Repository navigation
chore(deps): bump the actions group with 3 updates - #1300
Merged
Merged
Conversation
Bumps the actions group with 3 updates: [actions/create-github-app-token](https://github.com/actions/create-github-app-token), [dtolnay/rust-toolchain](https://github.com/dtolnay/rust-toolchain) and [ossf/scorecard-action](https://github.com/ossf/scorecard-action). Updates `actions/create-github-app-token` from 3.2.0 to 3.3.0 - [Release notes](https://github.com/actions/create-github-app-token/releases) - [Changelog](https://github.com/actions/create-github-app-token/blob/main/CHANGELOG.md) - [Commits](actions/create-github-app-token@bcd2ba4...64ab729) Updates `dtolnay/rust-toolchain` from e2a55d2ffb04f378e9626c28d38b36d230d1e12f to 683b588c487a69d01f6c6ddf40f036ff682cc2c8 - [Release notes](https://github.com/dtolnay/rust-toolchain/releases) - [Commits](dtolnay/rust-toolchain@e2a55d2...683b588) Updates `ossf/scorecard-action` from 2.4.4 to 2.5.0 - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](ossf/scorecard-action@2d11466...fa7117d) --- updated-dependencies: - dependency-name: actions/create-github-app-token dependency-version: 3.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: dtolnay/rust-toolchain dependency-version: 683b588c487a69d01f6c6ddf40f036ff682cc2c8 dependency-type: direct:production dependency-group: actions - dependency-name: ossf/scorecard-action dependency-version: 2.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Contributor
|
🟢 conformant · commit
K9 live corpus (L0–L2): 2 finding(s) / scope notes
Scope: DEED syntax and K9 contracts L0–L2. L3 signature verification and routed coordination dialects are not certified. Green is limited to this scope. Orange is missing evidence; grey is an explicit scope exclusion. Logs and report.json are in the dated conformance-evidence artifact on the linked run. |
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e540225bf1
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| # a failed scan or upload must fail the workflow, not become a clean gate. | ||
| - name: Analyze pull request | ||
| uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4 | ||
| uses: ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e # v2.5.0 |
There was a problem hiding this comment.
On pull_request runs, this upgrades the filesystem scan to Scorecard 5.6.0, but the same job still installs CLI 5.5.0 at line 165 and downloads the v2.4.4 policy at line 179—even though the comment says that policy matches the action pin. The workflow then merges both SARIF streams, so local and repository-level checks are evaluated using different engine/policy releases, yielding inconsistent security-gate results when 5.6 changes checks or result generation. Update the CLI checksum and policy URL/hash together with this action pin, or keep the action on the previous release.
Useful? React with 👍 / 👎.
Contributor
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
hyperpolymath
approved these changes
Oct 19, 2026
hyperpolymath
approved these changes
Oct 19, 2026
hyperpolymath
deleted the
dependabot/github_actions/actions-b3604d8f48
branch
October 19, 2026 14:45
This was referenced Oct 19, 2026
hyperpolymath
added a commit
that referenced
this pull request
Oct 19, 2026
…1303) ## What this is Follow-up to #1298, which merged the work orders at v1.2.0 plus CodeRabbit's agent edit (`c932c96e`). Fifteen findings were posted on that PR after its last reviewed head and before the merge: three by CodeRabbit (applied by its agent in `c932c96e`, refined here) and twelve by Codex across three rounds. Each was verified against the tree before being written in. Same file, same authority (applied-unless-struck, D113; prose, CC-BY-SA-4.0). The branch is the designated one restarted after the squash; a clean restart needed a force-push this session may not make, so `7406ac7d` merges `main` and keeps v1.3.0 where both sides added the file. The diff against `main` is the v1.3.0 to v1.4.3 deltas alone: one file. ## Dispositions (v1.3.0) | Finding | Where | Disposition | |---|---|---| | Pre-push gate requires post-push states (Codex P1, line 54) | Session mechanics | The gate is the locally runnable part of an acceptance block; "after push", "On the PR", "after merge" lines are recorded as they land. | | Root-level touches make the scoped guard the repo-wide run, which exits 1 at the baseline (Codex P1, line 51) | Session mechanics | Exit 1 at the 443 baseline is accepted; see v1.4.0 below for the set-based gate that replaced count equality. | | Keep the repo-wide link-rot check (CodeRabbit, line 51) | Session mechanics | Kept, with the expected result stated. | | Archive README: the scoped guard on `9-archive/` scans the archive and reports 272 (Codex P1, line 366) | WO-4 | Never run the guard on the archive alone; the repo-wide run from a checkout named `standards` is the gate, plus the new file's links by eye. 272 verified. | | Empty pathspec from the default input breaks every other caller (Codex P1, line 386) | WO-4 | Append only when non-empty (bash array), prove the default arm locally. | | `check-package-policy.sh` walks the archive; ten manifests there could satisfy the policy (Codex P2, line 337) | WO-4 | Added as the eleventh validator; `find_first` noted. Verified: ten `manifest.scm`/`guix.scm`/`Containerfile` under the archive. | | `files = 1136` goes stale (Codex P2, line 366) | WO-4 | Raise to 1137; Gate D does not count files, the map must still be true. | | Fallback test must run under `bun test` (Codex P2, line 456) | WO-5 | Done; the file imports from `bun:test`. | | All seven drafts call themselves draft/to-do/in-progress (Codex P2, line 494) | WO-6 | The owner disposes of each ("file" or "discard"); silence means they stay; new owner item. Verified status lines. | | `TOPOLOGY.adoc` is a frozen snapshot (Codex P2, line 545) | WO-7 | Moved to bucket C (archived by P2.4); count becomes 440; the one remaining manifest link is TOPOLOGY's. | | `ROADMAP.adoc` 103 describes the AI Gatekeeper Protocol (Codex P2, line 541) | WO-7 | Moved to bucket B (D338). | | Zero-reference loop exits 1 in the desired state (Codex P2, line 586; CodeRabbit, lines 252–253 and others) | Acceptance blocks | CodeRabbit's agent rewrote them in `c932c96e`; kept. | | Plan README line 69 says "Deno and Python banned" outside any row (Codex P2, line 115) | WO-8 | Rewritten in place; both prose files grepped. | | GitLab's `could not be found` is ambiguous (CodeRabbit, lines 226–230; Codex P1 earlier) | WO-2 | The probe is a diagnostic only, never a skip: a deploy key cannot tell absent from forbidden, and the `*_MIRROR_ENABLED` variable is the one legitimate skip. CodeRabbit's "forge-specific evidence" rewrite is withdrawn too: it needs a second credential per forge for a question the variable already answers. | ## Review rounds on this PR v1.4.0 (`559d3a8e`): Codex posted five findings on `7406ac7d`; all five verified and taken. | Finding | Disposition | |---|---| | Both reusables pin `hypatia-ref` to a vetted SHA; the upstream fix clears nothing by itself (P1) | The known-red paragraph now gives the two steps: hypatia#927 or #928 merges, then both `hypatia-ref` defaults advance past it (a two-line PR here, no `uses:` change). New owner item. My "resolves at HEAD" claim was wrong and is corrected on #1298 too. | | Count equality with `origin/main` blocks WO-7's intended reduction (P1) | The gate compares sets: save the guard's output before the first edit, require no new BROKEN line; repairs show as removals. A touched file may keep its old broken links (ai-instruction's README has six others). | | A bare `-o -name 9-archive` in `check-package-policy.sh` weakens every caller (P2) | One opt-in input, `policy_exclude_dir`, feeds the language block's pathspec and a `PKG_PRUNE_DIRS` hook in the script; the shared copy is unchanged by default; four default-arm runs required. | | `test ! -d .github/ISSUES` fails in the supported silence case (P2) | Out of the pre-push gate; while drafts wait, the gate is that the directory is untouched. | | WO-8's plan check cannot pass with the historical Deno rows (P2) | Only live claims are forbidden; issue-triage rows keep their titles with the dated note. | v1.4.1 (`5d5c7bbc`): Codex posted one finding on `559d3a8e`, verified and taken: `diff … | grep '^>'` exits 1 in the desired state, so the three gate lines now read `! diff "$before" <(…) | grep -q '^>'` (exit 0 when no new BROKEN line), proved on synthetic output. v1.4.2 (`15fb14d9`): Codex posted one finding on `5d5c7bbc`, verified and taken: under `set -o pipefail`, diff's own exit 1 (the outputs differ) replaced grep's verdict as the pipeline status, so the inverted gate passed a new BROKEN line, and WO-7's count printed 3 but returned 1. All four uses now wrap diff as `{ diff "$before" <(…) || true; }` so grep alone decides; proved with and without pipefail (unchanged 0, repairs 0 with count 3 and exit 0, added 1, mixed 1). The revision line, which v1.4.1 had left at v1.4.0, now reads v1.4.2. v1.4.3 (`8aa2e177`): Codex posted two findings on `15fb14d9`; both verified and taken. | Finding | Disposition | |---|---| | WO-7's raw `link-rot-guard.sh . \| grep '0-AI-MANIFEST'` returns 1 under pipefail, the guard exiting 1 at 440 (P2) | Wrapped as `{ … \|\| true; } \| grep`; proved on the tree (old form 1, new form 0). No other line pipes the guard raw. | | An enabled forge whose `*_SSH_KEY` secret is empty hits a notice-only "Skipped" step and stays green, so "skipped by its variable or red" was false (P2) | Retained as the second legitimate skip: all seven forge jobs carry the step, the reusable's Radicle comment calls the secret the second switch, and the regularisation design (line 107) counts 142 estate callers skipping this way with the question marked `OWNER?`. WO-2 records the facts, keeps the seven steps (`grep -c 'not configured)' -> 7`) and names three honest outcomes. New owner item: red is labelled the elegant arm, with the reasons the order departs from it. | Found while re-reading WO-2's block: `grep -c 'continue-on-error'` would have counted the comment at line 121, which the order keeps because it names the owner action. The check is now anchored to the key (`^[[:space:]]*continue-on-error:`): 2 on the tree today, 0 after the order. ## A third known red on `main`, recorded for the executor `scan / Hypatia Neurosymbolic Analysis` and `governance / Validate Hypatia Baseline` are red on `main` at every commit since #1300 regenerated `actions.lock` in `gh actions-lock` format v0.0.3 (`version:` line 4, plus `commit`/`owner_id`/`repo_id` on dependencies). Hypatia's `lib/rules/actions_lock.ex` accepts v0.0.2 only, so the gate sees two `invalid_actions_lock` findings at severity high. The fix takes two steps: hyperpolymath/hypatia#927 or #928 merges, then the `hypatia-ref` defaults in `governance-reusable.yml` and `hypatia-scan-reusable.yml` (vetted SHAs that the local callers do not override) advance past it. This PR shows the same red on its head, as its base `a85aa8e7` does on `main`. The work orders say so, and say never to acknowledge it in the baseline. ## Acceptance (local, on `8aa2e177`) ``` bash scripts/link-rot-guard.sh docs/reorg/2026-10-14-tidy -> all internal links resolve bash scripts/check-launcher-standard-currency.sh --root . -> no stale references bash scripts/check-canonical-names.sh origin/main -> no deprecated names reintroduced bash scripts/check-standards-map.sh -> GATE D PASSED git diff --check -> clean { bash scripts/link-rot-guard.sh 9-archive || true; } | grep -c '^BROKEN' -> 272 (the figure the order quotes) ``` Known reds that are not this PR's: the Debtfile `deno-residue` breach (WO-8 retires it) and the Hypatia gate above. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01T4U5XuN4NWs8FTxoe5PuH7 --------- Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the actions group with 3 updates: actions/create-github-app-token, dtolnay/rust-toolchain and ossf/scorecard-action.
Updates
actions/create-github-app-tokenfrom 3.2.0 to 3.3.0Release notes
Sourced from actions/create-github-app-token's releases.
Changelog
Sourced from actions/create-github-app-token's changelog.
Commits
64ab729chore(main): release 3.3.0 (#402)f3a828eci: create signed dist commits in release workflow (#404)655017fdocs: clarify when owner grants access to all repositories (#378)12461a3fix(deps): bump nested undici from 6.24.0 to 6.29.0 (#403)a47236ffeat: update permission inputs (#399)a69c19dfix(deps): bump the production-dependencies group across 1 directory with 3 u...d5cb7aebuild(deps): bump actions/checkout from 6 to 7 (#384)575da86build(deps): bump stefanzweifel/git-auto-commit-action from 7.1.0 to 7.2.0 in...e85f677test: omit stack traces from snapshots (#401)9419396build(deps-dev): bump c8 from 11.0.0 to 12.0.0 (#400)Updates
dtolnay/rust-toolchainfrom e2a55d2ffb04f378e9626c28d38b36d230d1e12f to 683b588c487a69d01f6c6ddf40f036ff682cc2c8Commits
683b588Add 1.99.1 patch releaseUpdates
ossf/scorecard-actionfrom 2.4.4 to 2.5.0Release notes
Sourced from ossf/scorecard-action's releases.
Commits
fa7117dBump action tag for v2.5.0 release (#1720)cef4eb5🌱 Bump Scorecard to v5.6.0 (#1719)bedb16e✨ Add intoto results format (#1702)de70347Remove the leftover debug print of the auth token (#1709)950873d🌱 Derive the reported Scorecard version from go.mod (#1718)2ce8ee4🌱 Bump github.com/sigstore/cosign/v2 from 2.6.4 to 2.6.5 (#1695)aabdf5a🌱 Bump the github-actions group across 1 directory with 7 updates (#...b4b9adf🌱 CodeQL: Analyze workflows instead of a placeholder JavaScript file4e9f2a2📖 RELEASE.md: Document drafting release notesf618e8b🌱 Build the image with Go 1.27.2 and refresh distrolessDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions