Repository navigation
chore(deps): bump the actions group with 3 updates - #118
Merged
Merged
Conversation
Bumps the actions group with 3 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/autobuild](https://github.com/github/codeql-action) and [github/codeql-action/analyze](https://github.com/github/codeql-action). Updates `github/codeql-action/init` from 4.38.0 to 4.38.2 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@b96794f...2892aa5) Updates `github/codeql-action/autobuild` from 4.38.0 to 4.38.2 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@b96794f...2892aa5) Updates `github/codeql-action/analyze` from 4.38.0 to 4.38.2 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@b96794f...2892aa5) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.38.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: github/codeql-action/autobuild dependency-version: 4.38.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: github/codeql-action/analyze dependency-version: 4.38.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
7 of 13 tasks
hyperpolymath
added a commit
that referenced
this pull request
Oct 6, 2026
…ene (#119) ## Summary This PR clears the three reds on `main` (54e02de), plus the reds hidden behind them. 1. **estate-audit printed no reason.** cicd-suite `5a10b72e` runs `functional_lines=$(grep -vE … "$f" | wc -l)` in its Required Files Gate. The harness shell is `bash -e -o pipefail`, and this repo's CODEOWNERS contains only comments, so `grep` exits 1 and the step aborts without a message. cicd-suite fixed this in `fa71ac2a` (#32), and this PR moves every cicd-suite pin to cicd-suite main `4c772eb2`. Once that gate ran, it exposed a second, masked failure in the Recipes Set gate: the `Justfile` did not parse (`unknown start of token '-' Justfile:72:12`) because lines in its shebang recipes started at column 0. Those lines are now indented. 2. **Workflow security linter.** `main-estate-audit.yml` had no SPDX header and no top-level `permissions:`. Both are added, with `contents: read`. 3. **rust-ci.** `rust-ci-reusable@d135b05b` called `dtolnay/rust-toolchain`, pinned by SHA, without the required `toolchain` input. This PR bumps it to standards main `eafcfbb5`, which passes `toolchain: stable`. That exposed 12 clippy `deprecated` errors for `criterion::black_box`, so the bench now imports `std::hint::black_box`. ## Type of change - [ ] 🐛 Bug fix: no runtime code changed. - [ ] ✨ New feature: N/A - [ ] 💥 Breaking change: N/A - [ ] 🕳️ Soundness fix: N/A - [ ] 📖 Documentation: N/A - [x] 🧹 Refactor / tech debt (behaviour-preserving): the bench import and Justfile indentation. - [ ] ⚡ Performance: N/A - [x] 🔧 Build / CI / tooling ## 📌 New pins Head SHA: **`a87fa8ad5cef7074136beb24f767cbb5c91da0cd`** - **`hyperpolymath/cicd-suite/actions/*@4c772eb235b04455307d5c03cbbc4f45130f7f0f`**, all refs in `main-estate-audit.yml` (was `5a10b72e…`). This is cicd-suite `main`. - **`actions.lock`**: - `hyperpolymath/cicd-suite@4c772eb2…` replaces the `5a10b72e` workflow entry and dependency, with `commit: sha1-4c772eb235b04455307d5c03cbbc4f45130f7f0f`. - The transitive `deed-ecosystem@f9d999b6` and `k9-ecosystem@2155aa26` entries are unchanged; 4c772eb2 still uses them. - **`hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@eafcfbb5933dde8b42fdbd61483794bb75fb4c97`** (was `d135b05b…`). - This is standards `main` and a commit. - The standards lock at that commit covers `dtolnay/rust-toolchain@7e38f4b4`. ## Reds (decisive log line on `main`) | Check | Decisive line | Outcome | |---|---|---| | estate-audit (job 111187403025) | output stops after `found toolchain -> .mise.toml`, then `##[error]Process completed with exit code 1.