build(deps): bump slackapi/slack-github-action from 2.1.1 to 3.0.1

[dependabot]

Bumps slackapi/slack-github-action from 2.1.1 to 3.0.1.

Release notes

Sourced from slackapi/slack-github-action's releases.

Slack GitHub Action v3.0.1

What's Changed

Alongside the breaking changes of @v3.0.0 and a new technique to run Slack CLI commands, we tried the wrong name to publish to the GitHub Marketplace 🐙 This action is now noted as The Slack GitHub Action in listings 🎶 ✨

🎨 Maintenance

• chore: use a unique title for marketplace in slackapi/slack-github-action#576 - Thanks @​zimeg!
• chore(release): tag version 3.0.1 in slackapi/slack-github-action#577 - Thanks @​zimeg!

Full Changelog: slackapi/slack-github-action@v3.0.0...v3.0.1

Slack GitHub Action v3.0.0

The @v3.0.0 release had a hiccup on publish and we recommend using @​v3.0.1 or a more recent version when updating! Oops!

🎽 Running Slack CLI commands and the active Node runtime, both included in this release 👟 ✨

⚠️ Breaking change: Node.js 24 the runtime

This major version updates the GitHub Actions required runtime to Node.js 24. Most GitHub-hosted runners already include this, but self-hosted runners may need to be updated ahead of planned deprecations of Node 20 on GitHub Actions runners.

📺 Enhancement: Run Slack CLI commands

This release introduces a new technique for running Slack CLI commands directly in GitHub Actions workflows. Use this to install the latest version (or a specific one) of the CLI and execute commands like deploy for merges to main, manifest validate with tests, and other commands.

Gather a token using the following CLI command to store with repo secrets, then get started with an example below:

$ slack auth token

🧪 Validate an app manifest on pull requests

Check that your app manifest is valid before merging changes:

🔗 https://docs.slack.dev/tools/slack-github-action/sending-techniques/running-slack-cli-commands/validate-a-manifest

- name: Validate the manifest
  uses: slackapi/slack-github-action/cli@v3.0.0
  with:
    command: "manifest validate --app ${{ vars.SLACK_APP_ID }}"
    token: ${{ secrets.SLACK_SERVICE_TOKEN }}

🚀 Deploy your app on push to main

Automate deployments whenever changes land on your main branch:

🔗 https://docs.slack.dev/tools/slack-github-action/sending-techniques/running-slack-cli-commands/deploy-an-app

... (truncated)

Commits

• af78098 Release
• add1a00 chore(release): tag version 3.0.1 (#577)
• 2bc9e7a chore: use a unique title for marketplace (#576)
• c5d43da chore(release): tag version 3.0.0 (#575)
• 963b979 build(deps): bump @​slack/web-api from 7.14.1 to 7.15.0 (#574)
• 90b7328 build(deps): bump @​slack/logger from 4.0.0 to 4.0.1 (#573)
• e45cb89 feat: support slack cli commands with composite action inputs (#560)
• 0aed2c2 build(deps): bump https-proxy-agent from 7.0.6 to 8.0.0 (#572)
• 4795f96 build(deps-dev): bump sinon from 21.0.1 to 21.0.2 (#571)
• bd9e2ce build(deps): bump actions/setup-node from 6.2.0 to 6.3.0 (#569)
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[vroldanbet]

Added a follow-up commit to SHA-pin this action to the immutable commit behind v3.0.1 (af78098f536edbc4de71162a307590698245be95), matching the convention every other action in release.yml already uses.

Rationale: this workflow has access to the GPG release-signing key and the Slack webhook, so a mutable @v3.0.1 tag is a supply-chain risk — a poisoned/moved upstream tag would run with those secrets. Pinning to the SHA removes that exposure.

Verified: v3.0.1 tag resolves to that exact SHA upstream; the only v3 breaking change is the Node.js 24 runtime, which ubuntu-latest already provides, and the webhook/incoming-webhook usage is unchanged.

[dependabot]

A newer version of slackapi/slack-github-action exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged.