diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 0fb98e2c..3ccafd84 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,48 +1,42 @@
# SPDX-License-Identifier: MPL-2.0
-# Dependabot configuration for RSR-compliant repositories
-# Covers common ecosystems - remove unused ones for your project
-
+# Dependabot v2 configuration for boj-server.
+# Scoped strictly to directories that actually hold standalone manifests/lockfiles:
+# - / -> GitHub Actions (.github/workflows/*.yml) + root JS package.json
+# - /elixir -> Mix (elixir/mix.exs + elixir/mix.lock)
+# - /coord-tui -> Cargo (coord-tui/Cargo.toml + coord-tui/Cargo.lock)
+# Note: /tray is intentionally omitted because tray/Cargo.toml references the
+# external sibling path `../../gossamer/bindings/rust`, which cannot resolve in
+# Dependabot's repository-only checkout.
version: 2
updates:
- # GitHub Actions - always include
- package-ecosystem: "github-actions"
directory: "/"
schedule:
- interval: "daily"
+ interval: "weekly"
+ day: "monday"
+ open-pull-requests-limit: 5
groups:
actions:
patterns:
- "*"
- # Rust/Cargo
- - package-ecosystem: "cargo"
- directory: "/"
- schedule:
- interval: "daily"
- ignore:
- - dependency-name: "*"
- update-types: ["version-update:semver-patch"]
-
- # Elixir/Mix
- - package-ecosystem: "mix"
- directory: "/"
- schedule:
- interval: "daily"
-
- # Node.js/npm
- package-ecosystem: "npm"
directory: "/"
schedule:
- interval: "daily"
+ interval: "weekly"
+ day: "monday"
+ open-pull-requests-limit: 5
- # Python/pip
- - package-ecosystem: "pip"
- directory: "/"
+ - package-ecosystem: "mix"
+ directory: "/elixir"
schedule:
- interval: "daily"
+ interval: "weekly"
+ day: "monday"
+ open-pull-requests-limit: 5
- # Guix flakes
- - package-ecosystem: "guix"
- directory: "/"
+ - package-ecosystem: "cargo"
+ directory: "/coord-tui"
schedule:
- interval: "daily"
+ interval: "weekly"
+ day: "monday"
+ open-pull-requests-limit: 5
diff --git a/.github/workflows/abi-drift.yml b/.github/workflows/abi-drift.yml
index 075a9c6c..cd41cc92 100644
--- a/.github/workflows/abi-drift.yml
+++ b/.github/workflows/abi-drift.yml
@@ -47,7 +47,7 @@ jobs:
outputs:
run: ${{ steps.detect.outputs.run }}
steps:
- - uses: actions/checkout@v6.0.2
+ - uses: actions/checkout@v7.0.1
with:
fetch-depth: 0
- id: detect
@@ -72,7 +72,7 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 15
steps:
- - uses: actions/checkout@v6.0.2
+ - uses: actions/checkout@v7.0.1
with:
# Need at least two commits so `git diff origin/...HEAD`
# can compute the changed-cartridge set on pull_request events.
@@ -92,7 +92,7 @@ jobs:
# GADT-skip fix (iseriser#20, merged 2026-05-20) never reached CI.
# Bumping ISERISER_REV invalidates the cache and forces a rebuild.
- name: Cache cargo bin (iseriser install)
- uses: actions/cache@v4.2.2
+ uses: actions/cache@v6.1.0
env:
ISERISER_REV: 741a3b63e7619b6e9cfe7f91b04d7ccfb130b1ca
with:
diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
index 739b3185..d33a9330 100644
--- a/.github/workflows/actions.lock
+++ b/.github/workflows/actions.lock
@@ -1,267 +1,294 @@
# This file is machine-generated by `gh actions-lock`.
# Do not edit by hand; run `gh actions-lock` to update.
# Docs: https://gh.io/actions-lockfile
-version: 'v0.0.2'
+version: 'v0.0.3'
workflows:
'.github/workflows/abi-drift.yml':
- - 'actions/cache@v4.2.2'
- - 'actions/checkout@v6.0.2'
+ - 'actions/cache@v6.1.0'
+ - 'actions/checkout@v7.0.1'
- 'dtolnay/rust-toolchain@v1'
'.github/workflows/backend-assurance.yml':
- - 'actions/cache@v4.2.2'
- - 'actions/checkout@v6.0.2'
- - 'erlef/setup-beam@v1.24.0'
+ - 'actions/cache@v6.1.0'
+ - 'actions/checkout@v7.0.1'
+ - 'erlef/setup-beam@v1.24.1'
'.github/workflows/build.yml':
- - 'actions/checkout@v4.3.1'
- - 'sonarsource/sonarqube-scan-action@v8.1.0'
+ - 'actions/checkout@v7.0.1'
+ - 'sonarsource/sonarqube-scan-action@v8.3.0'
'.github/workflows/codeql.yml':
- - 'actions/checkout@v6.0.2'
- - 'github/codeql-action@v4.34.0'
+ - 'actions/checkout@v7.0.1'
+ - 'github/codeql-action@v4.39.0'
'.github/workflows/container-publish.yml':
- - 'actions/attest-build-provenance@v2.4.0'
- - 'actions/checkout@v6.0.2'
+ - 'actions/attest-build-provenance@v4.2.2'
+ - 'actions/checkout@v7.0.1'
'.github/workflows/dogfood-gate.yml':
- - 'actions/checkout@v6.0.2'
+ - 'actions/checkout@v7.0.1'
+ - 'denoland/setup-deno@v2.0.5'
'.github/workflows/e2e.yml':
- - 'actions/checkout@v6.0.2'
- - 'actions/github-script@v8.0.0'
- - 'actions/setup-node@v4.4.0'
- - 'actions/upload-artifact@v4.6.2'
- - 'denoland/setup-deno@v2.0.4'
- - 'erlef/setup-beam@v1.24.0'
+ - 'actions/checkout@v7.0.1'
+ - 'actions/github-script@v9.0.0'
+ - 'actions/setup-node@v7.1.0'
+ - 'actions/upload-artifact@v7.0.2'
+ - 'denoland/setup-deno@v2.0.5'
+ - 'erlef/setup-beam@v1.24.1'
- 'mlugg/setup-zig@v2.2.1'
- 'oven-sh/setup-bun@v2.2.0'
'.github/workflows/fuzz.yml':
- - 'actions/checkout@v6.0.2'
+ - 'actions/checkout@v7.0.1'
- 'mlugg/setup-zig@v2.2.1'
- '.github/workflows/governance.yml': []
+ '.github/workflows/governance.yml':
+ - 'actions/checkout@v7.0.1'
'.github/workflows/hcg-surface-drift.yml':
- - 'actions/checkout@v6.0.2'
+ - 'actions/checkout@v7.0.1'
'.github/workflows/hypatia-scan.yml':
- - 'actions/checkout@v6.0.2'
- - 'actions/github-script@v8.0.0'
- - 'actions/upload-artifact@v4.6.2'
- - 'erlef/setup-beam@v1.24.0'
- - 'github/codeql-action@v4.32.6'
+ - 'actions/checkout@v7.0.1'
+ - 'actions/github-script@v9.0.0'
+ - 'actions/upload-artifact@v7.0.2'
+ - 'erlef/setup-beam@v1.24.1'
+ - 'github/codeql-action@v4.39.0'
'.github/workflows/instant-sync.yml':
- - 'peter-evans/repository-dispatch@v3.0.0'
+ - 'peter-evans/repository-dispatch@v4.0.1'
'.github/workflows/label-triage.yml': []
'.github/workflows/labels.yml': []
'.github/workflows/lsp-dap-bsp.yml':
- - 'actions/checkout@v6.0.2'
+ - 'actions/checkout@v7.0.1'
- 'mlugg/setup-zig@v2.2.1'
- '.github/workflows/mirror.yml': []
+ '.github/workflows/mirror.yml':
+ - 'hyperpolymath/standards@e16a23170fa378bf3b1444c3ee94100413ae3ff7'
'.github/workflows/pages-deploy.yml':
- - 'actions/checkout@v4.4.0'
+ - 'actions/checkout@v7.0.1'
'.github/workflows/pages.yml':
- - 'actions/checkout@v4.4.0'
- - 'actions/deploy-pages@v4.0.5'
- - 'actions/upload-pages-artifact@v3.0.1'
+ - 'actions/checkout@v7.0.1'
+ - 'actions/deploy-pages@v5.0.1'
+ - 'actions/upload-pages-artifact@v5.0.0'
'.github/workflows/proofs.yml':
- - 'actions/cache@v4.2.2'
- - 'actions/checkout@v6.0.2'
+ - 'actions/cache@v6.1.0'
+ - 'actions/checkout@v7.0.1'
'.github/workflows/publish.yml':
- - 'actions/checkout@v6.0.2'
- - 'denoland/setup-deno@v2.0.4'
+ - 'actions/checkout@v7.0.1'
+ - 'denoland/setup-deno@v2.0.5'
- 'oven-sh/setup-bun@v2.2.0'
'.github/workflows/push-email-notify.yml':
- - 'hyperpolymath/smtp-notify-action@v0.2.0'
- '.github/workflows/readme-derive.yml': []
+ - 'hyperpolymath/smtp-notify-action@v0.5.0'
+ '.github/workflows/readme-derive.yml':
+ - 'actions/checkout@v7.0.1'
'.github/workflows/release.yml':
- - 'actions/checkout@v6.0.2'
- - 'actions/download-artifact@v4.2.1'
- - 'actions/upload-artifact@v4.6.2'
+ - 'actions/checkout@v7.0.1'
+ - 'actions/download-artifact@v8.0.2'
+ - 'actions/upload-artifact@v7.0.2'
- 'mlugg/setup-zig@v2.2.1'
- - 'softprops/action-gh-release@v2.6.2'
- '.github/workflows/scorecard.yml': []
- '.github/workflows/secret-scanner.yml': []
+ - 'slsa-framework/slsa-github-generator@f7dd8c54c2067bafc12ca7a55595d5ee9b75204a'
+ - 'softprops/action-gh-release@v3.0.3'
+ '.github/workflows/scorecard.yml':
+ - 'hyperpolymath/standards@e16a23170fa378bf3b1444c3ee94100413ae3ff7'
+ '.github/workflows/secret-scanner.yml':
+ - 'actions/checkout@v7.0.1'
'.github/workflows/truthfulness.yml':
- - 'actions/checkout@v6.0.2'
+ - 'actions/checkout@v7.0.1'
- 'mlugg/setup-zig@v2.2.1'
'.github/workflows/zig-test.yml':
- - 'actions/checkout@v6.0.2'
+ - 'actions/checkout@v7.0.1'
- 'mlugg/setup-zig@v2.2.1'
dependencies:
- 'actions/attest-build-provenance@1176ef556905f349f669722abf30bce1a6e16e01':
- ref: 'predicate@1.1.5'
- commit: 'sha1-1176ef556905f349f669722abf30bce1a6e16e01'
- owner_id: 44036562
- repo_id: 760702757
- 'actions/attest-build-provenance@v2.4.0':
- ref: 'v2.4.0'
- commit: 'sha1-e8998f949152b193b063cb0ec769d69d929409be'
+ 'actions/attest-build-provenance@v4.2.2':
+ ref: 'v4.2.2'
+ commit: 'sha1-4d101475d8b20a2381f78447822ac1eab6504dd8'
owner_id: 44036562
repo_id: 760702757
uses:
- - 'actions/attest-build-provenance@1176ef556905f349f669722abf30bce1a6e16e01'
- - 'actions/attest@ce27ba3b4a9a139d9a20a4a07d69fabb52f1e5bc'
- 'actions/attest@ce27ba3b4a9a139d9a20a4a07d69fabb52f1e5bc':
- ref: 'v2.4.0'
- commit: 'sha1-ce27ba3b4a9a139d9a20a4a07d69fabb52f1e5bc'
+ - 'actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d'
+ 'actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d':
+ ref: 'v4.2.1'
+ commit: 'sha1-508db95dd578ae2727ebd6217d5ba78e4fbda05d'
owner_id: 44036562
repo_id: 760701061
- 'actions/cache@v4.2.2':
- ref: 'v4.2.2'
- commit: 'sha1-d4323d4df104b026a6aa633fdb11d772146be0bf'
+ 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9':
+ ref: 'v6.1.0'
+ commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
owner_id: 44036562
repo_id: 215566462
- 'actions/checkout@v4.3.1':
- ref: 'v4.3.1'
- commit: 'sha1-34e114876b0b11c390a56381ad16ebd13914f8d5'
+ 'actions/cache@v6.1.0':
+ ref: 'v6.1.0'
+ commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
owner_id: 44036562
- repo_id: 197814629
- 'actions/checkout@v4.4.0':
- ref: 'v4.4.0'
- commit: 'sha1-11d5960a326750d5838078e36cf38b85af677262'
+ repo_id: 215566462
+ 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1':
+ ref: 'v7.0.1'
+ commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
owner_id: 44036562
repo_id: 197814629
- 'actions/checkout@v6.0.2':
- ref: 'v6.0.2'
- commit: 'sha1-de0fac2e4500dabe0009e67214ff5f5447ce83dd'
+ 'actions/checkout@v7.0.1':
+ ref: 'v7.0.1'
+ commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
owner_id: 44036562
repo_id: 197814629
- 'actions/deploy-pages@v4.0.5':
- ref: 'v4.0.5'
- commit: 'sha1-d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e'
+ 'actions/deploy-pages@v5.0.1':
+ ref: 'v5.0.1'
+ commit: 'sha1-368f82528645a54fb793d4d04e342629a3f51346'
owner_id: 44036562
repo_id: 438112499
- 'actions/download-artifact@v4.2.1':
- ref: 'v4.2.1'
- commit: 'sha1-95815c38cf2ff2164869cbab79da8d1f422bc89e'
+ 'actions/download-artifact@v8.0.2':
+ ref: 'v8.0.2'
