[dependabot]

Bumps the actions group with 1 update: hyperpolymath/cicd-squabbler/.github/actions/squabble.

Updates hyperpolymath/cicd-squabbler/.github/actions/squabble from b625e05da04c0b72fe2ca19bd009841ff982f43d to 79d7dbacc8a02b4a4388b4a36fe46893b5b7ce73

Changelog

Sourced from hyperpolymath/cicd-squabbler/.github/actions/squabble's changelog.

== Changelog

All notable changes to this project will be documented in this file.

The format is based on https://keepachangelog.com/en/1.1.0/[Keep a Changelog], and this project adheres to https://semver.org/spec/v2.0.0.html[Semantic Versioning].

=== [Unreleased]

==== Added

• scripts/local-verify.sh (and just local-verify) — runs every gate CI runs, locally, and leaves one bundle (SUMMARY.txt inside a timestamped $TMPDIR directory) carrying per-step status, the errors extracted from each log, the toolchain identity and the before/after worktree state. It writes nothing into the repository, and it delegates installation to scripts/install-toolchain.sh so nothing it installs is unverified. Status vocabulary is the estate's: PASS/FAIL/VOID/SKIP/KNOWN, where VOID ("no check was performed") and SKIP are never passes, and a KNOWN pre-existing failure must be the single failure in the run to be recognised at all. --only <ids> runs a subset (deselected steps are recorded SKIP, never PASS) and --check reports the toolchain and the plan without running a step or writing a ledger. Written because the new modules below were authored without a reachable Rust toolchain. They type-check on CI but have not been executed: Cargo fmt fails first, and the Cargo test job does not start. That failure is inherited: main is not fmt-clean, and the 7 unformatted workspace files it carries are repaired by #144 (and identically by #143). None of the files this change adds or modifies is unformatted. Merge one of those two first, rebase, and fmt passes on its own — only then do clippy and the tests execute.
• tests/local_verify_test.sh — 31 planted controls for the harness above: no toolchain (VOID, exit 2), all-green (exit 0), a planted compile error (its diagnostic and file:line extracted), a fmt diff, a failing assertion (both sides extracted), --only, --check, a missing jq (VOID, never PASS), an unchanged worktree, and exactly one documented status per ledger row. No Rust, no network, no token: bash tests/local_verify_test.sh. Two of its own first-draft cases were wrong and were fixed, not worked around: the bare PATH fixture omitted dirname, so the script under test resolved its repository root to / and two VOID cases passed for the wrong reason; and one case piped the script into grep -q, which exits at the first match and killed the writer with SIGPIPE, which pipefail then reported as the plan being missing.
• squabble_core::execution — the execution-phase classifier. fight knew only that a check was red, so a job that died in runner setup or lock resolution was attributed by the workflow's shape (a code fixer, a security scan, an upstream owner) rather than as provisioning. The module classifies step evidence into the five outcomes an estate report must keep distinct — not started, preflight, prerequisite missing, policy step failed, verified — with a fail-closed Unclassified carrying one of five reasons, and a Handoff naming who must act. Signatures are host-supplied (no step name is

... (truncated)

Commits

• 79d7dba fix: preserve @ in workflow filenames and record qualified proof receipt (#152)
• 36a150d refactor(forge): separate workflow-entry parsing from repository metadata
• 4534cf1 docs: scope Creusot receipts to their source and counted evidence
• 4ee55d1 style: apply hosted formatter output for workflow population guards
• 81d8103 fix: require complete workflow populations before coordinate attribution
• ac26aa5 test: use extracted workflow paths in two-hop chain controls
• 99a9859 fix: resolve run ref suffixes against exact source filenames
• e54ffe6 fix: preserve workflow filenames containing @ in startup diagnosis
• 395f16c fix: qualify zero-job and native-lock diagnosis against exact source (#151)
• 7744f6d Update crates/squabble-core/src/chains.rs
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-05T05:25:20.079734Z	cab8983	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: ba52d13d-5dcf-48d1-a401-aa6bb38cb75f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud