chore(deps): bump orieg/discipline from 0.14.4 to 0.16.0 in the github-actions group

[dependabot]

Bumps the github-actions group with 1 update: orieg/discipline.

Updates orieg/discipline from 0.14.4 to 0.16.0

Release notes

Sourced from orieg/discipline's releases.

v0.16.0

Upgrading to v0.16.0

Default changes

• sandbox-config: (new gate) → on, error (stricter). A change that widens an agent's permissions or sandbox (Claude Code, Codex, Gemini CLI, Qwen Code, OpenCode, Cursor and Copilot CLI settings, MCP server lists) or a container's isolation (devcontainer.json, Compose) is reported; a changed firewall script at warning as not analysed. A repository with none of these files examines nothing. Restore: [gates.sandbox-config] enabled = false.

Behaviour changes

• release (additive): Attach a CycloneDX SBOM (JSON) to each published release (discipline.cdx.json), attested via GitHub's SBOM attestation (actions/attest) against the release archives and checksummed in SHA256SUMS (#434). Migration: None.
• doctor (stricter): workflow-protection (Gitea / Forgejo) matches a protected file pattern as the forge does: case folded, * and ? stop at . as well as /, ** crosses both. Before, .gitea/workflows/* was reported as protecting .gitea/workflows/ci.yml, and the fix recommended it; the forge does not apply it there, and a pull request editing the workflow merged (RUN: red-team lab, Gitea 1.24.7 and Forgejo 12; #428). The fix now names .gitea/workflows/**, .forgejo/workflows/**, .github/workflows/**. Migration: A branch rule protecting workflows with <dir>/workflows/* now reads warn (--strict fails): change the pattern to <dir>/workflows/**.
• directives, ratified-paths, issue-link (verify_references), audit, archive-contents (fix): Three panics on text with a multi-byte character, found by the new fuzz targets (#418): a directive reason such as tod\u{fffd}o (placeholder check), a reference preceded by a non-ASCII character such as café [#1](https://github.com/orieg/discipline/issues/1) (closing-keyword check, used to read a pull request's references and closing issues), and a source-map URL with a multi-byte character in its first five bytes. Before, the run panicked (a release build aborts) instead of judging the text. Migration: None.
• assertion-reduction, vacuous-tests (Rust) (changed): A library function's ? is no longer counted as a check of the unit test that calls it, as its .unwrap() / .expect() already were not (#392): it hands the error to the caller, where the test's own ?, unwrap or assertion checks it. In a fallible test, and in a helper that is test code (a #[cfg(test)] module or function, or a file under a test path), a ? still counts. Moving a library function's ?s into another module read as an assertion drop in every unchanged test that called it: #420 waived 12 such tests (#422). RUN: discipline check --base 3178b4f^ at 3178b4f reported 12 Assertion Count Decreased In Existing Test findings before and none after; the Expected Value Changed In Existing Test finding at tests/test_report_redaction.rs:146 stays. Migration: A test that relied on a library function's ? as its only check now reads as having fewer assertions, and a new one as vacuous; give it an assertion of its own.
• error-swallowing (stricter): A JS/TS promise .catch callback that only logs is reported as Error Logged And Dropped, like a logging-only catch clause: p.catch((e) => console.error(e)), p.catch((e) => { console.error(e); }), p.catch(function (e) { logger.warn(e) }). A callback that logs then rethrows or returns a computed value, calls another function, or a named handler is not reported. (#419) Migration: A new callback of this form is reported (an existing one is not, the gate is a base-versus-head delta). Handle the error, or justify it with allow-swallow: <path> <reason> or discipline:allow(error-swallowing) on the line.
• pii (secrets), shell-secrets (stricter): pii with secrets = true checks every text file for every fixed-format token class shell-secrets knows, from one shared table (#404): OpenAI and Anthropic API keys (sk-), GitHub fine-grained tokens (github_pat_) and GitHub tokens longer than 255 characters, Slack tokens of the broader xox[baprs]- shape, and a literal Authorization: Bearer <value> (not a variable or placeholder), besides the private-key headers, AWS ids and GitHub gh[pousr]_ tokens it already checked. shell-secrets now also takes the AWS prefixes ABIA and ACCA and any private-key label. Findings keep reporting the file, line and token class only. The declared-test-scope exemption is unchanged. Entropy detection is not part of this change, and the schema no longer claims it. Migration: A documented example that has a real token's shape: an inline discipline:allow(pii) on the line, or allow_patterns. secrets = false switches the token checks off.
• error-swallowing (stricter): A handler whose whole body returns an empty or default literal is reported like return null: Python return False / 0 / "" / [] / {} / (), JS/TS return 0 / "" / [] / {}, Java and C# return 0 / "" and empty-collection returns, PHP return 0 / "" / [] / array(), C/C++ return 0. Trivial statements compare with whitespace folded. JS/TS p.catch(() => {}), .catch(() => null), .catch(() => []) and .catch(function () {}) are Error Silenced. (#402) Migration: A new handler of these forms is reported (an existing one is not, the gate is a base-versus-head delta). Handle the error, or justify it with allow-swallow: <path> <reason> or discipline:allow(error-swallowing) on the line.
• toolchain-config (stricter): Compiler warning flags in build files are judged (#403): in Makefile / GNUmakefile / *.mk (*FLAGS assignments and compiler recipe lines), CMakeLists.txt / *.cmake (CMAKE_<LANG>_FLAGS, add_compile_options, target_compile_options), setup.py (extra_compile_args) and build.rs (cc::Build .flag(..), .warnings(false), .extra_warnings(false), .warnings_into_errors(false)). A lax flag gained (-w, -Wno-error, -Wno-error=<diagnostic>, -Wno-<diagnostic>) or a strict flag lost (-Werror, -Wall, -Wextra, -Wpedantic, -D warnings) is Toolchain Configuration Weakened; an unchanged flag is not reported. The lax list also gains -Wno-error and the -Wno- prefix for rustflags and addopts. A build file whose syntax tree has errors is Toolchain Configuration Unreadable. Migration: allow-toolchain-weakening: <flag, variable or command, or path> <reason>; or [gates.toolchain-config] exempt_paths.
• suppression-delta (stricter): C and C++ diagnostic pragmas are suppression sites (#403): #pragma GCC diagnostic ignored, #pragma clang diagnostic ignored and MSVC #pragma warning(disable: ...) / warning(suppress: ...). Before, the C/C++ packs counted NOLINT* only. The directive is read from the parse, so a pragma in a comment or string, push / pop, and an unchanged pragma are not new. Migration: A change that adds one of these pragmas is now reported (warning by default); name the option or code list in allow-suppression: <rule> <reason>, or list it in allowed_suppressions.
• ratified-paths (refuse_author_ratification), directives.require_approval (fix): On GitLab the merge request's author is read from the forge (projects/:id/merge_requests/:iid, author.username). Before, the author was GITLAB_USER_LOGIN, which names the login that started the pipeline: when another login's push or re-run started it, the author's own ratification counted, and require_approval refused the starter's approval (the author's own approval was already refused, since the GitLab approvals read drops the merge request's author). A merge request the forge cannot answer for is exit 2 (forge). require_approval with an empty author (a merged pull request the forge names no author for, on a push) is exit 2; before, the author's own approval counted. Migration: A GitLab run with either option needs a token that can read the merge request (read_api), which the approvals and closing-issue reads already needed.
• issue-link (additive): New exempt_authors (#408): a pull request opened by a listed login (dependabot[bot], renovate[bot]) needs no tracking-issue reference. The author is read from the forge's event payload, never the run's actor; on GitLab, from the merge request (author.username), and a merge request that cannot be read is exit 2. Directive In Subject Line and every other gate still apply. An entry that is empty or contains whitespace is a configuration error. Migration: None: the list is empty by default.
• instruction-smuggling, pii, error-swallowing, stub-bodies (stricter): A changed file the gate cannot read as text is named in a note (skipped (binary or unreadable file)); pii scanning the whole tree still counts the binary files the change did not touch. Language-pack extensions missing from the text list (.cs, .cts, .mts, .dart, .inc, .m, .mm, .phtml, .rake, .sc, .gemspec) and Gemfile, Rakefile, Dockerfile, Makefile are read as text even with a NUL byte. Migration: None: a file that was skipped is now read or named.
• directives (stricter): New option directives.max_inline_overrides caps the number of inline source marker exemptions (discipline:allow(...)) a change may apply. Raising or removing it is a weakening flagged by config-integrity (probe esc-12). Migration: Set directives.max_inline_overrides = N in discipline.toml to enforce a budget on inline markers.
• ci-integrity (stricter): A configured rollup_job (e.g. ci-gate) that is removed or renamed in CI workflow files cannot be excused as a job rename or split by job_moved, preserving required context enforcement for branch protection (probes ci-01, ci-02). Migration: Keep the required rollup job name intact, or lift with allow-gate-weakening: ci-integrity <reason>.
• tokens (stricter): Directives and waivers require a rationale with at least two alphanumeric characters; single-word reasons with trailing sentence punctuation (todo., TBD!) are trimmed before lookup; ok, temp, dummy, null, placeholder, and asdf are added to the built-in placeholder list alongside todo, tbd, none, n/a, ..., and <reason>; and placeholder matching folds Unicode confusables, combining marks, invisible characters, and leetspeak (#385, probes esc-10, esc-11). Migration: Provide a meaningful rationale containing at least two alphanumeric characters explaining the exception.
• all gates that read whole files (stricter): A file with a known text extension is read as text whatever its first bytes, and a printable magic number (MZ, %PDF-, GIF89a, BZh, PAR1, ARROW1) makes a file binary only with a NUL byte in its first kilobyte. Before, a source file starting with MZ = 0 was read as binary, so pii, instruction-smuggling, error-swallowing and stub-bodies skipped it. Migration: None: a file these gates now read reports what it carries.
• check (stricter): When --base main or origin/main does not resolve, a guessed default branch (origin/HEAD, master, trunk) that already holds HEAD is refused (exit 2). Before, origin/HEAD after git clone --branch <change> named the change itself: an empty diff, and exit 0 on a change that deleted a test file. Migration: Fetch the base branch, or pass --base naming it.
• instruction-smuggling (stricter): The change description's directive lines are scanned for instruction-like text, their reasons included (#363). Only an allow-agent-instructions line that parsed as a directive and names a location of this change (pr-body, pr-title, a commit:<sha7> in the range, or a changed path) is exempt; a fenced line, a commit's subject line, a fake subject or any other directive's reason is scanned. Findings stay at warning, so a repository with fail_on_warnings (DISCIPLINE_FAIL_ON_WARNINGS) fails a run whose directive reason quotes an injection phrase, for example an allow-ignore reason. RUN 2026-10-01: discipline replay --last 100 on this repository raised 0 new warnings over the 81 directive lines of the 86 changes it could check. Migration: Move a quoted phrase to an allow-agent-instructions: <location> <reason> line, or out of the description.
• audit (fix): In --format html, a source link percent-encodes the file path segment by segment. Before, a directory named %2e%2e read as .. in a browser and the link opened another repository on the same forge, and # or ? in a file name cut the link short. Migration: None.
• assertion-reduction, vacuous-tests (Rust) (changed): A library function's .unwrap() / .expect() is no longer counted as a check of the unit test that calls it; in a test, and in a helper that is test code (a #[cfg(test)] module or function, or a file under a test path), it still is. A refactor of library code that ended a same-file wrapper chain read as an assertion drop in unchanged tests (#392). Library assert!, panic! and unreachable! still count. Migration: A test that relied on a library function's expect as its only check now reads as having fewer assertions; give it an assertion of its own.
• directives (stricter): A directive on a line indented four or more columns (an indented code block), or inside a fence after a shorter fence of the same character, is code and no longer arms an override (F8). Before, an indented block was read, and a fence closed on any line starting with its first three characters. Migration: Start a directive at the beginning of its line (up to three spaces), outside any code block.
• assertion-reduction (stricter): New finding expected-value-changed (Expected Value Changed In Existing Test): an existing assertion that now expects a different value while its count and strength hold (assert_eq!(add(2, 2), 4) -> 5). Read for Rust, Python, JS/TS and Go equality assertions and inline snapshots; assertions are paired by their text with the literal masked. At the gate's severity, a warning in staged mode (#386). Replay of this repository's last 100 merged changes (RUN 2026-10-01): one finding, #285, an intended behaviour change that would have needed the directive; no other change edited an existing expected value. Migration: A test whose expected value changes with an intended behaviour change records it: allow-assertion-drop: <test> <reason>.
• config-integrity (stricter): Removing an optional key is a weakening when its absence reads looser than the value removed: bench-regression.max_noise_cv (absent means no noise check), and a gate's allow_hidden = false while [directives] allow_hidden = true. Before, only evidence, floor and cap keys were reported when removed. Found by the lab runs tests/red_team/attacks/cfg-04 and cfg-06 (#359). Migration: Keep the key, or lift with allow-gate-weakening: <gate> <reason>.
• doctor (stricter (--strict fails on the new warning)): On GitLab, two-factor reads the project's top-level group (require_two_factor_authentication: a warning when off, could not check without access to the group, information for a personal namespace) and environment-reviewers names the environments that masked or hidden variables are scoped to and that need no deployment approval. Both were not available on this forge before. Migration: Require two-factor authentication in the top-level group; add a deployment approval to an environment whose variables deploy or publish.
