build(deps): bump c-hive/gha-remove-artifacts from 1.4.0 to 1.8.0

[dependabot]

Bumps c-hive/gha-remove-artifacts from 1.4.0 to 1.8.0.

Release notes

Sourced from c-hive/gha-remove-artifacts's releases.

v1.8.0

Enhancements:

• New skip-recent-commits input keeps every artifact of the N most recent commits, regardless of how many artifacts each commit produced. Applied before skip-recent, so the two can be combined. Fixes #28
• GITHUB_TOKEN can now be set on both env: and with: (for example when it is exported for all steps) without the action failing. The input takes precedence. Fixes #48

v1.7.0

Enhancements:

• New dry-run input: logs which artifacts would be removed without deleting anything.
• Stricter input validation. age now rejects fractional amounts and units that are not durations (for example 30 D, which moment silently treated as zero); skip-recent and max-retries must be non-negative integers. Previously such values could make every artifact eligible for deletion.
• Artifacts without commit information are reported separately from tagged ones when skip-tags is on.

Maintenance:

• Rewritten in TypeScript under src/, bundled with esbuild
• Unit tests for input parsing and the cleanup plan, plus end-to-end tests against a mock GitHub API covering deletion, rate limit retries and failure handling
• CI split into lint, typecheck, test, build and run jobs
• Dropped dependencies: yn, dotenv-safe, cross-env, eslint-plugin-import

v1.6.0

Enhancements:

• Artifacts are now listed repo-wide instead of per workflow run. This cuts API requests by roughly two orders of magnitude and removes the hardcoded 90-day window, so artifacts on repositories with longer retention are now cleaned up too. Fixes #62
• A failed deletion no longer aborts the run: remaining artifacts are still processed and the action fails at the end with a count.
• With skip-tags, artifacts without commit information are kept rather than deleted.
• The log ends with a summary of removed and skipped artifacts. Fixes #21

Maintenance:

• CI checks that dist/ matches the source instead of auto-committing it
• Removed CodeQL workflow, pre-commit hooks and eslint-plugin-import
• Dependency purposes documented in package.json

v1.5.0

Enhancements:

• New max-retries input caps how often a rate-limited request is retried before the action fails. Default: 5. Previously requests were retried indefinitely; set a larger value to keep the old behaviour. Fixes #36, #49, #51
• Action runtime updated to Node 24 (#63)

Maintenance:

• All dependencies upgraded (@actions/core 3, @octokit/action 8, @octokit/plugin-throttling 11, moment 2.30). pnpm audit reports no known vulnerabilities.
• Source converted to ESM, bundled with @vercel/ncc
• Tooling: pnpm, ESLint 10, Prettier 3, CI on Node 24
• Docs: action.yml description, updated retention docs link

Commits

• 62c2fbe Bump version to 1.8.0
• 449a616 Add skip-recent-commits input and accept GITHUB_TOKEN from env and input
• 4bff157 Bump version to 1.7.0
• a52e55e Add end-to-end tests against a mock GitHub API
• 03f14e2 Simplify config parsing, logging and tsconfig
• 04de7b0 Address review findings on the TypeScript rewrite
• 8b74b1b Rewrite in TypeScript, add tests, merge CI workflows
• 73aaf4a Bump version to 1.6.0
• c4da97c Ignore CLAUDE.local.md
• 614c11c Describe each dependency in package.json
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[hanthor]

Reviewed in a sweep of PRs open more than two days. This one has been open 11 days with CI red.

Failing required check(s): Required Checks: Test, check.

Requesting changes rather than closing — the change itself may well be fine, and nothing here is stale enough to discard. But it cannot merge in this state, and a red PR that nobody is looking at is indistinguishable from an abandoned one after a while.

If the failure is not caused by this PR — a broken base branch or shared CI problem — say so here and it should be treated as infrastructure rather than left against this change.

[hanthor]

Superseded by #77. Verified identical patch: both bump c-hive/gha-remove-artifacts v1.4.0 to v1.8.0 in clean-artifacts.yml (same pin SHA 62c2fbe). Keeping #77 (fresher base: 2 behind ptyxis-port vs 4 behind here). Note: duplicate exists because both Renovate and Dependabot are enabled for GitHub Actions updates.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.