ci: bump signpath/github-action-submit-signing-request from 2 to 3

[dependabot]

Bumps signpath/github-action-submit-signing-request from 2 to 3.

Commits

• f6d0478 Build from - 7336bb524a08c99aa48ba5065b00095eb2b0e09e. Original commit messag...
• ef0ce19 Build from - 8ff04a5c1f8d21d18e1eb1fc41b698b425a83654. Original commit messag...
• a790881 Build from - 9c89d7e4aa8c240d6deba49c8e4f52910fd41288. Original commit messag...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies, github-actions. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[erikdarlingdata]

Dependabot bump of signpath/github-action-submit-signing-request from v2 → v3, single-line change in .github/workflows/release.yml. Base branch is dev — correct.

Diff of the action between v2 and v3 (verified against tags on SignPath/github-action-submit-signing-request):

• action.yml: connector-url default changed from https://githubactions.connectors.signpath.io to https://pipelineconnector.connectors.signpath.io/GitHubActions/GitHubCom. This is the only functional change.
• index.js: three core.info / core.error / core.startGroup string tweaks (rewording "SignPath GitHub Actions connector" → "SignPath Pipeline Connector" and "CI system validation" → "Build system validation") and the internal taskVersion constant bumped to 3.0.0. No behavioral impact.

What's good:

• All nine inputs used here (api-token, organization-id, project-slug, signing-policy-slug, artifact-configuration-slug, github-artifact-id, wait-for-completion, output-artifact-directory, wait-for-completion-timeout-in-seconds) are still defined in v3 with unchanged semantics.
• The 30-minute wait-for-completion-timeout-in-seconds override and the comment explaining it still apply.
• Signing failure still aborts the release before gh release create runs (release.yml:170ish), so a broken connector-url won't leave a half-published release.

Needs attention: see the inline comment on line 133 — v3's new default connector-url points at the Pipeline Connector, not the old GitHub Actions connector. Verify the SignPath organization has the Pipeline Connector configured before merging, or pin the old endpoint explicitly.

Nothing else changed: no src/ code, no XAML, no Avalonia controls, no PlanAnalyzer rules, no brushes, no tests needed.

---

Generated by Claude Code

[erikdarlingdata]

v3 changes the default connector-url — this is the only behavior change v2→v3 (everything else in the diff is log-string cosmetics and the taskVersion bump).

• v2 default: https://githubactions.connectors.signpath.io
• v3 default: https://pipelineconnector.connectors.signpath.io/GitHubActions/GitHubCom

This step doesn't set connector-url, so the action will start posting to the Pipeline Connector endpoint. If the PerformanceStudio SignPath organization / project was set up against the older GitHub Actions connector and hasn't been migrated to the Pipeline Connector, the next release will fail at "Sign Windows build" with a connector error.

Two options:

1. Confirm in the SignPath portal that the Pipeline Connector is configured for this org and the release-signing policy, then merge as-is.
2. Pin the old endpoint explicitly during migration by adding connector-url: 'https://githubactions.connectors.signpath.io' to with:, and drop the pin once migrated.

Ref: v2/v3 action.yml diff, signpath/github-action-submit-signing-request — the connector-url default: line is the only functional change.

---

Generated by Claude Code