+ commit: 'sha1-9000827ccba6bdab643e8b6fd33ac0654aef8333'
owner_id: 44036562
repo_id: 192626254
- 'actions/github-script@v8.0.0':
- ref: 'v8.0.0'
- commit: 'sha1-ed597411d8f924073f98dfc5c65a23a2325f34cd'
+ 'actions/github-script@v9.0.0':
+ ref: 'v9.0.0'
+ commit: 'sha1-3a2844b7e9c422d3c10d287c895573f7108da1b3'
owner_id: 44036562
repo_id: 205262760
- 'actions/setup-node@v4.4.0':
- ref: 'v4.4.0'
- commit: 'sha1-49933ea5288caeca8642d1e84afbd3f7d6820020'
+ 'actions/setup-node@v7.1.0':
+ ref: 'v7.1.0'
+ commit: 'sha1-949feb2413d6458794dcd2491c4babbbce0c15c1'
owner_id: 44036562
repo_id: 189476904
- 'actions/upload-artifact@v4':
- ref: 'v4'
- commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02'
+ 'actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08':
+ ref: 'v4.6.0'
+ commit: 'sha1-65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08'
+ owner_id: 44036562
+ repo_id: 192625955
+ 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f':
+ ref: 'v7.0.0'
+ commit: 'sha1-bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
+ owner_id: 44036562
+ repo_id: 192625955
+ 'actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9':
+ ref: 'v7.0.2'
+ commit: 'sha1-cf430e030ddbb5b0abf93d22962f4752f3646cd9'
owner_id: 44036562
repo_id: 192625955
- 'actions/upload-artifact@v4.6.2':
- ref: 'v4.6.2'
- commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02'
+ 'actions/upload-artifact@v7.0.2':
+ ref: 'v7.0.2'
+ commit: 'sha1-cf430e030ddbb5b0abf93d22962f4752f3646cd9'
owner_id: 44036562
repo_id: 192625955
- 'actions/upload-pages-artifact@v3.0.1':
- ref: 'v3.0.1'
- commit: 'sha1-56afc609e74202658d3ffba0e8f6dda462b719fa'
+ 'actions/upload-pages-artifact@v5.0.0':
+ ref: 'v5.0.0'
+ commit: 'sha1-fc324d3547104276b827a68afc52ff2a11cc49c9'
owner_id: 44036562
repo_id: 496012378
uses:
- - 'actions/upload-artifact@v4'
- 'denoland/setup-deno@v2.0.4':
- ref: 'v2.0.4'
- commit: 'sha1-667a34cdef165d8d2b2e98dde39547c9daac7282'
+ - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
+ 'denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed':
+ ref: 'v2.0.5'
+ commit: 'sha1-22d081ff2d3a40755e97629de92e3bcbfa7cf2ed'
+ owner_id: 42048915
+ repo_id: 356423100
+ 'denoland/setup-deno@v2.0.5':
+ ref: 'v2.0.5'
+ commit: 'sha1-22d081ff2d3a40755e97629de92e3bcbfa7cf2ed'
owner_id: 42048915
repo_id: 356423100
+ 'dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8':
+ ref: 'v1'
+ commit: 'sha1-683b588c487a69d01f6c6ddf40f036ff682cc2c8'
+ owner_id: 1940490
+ repo_id: 260749683
'dtolnay/rust-toolchain@v1':
ref: 'v1'
commit: 'sha1-02cb101ec7c40f2c49e1d9714d64511d8e1b74de'
owner_id: 1940490
repo_id: 260749683
- 'erlef/setup-beam@v1.24.0':
- ref: 'v1.24.0'
- commit: 'sha1-fc68ffb90438ef2936bbb3251622353b3dcb2f93'
+ 'editorconfig-checker/action-editorconfig-checker@51f63319f592f97930c73d9c46184d20bd206393':
+ ref: 'v3.0.0'
+ commit: 'sha1-51f63319f592f97930c73d9c46184d20bd206393'
+ owner_id: 26415196
+ repo_id: 297874902
+ 'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124':
+ ref: 'v1.24.1'
+ commit: 'sha1-54075bcc5e249e4758d363f27d099f55d843f124'
+ owner_id: 47606891
+ repo_id: 331103973
+ 'erlef/setup-beam@v1.24.1':
+ ref: 'v1.24.1'
+ commit: 'sha1-54075bcc5e249e4758d363f27d099f55d843f124'
owner_id: 47606891
repo_id: 331103973
- 'github/codeql-action@v4.32.6':
- ref: 'v4.32.6'
- commit: 'sha1-0d579ffd059c29b07949a3cce3983f0780820c98'
+ 'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63':
+ ref: 'v4.38.0'
+ commit: 'sha1-b96794f015dfd88f77b49b1c93e0fa7110f94c63'
owner_id: 9919
repo_id: 259445878
- 'github/codeql-action@v4.34.0':
- ref: 'v4.34.0'
- commit: 'sha1-c6f931105cb2c34c8f901cc885ba1e2e259cf745'
+ 'github/codeql-action@v4.39.0':
+ ref: 'v4.39.0'
+ commit: 'sha1-6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee'
owner_id: 9919
repo_id: 259445878
- 'hyperpolymath/smtp-notify-action@v0.2.0':
- ref: 'v0.2.0'
- commit: 'sha1-ede1191ef6ff3ac02c4f4d9efdf837ee517e11d7'
+ 'hyperpolymath/smtp-notify-action@v0.5.0':
+ ref: 'v0.5.0'
+ commit: 'sha1-c1c9fa07992a02c1fd3d67a0dc1b08cccb852aef'
owner_id: 6759885
repo_id: 1352485172
+ 'hyperpolymath/standards@e16a23170fa378bf3b1444c3ee94100413ae3ff7':
+ ref: 'e16a23170fa378bf3b1444c3ee94100413ae3ff7'
+ commit: 'sha1-e16a23170fa378bf3b1444c3ee94100413ae3ff7'
+ owner_id: 6759885
+ repo_id: 1116521501
+ uses:
+ - 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
+ - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
+ - 'actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9'
+ - 'denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed'
+ - 'dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8'
+ - 'editorconfig-checker/action-editorconfig-checker@51f63319f592f97930c73d9c46184d20bd206393'
+ - 'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124'
+ - 'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63'
+ - 'ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e'
+ - 'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6'
+ - 'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555'
'mlugg/setup-zig@v2.2.1':
ref: 'v2.2.1'
commit: 'sha1-d1434d08867e3ee9daa34448df10607b98908d29'
owner_id: 7289241
repo_id: 812112570
+ 'ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e':
+ ref: 'v2.5.0'
+ commit: 'sha1-fa7117db83c52d787ae5a89f350999701505d78e'
+ owner_id: 67707773
+ repo_id: 421101922
+ 'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6':
+ ref: 'v2.2.0'
+ commit: 'sha1-0c5077e51419868618aeaa5fe8019c62421857d6'
+ owner_id: 108928776
+ repo_id: 512644635
'oven-sh/setup-bun@v2.2.0':
ref: 'v2.2.0'
commit: 'sha1-0c5077e51419868618aeaa5fe8019c62421857d6'
owner_id: 108928776
repo_id: 512644635
- 'peter-evans/repository-dispatch@v3.0.0':
- ref: 'v3.0.0'
- commit: 'sha1-ff45666b9427631e3450c54a1bcbee4d9ff4d7c0'
+ 'peter-evans/repository-dispatch@v4.0.1':
+ ref: 'v4.0.1'
+ commit: 'sha1-28959ce8df70de7be546dd1250a005dd32156697'
owner_id: 18365890
repo_id: 220359305
- 'softprops/action-gh-release@v2.6.2':
- ref: 'v2.6.2'
- commit: 'sha1-3bb12739c298aeb8a4eeaf626c5b8d85266b0e65'
- owner_id: 2242
- repo_id: 204253808
- 'sonarsource/sonarqube-scan-action@v8.1.0':
- ref: 'v8.1.0'
- commit: 'sha1-7006c4492b2e0ee0f816d36501671557c97f5995'
- owner_id: 545988
- repo_id: 366408409
- 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9':
- ref: 'v6.1.0'
- commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
- owner_id: 44036562
- repo_id: 215566462
- 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1':
- ref: 'v7.0.1'
- commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
- owner_id: 44036562
- repo_id: 197814629
- 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a':
- ref: 'v7.0.1'
- commit: 'sha1-043fb46d1a93c77aae656e7c1c64a875d1fc6a0a'
- owner_id: 44036562
- repo_id: 192625955
- 'actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08':
- ref: 'v4.6.0'
- commit: 'sha1-65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08'
- owner_id: 44036562
- repo_id: 192625955
- 'denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed':
- ref: 'v2.0.5'
- commit: 'sha1-22d081ff2d3a40755e97629de92e3bcbfa7cf2ed'
- owner_id: 42048915
- repo_id: 356423100
- 'dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772':
- ref: 'stable'
- commit: 'sha1-6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772'
- owner_id: 1940490
- repo_id: 260749683
- 'editorconfig-checker/action-editorconfig-checker@840e866d93b8e032123c23bac69dece044d4d84c':
- ref: 'v2.2.0'
- commit: 'sha1-840e866d93b8e032123c23bac69dece044d4d84c'
- owner_id: 26415196
- repo_id: 297874902
- 'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124':
- ref: 'v1.24.1'
- commit: 'sha1-54075bcc5e249e4758d363f27d099f55d843f124'
- owner_id: 47606891
- repo_id: 331103973
- 'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc':
- ref: 'v2.4.4'
- commit: 'sha1-2d1146689b8cda280b9bc96326124645441f03bc'
- owner_id: 67707773
- repo_id: 421101922
+ 'slsa-framework/slsa-github-generator@f7dd8c54c2067bafc12ca7a55595d5ee9b75204a':
+ ref: 'f7dd8c54c2067bafc12ca7a55595d5ee9b75204a'
+ commit: 'sha1-f7dd8c54c2067bafc12ca7a55595d5ee9b75204a'
+ owner_id: 80431187
+ repo_id: 475074978
+ uses:
+ - 'actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08'
+ - 'slsa-framework/slsa-github-generator@v2.1.0'
+ - 'softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda'
+ 'slsa-framework/slsa-github-generator@v2.1.0':
+ ref: 'v2.1.0'
+ commit: 'sha1-f7dd8c54c2067bafc12ca7a55595d5ee9b75204a'
+ owner_id: 80431187
+ repo_id: 475074978
'softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda':
ref: 'v2.2.1'
commit: 'sha1-c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda'
owner_id: 2242
repo_id: 204253808
+ 'softprops/action-gh-release@v3.0.3':
+ ref: 'v3.0.3'
+ commit: 'sha1-efb35369e0ad2afab669f228072c1b0d510eae64'
+ owner_id: 2242
+ repo_id: 204253808
+ 'sonarsource/sonarqube-scan-action@v8.3.0':
+ ref: 'v8.3.0'
+ commit: 'sha1-d209202bc7d53ff1cc128f7f907dac145c9d6ae9'
+ owner_id: 545988
+ repo_id: 366408409
'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555':
ref: 'v0.10.0'
commit: 'sha1-e83874834305fe9a4a2997156cb26c5de65a8555'
diff --git a/.github/workflows/backend-assurance.yml b/.github/workflows/backend-assurance.yml
index 1b83a8e1..c1bacb70 100644
--- a/.github/workflows/backend-assurance.yml
+++ b/.github/workflows/backend-assurance.yml
@@ -48,7 +48,7 @@ jobs:
outputs:
run: ${{ steps.detect.outputs.run }}
steps:
- - uses: actions/checkout@v6.0.2
+ - uses: actions/checkout@v7.0.1
with:
fetch-depth: 0
- id: detect
@@ -74,29 +74,29 @@ jobs:
name: BEAM property tests
needs: changes
if: needs.changes.outputs.run == 'true'
- runs-on: ubuntu-latest
+ runs-on: ubuntu-24.04
timeout-minutes: 10
defaults:
run:
working-directory: elixir
steps:
- - uses: actions/checkout@v6.0.2
+ - uses: actions/checkout@v7.0.1
- name: Set up BEAM (Elixir + OTP)
- uses: erlef/setup-beam@v1.24.0
+ uses: erlef/setup-beam@v1.24.1
with:
elixir-version: '1.18.4'
otp-version: '27.0'
- name: Cache deps + _build
- uses: actions/cache@v4.2.2
+ uses: actions/cache@v6.1.0
with:
path: |
elixir/deps
elixir/_build
- key: backend-assurance-${{ runner.os }}-${{ hashFiles('elixir/mix.lock') }}
+ key: backend-assurance-${{ runner.os }}-${{ env.ImageOS || 'ubuntu24' }}-${{ hashFiles('elixir/mix.lock') }}
restore-keys: |
- backend-assurance-${{ runner.os }}-
+ backend-assurance-${{ runner.os }}-${{ env.ImageOS || 'ubuntu24' }}-
- name: Fetch deps
run: mix deps.get
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 9a2dde99..af4d88ca 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -28,10 +28,10 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 15
steps:
- - uses: actions/checkout@v4.3.1
+ - uses: actions/checkout@v7.0.1
with:
fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis
- name: SonarQube Scan
- uses: SonarSource/sonarqube-scan-action@v8.1.0
+ uses: SonarSource/sonarqube-scan-action@v8.3.0
env:
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index bbf70899..0c6090b0 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -26,7 +26,7 @@ permissions:
jobs:
analyze:
- runs-on: ubuntu-latest
+ runs-on: ubuntu-24.04
timeout-minutes: 60
permissions:
contents: read
@@ -35,6 +35,8 @@ jobs:
fail-fast: false
matrix:
include:
+ - language: actions
+ build-mode: none
- language: javascript-typescript
build-mode: none
# C/C++ CodeQL is intentionally not enabled for the generated
@@ -44,15 +46,17 @@ jobs:
steps:
- name: Checkout
- uses: actions/checkout@v6.0.2
+ uses: actions/checkout@v7.0.1
+ with:
+ persist-credentials: false
- name: Initialize CodeQL
- uses: github/codeql-action/init@v4.34.0
+ uses: github/codeql-action/init@v4.39.0
with:
languages: ${{ matrix.language }}
build-mode: ${{ matrix.build-mode }}
- name: Perform CodeQL Analysis
- uses: github/codeql-action/analyze@v4.34.0
+ uses: github/codeql-action/analyze@v4.39.0
with:
category: "/language:${{ matrix.language }}"
diff --git a/.github/workflows/container-publish.yml b/.github/workflows/container-publish.yml
index a0cfdcc7..cb0625fd 100644
--- a/.github/workflows/container-publish.yml
+++ b/.github/workflows/container-publish.yml
@@ -29,7 +29,7 @@ jobs:
id-token: write # mint the OIDC token the attestation is signed with
attestations: write # write the build-provenance attestation (the "claim")
steps:
- - uses: actions/checkout@v6.0.2
+ - uses: actions/checkout@v7.0.1
- name: Extract version metadata
id: meta
@@ -95,7 +95,7 @@ jobs:
# gh attest verify oci://ghcr.io/${{ github.repository }}: \
# --repo ${{ github.repository }}
- name: Attest container provenance
- uses: actions/attest-build-provenance@v2.4.0
+ uses: actions/attest-build-provenance@v4.2.2
with:
subject-name: ghcr.io/${{ github.repository }}
subject-digest: ${{ steps.push.outputs.digest }}
diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml
index b78cd483..3d832bae 100644
--- a/.github/workflows/dogfood-gate.yml
+++ b/.github/workflows/dogfood-gate.yml
@@ -29,57 +29,105 @@ permissions:
jobs:
# ---------------------------------------------------------------------------
- # Job 1: A2ML manifest validation
+ # Job 1: DEED + legacy A2ML manifest validation
# ---------------------------------------------------------------------------
a2ml-validate:
name: Validate DEED manifests
- runs-on: ubuntu-latest
- timeout-minutes: 5
+ runs-on: ubuntu-24.04
+ timeout-minutes: 10
steps:
- name: Checkout repository
- uses: actions/checkout@v6.0.2
-
- - name: Check for A2ML files
+ uses: actions/checkout@v7.0.1
+ with:
+ persist-credentials: false
+
+ - name: Checkout canonical DEED validator
+ uses: actions/checkout@v7.0.1
+ with:
+ repository: metadatastician/standards
+ ref: 1725bebd3773ea25627479f813283abf1c497a85
+ path: .standards-deed
+ sparse-checkout: 1-formats/deed
+ sparse-checkout-cone-mode: true
+ persist-credentials: false
+
+ - name: Setup Deno runtime
+ uses: denoland/setup-deno@v2.0.5
+ with:
+ deno-version: v2.x
+
+ - name: Check for DEED and A2ML files
id: detect
run: |
+ set -euo pipefail
+ rm -rf "$RUNNER_TEMP/standards-deed"
+ mv "$PWD/.standards-deed" "$RUNNER_TEMP/standards-deed"
+ DEED_NAME="${GITHUB_REPOSITORY#*/}_chora.deed"
+ if [ ! -f "$DEED_NAME" ]; then
+ echo "::error::Missing required repo deed $DEED_NAME at repository root (standards#837)"
+ exit 1
+ fi
+ DEED_COUNT=$(find . -type f -name '*.deed' -not -path './.git/*' | wc -l)
COUNT=$(find . -type f \( -name '*.a2ml' -o -name '*.deed' \) -not -path './.git/*' | wc -l)
+ echo "deed_count=$DEED_COUNT" >> "$GITHUB_OUTPUT"
echo "count=$COUNT" >> "$GITHUB_OUTPUT"
- if [ "$COUNT" -eq 0 ]; then
- echo "::warning::No .a2ml/.deed manifest files found. Every RSR repo should have a repo deed (_chora.deed); legacy 0-AI-MANIFEST.a2ml accepted mid-migration — standards #837"
- fi
- - name: Validate A2ML manifests
+ - name: Validate DEED grammar (deed_lint.js)
+ run: |
+ set -euo pipefail
+ mapfile -t deeds < <(git ls-files -- '*.deed' | sort)
+ deno run --allow-read "$RUNNER_TEMP/standards-deed/1-formats/deed/tools/deed_lint.js" "${deeds[@]}"
+
+ - name: Validate manifest structure
if: steps.detect.outputs.count > 0
run: bash .github/hooks/validate-a2ml.sh
- name: Write summary
+ env:
+ A2ML_COUNT: ${{ steps.detect.outputs.count }}
+ DEED_COUNT: ${{ steps.detect.outputs.deed_count }}
run: |
- A2ML_COUNT="${{ steps.detect.outputs.count }}"
- if [ "$A2ML_COUNT" -eq 0 ]; then
- cat <<'EOF' >> "$GITHUB_STEP_SUMMARY"
- ## A2ML Validation
-
- :warning: **No .a2ml/.deed manifest files found.** Every RSR-compliant repo should have a repo deed (`_chora.deed`) at its root.
-
- Copy one from [rsr-template-repo](https://github.com/hyperpolymath/rsr-template-repo).
- EOF
- else
- echo "## A2ML Validation" >> "$GITHUB_STEP_SUMMARY"
- echo "" >> "$GITHUB_STEP_SUMMARY"
- echo "Scanned **${A2ML_COUNT}** manifest file(s) (.deed, or legacy .a2ml). See step output for details." >> "$GITHUB_STEP_SUMMARY"
- fi
+ echo "## DEED & Manifest Validation" >> "$GITHUB_STEP_SUMMARY"
+ echo "" >> "$GITHUB_STEP_SUMMARY"
+ echo "Validated **${DEED_COUNT}** \`.deed\` file(s) via canonical \`deed_lint.js\` and **${A2ML_COUNT}** total manifest file(s)." >> "$GITHUB_STEP_SUMMARY"
# ---------------------------------------------------------------------------
- # Job 2: K9 contract validation
+ # Job 2: K9 contract validation (L0 + L1 + L2 Nickel contract check)
# ---------------------------------------------------------------------------
k9-validate:
name: Validate K9 contracts
- runs-on: ubuntu-latest
- timeout-minutes: 5
+ runs-on: ubuntu-24.04
+ timeout-minutes: 15
+ env:
+ NICKEL_VERSION: '1.18.0'
+ NICKEL_SHA256: '9cba4dd65ae9915ec61f73033aafcff307a377665a83fd8f530df086763318cb'
steps:
- name: Checkout repository
- uses: actions/checkout@v6.0.2
+ uses: actions/checkout@v7.0.1
+ with:
+ persist-credentials: false
+
+ - name: Checkout canonical K9 validator
+ uses: actions/checkout@v7.0.1
+ with:
+ repository: metadatastician/standards
+ ref: 1725bebd3773ea25627479f813283abf1c497a85
+ path: .standards-k9
+ sparse-checkout: 1-formats/k9
+ sparse-checkout-cone-mode: true
+ persist-credentials: false
+
+ - name: Install sha256-verified Nickel CLI
+ run: |
+ set -euo pipefail
+ rm -rf "$RUNNER_TEMP/standards-k9"
+ mv "$PWD/.standards-k9" "$RUNNER_TEMP/standards-k9"
+ URL="https://github.com/tweag/nickel/releases/download/${NICKEL_VERSION}/nickel-x86_64-linux"
+ curl -sSfL --proto '=https' --proto-redir '=https' --tlsv1.2 --retry 3 -o "$RUNNER_TEMP/nickel" "$URL"
+ echo "${NICKEL_SHA256} ${RUNNER_TEMP}/nickel" | sha256sum -c -
+ chmod +x "$RUNNER_TEMP/nickel"
+ echo "$RUNNER_TEMP" >> "$GITHUB_PATH"
- name: Check for K9 files
id: detect
@@ -94,25 +142,40 @@ jobs:
echo "::warning::Found $CONFIG_COUNT config files but no K9 contracts. Run k9iser to generate contracts."
fi
- - name: Validate K9 contracts
+ - name: Validate K9 contracts (canonical L0+L1+L2 + repo hook)
if: steps.detect.outputs.k9_count > 0
- run: bash .github/hooks/validate-k9.sh
+ run: |
+ set -euo pipefail
+ mapfile -t k9_files < <(git ls-files -- '*.k9' '*.k9.ncl' | sort)
+ set +e
+ k9_out="$(bash "$RUNNER_TEMP/standards-k9/1-formats/k9/tools/k9-validate.sh" --layer L2 --strict "${k9_files[@]}" 2>&1)"
+ k9_rc=$?
+ set -e
+ printf '%s\n' "$k9_out"
+ if [ "$k9_rc" -ne 0 ]; then
+ while IFS= read -r line; do
+ [ -n "$line" ] && echo "::error::$line"
+ done <<< "$k9_out"
+ exit "$k9_rc"
+ fi
+ bash .github/hooks/validate-k9.sh
- name: Write summary
+ env:
+ K9_COUNT: ${{ steps.detect.outputs.k9_count }}
+ CFG_COUNT: ${{ steps.detect.outputs.config_count }}
run: |
- K9_COUNT="${{ steps.detect.outputs.k9_count }}"
- CFG_COUNT="${{ steps.detect.outputs.config_count }}"
if [ "$K9_COUNT" -eq 0 ]; then
cat <<'EOF' >> "$GITHUB_STEP_SUMMARY"
## K9 Contract Validation
- :warning: **No .a2ml/.deed manifest files found.** Every RSR-compliant repo should have a repo deed (`_chora.deed`) at its root.
+ :warning: **No K9 contracts found.**
Generate contracts with: `k9iser generate .`
EOF
else
echo "## K9 Contract Validation" >> "$GITHUB_STEP_SUMMARY"
echo "" >> "$GITHUB_STEP_SUMMARY"
- echo "Validated **${K9_COUNT}** K9 contract(s) against **${CFG_COUNT}** config file(s)." >> "$GITHUB_STEP_SUMMARY"
+ echo "Validated **${K9_COUNT}** K9 contract(s) (L0+L1+L2 Nickel contract check) against **${CFG_COUNT}** config file(s)." >> "$GITHUB_STEP_SUMMARY"
fi
# ---------------------------------------------------------------------------
@@ -120,12 +183,14 @@ jobs:
# ---------------------------------------------------------------------------
empty-lint:
name: Empty-linter (invisible characters)
- runs-on: ubuntu-latest
+ runs-on: ubuntu-24.04
timeout-minutes: 15
steps:
- name: Checkout repository
- uses: actions/checkout@v6.0.2
+ uses: actions/checkout@v7.0.1
+ with:
+ persist-credentials: false
- name: Scan for invisible characters
id: lint
@@ -216,12 +281,14 @@ jobs:
# ---------------------------------------------------------------------------
groove-check:
name: Groove manifest check
- runs-on: ubuntu-latest
+ runs-on: ubuntu-24.04
timeout-minutes: 5
steps:
- name: Checkout repository
- uses: actions/checkout@v6.0.2
+ uses: actions/checkout@v7.0.1
+ with:
+ persist-credentials: false
- name: Check for Groove manifest
id: groove
@@ -275,12 +342,14 @@ jobs:
# ---------------------------------------------------------------------------
eclexiaiser-validate:
name: Validate eclexiaiser manifest
- runs-on: ubuntu-latest
+ runs-on: ubuntu-24.04
timeout-minutes: 5
steps:
- name: Checkout repository
- uses: actions/checkout@v6.0.2
+ uses: actions/checkout@v7.0.1
+ with:
+ persist-credentials: false
- name: Check and validate eclexiaiser manifest
id: eclex
@@ -321,14 +390,16 @@ jobs:
# ---------------------------------------------------------------------------
dogfood-summary:
name: Dogfooding compliance summary
- runs-on: ubuntu-latest
+ runs-on: ubuntu-24.04
needs: [a2ml-validate, k9-validate, empty-lint, groove-check, eclexiaiser-validate]
if: always()
timeout-minutes: 5
steps:
- name: Checkout repository
- uses: actions/checkout@v6.0.2
+ uses: actions/checkout@v7.0.1
+ with:
+ persist-credentials: false
- name: Generate dogfooding scorecard
run: |
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index d34e9f76..49db7d92 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -35,7 +35,7 @@ jobs:
outputs:
run: ${{ steps.detect.outputs.run }}
steps:
- - uses: actions/checkout@v6.0.2
+ - uses: actions/checkout@v7.0.1
with:
fetch-depth: 0
- id: detect
@@ -62,12 +62,12 @@ jobs:
name: E2E — Full REST + MCP Bridge
needs: changes
if: needs.changes.outputs.run == 'true'
- runs-on: ubuntu-latest
+ runs-on: ubuntu-24.04
timeout-minutes: 15
steps:
- name: Checkout
- uses: actions/checkout@v6.0.2
+ uses: actions/checkout@v7.0.1
- name: Install Zig
uses: mlugg/setup-zig@v2.2.1
@@ -75,7 +75,7 @@ jobs:
version: 0.16.0
- name: Install Deno
- uses: denoland/setup-deno@v2.0.4
+ uses: denoland/setup-deno@v2.0.5
with:
deno-version: v2.x
@@ -83,7 +83,7 @@ jobs:
# tests/e2e_full.sh requires `mix` on PATH to start the Elixir
# backend (elixir/ — `mix run --no-halt`). Pinned to match the
# estate convention (see hypatia-scan.yml across the org).
- uses: erlef/setup-beam@v1.24.0
+ uses: erlef/setup-beam@v1.24.1
with:
elixir-version: '1.18'
otp-version: '27'
@@ -116,7 +116,7 @@ jobs:
- name: Upload test logs
if: always()
- uses: actions/upload-artifact@v4.6.2
+ uses: actions/upload-artifact@v7.0.2
with:
name: e2e-full-logs
path: /tmp/boj-e2e-test.*
@@ -132,7 +132,7 @@ jobs:
steps:
- name: Checkout
- uses: actions/checkout@v6.0.2
+ uses: actions/checkout@v7.0.1
- name: Install Zig
uses: mlugg/setup-zig@v2.2.1
@@ -155,7 +155,7 @@ jobs:
steps:
- name: Checkout
- uses: actions/checkout@v6.0.2
+ uses: actions/checkout@v7.0.1
- name: Run aspect tests
run: bash tests/aspect_tests.sh
@@ -170,7 +170,7 @@ jobs:
steps:
- name: Checkout
- uses: actions/checkout@v6.0.2
+ uses: actions/checkout@v7.0.1
- name: Install Zig
uses: mlugg/setup-zig@v2.2.1
@@ -185,7 +185,7 @@ jobs:
- name: Upload benchmark results
if: always()
- uses: actions/upload-artifact@v4.6.2
+ uses: actions/upload-artifact@v7.0.2
with:
name: benchmark-results
path: ffi/zig/zig-out/bench*
@@ -224,18 +224,18 @@ jobs:
steps:
- name: Checkout
- uses: actions/checkout@v6.0.2
+ uses: actions/checkout@v7.0.1
- name: Setup Node
# Node is needed on every leg: it is the subject on the node
# leg and the boot-smoke orchestrator on all three.
- uses: actions/setup-node@v4.4.0
+ uses: actions/setup-node@v7.1.0
with:
node-version: '22'
- name: Install Deno
if: matrix.runtime == 'deno'
- uses: denoland/setup-deno@v2.0.4
+ uses: denoland/setup-deno@v2.0.5
with:
deno-version: v2.x
@@ -270,10 +270,10 @@ jobs:
steps:
- name: Checkout
- uses: actions/checkout@v6.0.2
+ uses: actions/checkout@v7.0.1
- name: Setup Node
- uses: actions/setup-node@v4.4.0
+ uses: actions/setup-node@v7.1.0
with:
node-version: '22'
@@ -282,7 +282,7 @@ jobs:
- name: Upload bridge bench artifact
if: always()
- uses: actions/upload-artifact@v4.6.2
+ uses: actions/upload-artifact@v7.0.2
with:
name: bench-bridge-results
path: bench-bridge.txt
@@ -293,7 +293,7 @@ jobs:
# Advisory — a comment failure must never gate the bench job.
# Same reasoning as the hypatia-scan PR-comment step.
continue-on-error: true
- uses: actions/github-script@v8.0.0
+ uses: actions/github-script@v9.0.0
with:
script: |
const fs = require('fs');
diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml
index 7afaeba6..fdf1f47c 100644
--- a/.github/workflows/fuzz.yml
+++ b/.github/workflows/fuzz.yml
@@ -28,7 +28,7 @@ jobs:
permissions:
contents: read
steps:
- - uses: actions/checkout@v6.0.2
+ - uses: actions/checkout@v7.0.1
- name: Install Zig
uses: mlugg/setup-zig@v2.2.1
@@ -56,7 +56,7 @@ jobs:
permissions:
contents: read
steps:
- - uses: actions/checkout@v6.0.2
+ - uses: actions/checkout@v7.0.1
- name: Fuzz JSON-RPC message parsing
run: |
diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml
index a964439c..39e4910f 100644
--- a/.github/workflows/governance.yml
+++ b/.github/workflows/governance.yml
@@ -1,17 +1,10 @@
# This workflow is managed by gh actions-lock.
# SPDX-License-Identifier: MPL-2.0
-# This workflow is managed by gh actions-lock.
-# This workflow is managed by gh actions-lock.
-# governance.yml — single wrapper calling the shared estate governance bundle
-# in hyperpolymath/standards instead of carrying per-repo copies.
-#
-# Replaces the per-repo governance scaffolding removed in the same commit:
-# quality.yml, guix-guix-policy.yml, npm-bun-blocker.yml, ts-blocker.yml,
-# security-policy.yml, rsr-antipattern.yml, wellknown-enforcement.yml,
-# workflow-linter.yml
-#
-# Load-bearing build/security workflows stay standalone in the repo
-# (rust-ci, codeql, dependabot, release, scan/mirror/pages plumbing).
+# governance.yml — Estate governance checks ported from
+# metadatastician/standards/.github/workflows/governance-reusable.yml
+# (@1725bebd3773ea25627479f813283abf1c497a85) via actions/checkout while
+# hyperpolymath's Actions allowlist omits metadatastician/standards@* as a
+# reusable workflow owner.
name: Governance
@@ -21,10 +14,6 @@ on:
pull_request:
workflow_dispatch:
-# Estate guardrail: cancel superseded runs so re-pushes / rebased PR
-# updates do not pile up queued runs against the shared account-wide
-# Actions concurrency pool. Applied only to read-only check workflows
-# (no publish/mutation), so cancelling a superseded run is always safe.
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
@@ -35,9 +24,72 @@ permissions:
jobs:
governance:
- # Previous 5a0891e9 pin predates hyperpolymath/standards#1271 (f335165),
- # which fixed actions.lock leaf tag refs so runner job setup succeeds,
- # and hyperpolymath/standards#1260 (UUID v8 conformance).
- uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@e16a23170fa378bf3b1444c3ee94100413ae3ff7
- secrets:
- HYPATIA_SCAN_PAT: ${{ secrets.HYPATIA_SCAN_PAT }}
+ name: governance
+ runs-on: ubuntu-24.04
+ timeout-minutes: 20
+ steps:
+ - name: Checkout repository
+ uses: actions/checkout@v7.0.1
+ with:
+ fetch-depth: 0
+ persist-credentials: false
+
+ - name: Checkout canonical standards tools
+ uses: actions/checkout@v7.0.1
+ with:
+ repository: metadatastician/standards
+ ref: 1725bebd3773ea25627479f813283abf1c497a85
+ path: .standards-ci
+ persist-credentials: false
+
+ - name: Relocate standards tools outside workspace scan root
+ run: |
+ set -euo pipefail
+ rm -rf "$RUNNER_TEMP/standards-ci"
+ mv "$PWD/.standards-ci" "$RUNNER_TEMP/standards-ci"
+
+ - name: Verify workflow syntax, lockfile sync, and closure
+ run: |
+ set -euo pipefail
+ bash "$RUNNER_TEMP/standards-ci/tools/policy/check-workflows-parse.sh" .
+ bash "$RUNNER_TEMP/standards-ci/scripts/check-lock-sync.sh" .github/workflows
+ bash "$RUNNER_TEMP/standards-ci/scripts/close-lock.sh" --check .github/workflows/actions.lock
+ bash "$RUNNER_TEMP/standards-ci/scripts/check-workflow-duplicate-keys.sh" .github/workflows
+
+ - name: Verify UUID-v8 conformance (ADR-008 / D320)
+ run: |
+ set -euo pipefail
+ chmod +x "$RUNNER_TEMP/standards-ci/scripts/check-uuid-v8.sh"
+ "$RUNNER_TEMP/standards-ci/scripts/check-uuid-v8.sh" --strict .
+
+ - name: Verify licence consistency, language policy, TS allowlist, packaging, and docs
+ run: |
+ set -euo pipefail
+ bash "$RUNNER_TEMP/standards-ci/scripts/check-licence-consistency.sh" .
+ bash "$RUNNER_TEMP/standards-ci/tools/policy/check-language-policy.sh" .
+ bash "$RUNNER_TEMP/standards-ci/scripts/check-ts-allowlist.sh"
+ bash "$RUNNER_TEMP/standards-ci/scripts/check-package-policy.sh" .
+ bash "$RUNNER_TEMP/standards-ci/scripts/check-docs-presence.sh" .
+
+ - name: Verify exemption and debt ratchets against base branch
+ env:
+ BASE_REF: ${{ github.base_ref }}
+ run: |
+ set -euo pipefail
+ TARGET_REF="origin/${BASE_REF:-main}"
+ if git rev-parse --verify "$TARGET_REF" >/dev/null 2>&1; then
+ bash "$RUNNER_TEMP/standards-ci/scripts/check-exemption-ratchet.sh" "$TARGET_REF"
+ bash "$RUNNER_TEMP/standards-ci/scripts/check-debt-ratchet.sh" "$TARGET_REF"
+ else
+ bash "$RUNNER_TEMP/standards-ci/scripts/check-exemption-ratchet.sh" HEAD~1
+ bash "$RUNNER_TEMP/standards-ci/scripts/check-debt-ratchet.sh" HEAD~1
+ fi
+
+ - name: Verify trusted-base reduction, shebangs, and A2ML/K9 repository hooks
+ run: |
+ set -euo pipefail
+ bash "$RUNNER_TEMP/standards-ci/scripts/check-trusted-base.sh" .
+ bash scripts/check-trusted-base.sh
+ bash scripts/check-shebang-first.sh
+ bash .github/hooks/validate-a2ml.sh
+ bash .github/hooks/validate-k9.sh
diff --git a/.github/workflows/hcg-surface-drift.yml b/.github/workflows/hcg-surface-drift.yml
index b1e447d0..aea0a2ee 100644
--- a/.github/workflows/hcg-surface-drift.yml
+++ b/.github/workflows/hcg-surface-drift.yml
@@ -53,7 +53,7 @@ jobs:
outputs:
run: ${{ steps.detect.outputs.run }}
steps:
- - uses: actions/checkout@v6.0.2
+ - uses: actions/checkout@v7.0.1
with:
fetch-depth: 0
- id: detect
@@ -88,7 +88,7 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 5
steps:
- - uses: actions/checkout@v6.0.2
+ - uses: actions/checkout@v7.0.1
- name: Confirm script + inputs are present
run: |
set -euo pipefail
diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index bb2f17c4..13b6934a 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -46,17 +46,19 @@ permissions:
jobs:
scan:
name: Hypatia Neurosymbolic Analysis
- runs-on: ubuntu-latest
+ # Pin to ubuntu-24.04: erlef/setup-beam rejects ImageOS=ubuntu26 following
+ # GitHub's Oct 19, 2026 ubuntu-latest migration.
+ runs-on: ubuntu-24.04
timeout-minutes: 15
steps:
- name: Checkout repository
- uses: actions/checkout@v6.0.2
+ uses: actions/checkout@v7.0.1
with:
fetch-depth: 0 # Full history for better pattern analysis
- name: Setup Elixir for Hypatia scanner
- uses: erlef/setup-beam@v1.24.0
+ uses: erlef/setup-beam@v1.24.1
with:
elixir-version: '1.18'
otp-version: '27'
@@ -110,13 +112,14 @@ jobs:
echo "- Medium: $MEDIUM" >> $GITHUB_STEP_SUMMARY
- name: Upload findings artifact
- uses: actions/upload-artifact@v4.6.2
+ uses: actions/upload-artifact@v7.0.2
with:
name: hypatia-findings
path: hypatia-findings.json
retention-days: 90
- name: Convert Hypatia findings to SARIF
+ id: sarif
# Always runs (no findings_count guard): an EMPTY SARIF run is
# valid and intentional — uploading it clears stale Hypatia
# alerts from the code-scanning page when a repo goes clean.
@@ -244,9 +247,10 @@ jobs:
# handled in the converter above and does not error here.
if: >-
always() &&
+ steps.sarif.outcome == 'success' &&
(github.event_name != 'pull_request' ||
github.event.pull_request.head.repo.fork != true)
- uses: github/codeql-action/upload-sarif@v4.32.6
+ uses: github/codeql-action/upload-sarif@v4.39.0
with:
sarif_file: hypatia.sarif
# Distinct category so Hypatia results coexist with CodeQL's
@@ -386,12 +390,16 @@ jobs:
# the pull-requests: write permission above: a token/API hiccup or
# a fork PR (read-only token) skips the comment, not the check.
continue-on-error: true
- uses: actions/github-script@v8.0.0
+ uses: actions/github-script@v9.0.0
with:
script: |
const fs = require('fs');
const findings = JSON.parse(fs.readFileSync('hypatia-findings.json', 'utf8'));
+ const rank = { critical: 0, high: 1, medium: 2, low: 3 };
+ const sorted = [...findings].sort(
+ (a, b) => (rank[a.severity] ?? 9) - (rank[b.severity] ?? 9)
+ );
const critical = findings.filter(f => f.severity === 'critical').length;
const high = findings.filter(f => f.severity === 'high').length;
@@ -406,8 +414,8 @@ jobs:
comment += `⚠️ **Action Required:** Critical security issues found!\n\n`;
}
- comment += `View findings
\n\n`;
- comment += `\`\`\`json\n${JSON.stringify(findings.slice(0, 10), null, 2)}\n\`\`\`\n`;
+ comment += `View findings (sorted by severity)
\n\n`;
+ comment += `\`\`\`json\n${JSON.stringify(sorted.slice(0, 25), null, 2)}\n\`\`\`\n`;
comment += `