Repository navigation
chore(deps): bump docker/login-action from 3.0.0 to 3.6.0 - #21
Merged
hyperpolymath merged 2 commits intoJan 22, 2026
Merged
Conversation
Bumps [docker/login-action](https://github.com/docker/login-action) from 3.0.0 to 3.6.0. - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@343f7c4...5e57cd1) --- updated-dependencies: - dependency-name: docker/login-action dependency-version: 3.6.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
hyperpolymath
deleted the
dependabot/github_actions/docker/login-action-3.6.0
branch
January 22, 2026 10:41
hyperpolymath
pushed a commit
that referenced
this pull request
Jun 13, 2026
Generalises the existing license-finding cap into a subject-criticality policy so Hypatia recognises CI/CD-load-bearing, reflexive, and self-language subjects and disposes of their findings differently: cap auto_execute, prefer upstream fix locus, prioritise by blast radius, and lock the actuator x reflexive cell against runaway. Names a taxonomy (4 axes, 7 classes) and a single-engine pathway enforced in Kin.Gate. Motivated by the empty-linter PR #21/#22 incident (a broken WF017 recipe auto-applied to a CI/CD-critical repo took estate propagation down). Design for owner review; no pipeline code changed. https://claude.ai/code/session_01EqEysvTPzPwhS9ZGY7EYdr
hyperpolymath
pushed a commit
that referenced
this pull request
Jun 13, 2026
Generalises the existing license-finding cap into a subject-criticality policy so Hypatia recognises CI/CD-load-bearing, reflexive, and self-language subjects and disposes of their findings differently: cap auto_execute, prefer upstream fix locus, prioritise by blast radius, and lock the actuator x reflexive cell against runaway. Names a taxonomy (4 axes, 7 classes) and a single-engine pathway enforced in Kin.Gate. Motivated by the empty-linter PR #21/#22 incident (a broken WF017 recipe auto-applied to a CI/CD-critical repo took estate propagation down). Design for owner review; no pipeline code changed. https://claude.ai/code/session_01EqEysvTPzPwhS9ZGY7EYdr
hyperpolymath
added a commit
that referenced
this pull request
Jun 13, 2026
) ## What A design advisory (no pipeline code changed) for a recurring class of risk surfaced by the empty-linter PR #21/#22 incident: Hypatia treats nearly every subject uniformly, but a minority are **part of the apparatus**, **fan out estate-wide**, or **define our own languages/formats** — and acting on those can start a runaway change process or break many repos at once. Doc: `docs/design/protected-subjects-reflexivity-taxonomy.adoc`. ## The proposal in one breath Generalise the mechanism the **license cap already uses** (`cicd_rules.ex` `license_finding_strategy/0` ⇒ `:review`) into a **subject-criticality policy**, enforced in **`Kin.Gate`** and expressed in the vocabulary of **`Kin.Contingency` `:caution`**. One engine, not two rulesets — detection stays unified; only *disposition* changes. - **Taxonomy:** 4 orthogonal axes (Ownership/Influence · Role · Reflexivity · Blast radius) → 7 composable classes (C0 Ordinary … C6 Third-party). - **Runaway brakes:** no-self-actuation invariant (Graph of Trust cycle detection) · oscillation damper (LSM/ESN → Quarantine) · per-subject-class convergence budget (Rate Limiter). - **Priority:** `severity × blast_radius × PageRank-centrality` → high-consequence subjects surface first, but capped at `:review` (do-first-with-eyes). - **Upstream locus:** `owned-upstream` ⇒ fix the class once at source (the recipe / `.git-private-farm` template), not per downstream copy. - **Actuation distinction:** observer vs actuator × ordinary vs reflexive → the **actuator × reflexive** cell is locked to owner-review. - **Special cases placed:** rhodibot (bot=C2 vs template=C4) · echidnabot/panicbot (C3 tool-twin) · a2ml/k9-svc/gossamer/burble/AffineScript (C5 self-language — treat findings as possible *stale-spec* signals, never auto-rewrite). ## Why now The WF017 broken-gate recipe was auto-applied to a CI/CD-critical repo and took `.git-private-farm` propagation down. Under this design, empty-linter classifies as **C1 (CI/CD-load-bearing, estate-wide)**: the auto-fix is capped at `:review`, guarded by actionlint + dry re-scan, and `fix_locus` points upstream at the recipe + template — so the broken edit never lands unattended. ## Status **Design for owner review — do not implement until the taxonomy and class dispositions are agreed** (C2/C5 owner-gates change fleet behaviour on the safety-critical path). Four open questions for you are listed at the end of the doc. https://claude.ai/code/session_01EqEysvTPzPwhS9ZGY7EYdr --- _Generated by [Claude Code](https://claude.ai/code/session_01EqEysvTPzPwhS9ZGY7EYdr)_ Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Rebasing might not happen immediately, so don't worry if this takes some time.
Note: if you make any changes to this PR yourself, they will take precedence over the rebase.
Bumps docker/login-action from 3.0.0 to 3.6.0.
Release notes
Sourced from docker/login-action's releases.
... (truncated)
Commits
5e57cd1Merge pull request #890 from docker/dependabot/npm_and_yarn/aws-sdk-dependenc...97e3143chore: update generated content3a0796bbuild(deps): bump the aws-sdk-dependencies group with 2 updates5b7b28bMerge pull request #882 from docker/dependabot/npm_and_yarn/aws-sdk-dependenc...abc9fb3chore: update generated contentd468688build(deps): bump the aws-sdk-dependencies group with 2 updatesa99b2f8Merge pull request #883 from docker/dependabot/npm_and_yarn/docker/actions-to...0d7fae8chore: update generated content9832253build(deps): bump@docker/actions-toolkitfrom 0.62.1 to 0.63.009e05bbMerge pull request #881 from docker/dependabot/npm_and_yarn/tmp-0.2.4Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)