ci: bump getplumber/plumber from 0.3.86 to 0.4.2

[dependabot]

Bumps getplumber/plumber from 0.3.86 to 0.4.2.

Release notes

Sourced from getplumber/plumber's releases.

v0.4.2

0.4.2 (2026-07-10)

🐛 Bug Fixes

• gate: restore the pre-0.4.0 pass for GitHub repositories without (usable) workflows (f22f5ef)

👷 CI/CD

• release: pin v0.4.1 refs [skip ci] (b885b8b)

v0.4.1

0.4.1 (2026-07-10)

✨ Features

• control: Add control actionRefsMustExistUpstream that emits issue 707 (b9817e3)

👷 CI/CD

• release: pin v0.4.0 refs [skip ci] (ddcfee6)

v0.4.0

0.4.0 (2026-07-10)

One grade, one gate: the Plumber Score

Until now, Plumber gave you two competing verdicts: 1. The Plumber Score (A–E, severity-weighted) 2. A compliance percentage (share of passing controls, severity-blind)

They could disagree: one Critical finding in a single control read as "95% compliant" while scoring an E. And only the percentage gated your CI.

As of 0.4.0 the score is the single source of truth

What you get:

• Severity-aware CI gating. A Critical finding can now fail your pipeline on its own; a handful of Lows won't drag you below the bar the way they skewed the old percentage.
• Two simple knobs instead of an opaque threshold:
  • --min-score <A-E>: fail below a score floor. Ex: "require at least a B"
    • Combined with --min-point below: both must pass
  • --min-points <0-100>: fail below a points floor
    • GitHub Action input: min-points
    • GitLab component input: min_points
    • Default: 100 (any finding fails, same strictness as before)
    • Combined with --min-score: both must pass

... (truncated)

Changelog

Sourced from getplumber/plumber's changelog.

0.4.2 (2026-07-10)

🐛 Bug Fixes

• gate: restore the pre-0.4.0 pass for GitHub repositories without (usable) workflows (f22f5ef)

👷 CI/CD

• release: pin v0.4.1 refs [skip ci] (b885b8b)

0.4.1 (2026-07-10)

✨ Features

• control: Add control actionRefsMustExistUpstream that emits issue 707 (b9817e3)

👷 CI/CD

• release: pin v0.4.0 refs [skip ci] (ddcfee6)

0.4.0 (2026-07-10)

⚠ BREAKING CHANGES

• gate: the JSON report and the GitHub Action no longer expose 'compliance'; 'passed' is redefined as 'score gate met'; the default artifact name changed to plumber-report. Runs with nothing scoreable now fail closed (exit 1): on GitHub, a repository with no workflows previously passed the compliance gate and now fails, and a configuration that enables zero controls for the scanned provider (or a skip-all filter) also fails instead of passing with a perfect score. Skip Plumber or use soft-fail on repos that intentionally have no CI.

Co-Authored-By: Claude Fable 5 noreply@anthropic.com

✨ Features

• gate: gate runs on the Plumber Score, drop the compliance percentage (2bd2639), closes #320 #320

👷 CI/CD

• claude: use claude-opus-4-8 for PR review checks (0c65684)
• release: pin v0.3.101 refs [skip ci] (e209f31)

... (truncated)

Commits

• feaea98 chore(release): 0.4.2 [skip ci]
• f22f5ef fix(gate): restore the pre-0.4.0 pass for GitHub repositories without (usable...
• b885b8b ci(release): pin v0.4.1 refs [skip ci]
• 11a0992 chore(release): 0.4.1 [skip ci]
• b9817e3 feat(control): Add control actionRefsMustExistUpstream that emits issue 707
• ddcfee6 ci(release): pin v0.4.0 refs [skip ci]
• 346a529 chore(release): 0.4.0 [skip ci]
• 2bd2639 feat(gate)!: gate runs on the Plumber Score, drop the compliance percentage
• 0c65684 ci(claude): use claude-opus-4-8 for PR review checks
• e209f31 ci(release): pin v0.3.101 refs [skip ci]
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[dependabot]

Superseded by #43.