From 799506df0cc2c72aa48c95e6ff25fbd3e3801330 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 31 Oct 2026 22:37:44 +0000 Subject: [PATCH] chore(deps): bump the actions group with 4 updates Bumps the actions group with 4 updates: [hyperpolymath/cicd-squabbler/.github/actions/squabble](https://github.com/hyperpolymath/cicd-squabbler), [step-security/harden-runner](https://github.com/step-security/harden-runner), [taiki-e/install-action](https://github.com/taiki-e/install-action) and [hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml](https://github.com/hyperpolymath/panic-attack). Updates `hyperpolymath/cicd-squabbler/.github/actions/squabble` from 541ab9bc21a776d55eb46611877521a824d6319c to 193349090edb29f4ed1ef82142c207e22e1715c9 - [Release notes](https://github.com/hyperpolymath/cicd-squabbler/releases) - [Changelog](https://github.com/hyperpolymath/cicd-squabbler/blob/main/CHANGELOG.adoc) - [Commits](https://github.com/hyperpolymath/cicd-squabbler/compare/541ab9bc21a776d55eb46611877521a824d6319c...193349090edb29f4ed1ef82142c207e22e1715c9) Updates `step-security/harden-runner` from 2.22.2 to 2.22.3 - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](https://github.com/step-security/harden-runner/compare/v2.22.2...v2.22.3) Updates `taiki-e/install-action` from 2.87.30 to 2.88.0 - [Release notes](https://github.com/taiki-e/install-action/releases) - [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/taiki-e/install-action/compare/v2.87.30...v2.88.0) Updates `hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml` from b22bed4f8c6dce82fde639aa0dab9ce79d1006f5 to be6ac46716eaf049570ec4966f4ae4699b319689 - [Release notes](https://github.com/hyperpolymath/panic-attack/releases) - [Changelog](https://github.com/hyperpolymath/panic-attack/blob/main/CHANGELOG.adoc) - [Commits](https://github.com/hyperpolymath/panic-attack/compare/b22bed4f8c6dce82fde639aa0dab9ce79d1006f5...be6ac46716eaf049570ec4966f4ae4699b319689) --- updated-dependencies: - dependency-name: hyperpolymath/cicd-squabbler/.github/actions/squabble dependency-version: 193349090edb29f4ed1ef82142c207e22e1715c9 dependency-type: direct:production dependency-group: actions - dependency-name: step-security/harden-runner dependency-version: 2.22.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: taiki-e/install-action dependency-version: 2.88.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml dependency-version: be6ac46716eaf049570ec4966f4ae4699b319689 dependency-type: direct:production dependency-group: actions ... Signed-off-by: dependabot[bot] --- .github/workflows/actions.lock | 24 ++++++++++++------------ .github/workflows/ci-meta.yml | 2 +- .github/workflows/ghcr-publish.yml | 2 +- .github/workflows/nightly.yml | 4 ++-- .github/workflows/rust-ci.yml | 8 ++++---- .github/workflows/security-scan.yml | 2 +- 6 files changed, 21 insertions(+), 21 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 132cb0b..87e98c5 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -21,7 +21,7 @@ workflows: - 'google/clusterfuzzlite@v1' '.github/workflows/ci-meta.yml': - 'actions/checkout@v7.0.1' - - 'hyperpolymath/cicd-squabbler@541ab9bc21a776d55eb46611877521a824d6319c' + - 'hyperpolymath/cicd-squabbler@193349090edb29f4ed1ef82142c207e22e1715c9' '.github/workflows/codeql.yml': - 'actions/checkout@v7.0.1' - 'github/codeql-action@9b3254085494b55a0f7c4c2b3d2d52cc712ce370' @@ -47,7 +47,7 @@ workflows: '.github/workflows/ghcr-publish.yml': - 'actions/attest-build-provenance@v4.2.2' - 'actions/checkout@v7.0.1' - - 'step-security/harden-runner@v2.22.2' + - 'step-security/harden-runner@v2.22.3' '.github/workflows/governance.yml': - 'metadatastician/standards@8e48b1caade08a552646adeab66558ac43b4360d' '.github/workflows/hypatia-scan.yml': @@ -67,7 +67,7 @@ workflows: - 'actions/checkout@v7.0.1' - 'actions/upload-artifact@v7.0.2' - 'dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8' - - 'taiki-e/install-action@v2.87.30' + - 'taiki-e/install-action@v2.88.0' '.github/workflows/pages.yml': - 'actions/checkout@v7.0.1' - 'actions/deploy-pages@v5.0.1' @@ -83,7 +83,7 @@ workflows: - 'actions/upload-artifact@v7.0.2' - 'dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8' - 'rustsec/audit-check@v2.0.0' - - 'taiki-e/install-action@v2.87.30' + - 'taiki-e/install-action@v2.88.0' '.github/workflows/scorecard.yml': - 'metadatastician/standards@8e48b1caade08a552646adeab66558ac43b4360d' '.github/workflows/secret-scanner.yml': @@ -191,9 +191,9 @@ dependencies: commit: 'sha1-884713a6c30a92e5e8544c39945cd7cb630abcd1' owner_id: 1342004 repo_id: 400046858 - 