix: replace existing release assets on Gitea by @​chenrui333 in softprops/action-gh-release#816
• fix: clarify release creation 404 errors by @​chenrui333 in softprops/action-gh-release#817

Other Changes 🔄

• chore(deps): upgrade TypeScript to 7 by @​chenrui333 in softprops/action-gh-release#812
• chore(deps): remove unused TypeScript tooling by @​chenrui333 in softprops/action-gh-release#814
• dependency, Node 24 pin, and CI maintenance merged since 3.0.1

3.0.1

• maintenance release with updated dependencies

... (truncated)

Commits

• efb3536 release 3.0.3 (#840)
• 6441963 chore(deps): bump the npm group with 2 updates (#839)
• e5ee6bc chore(deps): bump esbuild from 0.28.1 to 0.28.2 in the npm group (#837)
• d1e6617 chore(deps): bump undici from 6.27.0 to 6.28.0 (#831)
• 6403751 chore(deps): bump the npm group with 2 updates (#835)
• 7c7184b chore(deps): bump postcss from 8.5.19 to 8.5.25 (#833)
• 0f3f0d2 chore(deps): bump brace-expansion from 5.0.8 to 5.0.9 (#832)
• 77fb938 chore(deps): bump prettier from 3.9.5 to 3.9.6 in the npm group (#830)
• 5a6f517 chore(deps): bump brace-expansion from 5.0.7 to 5.0.8 (#828)
• a3c91c9 chore(deps): bump the github-actions group with 2 updates (#825)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[claude]

Claude finished @dependabot[bot]'s task in 51s —— View job

---

Dependency review: softprops/action-gh-release 3.0.2 → 3.0.3

• Read PR diff
• Verify pin style and SHA
• Check release notes for breaking input/behaviour changes
• Check how the action is used in this repo
• Post review

Verdict: safe to merge. Patch-level bump, no semver boundary crossed, no changes needed in this repo.

---

What changed

One line, .github/workflows/release.yml:61:

- uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
+ uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3

• Semver: 3.0.2 → 3.0.3, patch. No major/minor boundary.
• Pin style preserved: full 40-char commit SHA with the trailing # vX.Y.Z comment, exactly as CLAUDE.md requires. Comment was updated in step with the SHA — no stale-comment drift.
• SHA provenance: efb3536 is the top commit in Dependabot's list, titled "release 3.0.3 (#840)", and the compare view in the PR body terminates at that SHA. Consistent with the release tag. (I couldn't independently hit the GitHub API from this run — network fetch wasn't permitted — so this is verified against the PR body rather than a live tag lookup. Worth a glance if you want belt-and-braces.)

Changelog assessment

3.0.3 is maintenance: dependency updates plus softprops/action-gh-release#822, which makes error classification tolerant of malformed GitHub API error payloads so a bad error response doesn't cascade into a secondary failure. That is strictly defensive — it only affects the failure path. No inputs added, removed, renamed, or given new defaults; no output changes; no behaviour change on the success path.

Usage in this repo

Exactly one call site — the Create GitHub Release step in the release job — using two inputs:

• files: '*.mcpb' — asset upload. Untouched in 3.0.3. Note the asset-upload hardening (#815) and Gitea asset replacement (#816) landed back in 3.0.2, which is already in use here, so nothing new arrives on that path with this bump.
• generate_release_notes: true — untouched.

Neither input is affected. permissions: contents: write at the workflow level still covers what the action needs.

Risks and follow-up

No blocking risks. Two small things worth knowing:

1. This step is untested until a real release. ci.yml builds and smoke-tests the .mcpb bundle but never runs release.yml, which fires only on v* tags. So the first exercise of efb3536 will be the next actual release. If it fails, the fallback is a one-line revert to 3d0d988.
2. Node 24 pin upstream. The action pins its own runtime to Node 24; release.yml already runs node-version: '24', and the action's runtime is independent of the job's setup-node anyway. No interaction with the repo's engines.node floor.

No code, tests, or docs need updating. Approving isn't something I can do, but from a review standpoint this is clean.
• Branch