Skip to content

chore(deps): bump the actions group across 1 directory with 2 updates - #113

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-eaba7f829e
Closed

chore(deps): bump the actions group across 1 directory with 2 updates#113
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-eaba7f829e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 25, 2026

Copy link
Copy Markdown
Contributor

Bumps the actions group with 2 updates in the / directory: github/codeql-action and dawidd6/action-send-mail.

Updates github/codeql-action from 4.38.3 to 4.39.1

Release notes

Sourced from github/codeql-action's releases.

v4.39.1

  • Update default CodeQL bundle version to 2.27.3. #4256

v4.39.0

  • Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205
  • The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148
  • Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206
  • The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198
Changelog

Sourced from github/codeql-action's changelog.

4.39.1 - 21 Oct 2026

  • Update default CodeQL bundle version to 2.27.3. #4256

4.39.0 - 15 Oct 2026

  • Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205
  • The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148
  • Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206
  • The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198
Commits
  • 9b32540 Merge pull request #4257 from github/update-v4.39.1-c5a2f4b0f
  • b5e1ed9 Trigger workflows
  • 20f5ec3 Update changelog for v4.39.1
  • c5a2f4b Merge pull request #4245 from github/henrymercer/graduate-overlay-trap-caching
  • 61a5a80 Merge pull request #4256 from github/update-bundle/codeql-bundle-v2.27.3
  • 3dd33f8 Merge pull request #4249 from github/mbg/upload-improvements-for-4223
  • b96e339 Change comment for getConfig call in upload-sarif
  • 7fa4518 Use shouldSkipSarifUpload in analyze-action.ts
  • a69c7cb Document that setting the env vars to false takes precedence
  • 74ddcd9 Fix typo in comment
  • Additional commits viewable in compare view

Updates dawidd6/action-send-mail from 22 to 23

Release notes

Sourced from dawidd6/action-send-mail's releases.

v23

What's Changed

New Contributors

Full Changelog: dawidd6/action-send-mail@v22...v23

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the actions group across 1 directory with 2 updates
be69264 
Bumps the actions group with 2 updates in the / directory: [github/codeql-action](https://github.com/github/codeql-action) and [dawidd6/action-send-mail](https://github.com/dawidd6/action-send-mail).


Updates `github/codeql-action` from 4.38.3 to 4.39.1
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@v4.38.3...v4.39.1)

Updates `dawidd6/action-send-mail` from 22 to 23
- [Release notes](https://github.com/dawidd6/action-send-mail/releases)
- [Commits](dawidd6/action-send-mail@v22...v23)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.39.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: dawidd6/action-send-mail
  dependency-version: '23'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 25, 2026
@coderabbitai

coderabbitai Bot commented Oct 25, 2026

Copy link
Copy Markdown
Contributor

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Organization UI
  • Review profile: ASSERTIVE
  • Plan: Advanced
  • Run ID: 5ae8b552-e456-45cf-8a38-6c479ff70b0a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 25, 2026 •
edited
Loading

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-25T12:37:32.952302Z be69264 PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@sonarqubecloud

sonarqubecloud Bot commented Oct 25, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

hyperpolymath added a commit that referenced this pull request Oct 31, 2026
@hyperpolymath @arena-agent
fix(ci): close actions.lock against the YAML already on main
5392441 
Governance job Actions lockfile verify is red on main after #111: the
workflows were bumped (setup-node 7.1.0, upload-artifact 7.0.2,
codeql-action 4.38.3, haskell-actions/setup 2.12.1) without a matching
lock. Dependabot #113 then rewrote only two lock keys and dropped the
reusable/composite records.

This commit does not change any uses: lines. It regenerates actions.lock
so every workflow list matches YAML, job-level standards@fad242d3 refs
are present (gh-actions-lock cannot see them), nested reusable uses and
the upload-pages-artifact composite edge are closed, and stale tag
records are gone. Reviewed SHAs and the standards pin are unchanged.

Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
@hyperpolymath hyperpolymath mentioned this pull request Oct 31, 2026
Merged
hyperpolymath added a commit that referenced this pull request Oct 31, 2026
@hyperpolymath @arena-agent
fix(ci): close actions.lock against the YAML already on main
5974749 
Governance / Actions lockfile verify is red on main after #111: workflows
already pin setup-node@v7.1.0, upload-artifact@v7.0.2, codeql-action@v4.38.3
and haskell-actions/setup@v2.12.1, but the lock still named the previous
tags. That is the same policy failure as gleam: uses: moved, lock not
closed in the same change.

YAML is unchanged. The lock is regenerated so every tag-form workflow list
matches YAML. Stale tag records are dropped. deed-ecosystem@main and
k9-ecosystem@main keep their reviewed commits. The upload-pages-artifact
composite edge to upload-artifact@bbbca2dd is kept.

Job-level metadatastician/standards@fad242d3 callers stay [] — the same
shape gh-actions-lock emits. Adding those SHA records (with nested union
and rust-toolchain@6c977a6c) made GitHub refuse Governance / Hypatia /
Secret Scanner at startup (0 jobs, run name = path). Main, with the empty
lists, still starts 15 governance jobs. The hosted gate is
`gh actions-lock --verify-local`, which does not see job-level reusables.
Nested uses of the five called reusables were inspected independently and
are listed in the PR, not forced into a lock GitHub will not start.

Do not take Dependabot #113: it further bumps CodeQL and send-mail and
deletes SHA nested leaves.

Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
hyperpolymath added a commit that referenced this pull request Oct 31, 2026
@hyperpolymath @arena-agent
fix(ci): close actions.lock against the YAML already on main
f44727c 
Governance / Actions lockfile verify is red on main after #111: workflows
already pin setup-node@v7.1.0, upload-artifact@v7.0.2, codeql-action@v4.38.3
and haskell-actions/setup@v2.12.1, but the lock still named the previous
tags. That is the same policy failure as gleam: uses: moved, lock not
closed in the same change.

YAML is unchanged. The lock is regenerated so every tag-form workflow list
matches YAML. Stale tag records are dropped. deed-ecosystem@main and
k9-ecosystem@main keep their reviewed commits. The upload-pages-artifact
composite edge to upload-artifact@bbbca2dd is kept.

Job-level metadatastician/standards@fad242d3 callers stay [] — the same
shape gh-actions-lock emits. Adding those SHA records (with nested union
and rust-toolchain@6c977a6c) made GitHub refuse Governance / Hypatia /
Secret Scanner at startup (0 jobs, run name = path). Main, with the empty
lists, still starts 15 governance jobs. The hosted gate is
`gh actions-lock --verify-local`, which does not see job-level reusables.
Nested uses of the five called reusables were inspected independently and
are listed in the PR, not forced into a lock GitHub will not start.

Do not take Dependabot #113: it further bumps CodeQL and send-mail and
deletes SHA nested leaves.

Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
@hyperpolymath Arena AI Coding Agent

hyperpolymath commented Oct 31, 2026

Copy link
Copy Markdown
Owner

Closing in favour of #114.

Nothing to cherry-pick: the CodeQL 4.39.1 and send-mail v23 bumps are extra Dependabot upgrades, the lock rewrite is incomplete (stale setup-node/upload-artifact/haskell tags, SHA nested leaves deleted, no job-level standards records), and SPDX/Deno failures are out of this PR's files. #114 already closed the tag mismatch against YAML on main; remaining CI is being fixed there.

@dependabot @github

dependabot Bot commented on behalf of github Oct 31, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/github_actions/actions-eaba7f829e branch October 31, 2026 19:21
hyperpolymath added a commit that referenced this pull request Oct 31, 2026
@hyperpolymath @arena-agent @coderabbitai
fix(ci): canonical standards slug, bun port, SPDX header, closed lock (…
e9033a6 
…#114)

## Why

On `main` after #111, **Actions lockfile verify is red** (stale tags).
Dependabot #113 was not this fix and is **closed** with nothing
cherry-picked (CodeQL 4.39.1 / send-mail v23 only; incomplete lock;
deleted SHA leaves).

Reusable callers using the **pre-transfer slug**
`hyperpolymath/standards` create **0 jobs** from 2026-10-26 (uses:
resolution does not follow the rename; `gh api` does). kyq on
`metadatastician/standards` stays clean.

## What changed

- Five reusable callers →
`metadatastician/standards/…@1725bebd3773ea25627479f813283abf1c497a85`
(current standards main).
- Job-level SHA recorded in `actions.lock` with nested union at that pin
(`owner_id` 297579217). `close-lock --check` and `check-lock-sync` pass.
- Tag-form workflow lists still match YAML. `deed-ecosystem@main` /
`k9-ecosystem@main` commits preserved. Composite `upload-pages-artifact`
→ `upload-artifact@bbbca2dd` kept.
- SPDX: linter scans the **header comment block**, not line 1 (`gh
actions-lock` marker).
- Deno/npm CI → Bun (`oven-sh/setup-bun@v2.2.0`). No `npm ci` /
`package-lock.json`.

## Verification

- Local: SPDX header-block 21/21; close-lock closed; check-lock-sync in
sync.
- Hosted: Governance must **start** (jobs > 0, run name `Governance`)
then **Actions lockfile verify** green. Checks not skipped.

## Gleam (not this PR)

You push: https://github.com/hyperpolymath/polyglot-formalisms-gleam —
do **not** merge #63. The lock-closure commit from this session was
never pushed and the clone is gone; recreate the same lock treatment
there (canonical slug + closed lock).

---------

Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@hyperpolymath