Repository navigation
chore(deps): bump the actions group with 2 updates - #47
Merged
Merged
Conversation
Bumps the actions group with 2 updates: [github/codeql-action](https://github.com/github/codeql-action) and [SonarSource/sonarqube-scan-action](https://github.com/sonarsource/sonarqube-scan-action). Updates `github/codeql-action` from 4.39.0 to 4.39.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@v4.39.0...v4.39.1) Updates `SonarSource/sonarqube-scan-action` from 8.3.0 to 8.4.0 - [Release notes](https://github.com/sonarsource/sonarqube-scan-action/releases) - [Commits](SonarSource/sonarqube-scan-action@v8.3.0...v8.4.0) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.39.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: SonarSource/sonarqube-scan-action dependency-version: 8.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
the
dependencies
dependabot
Bot
added
the
github_actions
Contributor
|
Important Review skippedBot user detected. To trigger a single review, invoke the
 |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
hyperpolymath
approved these changes
Oct 30, 2026
6 tasks
hyperpolymath
added a commit
that referenced
this pull request
Oct 31, 2026
## Summary - Preserve the Actions `SonarQube` context, but for PRs to `main` and pushes to `main`, verify the official SonarCloud quality gate rather than start a duplicate scanner. Pin `cicd-suite/actions/sonarcloud-result-check` to `4404c3c0474e17753fe7689f3485c02890aac113`; check the exact SHA, official app identity, newest matching completed success, project/PR or main URL, and a check start strictly after the event timestamp. Missing, pending, skipped, stale, wrong-app and failed results fail closed. - Per the owner’s choice, remove the legacy Sonar scanner, `SONAR_TOKEN` reference, manual dispatch and non-`main` routes. Automatic analysis ignores `sonar-project.properties`; no active exclusions or findings were changed. - Repair the required `scan / gitleaks` caller by using the canonical standards repository and a newer immutable reusable-workflow pin. Drop inherited secrets and excess permissions. Add a `merge_group` trigger and contract tests as **preparation only**; no real queue candidate has been tested. ## Sonar evidence - PR #47, SHA `748cf83de60de9cc9b968d38c187a7330183b2e2`: official app check [124289772397](https://github.com/hyperpolymath/vocarium/runs/124289772397) succeeded with zero new issues. Separate Actions scanner check [124289694405](https://github.com/hyperpolymath/vocarium/actions/runs/41121896614/job/124289694405) exited 3 and warned of missing `SONAR_TOKEN`; its complete final error could not be retrieved. This establishes duplicate **attempts/reporting**, not two completed analyses or a finding-based cause for the scanner failure. - The [project settings](https://sonarcloud.io/api/settings/values?component=hyperpolymath_vocarium&keys=sonar.autoscan.enabled,sonar.project.monorepo.enabled) reported automatic analysis enabled, and the official app reported exact-commit results on `main`. Sonar documents [automatic analysis](https://docs.sonarsource.com/sonarqube-cloud/analyzing-source-code/automatic-analysis), [fork PR support](https://docs.sonarsource.com/sonarqube-cloud/analyzing-source-code/ci-based-analysis/github-actions-for-sonarcloud), and [incompatibility with simultaneous CI scanning](https://docs.sonarsource.com/sonarqube-cloud/analyzing-source-code/ci-based-analysis/overview-of-integrated-cis). - Findings remain real: [official main check 117203725307](https://github.com/hyperpolymath/vocarium/runs/117203725307) failed its new-code security rating; the 2026-10-27 main analysis reported 21 vulnerabilities. The first PR #48 canary also caught a genuine `githubactions:S8264` permission issue, which was fixed rather than suppressed. ## Secret scanner diagnosis and current blocker - The [original run](https://github.com/hyperpolymath/vocarium/actions/runs/41199621947) had zero jobs: its annotation says the workflow was not found. `hyperpolymath/standards` redirects to `metadatastician/standards`; GitHub Actions does not follow redirects for reusable workflows. - Once the canonical old pin was allowed, [the scanner jobs started but failed at setup](https://github.com/hyperpolymath/vocarium/actions/runs/41220405232/job/124593567530). Its called repository’s old lockfile records the checkout ref as its own SHA, which the Actions backend rejects. The caller’s successful `gh-actions-lock --verify` does **not** verify remote reusable-workflow dependencies. - The candidate now pins `metadatastician/standards/.github/workflows/secret-scanner-reusable.yml@8d1a2aab4211493cf42f147f2080f024605797dc`. Its checkout lock records `v7.0.1` for the same checkout SHA; it has no secret expressions, pins its baseline, and runs working-tree and history scans. Unrelated entries in the upstream lock still cause that repository’s full local verification to fail, so a hosted canary is essential. - The owner reported saving the updated Actions allowlist entry, but the [latest run](https://github.com/hyperpolymath/vocarium/actions/runs/41221356944) still says that exact reusable workflow is not allowed and created zero jobs. No secret scan has been performed and the required context is absent. The effective Actions settings API is inaccessible here (403); do not bypass the check. ## Test evidence and remaining blockers - Consumer fixtures cover event routing, timestamp formats and freshness, project/PR/branch/SHA binding, missing/pending/skipped/wrong-app/failing checks, API denial and secret boundaries. The pinned upstream Sonar verifier’s 23 fixtures passed, as did read-only checks against historical PR/main receipts and a real historical gate failure. - Latest hosted Sonar canary, commit `b21dd51f7b979903ec398eaafd782526be475123`: official app check [124596448053](https://github.com/hyperpolymath/vocarium/runs/124596448053) passed with zero new issues; the [consumer verifier and contract jobs](https://github.com/hyperpolymath/vocarium/actions/runs/41221355555) passed. Main-push behaviour has been tested against historical receipts and fixtures, not by changing protected `main`. - Secret scanner contract fixtures reject inherited secrets, privileged PR triggers, failure bypasses, the old redirected owner, the old bad pin, excess permissions, a renamed required job and a missing `merge_group` trigger. `actionlint`, `gh-actions-lock --verify-local` and full caller `--verify` pass across 28 workflows; the existing workflow validator passes with four baseline recommendations. - Independent [workflow lint](https://github.com/hyperpolymath/vocarium/actions/runs/41221355620/job/124596397693) and [Hypatia](https://github.com/hyperpolymath/vocarium/actions/runs/41221355599/job/124596397850) remain red; Hypatia reports six critical retired-descriptile-location findings seen on #47. Other standards reusable callers still use the redirected owner and need separate review. ## Owner review before rollout - [ ] Resolve the effective Actions allowlist for the exact new scanner pin, then verify `scan / gitleaks` and the other two scanner jobs actually run and report their real results. - [ ] Run a real fork PR canary with this candidate, confirm exact fork-head official + Actions Sonar receipts and read-only access, then push again and verify an older success cannot satisfy the new head. - [ ] Inspect classic/organization required contexts and Actions policy (the relevant APIs returned 403). The visible `main` rules require `scan / gitleaks` from Actions app 15368; checked-in settings are not proof of live protection. No required contexts were changed here. - [ ] Plan the owner’s preferred move to an organization before enabling GitHub’s native merge queue: this public repository is currently user-owned, and GitHub documents native queue availability for organization-owned public repositories. No transfer or queue setting is performed by this PR. Update the hard-coded repository binding and verify Sonar project/app identity after any transfer. - [ ] Before requiring any Sonar context in a queue, qualify an official result for the exact synthetic `merge_group` SHA or explicitly review another analysis design. A PR-head result or skipped job must not stand in for it. Verify the gitleaks queue trigger on a real synthetic SHA too. - [ ] Review Sonar findings, active scope, and the independent Hypatia/lint failures without suppressing them. --------- Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
hyperpolymath
disabled auto-merge
October 31, 2026 22:32
hyperpolymath
enabled auto-merge (squash)
October 31, 2026 22:55
hyperpolymath
disabled auto-merge
October 31, 2026 22:56
hyperpolymath
enabled auto-merge (squash)
November 1, 2026 00:02
hyperpolymath
approved these changes
Nov 1, 2026
hyperpolymath
disabled auto-merge
November 1, 2026 00:21
hyperpolymath
enabled auto-merge (squash)
November 1, 2026 00:21
hyperpolymath
disabled auto-merge
November 1, 2026 00:21
hyperpolymath
enabled auto-merge (squash)
November 1, 2026 00:22
hyperpolymath
disabled auto-merge
November 1, 2026 00:45
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
|
hyperpolymath
added a commit
that referenced
this pull request
Nov 1, 2026
Keep the merged SonarCloud verifier and update only the remaining CodeQL action and its lockfile entry. <!-- SPDX-License-Identifier: CC-BY-SA-4.0 Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk> --> ## Summary <!-- Briefly describe what this PR does and why. Link to related issues with "Closes #N". --> ## Changes <!-- List the key changes introduced by this PR. --> - ## RSR Quality Checklist <!-- Check all that apply. PRs that fail required checks will not be merged. --> ### Required - [ ] Tests pass (`just test` or equivalent) - [ ] Code is formatted (`just fmt` or equivalent) - [ ] Linter is clean (no new warnings or errors) - [ ] No banned language patterns (no TypeScript, no npm/bun, no Go/Python) - [ ] No `unsafe` blocks without `// SAFETY:` comments - [ ] No banned functions (`believe_me`, `unsafeCoerce`, `Obj.magic`, `Admitted`, `sorry`) - [ ] SPDX license headers present on all new/modified source files - [ ] No secrets, credentials, or `.env` files included ### As Applicable - [ ] `.machine_readable/6a2/STATE.a2ml` updated (if project state changed) - [ ] `.machine_readable/6a2/ECOSYSTEM.a2ml` updated (if integrations changed) - [ ] `.machine_readable/6a2/META.a2ml` updated (if architectural decisions changed) - [ ] Documentation updated for user-facing changes - [ ] `TOPOLOGY.md` updated (if architecture changed) - [ ] `CHANGELOG` or release notes updated - [ ] New dependencies reviewed for license compatibility (MPL-2.0 / MPL-2.0) - [ ] ABI/FFI changes validated (`src/interface/abi/` and `src/interface/ffi/` consistent) ## Testing <!-- Describe how you tested these changes. --> ## Screenshots <!-- If applicable, add screenshots or terminal output demonstrating the change. --> Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
hyperpolymath
deleted the
dependabot/github_actions/actions-3792ef812e
branch
November 1, 2026 00:48
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the actions group with 2 updates: github/codeql-action and SonarSource/sonarqube-scan-action.
Updates
github/codeql-actionfrom 4.39.0 to 4.39.1Release notes
Sourced from github/codeql-action's releases.
Changelog
Sourced from github/codeql-action's changelog.
Commits
9b32540Merge pull request #4257 from github/update-v4.39.1-c5a2f4b0fb5e1ed9Trigger workflows20f5ec3Update changelog for v4.39.1c5a2f4bMerge pull request #4245 from github/henrymercer/graduate-overlay-trap-caching61a5a80Merge pull request #4256 from github/update-bundle/codeql-bundle-v2.27.33dd33f8Merge pull request #4249 from github/mbg/upload-improvements-for-4223b96e339Change comment forgetConfigcall inupload-sarif7fa4518UseshouldSkipSarifUploadinanalyze-action.tsa69c7cbDocument that setting the env vars tofalsetakes precedence74ddcd9Fix typo in commentUpdates
SonarSource/sonarqube-scan-actionfrom 8.3.0 to 8.4.0Release notes
Sourced from SonarSource/sonarqube-scan-action's releases.
Commits
4d1dc0cUpdate SonarScanner CLI to 8.3.0.16463 (#293)ee2d757SQSCANGHA-185 NO-JIRA Bump madhead/semver-utils from 5.0.0 to 5.1.1 (#290)a7de334Update dependency rollup to v4.65.0 (#291)38f0382Update dependency rollup to v4.64.12 (#288)54ae8f2Update dependency rollup to v4.64.9 (#283)3a63ba4CONTENT-3798 README update for marketing (#274)b632445Update dependency rollup to v4.64.7 (#282)c3c1d58SQSCANGHA-176 docs: refresh action and scanner version examples (#280)b541427SQSCANGHA-177 Update SonarScanner CLI to 8.2.0.6438 (#281)15d1d91Update dependency rollup to v4.64.6 (#279)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions