chore(deps): update deploy-pages action to 5.0.1

[steipete]

Update the immutable actions/deploy-pages pin from 5.0.0 to 5.0.1. This patch release adds bounded backoff and jitter to deployment-status polling and validates the polling interval; our existing default inputs remain supported. The action runtime, permissions, and deployment triggers are unchanged.

The upstream release tag resolves to 368f82528645a54fb793d4d04e342629a3f51346. Reviewed the source and bundled runtime diff against 5.0.0. All other package, formatting, and Action release pins are current; Node 26 and the Swift 6.2/macOS 26 minimums remain in place.

Validation: Pages workflow lint, both docs-builder regression tests, and a full local docs-site build. No Pages deployment was triggered during this preparation.

Upstream: https://github.com/actions/deploy-pages/releases/tag/v5.0.1

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 4, 2026, 4:33 AM ET / 08:33 UTC.

ClawSweeper review

What this changes

Updates the action that publishes Swabble’s documentation to an immutable deploy-pages 5.0.1 commit and records the update in the changelog.

Merge readiness

✅ Ready for maintainer review

The update remains useful because current main still pins 5.0.0. No actionable introduced defect was found, and the collaborator’s follow-up addresses the earlier upstream-verification concern.

Priority: P3
Reviewed head: 2b971c89921b10d54cab5d0bd885b9a8ddcd00b1

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused maintenance update with compatible inputs, explicit upstream verification, and no actionable findings.
Proof confidence	🌊 off-meta tidepool	Not applicable: The changed owner is the Pages deployment action; the body explicitly reports no deployment run, so docs builds and CI do not prove its polling behavior. The collaborator-authored PR is exempt from the ordinary real-setup proof gate, and no material authority change was identified.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: The changed owner is the Pages deployment action; the body explicitly reports no deployment run, so docs builds and CI do not prove its polling behavior. The collaborator-authored PR is exempt from the ordinary real-setup proof gate, and no material authority change was identified.
Evidence reviewed	8 items	Verified introduced scope: The pinned merge-base-to-head comparison contains only the deployment-action pin replacement and one changelog addition. Still absent from main: Fetched main uses deploy-pages commit cd2ce8fcbc39b97be8ca5fce6e763baed58fa128, annotated 5.0.0. No shipped Swabble release containing this update was established. Dependency and permission boundary: The workflow directly executes actions/deploy-pages, making that dependency’s runtime contract relevant. The diff preserves the existing triggers, GitHub Pages environment, token permissions, artifact path, and default action inputs.
Findings	None	None.
Security	None	None.

How this fits together

Swabble’s Pages workflow builds the public documentation, uploads the generated site, and deploys it through GitHub Pages. The updated action submits the deployment and polls its status.

flowchart LR
  A[Documentation changes or manual run] --> B[Build documentation site]
  B --> C[Upload site artifact]
  C --> D[Pinned Pages deployment action]
  D --> E[Poll deployment status]
  E --> F[Published site or failure result]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

None.

Technical review

Best possible solution:

Keep the existing Pages workflow and adopt the compatible upstream patch through its immutable commit pin.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is dependency maintenance, and no Swabble failure is claimed or reproduced.

Is this the best way to solve the issue?

Yes: replacing the existing immutable pin is the narrowest integration, and the collaborator explicitly verified upstream default-input compatibility.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning high; reviewed against 0268bbfd8a9d.

Labels

Label justifications:

• P3: This is a narrowly scoped documentation-deployment dependency update with no demonstrated urgent user-facing failure.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The changed owner is the Pages deployment action; the body explicitly reports no deployment run, so docs builds and CI do not prove its polling behavior. The collaborator-authored PR is exempt from the ordinary real-setup proof gate, and no material authority change was identified.

Evidence

What I checked:

• Verified introduced scope: The pinned merge-base-to-head comparison contains only the deployment-action pin replacement and one changelog addition. (.github/workflows/pages.yml:42, 2b971c89921b)
• Still absent from main: Fetched main uses deploy-pages commit cd2ce8fcbc39b97be8ca5fce6e763baed58fa128, annotated 5.0.0. No shipped Swabble release containing this update was established. (.github/workflows/pages.yml:42, 0268bbfd8a9d)
• Dependency and permission boundary: The workflow directly executes actions/deploy-pages, making that dependency’s runtime contract relevant. The diff preserves the existing triggers, GitHub Pages environment, token permissions, artifact path, and default action inputs. (.github/workflows/pages.yml:42, 2b971c89921b)
• Upstream verification supplied in discussion: The collaborator’s follow-up reports that the official tag API and git ls-remote both resolve 5.0.1 to the proposed pin, and that source plus bundled runtime were reviewed for polling changes and default-input compatibility. See chore(deps): update deploy-pages action to 5.0.1 #13 (comment). Independent API access failed in this review environment; this is a reviewer limitation, not missing contributor evidence.
• Re-review continuity: The deployment workflow is unchanged from the earlier reviewed head. The prior review had no findings; its upstream-access concern received an explicit collaborator response. The captured body reports workflow lint, two docs-builder tests, and a local site build, while expressly stating that no Pages deployment ran. (.github/workflows/pages.yml:42, 2b971c89921b)
• Verified merge result: The test merge’s raw parents are the pinned main followed by the exact PR head. Comparing its result with main preserves the same two-file scope. (.github/workflows/pages.yml:42, 5d8818cde39a)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (1 earlier review cycle)

• reviewed 2026-09-04T08:02:12.009Z sha fdc68f2 :: blocked before merge. :: none

[steipete]

Independently verified the upstream dependency to address the review's network-access limitation. Both the official GitHub tag API and git ls-remote resolve v5.0.1 to 368f82528645a54fb793d4d04e342629a3f51346, exactly matching this PR's immutable pin.

Sources: official release, tag reference, complete upstream diff.

Reviewed both src/internal/deployment.js and bundled dist/index.js: the patch adds bounded polling backoff/jitter and interval validation. Swabble keeps the default inputs, existing action runtime, permissions and triggers. The isolated P0–P2 review also verified the official pin and found no actionable issue. No deployment was triggered.

Final-head CI and all CodeQL analyses passed at fdc68f27f50a3e72d1f6a6542c78865fb4dcdcdb. This supplies the missing upstream evidence; no source correction is needed.