Repository navigation
chore(deps): bump the actions group with 6 updates - #52
Merged
Merged
Conversation
Bumps the actions group with 6 updates: | Package | From | To | | --- | --- | --- | | [julia-actions/cache](https://github.com/julia-actions/cache) | `3.4.0` | `3.5.0` | | [julia-actions/julia-runtest](https://github.com/julia-actions/julia-runtest) | `1.10.0` | `1.12.0` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `3.35.2` | `4.38.2` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `3.35.2` | `4.38.2` | | [dtolnay/rust-toolchain](https://github.com/dtolnay/rust-toolchain) | `7e38f4b43b4db5c8dd498af069a4f6196df1d067` | `e2a55d2ffb04f378e9626c28d38b36d230d1e12f` | | [hyperpolymath/smtp-notify-action](https://github.com/hyperpolymath/smtp-notify-action) | `0.3.0` | `0.5.0` | Updates `julia-actions/cache` from 3.4.0 to 3.5.0 - [Release notes](https://github.com/julia-actions/cache/releases) - [Commits](julia-actions/cache@e32267b...9353db0) Updates `julia-actions/julia-runtest` from 1.10.0 to 1.12.0 - [Release notes](https://github.com/julia-actions/julia-runtest/releases) - [Commits](julia-actions/julia-runtest@d0c4f09...6e050c8) Updates `github/codeql-action/init` from 3.35.2 to 4.38.2 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@ce64ddc...2892aa5) Updates `github/codeql-action/analyze` from 3.35.2 to 4.38.2 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@ce64ddc...2892aa5) Updates `dtolnay/rust-toolchain` from 7e38f4b43b4db5c8dd498af069a4f6196df1d067 to e2a55d2ffb04f378e9626c28d38b36d230d1e12f - [Release notes](https://github.com/dtolnay/rust-toolchain/releases) - [Commits](dtolnay/rust-toolchain@7e38f4b...e2a55d2) Updates `hyperpolymath/smtp-notify-action` from 0.3.0 to 0.5.0 - [Release notes](https://github.com/hyperpolymath/smtp-notify-action/releases) - [Changelog](https://github.com/hyperpolymath/smtp-notify-action/blob/main/CHANGELOG.adoc) - [Commits](hyperpolymath/smtp-notify-action@22e7bdb...c1c9fa0) --- updated-dependencies: - dependency-name: julia-actions/cache dependency-version: 3.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: julia-actions/julia-runtest dependency-version: 1.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: github/codeql-action/init dependency-version: 4.38.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: github/codeql-action/analyze dependency-version: 4.38.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: dtolnay/rust-toolchain dependency-version: e2a55d2ffb04f378e9626c28d38b36d230d1e12f dependency-type: direct:production dependency-group: actions - dependency-name: hyperpolymath/smtp-notify-action dependency-version: 0.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Contributor
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
2 of 3 tasks
hyperpolymath
deleted the
dependabot/github_actions/actions-8fa58e6768
branch
October 10, 2026 10:19
hyperpolymath
added a commit
that referenced
this pull request
Oct 10, 2026
… fix the CI-hygiene wave (#58–#62) (#63) ## Summary Executes the ultraplan in `ULTRAPLAN-ISSUE-43.adoc` (first commit): records the #43 determinations, fixes the five fixable recon findings, and retires two mis-created probe issues. Closes #43. ## #43 triage record (issue writes are blocked for this integration — recorded here) The Arena integration carries `issues: read`: it can create issues but not comment, edit bodies, tick checkboxes, add labels or close. The #43 determinations therefore live here; the issue closes via the `Closes` keyword below. **Root cause of all 9 red checks:** every `test (*)` job died at *setup* on `julia-actions/julia-runtest@79a7e100883947123f8263c5f06e6c2fee60dd0c` — a SHA that exists in no upstream ref (30-hex prefix collision with real v1.9.3 `79a7e100…c0ea3eb972f`). No test ever ran; all 9 were pre-existing on `main` @ `553d49e` (2026-09-20), i.e. the TOOLING-VERSION-INTEGRITY "never ran" failure class, not 9 independent test failures. **Determinations — all 9 `fixed`** (18/18 checkboxes would be ticked were the API able): | Check in #43 | Determination | Evidence | |---|---|---| | `test (1.10, {ubuntu,macos,windows}-latest, x64)` | **fixed** → successors `test (1.10, <os>)` green on `main` | PR #48 (`487c7ab4`) re-pinned `julia-runtest@d0c4f093…` = v1.10.0, verified via `git ls-remote`; PR #49 (`14da03a7`) fixed the 12 suite failures at root cause; CI run `37921988068` on `main` @ `126ced1` — 9/9 success | | `test (1.11, {ubuntu,macos,windows}-latest, x64)` | **fixed** → `test (1.11, <os>)` | same | | `test (nightly, {ubuntu,macos,windows}-latest, x64)` | **fixed** → `test (nightly, <os>)` | same | "Green on `main`, fix in the repo — not `continue-on-error`, not a demotion to a warning": satisfied — `CI.yml` has no soft gates and no matrix retirement (the only soft gate in the repo is `boj-build.yml`'s, explained in this PR). **One rename, checked for phantoms (CICD-SIGNAL-DISCIPLINE):** PR #45 dropped the matrix arch dimension, so the contexts lost their `, x64` suffix. Rulesets require exactly one context (`scan / gitleaks`); nothing required the old names → no phantom requirements were created. **#47 (closed) verified AC-by-AC** against the merged state: `get_statistics` ✔, `evaluate` `&&`/`||` ✔, Z3 unsat core ✔ (locally, Z3 4.13.3), `declare_const` decision ✔ (tests use `declare`/`build_script`), `Pkg.test()` green on the matrix ✔. The one caveat — the Z3 path never ran in CI — is fixed by this PR (#62). ## Changes in this PR - `docs` — `ULTRAPLAN-ISSUE-43.adoc`: the plan + execution record (841076c) - `fix(ci)` — install Z3 on the ubuntu CI legs so solver-backed tests run instead of skipping (cda05cb, closes #62) - `fix(ci)` — `boj-build.yml`: `by-design:` rationale for the `continue-on-error` (TOOLING-VERSION-INTEGRITY R4) + fix the mangled trigger payload (ce3f3db, closes #59) - `fix(docs)` — retire the stale `docs/make.jl` (points at `.md` files deleted by the md→adoc migration; nothing runs Documenter) (8fbc840, closes #60) - `docs` — fill `{{PROJECT_UNIQUE_STRENGTH}}` (derived from the README, not invented) and retire `REQUIRES_INITIALISATION.adoc` per its own agent rule (a905071, closes #61) - `chore(ci)` — adopt `.github/workflows/actions.lock` (estate canon R2), generated from the merged tree (14 workflows, 31 refs, job-level reusable refs included) and verified both directions against `check-lock-sync.sh` semantics (fb1d6d1, closes #58) Also closes #54 (a permission probe) and #55 (empty-bodied mis-create; superseded by #56). ## PR #52 (deps) handled first All 6 new pins verified resolvable upstream via `git ls-remote` / commit lookups — including the annotated-tag peels (`github/codeql-action` v4.38.2 → commit `2892aa5e…`; `smtp-notify-action` v0.5.0 → `c1c9fa07…`). Merged as squash before this branch, so the lock matches the merged tree. (Cosmetic leftover: the codeql lines' `# v3` comment tags are stale — dependabot does not update comments.) ## What this PR does NOT do - **#56 (mirror) and #57 (Pages)** stay open: both need a fix/retire ruling (secrets/vars and publishing intent are owner-level). No mute was applied to either red. - **Umbrella #53 stays open** until #56/#57 are determined (its AC2–AC4). - Estate-side GATE-tier / derived-required-context rollout is cross-cutting (standards #994 class); required contexts are derived by the estate applier, never typed here. Could not be commented onto `standards` #994 (same integration permission shape) — owner please relay §1.3/§4.8 of the ultraplan. - Spotted but out of scope: `src/abi/Types.idr` still carries scaffold guidance text ("Replace {{TYPES}}…") — ABI/FFI-seam residue outside the top-up ledger's token census; `docs/make.jl`-adjacent TEST-NEEDS.adoc claims "0 E2E tests" though `test/e2e_test.jl` exists. ## Verification - `check-lock-sync.sh` semantics (both directions): `OK: 14 workflows, 31 lock entries` - Payload quoting of the boj trigger is now valid JSON: `{"repo": …, "branch": …, "engine": "casket"}` - Token census: no `{{…}}` substitution token remains in tracked content (only the validator's `reject-if-contains` literals and the ABI template's guidance text) - CI matrix on this PR must be green **with Z3 installed** (that is #62's acceptance criterion — the solver-gated tests now execute) --------- Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the actions group with 6 updates:
3.4.03.5.01.10.01.12.03.35.24.38.23.35.24.38.27e38f4b43b4db5c8dd498af069a4f6196df1d067e2a55d2ffb04f378e9626c28d38b36d230d1e12f0.3.00.5.0Updates
julia-actions/cachefrom 3.4.0 to 3.5.0Release notes
Sourced from julia-actions/cache's releases.
