Repository navigation
chore(deps): bump the actions group with 2 updates - #462
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps the actions group with 2 updates: [taiki-e/install-action](https://github.com/taiki-e/install-action) and [hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml](https://github.com/hyperpolymath/panic-attack). Updates `taiki-e/install-action` from 2.87.32 to 2.90.0 - [Release notes](https://github.com/taiki-e/install-action/releases) - [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md) - [Commits](taiki-e/install-action@v2.87.32...v2.90.0) Updates `hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml` from be6ac46716eaf049570ec4966f4ae4699b319689 to d4cef9d4a05670ecb0db1127be2387f06eae73fd - [Release notes](https://github.com/hyperpolymath/panic-attack/releases) - [Changelog](https://github.com/hyperpolymath/panic-attack/blob/main/CHANGELOG.adoc) - [Commits](hyperpolymath/panic-attack@be6ac46...d4cef9d) --- updated-dependencies: - dependency-name: taiki-e/install-action dependency-version: 2.90.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml dependency-version: d4cef9d4a05670ecb0db1127be2387f06eae73fd dependency-type: direct:production dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
Important Review skippedBot user detected. To trigger a single review, invoke the
 |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7d5b8f7319
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| - 'hyperpolymath/proven-cicd@a12b2b4644db1a1250bc50b58fd24c99f89f564e' | ||
| '.github/workflows/security-scan.yml': | ||
| - 'hyperpolymath/panic-attack@be6ac46716eaf049570ec4966f4ae4699b319689' | ||
| '.github/workflows/security-scan.yml': [] |
There was a problem hiding this comment.
When the governance lockfile verifier processes security-scan.yml, it finds the reusable workflow pinned at d4cef9d..., but this row now declares no dependency and the corresponding hyperpolymath/panic-attack dependency record was deleted. This makes the required Actions lockfile check report an invalid lockfile and drops coverage of the workflow's transitive action pins; regenerate the lock with the official tooling so the new reusable-workflow ref is recorded.
Useful? React with 👍 / 👎.
…g casts) (#465) ## Summary Three checks fail on `main` (`2ab7574`), so every open PR is red on them. This PR fixes all three. It replaces #467 and #468, which carried the same commits and are now closed. | Check | Cause | Fix (commit) | |---|---|---| | `Dependency audit`, `rust-ci / Cargo audit` | `rmcp` 3.5.0 (`crates/echidna-mcp`) has RUSTSEC-2026-0457, -0461 and -0462, published after `main` last passed | `Cargo.lock` only: `rmcp` and `rmcp-macros` move to 3.9.0, inside the existing `"3"` requirement (`20dc691`) | | `rust-ci / Cargo check + clippy + fmt` | `cargo fmt --check` drift in `src/rust/proof_search.rs` | `cargo fmt`, formatting only (`17ebbb1`) | | `governance / Validate Hypatia Baseline` | Hypatia `code_safety/zig_ptr_cast` and `zig_align_cast` are high on the nine `@ptrCast(@aligncast(raw))` lines in `src/zig_ffi/` | A reasoned inline `hypatia: allow` per rule on each line, with no baseline entry (`f48fe0a`) | Every one of those casts gets a callback's own `*@this()` back from the type-erased `*anyopaque` it was registered with: `runtime_owner.Work.context`, or a `std.mem.Allocator` vtable's `ptr`. So each cast restores the pointer's original type and alignment. Order of preference: fix > inline directive > `.hypatia-ignore` > baseline. ## Changes - `Cargo.lock`: `rmcp` and `rmcp-macros` 3.5.0 → 3.9.0. - `src/rust/proof_search.rs`: `rustfmt` only. - `src/zig_ffi/chapel_bridge.zig` and `src/zig_ffi/runtime_owner.zig`: comments only. ## RSR Quality Checklist ### Required - [x] Code is formatted: `cargo fmt --all -- --check` passes. - [x] Linter is clean: `cargo clippy --all-targets --locked -- -D warnings` passes locally. - [x] No secrets, credentials or `.env` files. ## Testing - `cargo audit`: no vulnerabilities. - `cargo check -p echidna-mcp --locked`: passes. The crate has no tests. - Hypatia: the scanner could not be built here because hex.pm is unreachable. I simulated its suppression logic instead: `directive_re` and `ScannerSuppression.inline_allowed?/4` at hypatia `82396d81`, the CI pin. That reports 18 unsuppressed findings on `main` (9 casts × 2 rules) and 0 on this branch. - Zig isn't available here. The Zig change is comments only, so it can't affect the build. ## Checks still red, and not caused by this PR - **`Deposit findings for gitbot-fleet`, `Isabelle/HOL`, `scan / scan`:** also red on `main`. - **`panic-attack assail`:** fails with "Scanner completion receipt is missing, incomplete or inconsistent". It is also red on #462 and #463. - **`rust-ci / llvm-cov line coverage`** on `20dc691`: - **What failed:** `provers::chuffed::tests::version_requires_a_successful_help_response_and_closed_stdin` exited with `Text file busy (os error 26)`. - **Root cause:** `ETXTBSY`. A test writes its fake prover script and then executes it. If another test thread forks in between, the child inherits the still-open write descriptor, and the kernel refuses to execute the file while it is open for writing. The same pattern exists in the fixtures in `chuffed.rs`, `gpuverify.rs`, `faial.rs`, `version_probe.rs` and `proof_search.rs`. - **What I did:** re-ran the job once to confirm the failure is intermittent. - **Proposed fix (separate PR):** a shared test helper that retries the spawn on `io::ErrorKind::ExecutableFileBusy`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3 --------- Co-authored-by: Claude <noreply@anthropic.com>
|
Looks like these dependencies are updatable in another way, so this is no longer needed. |
Bumps the actions group with 2 updates: taiki-e/install-action and hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml.
Updates
taiki-e/install-actionfrom 2.87.32 to 2.90.0Release notes
Sourced from taiki-e/install-action's releases.
... (truncated)
Changelog
Sourced from taiki-e/install-action's changelog.
... (truncated)
Commits
b80e2bbRelease 2.90.0eb7aa1cAddfallback: skipinput optionc846932Update zizmor manifest29b5f80Updatevacuum@latestto 0.36.29787a83Update uv manifest8d24cc9Update typos manifest55b8476Update tombi manifestdcaca98Updaterelease-plz@latestto 0.4.3ee94ee5Update cargo-nextest manifest8c19464Updatebpf-linker@latestto 0.13.0Updates
hyperpolymath/panic-attack/.github/workflows/scan-and-report.ymlfrom be6ac46716eaf049570ec4966f4ae4699b319689 to d4cef9d4a05670ecb0db1127be2387f06eae73fdChangelog
Sourced from hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml's changelog.
... (truncated)
Commits
d4cef9dchore(deps): bump the rust-minor group across 1 directory with 3 updates (#260)96be279feat(assail): write a KYAML copy beside the sealed JSON report (#264)ebc984dchore(deps): bump the actions group across 1 directory with 4 updates (#252)9943a0cchore(deps): bump toml_edit from 0.23.10+spec-1.0.0 to 0.25.0+spec-1.1.0 (#256)1b766abfeat(attest): verify --report and --require-bound (#263)41966b7fix(deps): bump ijson-jcs to 03df9ed for RFC 8785 number ties (#261)0a4159bfix(attestation): hash evidence counts as u64 on every platform (#262)fb153cafix(assail): execute configuration and build input coverage (#258)5175a68fix(deps): move clipboard-win off a yanked release (#259)44eca00fix(ci): supply release-tag version to pinned Idris installer (#257)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions