From 52097c5cc39d96b15723461b8672a6a325a3ecf1 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 7 Nov 2026 22:35:31 +0000 Subject: [PATCH] chore(deps): bump the actions group across 1 directory with 7 updates Bumps the actions group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [hyperpolymath/cicd-squabbler/.github/actions/squabble](https://github.com/hyperpolymath/cicd-squabbler) | `541ab9bc21a776d55eb46611877521a824d6319c` | `79d7dbacc8a02b4a4388b4a36fe46893b5b7ce73` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.39.1` | `4.39.3` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.39.1` | `4.39.3` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.39.1` | `4.39.3` | | [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.22.2` | `2.22.3` | | [taiki-e/install-action](https://github.com/taiki-e/install-action) | `2.87.30` | `2.90.1` | | [hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml](https://github.com/hyperpolymath/panic-attack) | `b22bed4f8c6dce82fde639aa0dab9ce79d1006f5` | `f2a6a70eaec0cb02331e3264e05f185b5faab0f7` | Updates `hyperpolymath/cicd-squabbler/.github/actions/squabble` from 541ab9bc21a776d55eb46611877521a824d6319c to 79d7dbacc8a02b4a4388b4a36fe46893b5b7ce73 - [Release notes](https://github.com/hyperpolymath/cicd-squabbler/releases) - [Changelog](https://github.com/hyperpolymath/cicd-squabbler/blob/main/CHANGELOG.adoc) - [Commits](https://github.com/hyperpolymath/cicd-squabbler/compare/541ab9bc21a776d55eb46611877521a824d6319c...79d7dbacc8a02b4a4388b4a36fe46893b5b7ce73) Updates `github/codeql-action/init` from 4.39.1 to 4.39.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/9b3254085494b55a0f7c4c2b3d2d52cc712ce370...33d7b85da1a04171e211befe2c739303b9a4c066) Updates `github/codeql-action/analyze` from 4.39.1 to 4.39.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/9b3254085494b55a0f7c4c2b3d2d52cc712ce370...33d7b85da1a04171e211befe2c739303b9a4c066) Updates `github/codeql-action/upload-sarif` from 4.39.1 to 4.39.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/9b3254085494b55a0f7c4c2b3d2d52cc712ce370...33d7b85da1a04171e211befe2c739303b9a4c066) Updates `step-security/harden-runner` from 2.22.2 to 2.22.3 - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](https://github.com/step-security/harden-runner/compare/v2.22.2...v2.22.3) Updates `taiki-e/install-action` from 2.87.30 to 2.90.1 - [Release notes](https://github.com/taiki-e/install-action/releases) - [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/taiki-e/install-action/compare/v2.87.30...v2.90.1) Updates `hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml` from b22bed4f8c6dce82fde639aa0dab9ce79d1006f5 to f2a6a70eaec0cb02331e3264e05f185b5faab0f7 - [Release notes](https://github.com/hyperpolymath/panic-attack/releases) - [Changelog](https://github.com/hyperpolymath/panic-attack/blob/main/CHANGELOG.adoc) - [Commits](https://github.com/hyperpolymath/panic-attack/compare/b22bed4f8c6dce82fde639aa0dab9ce79d1006f5...f2a6a70eaec0cb02331e3264e05f185b5faab0f7) --- updated-dependencies: - dependency-name: hyperpolymath/cicd-squabbler/.github/actions/squabble dependency-version: 79d7dbacc8a02b4a4388b4a36fe46893b5b7ce73 dependency-type: direct:production dependency-group: actions - dependency-name: github/codeql-action/init dependency-version: 4.39.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: github/codeql-action/analyze dependency-version: 4.39.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.39.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: step-security/harden-runner dependency-version: 2.22.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: taiki-e/install-action dependency-version: 2.90.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml dependency-version: f2a6a70eaec0cb02331e3264e05f185b5faab0f7 dependency-type: direct:production dependency-group: actions ... Signed-off-by: dependabot[bot] --- .github/workflows/actions.lock | 34 ++++++++++++++--------------- .github/workflows/ci-meta.yml | 2 +- .github/workflows/codeql.yml | 4 ++-- .github/workflows/deep-recon.yml | 2 +- .github/workflows/ghcr-publish.yml | 2 +- .github/workflows/nightly.yml | 4 ++-- .github/workflows/rust-ci.yml | 8 +++---- .github/workflows/security-scan.yml | 2 +- 8 files changed, 29 insertions(+), 29 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 132cb0b..c5f6fe9 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -21,10 +21,10 @@ workflows: - 'google/clusterfuzzlite@v1' '.github/workflows/ci-meta.yml': - 'actions/checkout@v7.0.1' - - 'hyperpolymath/cicd-squabbler@541ab9bc21a776d55eb46611877521a824d6319c' + - 'hyperpolymath/cicd-squabbler@79d7dbacc8a02b4a4388b4a36fe46893b5b7ce73' '.github/workflows/codeql.yml': - 'actions/checkout@v7.0.1' - - 'github/codeql-action@9b3254085494b55a0f7c4c2b3d2d52cc712ce370' + - 'github/codeql-action@33d7b85da1a04171e211befe2c739303b9a4c066' '.github/workflows/coq-build.yml': - 'actions/checkout@v7.0.1' '.github/workflows/deep-recon.yml': @@ -32,7 +32,7 @@ workflows: - 'actions/checkout@v7.0.1' - 'actions/upload-artifact@v7.0.2' - 'dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8' - - 'github/codeql-action@9b3254085494b55a0f7c4c2b3d2d52cc712ce370' + - 'github/codeql-action@33d7b85da1a04171e211befe2c739303b9a4c066' '.github/workflows/doc-consonance.yml': - 'actions/checkout@v7.0.1' '.github/workflows/dogfood-gate.yml': @@ -47,7 +47,7 @@ workflows: '.github/workflows/ghcr-publish.yml': - 'actions/attest-build-provenance@v4.2.2' - 'actions/checkout@v7.0.1' - - 'step-security/harden-runner@v2.22.2' + - 'step-security/harden-runner@v2.22.3' '.github/workflows/governance.yml': - 'metadatastician/standards@8e48b1caade08a552646adeab66558ac43b4360d' '.github/workflows/hypatia-scan.yml': @@ -67,7 +67,7 @@ workflows: - 'actions/checkout@v7.0.1' - 'actions/upload-artifact@v7.0.2' - 'dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8' - - 'taiki-e/install-action@v2.87.30' + - 'taiki-e/install-action@v2.90.1' '.github/workflows/pages.yml': - 'actions/checkout@v7.0.1' - 'actions/deploy-pages@v5.0.1' @@ -83,7 +83,7 @@ workflows: - 'actions/upload-artifact@v7.0.2' - 'dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8' - 'rustsec/audit-check@v2.0.0' - - 'taiki-e/install-action@v2.87.30' + - 'taiki-e/install-action@v2.90.1' '.github/workflows/scorecard.yml': - 'metadatastician/standards@8e48b1caade08a552646adeab66558ac43b4360d' '.github/workflows/secret-scanner.yml': @@ -176,9 +176,9 @@ dependencies: commit: 'sha1-54075bcc5e249e4758d363f27d099f55d843f124' owner_id: 47606891 repo_id: 331103973 - 'github/codeql-action@9b3254085494b55a0f7c4c2b3d2d52cc712ce370': - ref: 'v4.39.1' - commit: 'sha1-9b3254085494b55a0f7c4c2b3d2d52cc712ce370' + 'github/codeql-action@33d7b85da1a04171e211befe2c739303b9a4c066': + ref: 'v4.39.3' + commit: 'sha1-33d7b85da1a04171e211befe2c739303b9a4c066' owner_id: 9919 repo_id: 259445878 'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63': @@ -191,9 +191,9 @@ dependencies: commit: 'sha1-884713a6c30a92e5e8544c39945cd7cb630abcd1' owner_id: 1342004 repo_id: 400046858 - 'hyperpolymath/cicd-squabbler@541ab9bc21a776d55eb46611877521a824d6319c': + 'hyperpolymath/cicd-squabbler@79d7dbacc8a02b4a4388b4a36fe46893b5b7ce73': ref: 'main' - commit: 'sha1-541ab9bc21a776d55eb46611877521a824d6319c' + commit: 'sha1-79d7dbacc8a02b4a4388b4a36fe46893b5b7ce73' owner_id: 6759885 repo_id: 1284026967 'metadatastician/standards@8e48b1caade08a552646adeab66558ac43b4360d': @@ -233,14 +233,14 @@ dependencies: commit: 'sha1-69366f33c96575abad1ee0dba8212993eecbe998' owner_id: 25397242 repo_id: 523199201 - 'step-security/harden-runner@v2.22.2': - ref: 'v2.22.2' - commit: 'sha1-dc2769abcc0fcfbadfc1df54081c1608579ef6b2' + 'step-security/harden-runner@v2.22.3': + ref: 'v2.22.3' + commit: 'sha1-46b06cea07f9e64621fdf066ba77ac6915163d43' owner_id: 88700172 repo_id: 422287306 - 'taiki-e/install-action@v2.87.30': - ref: 'v2.87.30' - commit: 'sha1-a4d3f3f761dcd95cce1b72cb61cb6d1963438177' + 'taiki-e/install-action@v2.90.1': + ref: 'v2.90.1' + commit: 'sha1-c509219cf42fba86913069efd0ade2458c59337b' owner_id: 43724913 repo_id: 442947557 'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555': diff --git a/.github/workflows/ci-meta.yml b/.github/workflows/ci-meta.yml index 89149b4..4b351fa 100644 --- a/.github/workflows/ci-meta.yml +++ b/.github/workflows/ci-meta.yml @@ -80,7 +80,7 @@ jobs: with: persist-credentials: false - name: Cross-repo CI dependency graph (read-only) - uses: hyperpolymath/cicd-squabbler/.github/actions/squabble@541ab9bc21a776d55eb46611877521a824d6319c + uses: hyperpolymath/cicd-squabbler/.github/actions/squabble@79d7dbacc8a02b4a4388b4a36fe46893b5b7ce73 with: args: | chains diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 0078b15..2a9cd4c 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -43,12 +43,12 @@ jobs: persist-credentials: false - name: Initialize CodeQL - uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.38.0 (4.38.1 blocked estate-wide; nexia-list#100) + uses: github/codeql-action/init@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.38.0 (4.38.1 blocked estate-wide; nexia-list#100) with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.38.0 (4.38.1 blocked estate-wide; nexia-list#100) + uses: github/codeql-action/analyze@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.38.0 (4.38.1 blocked estate-wide; nexia-list#100) with: category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/deep-recon.yml b/.github/workflows/deep-recon.yml index 568d616..b7dd5e8 100644 --- a/.github/workflows/deep-recon.yml +++ b/.github/workflows/deep-recon.yml @@ -84,7 +84,7 @@ jobs: # and the pons-report artifact carries the SARIF. - name: Upload SARIF if: always() && github.event_name != 'pull_request' - uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.38.0 (4.38.1 blocked estate-wide; nexia-list#100) + uses: github/codeql-action/upload-sarif@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.38.0 (4.38.1 blocked estate-wide; nexia-list#100) with: sarif_file: pons.sarif category: pons-asinorum diff --git a/.github/workflows/ghcr-publish.yml b/.github/workflows/ghcr-publish.yml index 93c4ceb..ed17f51 100644 --- a/.github/workflows/ghcr-publish.yml +++ b/.github/workflows/ghcr-publish.yml @@ -41,7 +41,7 @@ jobs: # monitor its outbound egress (audit mode; tighten to block with an # allowlist once the endpoint set is observed stable). - name: Harden runner (egress audit) - uses: step-security/harden-runner@v2.22.2 + uses: step-security/harden-runner@v2.22.3 with: egress-policy: audit - uses: actions/checkout@v7.0.1 diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index e8788f7..dc12dad 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -39,7 +39,7 @@ jobs: - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1 with: toolchain: stable - - uses: taiki-e/install-action@v2.87.30 + - uses: taiki-e/install-action@v2.90.1 with: tool: cargo-mutants - name: Run mutation tests @@ -74,7 +74,7 @@ jobs: - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1 with: toolchain: stable - - uses: taiki-e/install-action@v2.87.30 + - uses: taiki-e/install-action@v2.90.1 with: tool: cargo-hack - name: Check every feature combination compiles diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index 8597216..d7f0b41 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -101,7 +101,7 @@ jobs: - uses: actions/checkout@v7.0.1 with: persist-credentials: false - - uses: taiki-e/install-action@v2.87.30 + - uses: taiki-e/install-action@v2.90.1 with: tool: cargo-deny - run: cargo deny check advisories bans licenses sources @@ -131,7 +131,7 @@ jobs: with: toolchain: stable components: llvm-tools-preview - - uses: taiki-e/install-action@v2.87.30 + - uses: taiki-e/install-action@v2.90.1 with: tool: cargo-llvm-cov - name: Generate lcov report @@ -155,7 +155,7 @@ jobs: - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1 with: toolchain: stable - - uses: taiki-e/install-action@v2.87.30 + - uses: taiki-e/install-action@v2.90.1 with: tool: cargo-mutants - name: Run mutation tests on core invariant crates @@ -238,7 +238,7 @@ jobs: with: toolchain: stable - if: steps.detect.outputs.relevant == 'true' - uses: taiki-e/install-action@v2.87.30 + uses: taiki-e/install-action@v2.90.1 with: tool: cargo-mutants - name: Mutate only lines changed against the base diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml index afef046..465b650 100644 --- a/.github/workflows/security-scan.yml +++ b/.github/workflows/security-scan.yml @@ -38,7 +38,7 @@ jobs: # # Pin includes canonical .affine language detection and preserves # JSON.parseExn coverage after the ReScript-to-AffineScript migration. - uses: hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml@b22bed4f8c6dce82fde639aa0dab9ce79d1006f5 # main 2026-10-25 + uses: hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml@f2a6a70eaec0cb02331e3264e05f185b5faab0f7 # main 2026-10-25 with: # This lane reported success regardless of findings for its whole life # (the reusable's default is 'none' for backwards compatibility).