Commits
9353db0Unpack a GCS restore into a staging directory so a failed stream leaves the d...3ea528dBump@vercel/nccfrom 0.44.1 to 0.45.0 (#261)9e2ba38Bump@google-cloud/storagefrom 7.21.0 to 8.2.0 (#269)174ab9aBump undici from 6.28.0 to 6.29.0 (#267)8d0370fBump brace-expansion from 1.1.18 to 1.1.21 (#271)9509e92Bump@types/nodefrom 24.13.3 to 26.6.2 (#270)Updates
julia-actions/julia-runtestfrom 1.10.0 to 1.12.0Release notes
Sourced from julia-actions/julia-runtest's releases.
... (truncated)
Commits
6e050c8Bump codecov/codecov-action from 5.5.1 to 7.0.0 (#159)985e970Bump actions/checkout from 6.0.0 to 7.0.0 (#160)f0d0e1caddoptimizeas an input (#140)fc07e51Use julia.exe on Windows in test-run bash step (#162)7efd635Bump actions/checkout from 5.0.0 to 6.0.0 (#157)d60b785Update test_harness.jl80da54fUpdate test_harness.jl2e39f09Revert "revertme: disable buildpkg"4106f36revertme: disable buildpkg1cc5ceafixUpdates
github/codeql-action/initfrom 3.35.2 to 4.38.2Release notes
Sourced from github/codeql-action/init's releases.
... (truncated)
Changelog
Sourced from github/codeql-action/init's changelog.
... (truncated)
Commits
2892aa5Merge pull request #4168 from github/update-v4.38.2-a6ef2c96f8ad03a3Trigger workflows98af865Update changelog for v4.38.2a6ef2c9Merge pull request #4156 from github/mario-campos/fix-validate-cmd1ef28a1Merge pull request #4166 from github/dependabot/github_actions/dot-github/wor...26cb08bMerge pull request #4163 from github/mbg/fix-getCommitOid-stubsf035ce3Merge pull request #4165 from github/dependabot/npm_and_yarn/npm-minor-8eaed9...5e4e255Rebuildb13f5f4Bump ruby/setup-rubyc87fe57RebuildUpdates
github/codeql-action/analyzefrom 3.35.2 to 4.38.2Release notes
Sourced from github/codeql-action/analyze's releases.
... (truncated)
Changelog
Sourced from github/codeql-action/analyze's changelog.
... (truncated)
Commits
2892aa5Merge pull request #4168 from github/update-v4.38.2-a6ef2c96f8ad03a3Trigger workflows98af865Update changelog for v4.38.2a6ef2c9Merge pull request #4156 from github/mario-campos/fix-validate-cmd1ef28a1Merge pull request #4166 from github/dependabot/github_actions/dot-github/wor...26cb08bMerge pull request #4163 from github/mbg/fix-getCommitOid-stubsf035ce3Merge pull request #4165 from github/dependabot/npm_and_yarn/npm-minor-8eaed9...5e4e255Rebuildb13f5f4Bump ruby/setup-rubyc87fe57RebuildUpdates
dtolnay/rust-toolchainfrom 7e38f4b43b4db5c8dd498af069a4f6196df1d067 to e2a55d2ffb04f378e9626c28d38b36d230d1e12fCommits
e2a55d2Merge pull request #187 from dtolnay/pwn6af9a09Unify flags[@] and downgrade[@]83d0610Safely handle action inputsUpdates
hyperpolymath/smtp-notify-actionfrom 0.3.0 to 0.5.0Release notes
Sourced from hyperpolymath/smtp-notify-action's releases.
Changelog
Sourced from hyperpolymath/smtp-notify-action's changelog.
... (truncated)
Commits
c1c9fa0feat(nntp): NNTP posting + unblock the Marketplace listing (needs tag v0.5.0)...7ea6d7adocs(changelog): date v0.4.0 at its actual tag push (#26)170f53aci(secret-scan): canonical estate scanner caller, key scan (D243) (#25)9f3f89fdocs: add Signed commits section to CONTRIBUTING (#24)acd2d3dfix: address CodeRabbit review of #21 — CertificateRequest shape checks, benc...c9b6790fix: CodeRabbit auto-fixes for PR #21 (#22)10f080afix/issue 6 hardening (#21)5574cdcResolve community health, accessibility, diagnostics, and benchmark debt106e28ffix(ci): reconcile the workflows with actions.lock (gh-actions-lock) (#19)2c98910fix(ci): pin third-party actions to full commit SHAs (#18)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions