TPT-4593: Miscellaneous updates

.github/dependabot.yml

@@ -0,0 +1,8 @@
+# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"

.github/workflows/clean-release-notes.yml

@@ -12,7 +12,7 @@ jobs:
 
     steps:
       - name: Remove ticket prefixes from release notes
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         with:
           script: |
             const release = context.payload.release;

.github/workflows/dependency-review.yml

@@ -10,8 +10,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 'Checkout repository'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
       - name: 'Dependency Review'
-        uses: actions/dependency-review-action@v4
+        uses: actions/dependency-review-action@v5
         with:
           comment-summary-in-pr: on-failure

.github/workflows/labeler.yml

@@ -19,10 +19,10 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
       -
         name: Run Labeler
-        uses: crazy-max/ghaction-github-labeler@de749cf181958193cb7debf1a9c5bb28922f3e1b
+        uses: crazy-max/ghaction-github-labeler@548a7c3603594ec17c819e1239f281a3b801ab4d # pin@v6.0.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           yaml-file: .github/labels.yml

.github/workflows/test.yml

@@ -6,7 +6,7 @@ jobs:
     name: Test the action with a setup token
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v7
       - name: Install the Linode CLI
         uses: ./
         with:
@@ -19,7 +19,7 @@ jobs:
     name: Test the action without a setup token
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v7
       - name: Install the Linode CLI
         uses: ./
       - name: Run an authenticated command
@@ -32,7 +32,7 @@ jobs:
     name: Test the action with an explicit version
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v7
       - name: Install the Linode CLI
         uses: ./
         with:
@@ -46,7 +46,7 @@ jobs:
     name: Test the action with optional dependencies
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v7
       - name: Install the Linode CLI
         uses: ./
         with:
@@ -62,7 +62,7 @@ jobs:
     name: Test the action with upgrade disabled
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v7
       - name: Install the Linode CLI
         uses: ./
         with:

.gitignore

@@ -0,0 +1 @@
+.DS_Store

AGENTS.md

@@ -0,0 +1,26 @@
+# Agent Instructions
+
+## Repository Shape
+
+- This repository publishes a composite GitHub Action. Runtime behavior lives in [action.yml](action.yml); there is no source tree or generated build artifact.
+- Treat [README.md](README.md) as the user-facing contract and [CONTRIBUTING.md](CONTRIBUTING.md) as the general contribution guide.
+- The action supports Ubuntu-based runners. Do not imply macOS or Windows support without adding and passing coverage for those platforms.
+
+## Editing Rules
+
+- Treat action inputs and GitHub context values as untrusted. Never interpolate `${{ inputs.* }}` or `${{ github.* }}` directly into a `run:` script. Bind expressions through step-level `env:` entries, then reference shell variables with appropriate quoting or validation.
+- Keep token masking before every other use of the token, and never print secret values.
+- When adding or changing an input or runtime behavior, update [action.yml](action.yml), the relevant argument or example in [README.md](README.md), and coverage in [.github/workflows/test.yml](.github/workflows/test.yml) together.
+- Preserve the existing composite-action and Bash style. Keep changes focused and avoid unrelated formatting churn.
+
+## Validation
+
+- There is no local build, unit-test, or lint command. The integration jobs in [.github/workflows/test.yml](.github/workflows/test.yml) are the executable test suite and run only on pushes.
+- Tests invoke the checked-out action with `uses: ./` on `ubuntu-latest`. Authenticated scenarios require the repository's `LINODE_TOKEN` secret and network access.
+- Add or adjust a focused integration scenario for each changed input path or installation mode.
+
+## Pull Requests
+
+- Target the default release branch, `v1`.
+- PR titles must match `TPT-<number>: <subject>` unless an exemption label listed in [.github/workflows/validate-pr-title.yml](.github/workflows/validate-pr-title.yml) applies. Obtain a Jira ticket or explicit approval before creating a PR without that prefix.
+- Follow [.github/pull_request_template.md](.github/pull_request_template.md) and keep each PR limited to one feature or fix.

README.md

@@ -12,7 +12,7 @@ This GitHub Action exposes the following arguments:
 
 | Name            | Required | Default | Description                                                                                                                                                                       |
 |-----------------|----------|---------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `token`         | No       | None    | The [Linode Personal Access Token](https://www.linode.com/docs/products/tools/api/guides/manage-api-tokens/) to authenticate the CLI with.                                        |
+| `token`         | No       | None    | The [Linode Personal Access Token](https://www.linode.com/docs/products/tools/api/guides/manage-api-tokens/) to authenticate the CLI with. Must not contain carriage returns or newlines. |
 | `version`       | No       | latest  | The version of the Linode CLI to install.                                                                                                                                         |
 | `setup-python`  | No       | true    | If true, Python will automatically be installed on the runner. If false, users are expected to have a functioning Python installation on their runner before running this action. | 
 | `upgrade`       | No       | true    | If true, Linode CLI and its dependencies will be automatically upgraded. (--upgrade)                                                                                              |

action.yml

@@ -6,7 +6,7 @@ branding:
   color: 'orange'
 inputs:
   token:
-    description: 'The Linode API Personal Access Token to authenticate with.'
+    description: 'The Linode API Personal Access Token to authenticate with. Must not contain carriage returns or newlines.'
   version:
     description: 'The Linode CLI version to install.'
     default: latest
@@ -24,10 +24,20 @@ runs:
   steps:
     - name: Mask the input token
       shell: bash
-      run: echo "::add-mask::${{ inputs.token }}"
+      env:
+        TOKEN: ${{ inputs.token }}
+      run: |
+        if [ -z "${TOKEN}" ]; then
+          exit 0
+        fi
+        # Match actions/toolkit escapeData(): %, \r, \n
+        MASK_VALUE="${TOKEN//%/%25}"
+        MASK_VALUE="${MASK_VALUE//$'\r'/%0D}"
+        MASK_VALUE="${MASK_VALUE//$'\n'/%0A}"
+        echo "::add-mask::${MASK_VALUE}"
 
     - name: Setup Python 3
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v7
       if: ${{ inputs.setup-python == 'true' }}
       with:
         python-version: '3.x'
@@ -66,13 +76,20 @@ runs:
         UPGRADE: ${{ inputs.upgrade }}
 
     - name: Install the Linode CLI
-      run: pip3 install ${{ env.pip_args }}linode-cli${{ env.version_extension }}
+      run: pip3 install ${pip_args}"linode-cli${version_extension}"
       shell: bash
 
     - name: Expose the Linode Token to the runner environment
       if: ${{ inputs.token != '' }}
       shell: bash
-      run: echo "LINODE_CLI_TOKEN=${{ inputs.token }}" >> "$GITHUB_ENV"
+      env:
+        TOKEN: ${{ inputs.token }}
+      run: |
+        if [[ "${TOKEN}" == *$'\n'* || "${TOKEN}" == *$'\r'* ]]; then
+          echo "::error::token must not contain carriage returns or newlines"
+          exit 1
+        fi
+        echo "LINODE_CLI_TOKEN=${TOKEN}" >> "${GITHUB_ENV}"
 
     - name: Validate the CLI is installed
       if: ${{ inputs.token != '' }}