` Reproduced locally: rc=1 under `-e -o pipefail`, rc=0 without | fixed (central fix, pin bump) | | estate-audit / Recipes Set, previously masked | `Justfile does not parse: error: unknown start of token '-' Justfile:72:12` | fixed | | Workflow security linter (111187404489) | `ERROR: .github/workflows/main-estate-audit.yml has no SPDX-License-Identifier`; `missing top-level 'permissions:'` | fixed | | rust-ci (111187500676) | `'toolchain' is a required input` | fixed (pin bump) | | rust-ci clippy, previously masked | 12× `use of deprecated function 'criterion::black_box'` | fixed | ## How has this been verified? - cicd-suite composite steps at `4c772eb2`, each run under `bash -e -o pipefail`: - All gates rc=0. - The deed and k9 validate-actions also rc=0 (`No K9 files found`). - `just --list` parses and `just doctor` runs. - Rust, with the `stable` toolchain: - `cargo fmt --check` rc=0. - `cargo check --locked --all-targets` rc=0. - `cargo clippy --locked --all-targets -- -D warnings` rc=0. - `cargo test --locked --all-targets`: all ok. - `cargo test --features git-integration`: ok. - `gh actions-lock --verify` rc=0. Positive control: putting the old SHA back in the lock gives rc=1. - Standards gates: - Duplicate keys: 14 files clean. - SPDX + permissions: OK. - Pins resolve: 10. - Allowed actions: 40 refs, 0 uncovered. - `check-actions-lock-gate.sh`: verified. - `actionlint`: clean. ## Checklist - [x] My commits are **signed** (`git commit -S`); `%G?` = `G`. - [x] I ran the project's own checks and tests locally, as listed above, and they pass. - [x] New files: none. I added the `MPL-2.0` SPDX header to `main-estate-audit.yml`, which had none; this matches the repo's existing workflow headers. Nothing was relicensed. - [x] Docs: no user-facing change. - [x] I have not introduced a soundness hole. No gate was weakened: the estate-audit pins moved to the commit that contains the upstream fix. ## Notes for reviewers - **Dependabot #118 will desync `actions.lock`.** It moves `codeql.yml` from `github/codeql-action@b96794f0` to `2892aa5e` without touching the lock, which still lists `@b96794f0…`. The `# v3` comment would also go stale. The PR itself was not touched. - `governance.yml` still pins `092dedad`. It was not red. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01X3hgXxWm6umMgZkjYyHnnm Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
hyperpolymath
approved these changes
Oct 8, 2026
hyperpolymath
enabled auto-merge (squash)
October 8, 2026 17:20
hyperpolymath
disabled auto-merge
October 8, 2026 17:21
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the actions group with 3 updates: github/codeql-action/init, github/codeql-action/autobuild and github/codeql-action/analyze.
Updates
github/codeql-action/initfrom 4.38.0 to 4.38.2Release notes
Sourced from github/codeql-action/init's releases.
Changelog
Sourced from github/codeql-action/init's changelog.
... (truncated)
Commits
2892aa5Merge pull request #4168 from github/update-v4.38.2-a6ef2c96f8ad03a3Trigger workflows98af865Update changelog for v4.38.2a6ef2c9Merge pull request #4156 from github/mario-campos/fix-validate-cmd1ef28a1Merge pull request #4166 from github/dependabot/github_actions/dot-github/wor...26cb08bMerge pull request #4163 from github/mbg/fix-getCommitOid-stubsf035ce3Merge pull request #4165 from github/dependabot/npm_and_yarn/npm-minor-8eaed9...5e4e255Rebuildb13f5f4Bump ruby/setup-rubyc87fe57RebuildUpdates
github/codeql-action/autobuildfrom 4.38.0 to 4.38.2Release notes
Sourced from github/codeql-action/autobuild's releases.
Changelog
Sourced from github/codeql-action/autobuild's changelog.
... (truncated)
Commits
2892aa5Merge pull request #4168 from github/update-v4.38.2-a6ef2c96f8ad03a3Trigger workflows98af865Update changelog for v4.38.2a6ef2c9Merge pull request #4156 from github/mario-campos/fix-validate-cmd1ef28a1Merge pull request #4166 from github/dependabot/github_actions/dot-github/wor...26cb08bMerge pull request #4163 from github/mbg/fix-getCommitOid-stubsf035ce3Merge pull request #4165 from github/dependabot/npm_and_yarn/npm-minor-8eaed9...5e4e255Rebuildb13f5f4Bump ruby/setup-rubyc87fe57RebuildUpdates
github/codeql-action/analyzefrom 4.38.0 to 4.38.2Release notes
Sourced from github/codeql-action/analyze's releases.
Changelog
Sourced from github/codeql-action/analyze's changelog.
... (truncated)
Commits
2892aa5Merge pull request #4168 from github/update-v4.38.2-a6ef2c96f8ad03a3Trigger workflows98af865Update changelog for v4.38.2a6ef2c9Merge pull request #4156 from github/mario-campos/fix-validate-cmd1ef28a1Merge pull request #4166 from github/dependabot/github_actions/dot-github/wor...26cb08bMerge pull request #4163 from github/mbg/fix-getCommitOid-stubsf035ce3Merge pull request #4165 from github/dependabot/npm_and_yarn/npm-minor-8eaed9...5e4e255Rebuildb13f5f4Bump ruby/setup-rubyc87fe57RebuildDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions