build(deps): bump taiki-e/install-action from 2.87.2 to 2.87.8

[dependabot]

Bumps taiki-e/install-action from 2.87.2 to 2.87.8.

Release notes

Sourced from taiki-e/install-action's releases.

2.87.8

• Update shfmt@latest to 3.14.1.

• Update release-plz@latest to 0.3.162.

• Update protoc-gen-connect-openapi@latest to 0.26.0.

• Update dprint@latest to 0.57.4.

• Update cargo-llvm-cov@latest to 0.9.1.

• Update cargo-crap@latest to 0.5.0.

• Update cargo-binstall@latest to 1.23.0.

2.87.7

• Update wasm-bindgen@latest to 0.2.128.

• Update uv@latest to 0.12.10.

• Update tombi@latest to 1.5.2.

• Update rclone@latest to 1.75.1.

2.87.6

• Update rafn@latest to 0.1.6.

• Update editorconfig-checker@latest to 3.11.3.

• Update dprint@latest to 0.57.1.

• Update convco@latest to 0.7.2.

2.87.5

• Update vacuum@latest to 0.30.3.

• Update uv@latest to 0.12.9.

• Update typos@latest to 1.50.1.

• Update tombi@latest to 1.5.1.

• Update release-plz@latest to 0.3.161.

• Update prek@latest to 0.5.2.

• Update oxfmt@latest to 1.81.0.

• Update mise@latest to 2026.9.1.

... (truncated)

Changelog

Sourced from taiki-e/install-action's changelog.

[2.87.8] - 2026-09-07

• Update shfmt@latest to 3.14.1.

• Update release-plz@latest to 0.3.162.

• Update protoc-gen-connect-openapi@latest to 0.26.0.

• Update dprint@latest to 0.57.4.

• Update cargo-llvm-cov@latest to 0.9.1.

• Update cargo-crap@latest to 0.5.0.

• Update cargo-binstall@latest to 1.23.0.

[2.87.7] - 2026-09-06

• Update wasm-bindgen@latest to 0.2.128.

• Update uv@latest to 0.12.10.

• Update tombi@latest to 1.5.2.

• Update rclone@latest to 1.75.1.

[2.87.6] - 2026-09-05

• Update rafn@latest to 0.1.6.

• Update editorconfig-checker@latest to 3.11.3.

• Update dprint@latest to 0.57.1.

• Update convco@latest to 0.7.2.

[2.87.5] - 2026-09-04

• Update vacuum@latest to 0.30.3.

• Update uv@latest to 0.12.9.

• Update typos@latest to 1.50.1.

• Update tombi@latest to 1.5.1.

• Update release-plz@latest to 0.3.161.

• Update prek@latest to 0.5.2.

... (truncated)

Commits

• d438492 Release 2.87.8
• cf1fade Update shfmt@latest to 3.14.1
• 7161449 Update release-plz@latest to 0.3.162
• 58df4bb Update protoc-gen-connect-openapi@latest to 0.26.0
• 33e9ffe Update oxfmt manifest
• 60bf882 Update kache manifest
• 667469a Update dprint@latest to 0.57.4
• aa52fd6 Update cargo-llvm-cov@latest to 0.9.1
• 834d344 Update cargo-crap@latest to 0.5.0
• 097f1f0 Update cargo-binstall@latest to 1.23.0
• Additional commits viewable in compare view

[da2ce7]

Reviewed at fc49c2da6b8e6b4e5cbda3b819041d759cfc16c3.

Verdict: comment, not approval — CI has not run at this head.

The change itself is correct and complete: three uses: lines bumped, exact version pin preserved (no moving @v2 tag), and no 2.87.2 reference left anywhere in the tree.

Upstream check between v2.87.2 (1ed6d7be) and v2.87.7 (84f5ac31): 33 files changed, none of them action runtime code — only manifests/*.json, the action's own CI, and CHANGELOG.md. Of the three tools these workflows install, the resolved versions are unchanged:

tool	@v2.87.2	@v2.87.7
grcov	0.10.7	0.10.7
cargo-llvm-cov	0.9.0	0.9.0
cargo-nextest	0.9.143	0.9.143

(cargo-llvm-cov.json gained a 0.9.1 entry, but latest still points at 0.9.0.) So this bump is functionally inert for this repository.

Blocker — organization allowed-actions list. Three runs at this head ended in startup_failure with zero jobs created:

• Testing (pull_request) — run 34396702764
• Testing (push) — run 34396698580
• Generate Coverage Report (PR) — run 34396703553

The repository's allowed-actions list still carries the exact pattern taiki-e/install-action@v2.87.2, which does not admit @v2.87.7, so the workflows are rejected at parse time. Because no jobs are created, no check runs are either — gh pr checks 2191 lists 19 passing/skipped rows and exits 0, so this PR looks green while its three main workflows never started. Coverage is not in the list only because it triggers on push to develop; it carries the same pin and would break on the first push after merge.

Per .github/skills/dev/maintenance/update-github-workflow-actions/SKILL.md (step 4 and the Allowlist Failure Diagnosis section), the fix is on the organization side, not in this diff: a Torrust organization administrator needs to update the allowed-actions list in the organization Actions settings, replacing taiki-e/install-action@v2.87.2 with the scoped pattern taiki-e/install-action@v2.*. That unblocks this bump and every future Dependabot bump in the v2 line while keeping the exact pins in the workflows.

Once the allowlist is updated and the three runs are re-run green at this head, approval and ACK follow. Nothing is required from the author.

[da2ce7]

@dependabot rebase