• doctor (additive): New local finding security-policy (#366, OpenSSF Scorecard Security-Policy): a pass when SECURITY.md is at the root, in .github/ or in docs/, information otherwise. Migration: None.
• doctor (stricter (--strict fails on the new warning)): New findings (#366): webhooks, by host only (GitHub: a warning for a webhook with no secret or with TLS verification off; GitLab: a warning when TLS verification is off; Gitea and Forgejo: information, since they do not say whether a webhook has a secret), and environment-reviewers (GitHub: information naming the deployment environments that hold secrets and need no required reviewer). Migration: Give each webhook a secret and keep TLS verification on; add required reviewers to an environment whose secrets deploy or publish.
• doctor (stricter (--strict fails on the new warnings)): New access findings (#366), counted and never named: deploy-keys (a warning when a deploy key can push; GitHub, GitLab, Gitea, Forgejo), outside-collaborators (information); on GitHub, for an organisation-owned repository, org-base-permission (a warning on write or admin), two-factor (a warning when not required) and visibility-change (a warning when members may change visibility). A setting the token cannot see is could not check (a warning). Migration: Make deploy keys read-only, lower the organisation base permission, require two-factor authentication; run doctor with an organisation owner's token to read the organisation settings.
• doctor (stricter (--strict fails on the new warnings)): New repository-settings findings from the OWASP CI/CD Security Cheat Sheet (#366): auto-merge (GitHub: a warning when allow_auto_merge is on and no approving review is required; information elsewhere), forking (a warning when a private or internal repository allows forks; GitHub, GitLab), secret-scanning (secret scanning and push protection, information when off; GitHub, GitLab) and dependency-alerts (GitHub, information when off). A setting the token cannot see is could not check (a warning). The forge client reads a 204 No Content answer as an empty one instead of a malformed one. docs/guides/ci-platforms.md maps every cheat-sheet item and Scorecard check to a finding, a gate, "not checked" or out of scope. Migration: Require an approving review or turn off auto-merge; turn off forking of a private repository; run doctor with an admin token to read the admin-only settings.
• check (report) (fix): The note for a refused hidden directive (directives.allow_hidden = false) names the directive and where it was (hidden directive \removes` in commit abc1234 ignored ...), no longer its reason, and is attached once, to that directive's gate. Before, it quoted the reason word for word, so text hidden from reviewers reached the report, --format agent-prompt` and the step summary, and a directive whose name matched no gate was copied to every gate (#362). Migration: None.
• tokens (stricter): Directives that require a scoped subject and a rationale (removes:, allow-ignore:, allow-assertion-drop:, etc.) reject subject-only entries and placeholder reasons (todo, tbd, n/a, <reason>). A subject-only waiver without a non-empty, non-placeholder reason no longer lifts a finding (#358, probe esc-03). Migration: Add a non-empty, non-placeholder rationale explaining the waiver following the subject.
• sandbox-config (stricter): Reads CI job and service containers in .github/workflows/, .gitea/workflows/ and .forgejo/workflows/: a job's container or a services entry whose options gain --privileged, a host namespace, --cap-add, --device or a confinement switched off, or whose volumes mount the host's Docker, Podman or containerd socket, is sandbox-config-widened, as a Dev Container or Compose service already is (#367). Migration: Lift with allow-sandbox-widening: <workflow path or key path> <reason>.
• check (CI base fetch) (fix): The git fetch discipline runs in CI when the base does not resolve no longer runs a command the repository's own configuration names. Hooks, the file-system monitor, ext:: / fd:: / git:// transports and the upload-pack program are overridden; a repository-set core.sshCommand, credential.helper or core.askPass is replaced by the runner's global or system value. Before, a hostile .git/config ran commands there (#364). Migration: A checkout that relies on a repository-local core.sshCommand (actions/checkout with ssh-key) and does not fetch the base now gets exit 2 from the fallback fetch: check out with fetch-depth: 0, as the error says.
• instruction-smuggling (stricter (an invisible character on a directive line blocks)): The change description: a directive line inside an HTML comment (<!-- no-issue: ... -->) is no longer exempt from the phrase and blob scan (a bot reads it; a reviewer does not see it), and every line, directive lines included, is checked for invisible characters. Before, a directive line was skipped by both checks. A visible directive line's reason is still not scanned (#363). Migration: Move a hidden directive out of the comment or remove the invisible character; lift a quoted phrase with allow-agent-instructions: pr-body <reason>.
• instruction-smuggling (stricter (warning)): More prose files are scanned as whole lines: .mdx, .ini, .cfg, .conf, .ipynb, .svg and extensionless README / NOTES. docs/GATES.md lists the exact set, generated from the gate (#354). Migration: Lift a legitimate line with allow-agent-instructions: <path:line> <reason>, or exempt the path.
• instruction-smuggling (stricter (warning)): A phrase split across consecutive line comments (//, #, --) or consecutive non-blank added lines of a prose file is found, and reported at the first line of the shortest run that carries it (Lines 3-4 of ...). A directive naming any line of that run lifts it. A phrase on one line is reported as before (#354). Migration: Lift with allow-agent-instructions: <path:line> <reason>.
• instruction-smuggling (stricter (warning)): encoded-blob accepts base64url (-, _), a run with / inside it (a path is now rooted or has a dotted segment), base64 wrapped at 64 or 76 columns (joined into one run; a PEM block is not), and a hex run of 80 or more digits that decodes to text. SSH public keys are excluded by shape (#354). Migration: Lift with allow-agent-instructions: <path:line> <reason>, or exempt the path.
• instruction-smuggling (stricter (warning)): Phrases are matched on a folded copy of the text as well. Folding drops invisible characters and combining marks, applies NFKC, maps TR39 Latin look-alikes and leetspeak digits to letters, and splits words joined by two or more -, _ or .. They are also matched after decoding ROT13, %xx escapes, hex and base64/base64url runs; new classes rot13-encoded, percent-encoded, hex-encoded and base64-encoded name the encoding. New class mixed-script: a word that mixes Latin letters with a Cyrillic or Greek look-alike. Finding codes are unchanged, all at warning. New dependency unicode-normalization (#354). Migration: Lift with allow-agent-instructions: <path:line> <reason>; a quoted injection in a threat document is the expected case.
• audit (stricter): A loosening of sandbox-config raises guard-gate-loosened (look-first), as a loosening of ratified-paths, config-integrity, ci-integrity or instruction-smuggling does: with the gate off, an agent can widen its own sandbox and remove the hooks that run discipline with no finding. Migration: None.
• doctor (stricter): New local finding agent-sandbox: an agent settings file in the repository that runs an agent with less containment than its defaults (a looser mode, a protection switched off) is a warning, one in the user's home is information. Lists (allowed commands, MCP servers) are left to sandbox-config. Migration: A repository file it names fails doctor --strict: remove the setting or move it to a user-level file.
• audit (additive): New replay (the report --replay read: cases, checked), shown in the HTML page's "Read" line. waiver-lifted-nothing ranks review, not look-soon, and says the replay re-checks with the current discipline: a waiver lifts nothing when the finding was never there, or when the gate has changed since (refined, or a directive format it no longer reads). The HTML page's protected-path row points to the ratification the forge read. The demo report (docs/demo/audit.html) is regenerated with --forge and --replay. Migration: None.
• audit (additive): With --replay, inline markers are judged too: lifted is true when the replayed check applied an override of the marker's gate read from its file and line, else false. A marker that lifted nothing (usually one quoted in a test or a documentation example) is counted in the directive-lifted-a-finding detail, not in waiver-lifted-nothing, and the HTML page leaves it out of its per-gate chart and its table of markers outside tests and docs (#360). Migration: None.

... (truncated)

Commits

• 388c1a2 chore(release): bump version to 0.16.0 with its ledger rows (#445)
• b59b79e chore(release): bump version to 0.16.0-rc.2 and fix install-tool cyclonedx (#...
• 7048387 chore(release): bump version to 0.16.0-rc.1 (#440)
• 7f47196 docs(contributing): governance, DCO and scan policies (#437)
• 616608e ci(release): attach a CycloneDX SBOM to every release (#436)
• eeb6205 chore(ci): gate heavy test suites on code changes with detect-changes and ci-...
• f67ffbb docs: OpenSSF Best Practices badge, current Scorecard scores (#433)
• fc4c7b7 docs(license): rename LICENSE.md to LICENSE (#432)
• 5efae33 test(red-team): run the CI attacks through a real CI loop and check every lab...
• 5b19e34 fix(doctor): match Gitea and Forgejo protected file patterns as the forge doe...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions