Repository navigation
chore(deps): bump the actions group with 7 updates - #810
Merged
Merged
Conversation
Bumps the actions group with 7 updates: | Package | From | To | | --- | --- | --- | | [taiki-e/install-action](https://github.com/taiki-e/install-action) | `2.87.13` | `2.87.15` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.38.0` | `4.38.1` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.38.0` | `4.38.1` | | [ruby/setup-ruby](https://github.com/ruby/setup-ruby) | `1.323.0` | `1.324.0` | | [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `4.4.0` | `4.4.1` | | [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) | `3.97.4` | `3.97.5` | | [github/codeql-action](https://github.com/github/codeql-action) | `4.38.0` | `4.38.1` | Updates `taiki-e/install-action` from 2.87.13 to 2.87.15 - [Release notes](https://github.com/taiki-e/install-action/releases) - [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md) - [Commits](taiki-e/install-action@v2.87.13...v2.87.15) Updates `github/codeql-action/init` from 4.38.0 to 4.38.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@b96794f...1c5b675) Updates `github/codeql-action/analyze` from 4.38.0 to 4.38.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@b96794f...1c5b675) Updates `ruby/setup-ruby` from 1.323.0 to 1.324.0 - [Release notes](https://github.com/ruby/setup-ruby/releases) - [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb) - [Commits](ruby/setup-ruby@v1.323.0...v1.324.0) Updates `docker/setup-buildx-action` from 4.4.0 to 4.4.1 - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](docker/setup-buildx-action@v4.4.0...v4.4.1) Updates `trufflesecurity/trufflehog` from 3.97.4 to 3.97.5 - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@v3.97.4...v3.97.5) Updates `github/codeql-action` from 4.38.0 to 4.38.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@v4.38.0...v4.38.1) --- updated-dependencies: - dependency-name: taiki-e/install-action dependency-version: 2.87.15 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: github/codeql-action/init dependency-version: 4.38.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: github/codeql-action/analyze dependency-version: 4.38.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: ruby/setup-ruby dependency-version: 1.324.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: docker/setup-buildx-action dependency-version: 4.4.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: trufflesecurity/trufflehog dependency-version: 3.97.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: github/codeql-action dependency-version: 4.38.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Contributor
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| @@ -224,7 +224,7 @@ jobs: | |||
| @@ -584,13 +584,13 @@ jobs: | |||
| with: | ||
| languages: ${{ matrix.language }} | ||
| queries: security-extended,security-and-quality | ||
|
|
| @@ -533,7 +533,7 @@ jobs: | |||
hyperpolymath
approved these changes
Sep 22, 2026
hyperpolymath
deleted the
dependabot/github_actions/actions-08603b1370
branch
September 22, 2026 09:09
This was referenced Sep 22, 2026
hyperpolymath
added a commit
that referenced
this pull request
Sep 22, 2026
…#817) ## The gate I shipped in #811 is red on `main` #811 merged with its own new `ABI codegen drift` check failing. This fixes it forward. The gate is loudly red rather than silently green, so it is not a vacuous gate — but a gate that has never passed is not yet evidence of anything, and left red it trains people to ignore it. ### The cause, measured ``` INTERNAL ERROR: Can't find data file chez/support.ss in any of ["/home/runner/.idris2/idris2-0.7.0/support/chez/support.ss", ".../base-0.7.0/data/chez/support.ss", .../contrib-0.7.0/data/chez/support.ss"] ``` Compiling an Idris2 **executable** needs the Chez support tree at `$(idris2 --libdir)/support/chez/support.ss`. Type-checking and building a **library** does not. `verify-proofs.yml` only ever does the latter — `idris2 --check` over the proof files, `idris2 --build` on two library packages — and never links a binary. So the cache this job deliberately shares with it (same key `idris2-${IDRIS2_VERSION}-${runner.os}-2`, chosen so the gate would not repeat a 20-minute bootstrap) was populated **without** that tree. **Sharing a warm cache imports its omissions as well as its contents.** That is the generalisable lesson here, and it is why my local build passed while CI's failed: locally the support tree exists under pack, so the local success was never evidence about CI. ### The fix A step between "Verify Idris is on PATH" and "Build the generator" that: 1. resolves `$(idris2 --libdir)/support` and checks for `chez/support.ss`; 2. if absent, shallow-clones the Idris2 source at the **pinned** `IDRIS2_VERSION` and copies `support/` into place — `support/` is plain data (Scheme and C sources), needs no build, so this costs seconds, not a bootstrap; 3. **asserts the file is present by name** before continuing. Step 3 matters independently of step 2. A missing support tree previously surfaced as an opaque `INTERNAL ERROR` three steps later, inside the generator build, where it read like a generator bug. Now it fails where it is caused. ### Also in this PR `zig.yml` extracted the test count with `grep … || true`, which the `Hypatia` workflow scanner flagged at `zig.yml:99` as swallowing a non-zero exit. `set -o pipefail` already made a genuine `zig test` failure fatal, so nothing was actually masked — but a suppressed exit code is indistinguishable from a masked failure to a reader or a scanner, so this is a rewrite rather than an argument. `grep` exits 1 on no-match, which under `set -e` needs suppressing; **awk exits 0 whether or not it matched**, so the no-match case needs no suppression at all and the count check below it becomes the only thing that can fail the step. Measured, not assumed — the extraction was run against the real `zig test` output and three mutant logs: | Input | Extracted | Gate | |---|---|---| | real run (`All 4 tests passed.`) | `4` | green | | `All 0 tests passed.` | `0` | **red** | | no summary line at all | `0` | **red** | | empty log | `0` | **red** | | `3 of 7 tests passed.` | `7` | green | `awk` returns rc=0 on the no-match cases, which is the whole point of the change. The one remaining `|| true` in `abi-codegen-drift.yml` — a diagnostic `find` inside an already-failing branch — is replaced by a `[ -d ]` guard for the same reason. There is now no `|| true` in either workflow. ### Not caused by this change `governance / Actions lockfile verify` is red on every PR because #810 bumped 7 actions without refreshing `.github/workflows/actions.lock` (`taiki-e/install-action` v2.87.13→v2.87.15, `ruby/setup-ruby` v1.323.0→v1.324.0, `docker/setup-buildx-action` v4.4.0→v4.4.1, and a `github/codeql-action` SHA). Every finding is on a workflow this PR does not touch. Filed separately — folding an unrelated repo-wide fault into this PR would make both harder to review. The `Check` / `Test` / `Clippy` / `Cargo check + clippy + fmt` reds are pre-existing on `main` (the unsatisfiable `testcontainers` constraint, #814), as are the three `governance /` reds. ### Acceptance This PR is not done when it is merged; it is done when `abi-codegen-drift` reports **jobs > 0** and prints its denominator: ``` connectors emitted: 16 files compared: 3 of 3 ``` Refs #120 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_0113HQM9LVGkNCzU1WwkJZSV Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
hyperpolymath
added a commit
that referenced
this pull request
Sep 22, 2026
… pass (#819) ## Why this exists PR #817 was squash-merged at head `c82e9aa`, which carried only the **first half** of the fix. The second commit landed on the branch after the merge and is not in `main`. Measured, not assumed: ``` $ gh api repos/hyperpolymath/hypatia/commits/5060161.../check-runs completed failure abi-codegen-drift ``` `abi-codegen-drift` — the gate #811 shipped — **is still red on `main`**. This PR carries the remainder. ## What was actually wrong Running (not merely building) an Idris2 executable needs two support artefacts, and neither was present under `$(idris2 --libdir)` on the runner: | artefact | when it is needed | symptom | |---|---|---| | `<libdir>/support/chez/support.ss` | compile | `INTERNAL ERROR: Can't find data file chez/support.ss` | | `<libdir>/lib/libidris2_support.so` | run | `(while loading libidris2_support.so) cannot open shared object file` | #817 cured the first by copying `support/` in as data. That is not sufficient — `libidris2_support.so` is a **built C library**, not data, and the Chez backend *copies it into the executable's `_app` directory at link time*. Fixing an incomplete installation file-by-file reveals one layer per CI round trip, which is exactly how the second failure happened. So this uses the tree's own targets, which are complete by construction: ```sh make -C "$src" support make -C "$src" install-support PREFIX="$(idris2 --prefix)" ``` It builds `support/` only, never the compiler — seconds, not a bootstrap. ### ⚠ It corrects the cause #817 recorded #817 says library builds do not need the support tree, so the shared cache never had it. **That is false**, and the evidence was already in the repo. Idris2's top-level Makefile: ``` install: install-idris2 install-support install-libs ``` so `verify-proofs.yml`'s `sudo make install PREFIX=/usr/local` **does** install support — under `/usr/local/idris2-0.7.0/`. The binary resolves `idris2 --libdir` to `/home/runner/.idris2/idris2-0.7.0`, and that job's cache `path:` list names *both* prefixes. It is a **prefix mismatch**. Library work (`--check`, `--build` on the two proof packages) never needs the difference, which is why only a job linking an executable ever noticed. The fix is correct either way because it anchors on `$(idris2 --libdir)` / `$(idris2 --prefix)` rather than on a hard-coded prefix — but the comment in the workflow now says what was measured instead of the tidier story. ## Two further changes **Assert on the consumer's artefact.** #817 asserted the *installer's* output and the job still died at run time. This asserts `build/abi-gen/exec/hypatia-abi-gen_app/libidris2_support.so` — the thing that actually has to load it — because a build missing that copy still exits 0, and the failure then surfaces one step later inside the comparison, where it reads as a drift failure rather than a toolchain fault. Plus a `--help` smoke test: the cheapest proof the binary runs, and it writes nothing, so it cannot mask a drift failure by leaving output behind. **`Gen.idr`: `--help` exits 0.** It exited 1, so under `set -e` the smoke test would have failed and tempted an `|| true` — the exact pattern the `Hypatia` scanner flags and which is indistinguishable from a masked failure. Missing arguments are still a usage error and still exit 1. ## Verification done locally before pushing - `--help` / `-h` → rc=0; no-args and one-arg → rc=1. - Regeneration prints `connectors emitted: 16` / `files written: 3 of 3` with **zero diff** against all three tracked targets. - Mutants, against the gate's own comparison logic: | case | compared | drifted | verdict | |---|---|---|---| | positive control (clean tree) | 3 of 3 | 0 | **green** | | hand-edit generated Zig (`arrow_flight`→`arrowflight`) | 3 of 3 | 1 | **red** | | swap wire ids 3↔4 in the live `Types.idr`, no regen | 3 of 3 | 3 | **red** | | empty output dir | 0 of 3 | 3 | **red on the denominator** | The third is the decisive one: it proves the gate reads the **normative source**, not merely that the generated copies agree with each other. ## Note on caching The repair is deliberately **not persisted** — `Post Cache` is skipped on a cache hit, so this job never mutates the shared entry and redoes the clone+build each run. That is the intended property and should not be "optimised" away; two workflows writing one cache key is how the poisoned `-1` cache happened. ## Not blockers (pre-existing on `main`, per the standing ruling) `governance / Actions lockfile verify` (#818, from #810) · `Check` / `Test` / `Clippy` / `Cargo check + clippy + fmt` (#814) · `governance / {Code quality + docs, Validate Hypatia Baseline, Workflow security linter}` · `CodeQL Security Analysis` startup failure. None are touched by this diff. Refs #120, #811, #817 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_0113HQM9LVGkNCzU1WwkJZSV Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This was referenced Sep 22, 2026
hyperpolymath
added a commit
that referenced
this pull request
Sep 22, 2026
…#824) Closes #822. Deletes the orphaned first `with:` block from six workflow steps. **12 deletions, 0 insertions**, two lines per file. ## Measured, not assumed — it is six files, not one #822's body reports the symptom at **one** site (`build-gossamer-gui.yml` line 143). The gate reports **six**, and prints its own denominator: ``` 6 of 32 workflow file(s) contain duplicate keys. ``` | Workflow | Line | |---|---| | `build-gossamer-gui.yml` | 143 | | `ci.yml` | 43 | | `quality.yml` | 118 | | `release.yml` | 129 | | `security-policy.yml` | 41 | | `tests.yml` | 81 | All six are the identical mechanical shape Dependabot's #810 produced — the ref rewritten, a second `with:` **added** rather than the existing one edited, leaving `toolchain: master` orphaned above `toolchain: stable`. So #822's acceptance criterion 5 ("sweep the other six workflows Dependabot touched, since the cause is mechanical and would repeat") is discharged by fixing **all six here**, not by a separate sweep. ## The mutant is already dead Ran the gate's **own** script — `scripts/check-workflow-duplicate-keys.sh` from `hyperpolymath/standards` — against both trees locally: | Tree | Result | |---|---| | `origin/main` @ `7e1f9fd` | `rc=1` — *"6 of 32 workflow file(s) contain duplicate keys."* | | this branch | `rc=0` — *"duplicate-key check: 32 workflow file(s) clean"* | Same script, same invocation, red and green, **denominator printed in both directions**. Reverting this commit reproduces the red — which is exactly what criterion 4 asks for, so no throwaway mutant PR is needed. ⚠ **Why no ordinary linter caught this.** The script's own header states that conventional YAML parsers silently keep the *last* duplicate and report success. Confirmed directly: **`yq` accepted all 32 files, including the six defective ones.** A yq-based check here would have been a vacuous gate. ## Criterion 2 is deliberately not implemented #822 also asks that `dtolnay/rust-toolchain` be pinned to a commit SHA. Not done, on purpose: - `dtolnay/rust-toolchain@v1` appears at **22 sites across 8 workflows**. Converting the single site in `build-gossamer-gui.yml` would leave it inconsistent with 21 identical siblings and create the *appearance* of compliance without the substance. - hypatia's convention is symbolic refs — measured **40 tag/ref to 8 SHA** across the workflow tree. - `.github/workflows/actions.lock` **already records the resolved commit** for `'dtolnay/rust-toolchain@v1'` (`sha1-02cb101ec7c40f2c49e1d9714d64511d8e1b74de`), and that lockfile gate is green as of #823. The tag is pinned *by the lock*; a literal SHA at one call site would desynchronise it from the lock's key. Raised as its own issue covering all 22 sites instead, per the standing rule that a new finding is an issue rather than a merge blocker. ## This PR is also the control for #818 **No `uses:` line is changed and `actions.lock` is not modified** — verified: zero `uses:` lines appear in the diff. That is deliberate. #818's last acceptance criterion requires `governance / Actions lockfile verify` to be **still green on a subsequent unrelated PR**, proving the fix landed on `main` rather than being an artefact of #823's own merge commit. This PR is that control, and the result will be recorded on #818. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_0113HQM9LVGkNCzU1WwkJZSV Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the actions group with 7 updates:
2.87.132.87.154.38.04.38.14.38.04.38.11.323.01.324.04.4.04.4.13.97.43.97.54.38.04.38.1Updates
taiki-e/install-actionfrom 2.87.13 to 2.87.15Release notes
Sourced from taiki-e/install-action's releases.
Changelog
Sourced from taiki-e/install-action's changelog.
Commits
4076c08Release 2.87.15f094888Update uv manifestdf9870fUpdatesyft@latestto 1.52.0d432ab2Update release-plz manifestf2e9e6cUpdate protoc manifest5546883Updatemise@latestto 2026.9.106dfd42aUpdatekingfisher@latestto 2.4.05157ed3Updatekache@latestto 0.23.178a18eaUpdatecoreutils@latestto 0.12.0b02e9c7Updatecargo-nextest@latestto 0.9.145Updates
github/codeql-action/initfrom 4.38.0 to 4.38.1Release notes
Sourced from github/codeql-action/init's releases.
Changelog
Sourced from github/codeql-action/init's changelog.
... (truncated)
Commits
1c5b675Merge pull request #4152 from github/update-v4.38.1-a65b83a73a97cdcaAdd changelog entry for #4146cc6c691Update changelog for v4.38.1a65b83aMerge pull request #4146 from github/henrymercer/per-language-bundles-pr07fa87dClarify the latest-nightly eligibility exceptionf18f353Describe the bundle URL resolverecec9b5Share per-language telemetry fields without renaming79fe3a1Move download telemetry into the status-report directoryead1f7dRename the platform module549d498Simplify per-language platform eligibility checksUpdates
github/codeql-action/analyzefrom 4.38.0 to 4.38.1Release notes
Sourced from github/codeql-action/analyze's releases.
Changelog
Sourced from github/codeql-action/analyze's changelog.
... (truncated)
Commits
1c5b675Merge pull request #4152 from github/update-v4.38.1-a65b83a73a97cdcaAdd changelog entry for #4146cc6c691Update changelog for v4.38.1a65b83aMerge pull request #4146 from github/henrymercer/per-language-bundles-pr07fa87dClarify the latest-nightly eligibility exceptionf18f353Describe the bundle URL resolverecec9b5Share per-language telemetry fields without renaming79fe3a1Move download telemetry into the status-report directoryead1f7dRename the platform module549d498Simplify per-language platform eligibility checksUpdates
ruby/setup-rubyfrom 1.323.0 to 1.324.0Release notes
Sourced from ruby/setup-ruby's releases.
Commits
a0102e0Add truffleruby-40.0.0,truffleruby+graalvm-40.0.0Updates
docker/setup-buildx-actionfrom 4.4.0 to 4.4.1Release notes
Sourced from docker/setup-buildx-action's releases.
Commits
f87e599Merge pull request #624 from crazy-max/skip-pull-with-endpointe700274chore: update generated content3061c91skip BuildKit image pre-pulls for explicit endpointsUpdates
trufflesecurity/trufflehogfrom 3.97.4 to 3.97.5Release notes
Sourced from trufflesecurity/trufflehog's releases.
Commits
f714bf4[SCAN-177] Purge secret parts from verification cache (#5318)4ecb5c6Add elasticsearch source documentation (#5284)8d77a9dAdd filesystem source documentation (#5285)b8a71eeAdd documentation for CircleCI source (#5268)b1d7daeperf(engine): lowercase prefilter chunks as ASCII in a pooled buffer (#5291)07e3ac7Introduce a new optional detector interface that will allow us to verify cred...5a6944eci: avoid Node 20 BuildPulse action (#5266)ce7b2b8fix(detectors/ngrok): broaden valid bearer tokens matching (#5152)58bf481Postgres: drop non-connection URI params before verifying (#5296)82fd19cAdding no-ignore flag to allow reporting of "ignored" secrets (#5297)Updates
github/codeql-actionfrom 4.38.0 to 4.38.1Release notes
Sourced from github/codeql-action's releases.
Changelog
Sourced from github/codeql-action's changelog.
Commits
1c5b675Merge pull request #4152 from github/update-v4.38.1-a65b83a73a97cdcaAdd changelog entry for #4146cc6c691Update changelog for v4.38.1a65b83aMerge pull request #4146 from github/henrymercer/per-language-bundles-pr07fa87dClarify the latest-nightly eligibility exceptionf18f353Describe the bundle URL resolverecec9b5Share per-language telemetry fields without renaming79fe3a1Move download telemetry into the status-report directoryead1f7dRename the platform module549d498Simplify per-language platform eligibility checksDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions