Bump the github-actions group with 2 updates

[dependabot]

Bumps the github-actions group with 2 updates: azure/login and anthropics/claude-code-action.

Updates azure/login from 3.0.0 to 3.0.1

Release notes

Sourced from azure/login's releases.

Azure Login Action v3.0.1

What's Changed

• Escape single quotes in PowerShell login script inputs by @​MaddyMicrosoft in Azure/login#599

Full Changelog: https://github.com/Azure/login/commits/v3.0.1

Commits

• f5d393a Merge remote-tracking branch 'origin/master' into releases/v3.0.1
• e8cd11f Replacing hardcoded version v2 with v3 (#603)
• 73730b8 prepare release v3.0.1
• f4dcb80 Escape single quotes in PowerShell login script inputs (#599)
• e82415a Add IDE files to .gitignore (#597)
• a842007 Update CODEOWNERS (#598)
• 9dfca58 use the latest auzre/powershell@v3 (#581)
• See full diff in compare view

Updates anthropics/claude-code-action from 1.0.183 to 1.0.187

Release notes

Sourced from anthropics/claude-code-action's releases.

v1.0.187

What's Changed

• Redact common credential patterns from published run output by @​ashwin-ant in anthropics/claude-code-action#1595
• Scope the config snapshot to files inside the working tree by @​ashwin-ant in anthropics/claude-code-action#1596
• Run checkout auth cleanup when API commit signing is enabled by @​ashwin-ant in anthropics/claude-code-action#1597

Full Changelog: anthropics/claude-code-action@v1...v1.0.187

v1.0.186

What's Changed

• Invoke the formatter directly from the format hook by @​ashwin-ant in anthropics/claude-code-action#1594

Full Changelog: anthropics/claude-code-action@v1...v1.0.186

v1.0.185

What's Changed

• Derive trigger timestamps for issues and pull_request events by @​ashwin-ant in anthropics/claude-code-action#1592
• Pin bun config for MCP server processes by @​ashwin-ant in anthropics/claude-code-action#1589
• Match downloaded images to their source URLs by asset identifier by @​ashwin-ant in anthropics/claude-code-action#1588
• Check collaborator permissions for workflow_run events by @​ashwin-ant in anthropics/claude-code-action#1590

Full Changelog: anthropics/claude-code-action@v1...v1.0.185

v1.0.184

Full Changelog: anthropics/claude-code-action@v1...v1.0.184

Commits

• 1623c36 chore: bump Claude Code to 2.1.224 and Agent SDK to 0.3.224
• 96e281f Run checkout auth cleanup when API commit signing is enabled (#1597)
• e1fc925 Scope the config snapshot to files inside the working tree (#1596)
• 0aee57a Redact common credential patterns from published run output (#1595)
• c038e4d chore: bump Claude Code to 2.1.223 and Agent SDK to 0.3.223
• 4c04887 Invoke the formatter directly from the format hook (#1594)
• 9db594c chore: bump Claude Code to 2.1.222 and Agent SDK to 0.3.222
• acb0385 Check collaborator permissions for workflow_run events (#1590)
• b80a0f0 Match downloaded images to their source URLs by asset identifier (#1588)
• 6fb6bb6 Pin bun config for MCP server processes (#1589)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[potatoqualitee]

@claude a prior commit was supposed to fix this, that if the tokens arent available for dependabot then dont run the test

[claude]

Claude finished @potatoqualitee's task in 4m 6s —— View job

---

Investigated the Azure Migration Tests failure

• Gather context on the request
• Investigate whether a "skip test if tokens unavailable for dependabot" fix exists for this workflow
• Determine why CI is failing for this dependabot PR
• Report findings

What's happening

CI for this PR is 9/10 green — the one failure is Run Azure Migration Tests, failing at the "Authenticate existing Azure CI identity" step (.github/workflows/azure-migration-tests.yml:125-128):

##[error]Login failed with Error: Using auth-type: SERVICE_PRINCIPAL. Not all values are present.
Ensure 'client-id' and 'tenant-id' are supplied.

secrets.VMSS_AZURE_CREDENTIALS came through empty. This is expected: GitHub does not forward repository Actions secrets to workflow runs authored by dependabot[bot] (only secrets explicitly configured as Dependabot secrets are available to it), so any job that needs real Azure credentials will always fail this way on a dependabot push.

This workflow triggers here specifically because its paths: list includes .github/workflows/azure-migration-tests.yml itself (line 20) — and this PR's version bump touches that exact line via the azure/login pin update, so the heavy Azure integration job runs even though nothing test-relevant changed.

About the "prior commit" fix

I checked the current azure-migration-tests.yml and every related workflow (ci-azure.yml, ci-azure-supersede.yml, integration-tests*.yml, gallery.yml, xplat-import.yml) for an actor/secret guard (github.actor != 'dependabot[bot]', empty-secret check, etc.). No such guard exists in any of them today. The fix you're recalling did land in ci-azure.yml (its authorize job governs the self-hosted maintainer/community pool routing — that's why ci-azure [pool:dependabot[bot]] shows green above), but that's a different workflow with different needs; it doesn't touch cloud secrets. azure-migration-tests.yml never received an equivalent guard, so it still hard-fails for dependabot pushes.

Why I haven't pushed a fix

Editing files under .github/workflows/ is outside what my GitHub App permissions allow. The change needed is small — add a job-level condition so the job is skipped (not failed) when the actor is dependabot[bot], consistent with the actor-check style already used in claude-code-review.yml:13 and runner-boost.yml:18:

jobs:
  azure-migration-tests:
    if: github.actor != 'dependabot[bot]'
    env:
      SMODefaultModuleName: dbatools
    runs-on: ubuntu-latest
    timeout-minutes: 75

That one-line addition to .github/workflows/azure-migration-tests.yml (right after the azure-migration-tests: job key, alongside the existing env:/runs-on:/timeout-minutes: lines) would resolve this for future dependabot GitHub Actions bumps. Someone with workflow-write permission will need to apply it directly.