Bump fizyk/actions-reuse/.github/workflows/shared-pre-commit.yml from 5.2.7 to 5.4.1

[dependabot]

Bumps fizyk/actions-reuse/.github/workflows/shared-pre-commit.yml from 5.2.7 to 5.4.1.

Changelog

Sourced from fizyk/actions-reuse/.github/workflows/shared-pre-commit.yml's changelog.

Changelog

.. towncrier release notes start

actions-reuse 5.5.0 (2026-08-17)

Features

• Audit the workflows and composite actions with zizmor <https://docs.zizmor.sh/>__ on every pre-commit run. Its unpinned-uses policy allows tag references into fizyk/actions-reuse itself - a hash pin cannot name the commit that carries it - and requires a hash everywhere else; every other suppression sits inline next to the code it excuses. ([#313](https://github.com/fizyk/actions-reuse/issues/313) <https:/github.com/fizyk/actions-reuse/issues/313>__)
• Mint shared-release's app token with just Contents: write, Workflows: write and Metadata: read instead of the whole installation's permissions, and declare permissions on the workflows in this repository. The release caller only needs contents: read now, as the bump commit and the tag have always been pushed with the app token; the documented snippet was updated accordingly. Inputs that name a path, a Python version or a step output reach their shell through the environment rather than through template expansion; the command and install-option inputs stay expanded, as callers rely on shell syntax inside them. shared-release now refuses a version that is not one ([0-9A-Za-z.+-]) before minting the app token, as that input reaches tbump through a shell command.

Deprecations and Removals

• Drop the pipenv install --editable . step and the inputs that drove it: editable on the pipenv and pipenv-setup actions, install_editable on shared-tests-pytests. A Pipfile says the same thing by itself - <project> = {path = ".", editable = true} under [packages] - so the input only duplicated it. Callers still passing it have to drop the line: a reusable workflow rejects an input it does not declare.

Misc

• [#330](https://github.com/fizyk/actions-reuse/issues/330) <https:/github.com/fizyk/actions-reuse/issues/330>__

actions-reuse 5.4.1 (2026-08-13)

No significant changes.

actions-reuse 5.4.0 (2026-08-13)

Features

• Move shared-release-schedule's version planning into the new release-plan composite action, which asks towncrier what a newsfragment is instead of imitating it with globs. The fragments directory and the fragment types come from the repository's own towncrier configuration, and every name towncrier accepts counts - custom types, sections, markdown, the counter form and extension-less fragments alike. ([#316](https://github.com/fizyk/actions-reuse/issues/316) <https:/github.com/fizyk/actions-reuse/issues/316>__)
• Make shared-release-schedule bump levels configurable through minor-fragments and major-fragments, both taking their previous behaviour as defaults. Previously only feature raised the minor and nothing raised the major, so a break fragment released as a patch. On a pre-1.0 project list the breaking type under minor-fragments and leave major-fragments empty.
• Support triggering shared-automerge on pull_request_target, which is now the preferred trigger.

... (truncated)

Commits

• ae61774 Bump to 5.4.1
• 7dd881d Merge pull request #321 from fizyk/dependabot/github_actions/dot-github/actio...
• 3071ff5 Merge pull request #320 from fizyk/dependabot/github_actions/dot-github/actio...
• 993fba1 Merge pull request #319 from fizyk/dependabot/github_actions/dot-github/actio...
• ced3bd8 Bump the cache group across 1 directory with 2 updates
• 42f67b6 Bump actions/checkout
• 6f703fe Bump the setup-python group across 3 directories with 1 update
• 534831f Re-group dependabot
• bb9149f Bump to 5.4.0
• c596a88 Release schedule version planning in python - closes #316
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)