[pelikhan]

Apply pending Dependabot npm updates only where the exact releases and their required platform packages are available in the Microsoft 1ES public feed.

• Bump @github/copilot-sdk from 1.0.26 to 1.0.28, including all eight platform packages, from build(deps-dev): bump @github/copilot-sdk from 1.0.26 to 1.0.28 in /actions/setup/js #74491.
• Bump @types/node from 26.6.5 to 26.6.6 from build(deps-dev): bump @types/node from 26.6.5 to 26.6.6 in /actions/setup/js #74480.
• Preserve the existing dependency ranges and npmjs lockfile URLs; use 1ES only through command-scoped registry settings.

The minimatch PRs are excluded because required releases are missing from 1ES. The docs updates are already present, and non-npm updates are outside this change.

Validation

• Installed the locked dependencies successfully through the 1ES public feed.
• make agent-report-progress passed.
• TypeScript type checking passed.
• Five focused Copilot SDK suites passed: 606 tests.

Relates to #74491 and #74480.

[github-actions]

✅ Design Decision Gate 🏗️ completed the design decision gate check. See the comment below for the result and any generated ADR draft.

Design Decision Gate 🏗️

Outcome: reported_no_action

The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible.

Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.

Generated from Design Decision Gate 🏗️ · routed: opus55 medium · ~12 AIC · ⌖ ~2 AIC · ⊞ 7.7K · ◷

🏗️ ADR gate enforced by Design Decision Gate 🏗️

[github-actions]

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer

[github-actions]

✅ PR Code Quality Reviewer completed the code quality review.

🔎 Code quality review by PR Code Quality Reviewer

[github-actions]

✅ Test Quality Sentinel completed test quality analysis.

Test Quality Sentinel

Outcome: reported_no_action

The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible.

Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.

Generated from Test Quality Sentinel · routed: gpt56 max · ~1 AIC · ⌖ ~1 AIC · ⊞ 6.3K · ◷

🧪 Test quality analysis by Test Quality Sentinel

[github-actions]

✅ Ponytail Reviewer completed successfully!

Ponytail Reviewer

Outcome: reported_no_action

The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible.

Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.

Generated from Ponytail Reviewer · routed: gpt56 max · ~2 AIC · ⌖ ~1 AIC · ⊞ 118 · ◷

Generated by Ponytail Reviewer for #74953

[Copilot]

🟢 Approval recommended

The manifest and lockfile consistently capture the updated dependency versions, URLs, and integrity hashes.

No open issues 🎉

1 file not reviewed

• actions/setup/js/package-lock.json: Generated file

What changed in this PR

Updates actions/setup/js development dependencies to releases available through the Microsoft 1ES public feed, while preserving existing dependency ranges and npmjs lockfile URLs.

Changes:

• Bumps @github/copilot-sdk from 1.0.26 to 1.0.28, including all eight platform packages.
• Bumps @types/node from 26.6.5 to 26.6.6.
• Synchronizes dependency metadata, resolved URLs, and integrity hashes in the manifest and lockfile.

File	Description
actions/​setup/​js/​package.json	Updates the declared Copilot SDK and Node.js type dependency versions.
actions/​setup/​js/​package-lock.json	Locks the updated SDK, platform packages, and Node.js types with matching metadata and integrity hashes.

_{Review effort: Lite (auto)}

[github-actions]

🎉 This pull request is included in a new release.

Release: v1.2.0