Skip to content

chore(deps): bump the actions group across 1 directory with 3 updates - #24

Merged
hyperpolymath merged 2 commits into
mainfrom
dependabot/github_actions/actions-d465df9460
Mar 21, 2026
Merged

chore(deps): bump the actions group across 1 directory with 3 updates#24
hyperpolymath merged 2 commits into
mainfrom
dependabot/github_actions/actions-d465df9460

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Mar 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the actions group with 3 updates in the / directory: actions/checkout, actions/cache and github/codeql-action.

Updates actions/checkout from 4 to 6

Release notes

Sourced from actions/checkout's releases.

v6.0.0

What's Changed

Full Changelog: actions/checkout@v5.0.0...v6.0.0

v6-beta

What's Changed

Updated persist-credentials to store the credentials under $RUNNER_TEMP instead of directly in the local git config.

This requires a minimum Actions Runner version of v2.329.0 to access the persisted credentials for Docker container action scenarios.

v5.0.1

What's Changed

Full Changelog: actions/checkout@v5...v5.0.1

v5.0.0

What's Changed

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

Make sure your runner is updated to this version or newer to use this release.

Full Changelog: actions/checkout@v4...v5.0.0

v4.3.1

What's Changed

Full Changelog: actions/checkout@v4...v4.3.1

v4.3.0

What's Changed

... (truncated)

Commits

Updates actions/cache from 5.0.3 to 5.0.4

Release notes

Sourced from actions/cache's releases.

v5.0.4

What's Changed

New Contributors

Full Changelog: actions/cache@v5...v5.0.4

Changelog

Sourced from actions/cache's changelog.

Releases

How to prepare a release

[!NOTE]
Relevant for maintainers with write access only.

  1. Switch to a new branch from main.
  2. Run npm test to ensure all tests are passing.
  3. Update the version in https://github.com/actions/cache/blob/main/package.json.
  4. Run npm run build to update the compiled files.
  5. Update this https://github.com/actions/cache/blob/main/RELEASES.md with the new version and changes in the ## Changelog section.
  6. Run licensed cache to update the license report.
  7. Run licensed status and resolve any warnings by updating the https://github.com/actions/cache/blob/main/.licensed.yml file with the exceptions.
  8. Commit your changes and push your branch upstream.
  9. Open a pull request against main and get it reviewed and merged.
  10. Draft a new release https://github.com/actions/cache/releases use the same version number used in package.json
    1. Create a new tag with the version number.
    2. Auto generate release notes and update them to match the changes you made in RELEASES.md.
    3. Toggle the set as the latest release option.
    4. Publish the release.
  11. Navigate to https://github.com/actions/cache/actions/workflows/release-new-action-version.yml
    1. There should be a workflow run queued with the same version number.
    2. Approve the run to publish the new version and update the major tags for this action.

Changelog

5.0.4

  • Bump minimatch to v3.1.5 (fixes ReDoS via globstar patterns)
  • Bump undici to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)
  • Bump fast-xml-parser to v5.5.6

5.0.3

5.0.2

  • Bump @actions/cache to v5.0.3 #1692

5.0.1

  • Update @azure/storage-blob to ^12.29.1 via @actions/cache@5.0.1 #1685

5.0.0

[!IMPORTANT] actions/cache@v5 runs on the Node.js 24 runtime and requires a minimum Actions Runner version of 2.327.1.

... (truncated)

Commits

Updates github/codeql-action from 4.33.0 to 4.34.0

Release notes

Sourced from github/codeql-action's releases.

v4.34.0

  • Added an experimental change which disables TRAP caching when improved incremental analysis is enabled, since improved incremental analysis supersedes TRAP caching. This will improve performance and reduce Actions cache usage. We expect to roll this change out to everyone in March. #3569
  • We are rolling out improved incremental analysis to C/C++ analyses that use build mode none. We expect this rollout to be complete by the end of April 2026. #3584
  • Update default CodeQL bundle version to 2.25.0. #3585
Commits
  • c6f9311 Merge pull request #3588 from github/update-v4.34.0-30c555a52
  • eeb9b3f Update changelog for v4.34.0
  • 30c555a Merge pull request #3584 from github/idrissrio/cpp/overlay
  • 39191bd Merge branch 'main' into idrissrio/cpp/overlay
  • 147e93e Merge pull request #3585 from github/update-bundle/codeql-bundle-v2.25.0
  • e6d83bc Update CHANGELOG.md
  • 0d057cc Add changelog note for C/C++ overlay
  • 074a0db Feature flag: update test without overlay support
  • ab3b6fd Feature flag: address copilot comment
  • ce4a1fe Feature flag: update generated lib after build
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the actions group across 1 directory with 3 updates
51f3810 
Bumps the actions group with 3 updates in the / directory: [actions/checkout](https://github.com/actions/checkout), [actions/cache](https://github.com/actions/cache) and [github/codeql-action](https://github.com/github/codeql-action).


Updates `actions/checkout` from 4 to 6
- [Release notes](https://github.com/actions/checkout/releases)
- [Commits](actions/checkout@v4...v6)

Updates `actions/cache` from 5.0.3 to 5.0.4
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@cdf6c1f...6682284)

Updates `github/codeql-action` from 4.33.0 to 4.34.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@b1bff81...c6f9311)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/cache
  dependency-version: 5.0.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: github/codeql-action
  dependency-version: 4.34.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Mar 21, 2026

Copy link
Copy Markdown
Contributor Author

Dependabot can't parse your workflow-linter.yml. Because of this, Dependabot cannot update this pull request.

@hyperpolymath
Merge branch 'main' into dependabot/github_actions/actions-d465df9460
d55a2a7 
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
@hyperpolymath
hyperpolymath merged commit f826a6e into main Mar 21, 2026
15 of 17 checks passed
@hyperpolymath
hyperpolymath deleted the dependabot/github_actions/actions-d465df9460 branch March 21, 2026 13:00
hyperpolymath added a commit that referenced this pull request Apr 17, 2026
@dependabot @hyperpolymath
chore(deps): bump the actions group across 1 directory with 3 updates (…
1af8244 
…#24)

Bumps the actions group with 3 updates in the / directory:
[actions/checkout](https://github.com/actions/checkout),
[actions/cache](https://github.com/actions/cache) and
[github/codeql-action](https://github.com/github/codeql-action).

Updates `actions/checkout` from 4 to 6
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/checkout/releases">actions/checkout's
releases</a>.</em></p>
<blockquote>
<h2>v6.0.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Update README to include Node.js 24 support details and requirements
by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li>
<li>Persist creds to a separate file by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li>
<li>v6-beta by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2298">actions/checkout#2298</a></li>
<li>update readme/changelog for v6 by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2311">actions/checkout#2311</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v5.0.0...v6.0.0">https://github.com/actions/checkout/compare/v5.0.0...v6.0.0</a></p>
<h2>v6-beta</h2>
<h2>What's Changed</h2>
<p>Updated persist-credentials to store the credentials under
<code>$RUNNER_TEMP</code> instead of directly in the local git
config.</p>
<p>This requires a minimum Actions Runner version of <a
href="https://github.com/actions/runner/releases/tag/v2.329.0">v2.329.0</a>
to access the persisted credentials for <a
href="https://docs.github.com/en/actions/tutorials/use-containerized-services/create-a-docker-container-action">Docker
container action</a> scenarios.</p>
<h2>v5.0.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Port v6 cleanup to v5 by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v5...v5.0.1">https://github.com/actions/checkout/compare/v5...v5.0.1</a></p>
<h2>v5.0.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Update actions checkout to use node 24 by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li>
<li>Prepare v5.0.0 release by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2238">actions/checkout#2238</a></li>
</ul>
<h2>⚠️ Minimum Compatible Runner Version</h2>
<p><strong>v2.327.1</strong><br />
<a
href="https://github.com/actions/runner/releases/tag/v2.327.1">Release
Notes</a></p>
<p>Make sure your runner is updated to this version or newer to use this
release.</p>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v4...v5.0.0">https://github.com/actions/checkout/compare/v4...v5.0.0</a></p>
<h2>v4.3.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Port v6 cleanup to v4 by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v4...v4.3.1">https://github.com/actions/checkout/compare/v4...v4.3.1</a></p>
<h2>v4.3.0</h2>
<h2>What's Changed</h2>
<ul>
<li>docs: update README.md by <a
href="https://github.com/motss"><code>@​motss</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li>
<li>Add internal repos for checking out multiple repositories by <a
href="https://github.com/mouismail"><code>@​mouismail</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li>
<li>Documentation update - add recommended permissions to Readme by <a
href="https://github.com/benwells"><code>@​benwells</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/checkout/commit/de0fac2e4500dabe0009e67214ff5f5447ce83dd"><code>de0fac2</code></a>
Fix tag handling: preserve annotations and explicit fetch-tags (<a
href="https://redirect.github.com/actions/checkout/issues/2356">#2356</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/064fe7f3312418007dea2b49a19844a9ee378f49"><code>064fe7f</code></a>
Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is
set (...</li>
<li><a
href="https://github.com/actions/checkout/commit/8e8c483db84b4bee98b60c0593521ed34d9990e8"><code>8e8c483</code></a>
Clarify v6 README (<a
href="https://redirect.github.com/actions/checkout/issues/2328">#2328</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/033fa0dc0b82693d8986f1016a0ec2c5e7d9cbb1"><code>033fa0d</code></a>
Add worktree support for persist-credentials includeIf (<a
href="https://redirect.github.com/actions/checkout/issues/2327">#2327</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/c2d88d3ecc89a9ef08eebf45d9637801dcee7eb5"><code>c2d88d3</code></a>
Update all references from v5 and v4 to v6 (<a
href="https://redirect.github.com/actions/checkout/issues/2314">#2314</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/1af3b93b6815bc44a9784bd300feb67ff0d1eeb3"><code>1af3b93</code></a>
update readme/changelog for v6 (<a
href="https://redirect.github.com/actions/checkout/issues/2311">#2311</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/71cf2267d89c5cb81562390fa70a37fa40b1305e"><code>71cf226</code></a>
v6-beta (<a
href="https://redirect.github.com/actions/checkout/issues/2298">#2298</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/069c6959146423d11cd0184e6accf28f9d45f06e"><code>069c695</code></a>
Persist creds to a separate file (<a
href="https://redirect.github.com/actions/checkout/issues/2286">#2286</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493"><code>ff7abcd</code></a>
Update README to include Node.js 24 support details and requirements (<a
href="https://redirect.github.com/actions/checkout/issues/2248">#2248</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/08c6903cd8c0fde910a37f88322edcfb5dd907a8"><code>08c6903</code></a>
Prepare v5.0.0 release (<a
href="https://redirect.github.com/actions/checkout/issues/2238">#2238</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/checkout/compare/v4...v6">compare
view</a></li>
</ul>
</details>
<br />

Updates `actions/cache` from 5.0.3 to 5.0.4
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/cache/releases">actions/cache's
releases</a>.</em></p>
<blockquote>
<h2>v5.0.4</h2>
<h2>What's Changed</h2>
<ul>
<li>Add release instructions and update maintainer docs by <a
href="https://github.com/Link"><code>@​Link</code></a>- in <a
href="https://redirect.github.com/actions/cache/pull/1696">actions/cache#1696</a></li>
<li>Potential fix for code scanning alert no. 52: Workflow does not
contain permissions by <a
href="https://github.com/Link"><code>@​Link</code></a>- in <a
href="https://redirect.github.com/actions/cache/pull/1697">actions/cache#1697</a></li>
<li>Fix workflow permissions and cleanup workflow names / formatting by
<a href="https://github.com/Link"><code>@​Link</code></a>- in <a
href="https://redirect.github.com/actions/cache/pull/1699">actions/cache#1699</a></li>
<li>docs: Update examples to use the latest version by <a
href="https://github.com/XZTDean"><code>@​XZTDean</code></a> in <a
href="https://redirect.github.com/actions/cache/pull/1690">actions/cache#1690</a></li>
<li>Fix proxy integration tests by <a
href="https://github.com/Link"><code>@​Link</code></a>- in <a
href="https://redirect.github.com/actions/cache/pull/1701">actions/cache#1701</a></li>
<li>Fix cache key in examples.md for bun.lock by <a
href="https://github.com/RyPeck"><code>@​RyPeck</code></a> in <a
href="https://redirect.github.com/actions/cache/pull/1722">actions/cache#1722</a></li>
<li>Update dependencies &amp; patch security vulnerabilities by <a
href="https://github.com/Link"><code>@​Link</code></a>- in <a
href="https://redirect.github.com/actions/cache/pull/1738">actions/cache#1738</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/XZTDean"><code>@​XZTDean</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/cache/pull/1690">actions/cache#1690</a></li>
<li><a href="https://github.com/RyPeck"><code>@​RyPeck</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/cache/pull/1722">actions/cache#1722</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/cache/compare/v5...v5.0.4">https://github.com/actions/cache/compare/v5...v5.0.4</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/actions/cache/blob/main/RELEASES.md">actions/cache's
changelog</a>.</em></p>
<blockquote>
<h1>Releases</h1>
<h2>How to prepare a release</h2>
<blockquote>
<p>[!NOTE]<br />
Relevant for maintainers with write access only.</p>
</blockquote>
<ol>
<li>Switch to a new branch from <code>main</code>.</li>
<li>Run <code>npm test</code> to ensure all tests are passing.</li>
<li>Update the version in <a
href="https://github.com/actions/cache/blob/main/package.json"><code>https://github.com/actions/cache/blob/main/package.json</code></a>.</li>
<li>Run <code>npm run build</code> to update the compiled files.</li>
<li>Update this <a
href="https://github.com/actions/cache/blob/main/RELEASES.md"><code>https://github.com/actions/cache/blob/main/RELEASES.md</code></a>
with the new version and changes in the <code>## Changelog</code>
section.</li>
<li>Run <code>licensed cache</code> to update the license report.</li>
<li>Run <code>licensed status</code> and resolve any warnings by
updating the <a
href="https://github.com/actions/cache/blob/main/.licensed.yml"><code>https://github.com/actions/cache/blob/main/.licensed.yml</code></a>
file with the exceptions.</li>
<li>Commit your changes and push your branch upstream.</li>
<li>Open a pull request against <code>main</code> and get it reviewed
and merged.</li>
<li>Draft a new release <a
href="https://github.com/actions/cache/releases">https://github.com/actions/cache/releases</a>
use the same version number used in <code>package.json</code>
<ol>
<li>Create a new tag with the version number.</li>
<li>Auto generate release notes and update them to match the changes you
made in <code>RELEASES.md</code>.</li>
<li>Toggle the set as the latest release option.</li>
<li>Publish the release.</li>
</ol>
</li>
<li>Navigate to <a
href="https://github.com/actions/cache/actions/workflows/release-new-action-version.yml">https://github.com/actions/cache/actions/workflows/release-new-action-version.yml</a>
<ol>
<li>There should be a workflow run queued with the same version
number.</li>
<li>Approve the run to publish the new version and update the major tags
for this action.</li>
</ol>
</li>
</ol>
<h2>Changelog</h2>
<h3>5.0.4</h3>
<ul>
<li>Bump <code>minimatch</code> to v3.1.5 (fixes ReDoS via globstar
patterns)</li>
<li>Bump <code>undici</code> to v6.24.1 (WebSocket decompression bomb
protection, header validation fixes)</li>
<li>Bump <code>fast-xml-parser</code> to v5.5.6</li>
</ul>
<h3>5.0.3</h3>
<ul>
<li>Bump <code>@actions/cache</code> to v5.0.5 (Resolves: <a
href="https://github.com/actions/cache/security/dependabot/33">https://github.com/actions/cache/security/dependabot/33</a>)</li>
<li>Bump <code>@actions/core</code> to v2.0.3</li>
</ul>
<h3>5.0.2</h3>
<ul>
<li>Bump <code>@actions/cache</code> to v5.0.3 <a
href="https://redirect.github.com/actions/cache/pull/1692">#1692</a></li>
</ul>
<h3>5.0.1</h3>
<ul>
<li>Update <code>@azure/storage-blob</code> to <code>^12.29.1</code> via
<code>@actions/cache@5.0.1</code> <a
href="https://redirect.github.com/actions/cache/pull/1685">#1685</a></li>
</ul>
<h3>5.0.0</h3>
<blockquote>
<p>[!IMPORTANT]
<code>actions/cache@v5</code> runs on the Node.js 24 runtime and
requires a minimum Actions Runner version of <code>2.327.1</code>.</p>
</blockquote>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/cache/commit/668228422ae6a00e4ad889ee87cd7109ec5666a7"><code>6682284</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/cache/issues/1738">#1738</a>
from actions/prepare-v5.0.4</li>
<li><a
href="https://github.com/actions/cache/commit/e34039626f957d3e3e50843d15c1b20547fc90e2"><code>e340396</code></a>
Update RELEASES</li>
<li><a
href="https://github.com/actions/cache/commit/8a671105293e81530f1af99863cdf94550aba1a6"><code>8a67110</code></a>
Add licenses</li>
<li><a
href="https://github.com/actions/cache/commit/1865903e1b0cb750dda9bc5c58be03424cc62830"><code>1865903</code></a>
Update dependencies &amp; patch security vulnerabilities</li>
<li><a
href="https://github.com/actions/cache/commit/565629816435f6c0b50676926c9b05c254113c0c"><code>5656298</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/cache/issues/1722">#1722</a>
from RyPeck/patch-1</li>
<li><a
href="https://github.com/actions/cache/commit/4e380d19e192ace8e86f23f32ca6fdec98a673c6"><code>4e380d1</code></a>
Fix cache key in examples.md for bun.lock</li>
<li><a
href="https://github.com/actions/cache/commit/b7e8d49f17405cc70c1c120101943203c98d3a4b"><code>b7e8d49</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/cache/issues/1701">#1701</a>
from actions/Link-/fix-proxy-integration-tests</li>
<li><a
href="https://github.com/actions/cache/commit/984a21b1cb176a0936f4edafb42be88978f93ef1"><code>984a21b</code></a>
Add traffic sanity check step</li>
<li><a
href="https://github.com/actions/cache/commit/acf2f1f76affe1ef80eee8e56dfddd3b3e5f0fba"><code>acf2f1f</code></a>
Fix resolution</li>
<li><a
href="https://github.com/actions/cache/commit/95a07c51324af6001b4d6ab8dff29f4dfadc2531"><code>95a07c5</code></a>
Add wait for proxy</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/cache/compare/cdf6c1fa76f9f475f3d7449005a359c84ca0f306...668228422ae6a00e4ad889ee87cd7109ec5666a7">compare
view</a></li>
</ul>
</details>
<br />

Updates `github/codeql-action` from 4.33.0 to 4.34.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action's
releases</a>.</em></p>
<blockquote>
<h2>v4.34.0</h2>
<ul>
<li>Added an experimental change which disables TRAP caching when <a
href="https://redirect.github.com/github/roadmap/issues/1158">improved
incremental analysis</a> is enabled, since improved incremental analysis
supersedes TRAP caching. This will improve performance and reduce
Actions cache usage. We expect to roll this change out to everyone in
March. <a
href="https://redirect.github.com/github/codeql-action/pull/3569">#3569</a></li>
<li>We are rolling out improved incremental analysis to C/C++ analyses
that use build mode <code>none</code>. We expect this rollout to be
complete by the end of April 2026. <a
href="https://redirect.github.com/github/codeql-action/pull/3584">#3584</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.0">2.25.0</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3585">#3585</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/c6f931105cb2c34c8f901cc885ba1e2e259cf745"><code>c6f9311</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3588">#3588</a>
from github/update-v4.34.0-30c555a52</li>
<li><a
href="https://github.com/github/codeql-action/commit/eeb9b3f4244c2945a20b9761dfa77f19d468d35f"><code>eeb9b3f</code></a>
Update changelog for v4.34.0</li>
<li><a
href="https://github.com/github/codeql-action/commit/30c555a528e360aaf7570127a2440e1396c211cb"><code>30c555a</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3584">#3584</a>
from github/idrissrio/cpp/overlay</li>
<li><a
href="https://github.com/github/codeql-action/commit/39191bd27fc8e967ed5dcceadbcf78177091aa3c"><code>39191bd</code></a>
Merge branch 'main' into idrissrio/cpp/overlay</li>
<li><a
href="https://github.com/github/codeql-action/commit/147e93e5dc03f00298b26e52abd9964abdd807fc"><code>147e93e</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3585">#3585</a>
from github/update-bundle/codeql-bundle-v2.25.0</li>
<li><a
href="https://github.com/github/codeql-action/commit/e6d83bce6d20689ff9fc25b4321d33a4ed81bc43"><code>e6d83bc</code></a>
Update CHANGELOG.md</li>
<li><a
href="https://github.com/github/codeql-action/commit/0d057ccbceb05ef6fc6bf2273a4231791c81d5d0"><code>0d057cc</code></a>
Add changelog note for C/C++ overlay</li>
<li><a
href="https://github.com/github/codeql-action/commit/074a0dbd16a3bdc1c2fe0ac6e3b454501716f1fc"><code>074a0db</code></a>
Feature flag: update test without overlay support</li>
<li><a
href="https://github.com/github/codeql-action/commit/ab3b6fd19976dc97551864f5aaee06684f7cc4ad"><code>ab3b6fd</code></a>
Feature flag: address copilot comment</li>
<li><a
href="https://github.com/github/codeql-action/commit/ce4a1feb6ac0e2c658e4e4ff0b57a1efa64039e5"><code>ce4a1fe</code></a>
Feature flag: update generated lib after build</li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/b1bff81932f5cdfc8695c7752dcee935dcd061c8...c6f931105cb2c34c8f901cc885ba1e2e259cf745">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
Repository owner deleted a comment from chatgpt-codex-connector Bot May 13, 2026
This was referenced May 20, 2026
Open
Closed
@hyperpolymath hyperpolymath mentioned this pull request May 28, 2026
Closed
3 tasks
hyperpolymath added a commit that referenced this pull request Sep 1, 2026
@hyperpolymath
docs: place task #1 in the plan and correct the task range
5a09dcd 
The task-list audit ran after the plan was written, so two things were wrong:

- the abstract claimed to map #2-#23, but #1 is reopened and #24-#26 now exist
- task #1 appeared nowhere in the plan, leaving a 240-repo sweep unplaced

Task #1 was marked completed but 469 files across 240 of 382 repos still carry
application/vnd.k9+nickel; the fix exists only as draft PR #711. It belongs in
the Gate 0 sequence, since #711 cannot land until the merge clears.
@hyperpolymath hyperpolymath mentioned this pull request Sep 22, 2026
Merged
hyperpolymath added a commit that referenced this pull request Sep 22, 2026
@hyperpolymath @claude
fix(ci-pipeline): make report the single judge, and read the ledger a…
ed5e3f6 
…t job.workflow_sha (#989)

> ## ⚠ Merge ordering — read before clearing the queue
>
> **Merge this PR. Do _not_ merge the five
`secqual/repin-ci-pipeline-f95130bb` PRs**
> (`AcceleratorGate.jl#39`, `cicd-squabbler#107`, `ddraig-ssg#22`,
`modshells#122`,
> `tropical-types#56`). All five re-pin `ci-pipeline.yml` to
**`f95130bb`**, which
> **predates this PR and carries both defects this PR cures** —
measured, not assumed:
>
> ```
> $ gh api
repos/hyperpolymath/standards/contents/.github/workflows/ci-pipeline.yml
\
> ?ref=f95130bbcbc8917bfec8f8875fa810ad93b08871 --jq .content | base64
-d \
>   | grep -nE '^\s+ref:|exit 1|refused'
> 949:          ref: a2ff696          # unfetchable abbreviated SHA
> 270:              exit 1             # detect's own hard refusal
> (refused: 0 occurrences — no `refused` output, so no single judge)
> ```
>
> Merging them in **either order** re-pins every pilot to a callee where
the ledger
> fetch fails, is swallowed by `continue-on-error`, is treated as EMPTY,
and then
> fails closed — while `detect` exits 1 regardless. All four refusing
pilots go red
> again, for no gain. They are **superseded, not ready**.
>
> #24 retargets those five to **this** PR's squash SHA, one caller
first.

## Why

The pipeline exemption ledger **could never have granted an exemption**,
and its pin **could never have been read**. Both were invisible because
the wrong answer and the right answer coincided. Found while seeding the
ledger from the 5-repo pilot.

### 1. Two judges — the ledger could never say yes

`detect` did its own `exit 1` when it found no gated ecosystem. The
exemption ledger lives in `report`, and can spare only **`report`'s**
`exit 1`. So a ledgered repository still went red on `detect`: the run
failed anyway, and `report` printed a cheerful `::notice::` beside it.

That is the vacuous gate's mirror image — **a ledger that can never say
yes**. The owner's ruling was "blocking where the pipeline is green,
ledgered where it is not"; the second half was unreachable.

`detect` now publishes its refusal as an **output** and stays green.
`report` reads it in its own `if:` and is the **single judge** that can
fail the run.

> ⚠ This is why the `if:` had to widen to
`contains(needs.*.result,'failure') || needs.detect.outputs.refused ==
'true'`. Without the second clause, removing detect's `exit 1` would
make `contains(...,'failure')` false and the refusal would be **silently
lost** — the run would go green having checked nothing.

It still **fails closed**: an unreadable or empty ledger blocks exactly
as before.

### 2. The pin was unfetchable

The ledger checkout read `ref: a2ff696` — an **abbreviated object id**,
which the git wire protocol cannot fetch. Measured against the live
remote:

```
$ git fetch origin a2ff696
fatal: couldn't find remote ref a2ff696
$ git fetch origin a2ff696
(ok)
```

So the checkout **always failed**. `continue-on-error: true` meant the
verdict stayed correct (unreadable == empty == blocked) and nothing
looked broken — but **every exemption ever added would have been
silently vacuous**, while the job printed `pipeline debt: 0 repos`
computed from the file it could not read.

> ⚠ `git cat-file -t a2ff696` answers `commit`. **Local resolution
succeeds where the wire fails**, so a local probe cannot falsify a
remote-fetchability claim.

It now reads `${{ job.workflow_sha }}` — *"the commit SHA of the
workflow file that defines the current job"*, i.e. **exactly the SHA the
caller pinned**. This keeps in full the property the hand-pin existed
for (an edit to `standards@main` cannot change an already-pinned
caller's verdict), removes the manual bump forever, and makes the old
comment's promise — *"the pin and the first entry move in the SAME
commit"* — literally true instead of aspirational.

It also collapses what the literal reading demanded: add-slugs → squash
`S1`, bump-ref-to-`S1` → squash `S2`, re-pin callers to `S2`. **Three
waves become one**, because a commit cannot contain its own SHA.

> ⚠ **Not** `github.workflow_sha` — in a called reusable that is the
**caller's** file.
> ⚠ **Not** `github.job_workflow_sha` — **that name does not exist in
the `github` context.** It is an OIDC token claim, and it is a genuinely
convincing trap. actionlint rejected it and github/docs confirms no such
property. The workflow-identity properties (`workflow_sha`,
`workflow_ref`, `workflow_repository`, `workflow_file_path`) live on the
**`job`** context, which is available in `steps.*.with` and
`steps.*.env`.
> ⚠ Those four are **unavailable on GitHub Enterprise Server**. This
estate is github.com; a GHES port needs a different key.

The verdict step now **prints the SHA it read the ledger at** and raises
an explicit `::error::` if it is ever empty. A fail-closed verdict with
no explanation is precisely how defect 2 hid.

### 3. A notice that would have lied

The ledgered notice said *"the gates below REALLY FAILED"*. On a refusal
**no gate ran at all**. The verdict text now branches: gate-failed debt
is fixable in that repository; no-gate debt is not, and says so.

## Idris2 probe

Extended to `*.idr`, not just `*.ipkg` — Idris2 sources routinely ship
without a package file (`ddraig-ssg` tracks 4 `.idr` and no `.ipkg`, so
the pipeline could not see it at all).

Extension-keyed probes remain the **exception**: `.v` is deliberately
not one, being Coq and Verilog too. `.idr` is unambiguous, exactly like
the existing `*.hs` and `*.res`.

This converts **detector blindness into honest measured debt**. It does
*not* make the repository green.

## Ledger seed — the pilot's measured verdicts

The ledger header prescribes the method: *"The honest seed is a dry-run
wave: adopt the caller in a deliberate sample, record the real verdict
per repository, and add only what actually went red."* That is what
these four are.

| Repository | Detected | Verdict |
|---|---|---|
| `hyperpolymath/AcceleratorGate.jl` | Julia (1) | refused — no Julia
gate |
| `hyperpolymath/ddraig-ssg` | Idris2 (4, via the new probe) | refused —
no Idris2 gate |
| `hyperpolymath/modshells` | Ada (3) | refused — no Ada gate |
| `hyperpolymath/tropical-types` | Julia (1), Lean (2), Isabelle (1) |
refused — no gate for any |

All four refused at `detect`: their ecosystems have **zero overlap**
with the gated set (Rust, Nickel, ReScript, V, Haskell, Deno-refusal).
Nothing was checked, so nothing can be fixed in those repositories.

**`hyperpolymath/cicd-squabbler` is deliberately NOT listed.** Its
`detect` **passed**; its reds come from other workflows entirely. A slug
for a repository whose gate already passes is a vacuous entry — it would
inflate the denominator this ledger prints while exempting nothing.

Why ledger rather than gate these ecosystems: **Lean 4 and Isabelle have
no native `--check` formatter or linter.** The only gate is a full `lake
build` / `isabelle build` (hours for the latter), which is not the fast
native check this pipeline is specified around, and `detect`'s own
comment forbids promoting `ROOT` on that evidence. Julia is the one
clean check form (`JuliaFormatter.format(p; overwrite=false)` returns a
Bool) and is a **separate follow-up**, not a gate on this PR.

Each line retires via #967 when a real gate lands.

## Verification

- `bash -n` over **every** `run:` block in the file — 0 failures; YAML
reparses, 10 jobs.
- **Ratchet mutant killed**: committed without the trailer → `GREW 0 ->
4`, `Exemption ratchet: FAILED`, rc=1. With the trailer → `OK
(declared)`, rc=0. A passing ratchet proves nothing until the mutant
dies.
- `job.workflow_sha` and its availability in `steps.*.with` /
`steps.*.env` verified against **github/docs primary source**, after
actionlint contradicted the first name I tried.
- No abbreviated `ref:` remains in any workflow in the repository. ⚠ The
sibling pin in `governance-reusable.yml` (`9c256b67486b…`) was checked
and is **full 40-hex** — the lock and Deno ledgers are fetchable, and
their exemptions are real. The defect was bounded to this one line.

## Follow-up (not in this PR)

Re-pin the five pilot callers to this PR's squash SHA.

## Follow-up commit — three consequences of the contract change

Moving `detect`'s refusal from an `exit 1` to an output changed what
three
other places mean. Each was saying something false until this commit.

**1. `scripts/tests/detect-ecosystem-test.sh` went red, correctly.** It
keyed
every refusal assertion on RC, which is now `0` on a refusal by design.
Re-keyed onto the new `refused` output. This matters most for **MUTANT
2**,
whose entire job is to prove that the `TOTAL` / `N_UNSUPPORTED`
separation is
what drives the refusal: left asserting `RC == 0`, it would have
compared
`0` to `0` and passed vacuously forever — a dead control that still
prints
`ok`. Positive controls added so the verdict must be written `false` on
the
green paths rather than merely left unset. Confirmed discriminating by
deleting the `refused=` write: **7 failures; restored, 0**.

**2. The report table called a refusal a pass.** `row()` maps the job
result
`success` to the word "pass", and `detect` now succeeds *as a job* when
it
refuses. The Detect row printed `| Detect | pass | ran |` over a
repository
where nothing had been examined. It now prints `REFUSED` and the reason.

**3. The verdict treated two debts as either/or.** `secret-scan` and
`sast`
carry no `needs: detect`, so they run — and can fail — on a repository
that
*also* refused. The message would have printed "NOTHING WAS CHECKED"
over a
secret scan that really did fail, understating a live finding in order
to
describe a missing gate. It now states both when both hold.

## What is verified, and what is not

| Claim | Status |
|---|---|
| `detect-ecosystem-test.sh` | 39 pass / 0 fail, **mutant killed** |
| Exemption ratchet accepts the trailer | **passing in CI**, not only
locally |
| Every `run:` block parses | `bash -n`, 14 blocks, 0 failures |
| No abbreviated `ref:` left in any workflow | confirmed |
| `governance / Validate Hypatia Baseline` red | **pre-existing on
`main`** — the sole failing job at `d1bd7f42`, not this PR |
| `job.workflow_sha` resolves to a real SHA | ✅ **VERIFIED IN A REAL
RUN** — see below |

### ✅ `job.workflow_sha` has now resolved in a real run

This was the one claim in this PR that no check here could test:
`standards`
does not call its own `ci-pipeline.yml`, so nothing on this PR reaches
the code
this PR edits. The empty-value guard made a failure *legible*
(`::error::`
naming the context) without making it *tested*.

It has now been tested directly, **without merging anything and without
opening
a PR**. A throwaway branch on `hyperpolymath/AcceleratorGate.jl` pinned
`uses: ...ci-pipeline.yml@eb8faea4` — this PR's own head, reachable as
`refs/pull/989/head` — and the caller was `workflow_dispatch`ed on that
branch,
which runs the branch's copy. The branch has since been deleted; the run
log
persists.

**Run:** [AcceleratorGate.jl
actions/runs/35767300357](https://github.com/hyperpolymath/AcceleratorGate.jl/actions/runs/35767300357)
— `success`, 12 jobs.

The line that had never previously existed:

```
pipeline debt: 4 repos (ledger read at 'eb8faea44c03f4bac14bfccf7ba77310a607b5be')
```

40 hex characters, and it is the **callee's** commit rather than the
caller's —
which is the whole point of the context, and the reason
`github.workflow_sha` (the caller's file) would have been silently wrong
here.

| Assertion | Observed |
|---|---|
| ledger SHA is 40-hex, non-empty | `eb8faea4…07b5be`, length 40 |
| it names the **callee's** commit | equals this PR's head exactly |
| the empty-SHA `::error::` did **not** fire | run annotations contain
`notice` only |
| `detect` refuses without exiting 1 | `REFUSED: true`, job `success` |
| the report is the **single** judge | run conclusion `success` via the
ledger |
| the ledger was actually read | `pipeline debt: 4 repos` = the 4 seeded
slugs |
| the `::notice::` names the debt | emitted, naming #967 and the removal
condition |

So the end-to-end one-judge design is confirmed on a real repository,
not just
in the unit suite: a Julia-only repo **refused**, stayed green **because
the
ledger exempted it**, and said plainly in its own summary that nothing
was
checked. That is the intended behaviour of all three changes at once.

**This does not remove the staged-rollout requirement.** The wave should
still
re-pin `AcceleratorGate.jl` first and confirm the same line against the
*squash*
SHA, because the SHA that was proven here is a PR-head commit that will
not
exist on `main` after a squash merge.

Ratchet-exception: .machine_readable/pipeline-allow.txt — seeding the
ledger with the 5-repo pilot's measured refusals. Four repositories are
written in ecosystems this pipeline has no gate for (Julia, Lean,
Isabelle, Ada, Idris2), so nothing was checked and nothing can be fixed
in those repositories; retired per-line by #967
as real gates land.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01Ji1bq3TypfycfUPAR7hSxR

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@hyperpolymath