Repository navigation
Deferred red checks on dependabot PR #103 #104
Description
Context
Dependabot PR #103 (codeql-action v4.38.0 → v4.38.2, tag pins) is merged with four non-required checks red and two Hypatia WH004 review threads. This issue carries them so the PR body can name them.
Red checks on the PR head
| Context | Evidence |
|---|---|
governance / Allowlist Preflight |
red on base HEAD 9a1067ae too (exit 3). |
governance / Guix packaging policy (Nix retired) |
red on base HEAD 9a1067ae too. |
governance / Workflow security linter |
red on base HEAD 9a1067ae too. |
Hypatia (GitHub Advanced Security code-scanning check) |
35 open Hypatia alerts on main; the PR's two WH004 findings (codeql.yml:43, :49 pin github/codeql-action@v4.38.2 by tag) are the same lines pinned by tag on base (@v4.38.0). The PR moved the version only. |
Acceptance criteria
- The three governance jobs are green on
main. .github/workflows/codeql.ymlpinsgithub/codeql-action/*by commit SHA (closes WH004 on those lines) and the Hypatia check reports success on the next PR head.
Filed by an agent session clearing the owner's GitHub inbox (2026-10-02). Cross-cutting governance reds are tracked in hyperpolymath/standards#994. Per the standing ruling (2026-09-15), a red non-required check is an issue with acceptance criteria, not a merge blocker.
Activity
chore(deps): bump github/codeql-action from 4.38.0 to 4.38.2 in the g…