'hyperpolymath/cicd-squabbler@541ab9bc21a776d55eb46611877521a824d6319c': + 'hyperpolymath/cicd-squabbler@193349090edb29f4ed1ef82142c207e22e1715c9': ref: 'main' - commit: 'sha1-541ab9bc21a776d55eb46611877521a824d6319c' + commit: 'sha1-193349090edb29f4ed1ef82142c207e22e1715c9' owner_id: 6759885 repo_id: 1284026967 'metadatastician/standards@8e48b1caade08a552646adeab66558ac43b4360d': @@ -233,14 +233,14 @@ dependencies: commit: 'sha1-69366f33c96575abad1ee0dba8212993eecbe998' owner_id: 25397242 repo_id: 523199201 - 'step-security/harden-runner@v2.22.2': - ref: 'v2.22.2' - commit: 'sha1-dc2769abcc0fcfbadfc1df54081c1608579ef6b2' + 'step-security/harden-runner@v2.22.3': + ref: 'v2.22.3' + commit: 'sha1-46b06cea07f9e64621fdf066ba77ac6915163d43' owner_id: 88700172 repo_id: 422287306 - 'taiki-e/install-action@v2.87.30': - ref: 'v2.87.30' - commit: 'sha1-a4d3f3f761dcd95cce1b72cb61cb6d1963438177' + 'taiki-e/install-action@v2.88.0': + ref: 'v2.88.0' + commit: 'sha1-86f7a0ffb25f40114606501a311ebcfaf882ea32' owner_id: 43724913 repo_id: 442947557 'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555': diff --git a/.github/workflows/ci-meta.yml b/.github/workflows/ci-meta.yml index 89149b4..5b91319 100644 --- a/.github/workflows/ci-meta.yml +++ b/.github/workflows/ci-meta.yml @@ -80,7 +80,7 @@ jobs: with: persist-credentials: false - name: Cross-repo CI dependency graph (read-only) - uses: hyperpolymath/cicd-squabbler/.github/actions/squabble@541ab9bc21a776d55eb46611877521a824d6319c + uses: hyperpolymath/cicd-squabbler/.github/actions/squabble@193349090edb29f4ed1ef82142c207e22e1715c9 with: args: | chains diff --git a/.github/workflows/ghcr-publish.yml b/.github/workflows/ghcr-publish.yml index 93c4ceb..ed17f51 100644 --- a/.github/workflows/ghcr-publish.yml +++ b/.github/workflows/ghcr-publish.yml @@ -41,7 +41,7 @@ jobs: # monitor its outbound egress (audit mode; tighten to block with an # allowlist once the endpoint set is observed stable). - name: Harden runner (egress audit) - uses: step-security/harden-runner@v2.22.2 + uses: step-security/harden-runner@v2.22.3 with: egress-policy: audit - uses: actions/checkout@v7.0.1 diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index e8788f7..2b2c97e 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -39,7 +39,7 @@ jobs: - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1 with: toolchain: stable - - uses: taiki-e/install-action@v2.87.30 + - uses: taiki-e/install-action@v2.88.0 with: tool: cargo-mutants - name: Run mutation tests @@ -74,7 +74,7 @@ jobs: - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1 with: toolchain: stable - - uses: taiki-e/install-action@v2.87.30 + - uses: taiki-e/install-action@v2.88.0 with: tool: cargo-hack - name: Check every feature combination compiles diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index 8597216..23a1786 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -101,7 +101,7 @@ jobs: - uses: actions/checkout@v7.0.1 with: persist-credentials: false - - uses: taiki-e/install-action@v2.87.30 + - uses: taiki-e/install-action@v2.88.0 with: tool: cargo-deny - run: cargo deny check advisories bans licenses sources @@ -131,7 +131,7 @@ jobs: with: toolchain: stable components: llvm-tools-preview - - uses: taiki-e/install-action@v2.87.30 + - uses: taiki-e/install-action@v2.88.0 with: tool: cargo-llvm-cov - name: Generate lcov report @@ -155,7 +155,7 @@ jobs: - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1 with: toolchain: stable - - uses: taiki-e/install-action@v2.87.30 + - uses: taiki-e/install-action@v2.88.0 with: tool: cargo-mutants - name: Run mutation tests on core invariant crates @@ -238,7 +238,7 @@ jobs: with: toolchain: stable - if: steps.detect.outputs.relevant == 'true' - uses: taiki-e/install-action@v2.87.30 + uses: taiki-e/install-action@v2.88.0 with: tool: cargo-mutants - name: Mutate only lines changed against the base diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml index afef046..185fd77 100644 --- a/.github/workflows/security-scan.yml +++ b/.github/workflows/security-scan.yml @@ -38,7 +38,7 @@ jobs: # # Pin includes canonical .affine language detection and preserves # JSON.parseExn coverage after the ReScript-to-AffineScript migration. - uses: hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml@b22bed4f8c6dce82fde639aa0dab9ce79d1006f5 # main 2026-10-25 + uses: hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml@be6ac46716eaf049570ec4966f4ae4699b319689 # main 2026-10-25 with: # This lane reported success regardless of findings for its whole life # (the reusable's default is 'none' for backwards compatibility).