chore(deps): bump stablekernel/cascade from 0.1.0 to 0.3.0

[dependabot]

Bumps stablekernel/cascade from 0.1.0 to 0.3.0.

Release notes

Sourced from stablekernel/cascade's releases.

v0.3.0

Changelog

• 5444162: fix: reap superseded rc tags at publish time (#265) (@​joshua-temple)

v0.3.0-rc.26

Changelog

• 5444162: fix: reap superseded rc tags at publish time (#265) (@​joshua-temple)

v0.3.0-rc.25

Changelog

• b8ef53e: fix: complete hotfix-rejoin cleanup for published releases (#264) (@​joshua-temple)

v0.3.0-rc.24

⚠️ Breaking Changes

• remove inline run callback emission path #161 — @​joshua-temple

e2e

• add hotfix runner step actions and expectation surface #115 — @​joshua-temple
• plumb act event payload and env/* branch fetch #112 — @​joshua-temple

generate

• emit cascade-hotfix workflow for multi-env repos #106 — @​joshua-temple

git

• add IsAncestor, BranchExists, and RemoteBranchSHA helpers #99 — @​joshua-temple

hotfix

• add finalize verb writing diverged state, tag, and release #104 — @​joshua-temple

promote

• rejoin and clean up diverged envs on inbound promotion #105 — @​joshua-temple

• guard promotion against diverged environments #102 — @​joshua-temple

• default release_token to state_token to arm the rc-to-release chain #258 — @​joshua-temple

• emit least-privilege top-level workflow permissions #251 — @​joshua-temple

• elevate a hotfix commit set across the env chain in the generated workflow #248 — @​joshua-temple

• plan multi-commit hotfix elevation across the env chain #246 — @​joshua-temple

• add cascade plan command to preview workflow diffs #243 — @​joshua-temple

• add repository_dispatch trigger to the rollback workflow #242 — @​joshua-temple

• emit native GitHub Deployment objects for promotions #241 — @​joshua-temple

• support GitHub App token sources for state and release tokens #240 — @​joshua-temple

• emit environments.json from the manifest #239 — @​joshua-temple

• emit branch-protection.json from the manifest #238 — @​joshua-temple

• complete cascade init starter scaffold #237 — @​joshua-temple

... (truncated)

Changelog

Sourced from stablekernel/cascade's changelog.

Changelog

All notable changes to this project are documented in this file.

The format is based on Keep a Changelog. The manifest schema is versioned with a single integer schema_version; the schema-version compatibility policy is documented in https://github.com/stablekernel/cascade/blob/main/docs/versioning.md. A Migration section is added to any release that bumps schema_version.

[Unreleased]

[0.2.0] - 2026-06-18

This release restructures the orchestrate gate chain so build, deploy, and promote callbacks run in a deterministic dependency order, adds deploy-on-update so external-update events can drive a deploy directly, and hardens workflow generation (deterministic output, cross-repo reusable-workflow resolution, and stricter callback validation).

Added

• cascade rollback command: re-promotes a prior recorded version for a given deployable, reading version history from the manifest state store. (#69)
• GHA artifact passing between build jobs in a single orchestrate run: build and deploy callbacks may declare an artifact: block with upload and downloads sub-keys; the generator emits actions/upload-artifact and actions/download-artifact steps automatically. (#68)
• Per-deployable version recorded on promote finalize: the manifest state now tracks which version of each deployable is live per environment, making cascade status and rollback reliable. (#67)
• Per-callback runs_on, permissions (including OIDC id-token), and concurrency on inline-run jobs. (#66)
• cascade status subcommands for read-only state inspection: per-environment summary, per-deployable detail, and raw JSON output. (#61)
• strategy.matrix on build jobs in the orchestrate workflow: build callbacks that declare matrix: get a GHA strategy: block; max-parallel and fail-fast are emitted when non-zero/non-default. (#60)
• extra_triggers on the orchestrate workflow: schedule, repository_dispatch, workflow_run, and merge_group triggers are wired from the manifest. (#57)
• concurrency blocks on promote, release, and external-update workflows. (#55)
• schema_version field on the manifest (ci.config.schema_version). The CLI reads it on load and enforces a compatibility contract: a manifest written for a newer schema than the CLI understands is rejected (upgrade the CLI), a manifest below the supported minimum is rejected (migrate), and a manifest that omits the field is accepted with a warning. parse-config surfaces non-fatal advisories in a new warnings field on its JSON output. (#43, #63)
• docs/versioning.md describing the schema-version compatibility policy, the schema-version to CLI-version matrix, and the deprecation window.
• Inline run callbacks: cascade-owned callback jobs may use run: / shell:

... (truncated)

Commits

• 5444162 fix: reap superseded rc tags at publish time (#265)
• ec0f92c chore: update state [skip ci]
• b8ef53e fix: complete hotfix-rejoin cleanup for published releases (#264)
• fce0b6f chore: update state [skip ci]
• e80a351 chore: update state [skip ci]
• 3f1e95b docs: describe multi-commit, multi-env hotfix chains (#263)
• 1f4244a test(e2e): raise TestActRunner_Start deadline to 5m for cold image pulls (#262)
• 211ec11 chore: update state [skip ci]
• 7a2166c fix: retry manifest state writes on contents API 409 conflicts (#261)
• d89a055 chore: update state [skip ci]
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Workflow drift detected

The generated workflows are out of sync with the manifest.

To fix, run and commit the result:

cascade generate-workflow --config .github/manifest.yaml --force

cascade verify output

~ .github/workflows/orchestrate.yaml
~ .github/workflows/promote.yaml

2 file(s) drifted. Run `cascade generate-workflow` and commit the result.
Error: workflow drift detected
workflow drift detected

[joshua-temple]

Closing: this edits orchestrate.yaml and promote.yaml, which are generated (AUTO-GENERATED by cascade - DO NOT EDIT MANUALLY), so the bump would be reverted by the next regeneration. The setup-cli reference there is cascade's own action, emitted by the generator via getCLIRef() which tracks cli_version; it is not a Dependabot-managed third-party action, and v0.3.0 is already behind the current release line. cascade SHA-pins third-party actions via pin_mode: sha; pinning its own setup-cli is a separate deliberate choice. No action needed here.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.