chore(deps): bump orieg/discipline from 0.16.0 to 0.19.0 in the github-actions group

[dependabot]

Bumps the github-actions group with 1 update: orieg/discipline.

Updates orieg/discipline from 0.16.0 to 0.19.0

Release notes

Sourced from orieg/discipline's releases.

v0.19.0

Upgrading to v0.19.0

Behaviour changes

• bench-regression (ratio run provenance commit) (stricter): In paired-ratio mode, evaluate_run verifies that run.provenance.commit is a 40-digit hex SHA-1 and resolves in git via the evidence context. A missing or non-commit object is reported as not comparable; shallow clones emit a note. Before, the commit field was not verified outside record_paths (#651) Migration: Ensure benchmark run files record a full commit SHA that exists in the repository
• ignored-tests (JUnit DisabledIf off values, Kotest spec class skips) (stricter): JUnit @DisabledIfEnvironmentVariable and @DisabledIfSystemProperty with matches reading as off (0, false, no, off) are evaluated symmetrically to EnabledIf and run in CI (not reported as CI skips). Kotest tests defined inside spec bodies (StringSpec, FunSpec, etc.) inherit class-level conditional skip annotations (@DisabledOnOs, @DisabledIfEnvironmentVariable) (#651) Migration: Add allow-ignore: <test> <reason> if a test is intended to be skipped
• provenance-tags (thousands grouping and percent in figures) (looser): verify_cited_figures admits figures with thousands grouping (commas and underscores: 1,234,567, 1_234_567) and percentages (99.5%). Before, grouped figures were unrecognized or truncated, and percentages were not stripped before numeric comparison (#651) Migration: none
• ignored-tests (conditional skips in loops, switch/match, and preprocessors) (looser): In C#, Ruby, PHP, Swift, Scala, C/C++ and Objective-C, skip statements inside loops (while, for, do, foreach, until), switch/case/match, and preprocessor conditionals (#if, #ifdef, #ifndef) are recognized as conditional skips (reporting as notes or CI skips under CI conditions). Before, these structures were not recognized as enclosing condition guards, reporting tests as unconditionally skipped errors (#651) Migration: none
• Terminal, job summary, pull request comment, agent prompt (invisible characters) (stricter): Control characters other than tab, line feed and carriage return, bidirectional controls, zero-width characters (including joiners and marks), soft hyphens and tag characters are replaced with U+FFFD across the four human-facing report formats. Before, zero-width characters and bidi marks passed through (#681). Commit provenance squash entry subjects preserve control characters for the report layer instead of replacing them with spaces Migration: none
• assertion-reduction (net helper call gain across helper categories) (stricter): Net gain from helper calls (helper_call_gain) computes signed net changes across own reach, helper pairs, and resolved crate helpers before clamping to zero. Before, saturating subtraction was applied to each category separately, which could allow gains in test-support helpers to mask assertion drops in crate helpers (#688) Migration: Restore dropped checks, or add allow-assertion-drop: <test> <reason>
• assertion-reduction/test-helper-weakened (helper leaving test-support path) (stricter): A helper leaving a test-support path (moved to another file or the file renamed to a non-test-support path) can only pair into another test-support path. Moving or renaming a helper out of test support is reported as deleted in its original test-support path (#688). Before, it could pair into the non-test-support file Migration: Keep test helpers in test-support paths, or add allow-assertion-drop: <helper> <reason>
• hook install --agent qwen, a hook's own check, doctor (hook-mode) (looser): .qwen/settings.json is written with "$version": 4, the settings version Qwen Code 0.25.0 otherwise adds when it starts. A hook's check, hook install --upgrade and doctor read a generated file as generated when it differs only in that key (added after the last one, or with another whole number). Before, the first Qwen Code session changed the generated file, the hook reported instruction-smuggling/agent-instructions-changed for it, and doctor could not read its mode. Any other difference in the file is reported as before, and CI reports the key like any change to the file Migration: None is needed. hook install --agent qwen --upgrade adds the key to a file an earlier release wrote and Qwen Code has not yet started on
• hook run at the end of a turn (Claude Code, Qwen Code, Codex) (stricter when enabled): New opt-in check [hooks.premature-stop], off by default: with it enabled on the base ref, a final message that announces an action the agent did not take, or ends in a tool call written as text, is logged (mode = "observe", the default) or refuses the stop once (mode = "refuse"), with the codes turn/announced-action-not-taken and turn/tool-call-written-as-text. check and every report are unchanged. config-integrity reports the table being switched off or quietened (#706) Migration: None: nothing changes until the table is enabled
• doctor (hook-mode, truthful pretool-hook) (stricter): discipline doctor reports hook-mode for each agent hook file: Pass when enforcing, Warn when observe (with remediation showing how to switch to enforcing), Unknown when unreadable or edited, and Warn when a hook file has no check or stop entry. pretool-hook for an observe-mode file reports that it logs rather than refuses (#699) Migration: When running discipline doctor --strict, a hook file in observe mode now fails: switch it to enforcing by deleting the file and running discipline hook install --agent <name>, or accept the warning without --strict
• assertion-reduction (pairing of expected exceptions), handlers nested in one another, baseline lookup (none): Pairing the expected exceptions of a test, reading handlers nested in one another (JavaScript, Java, Kotlin, C#), and looking up the findings a baseline does not hold now cost work in proportion to their number. Before, 2,000 rewritten expectations cost about 2e11 instructions in an unoptimised build (#672). Findings, their order and fingerprints are unchanged Migration: none
• ci-integrity (line of a finding, inline exemption) (stricter): A finding is reported on the line of the job, step, key, trigger or pin it names. Before, it was the first line containing the name: a job test below any runs-on: ubuntu-latest was reported on that line. An inline discipline:allow(ci-integrity) is read from that line, so it now excuses only the job or step it is written on; before, one on another job's or step's line could excuse a finding (#678) Migration: A baseline entry for a finding that moves to another line no longer matches: record it again with discipline baseline --write. Move an inline allow that sat on the old line to the job's or step's own line
• dependency-delta (manifest that does not parse) (stricter): A changed Cargo.toml, pyproject.toml, package.json or composer.json that does not parse on the head side stops the run (exit 2), naming the file and line. Before, it read as declaring no dependency, and such a change to package.json or composer.json passed. On the base side it is a note. With toolchain-config also enabled, the stop comes before its toolchain-config-unreadable finding (#678) Migration: Fix the manifest; no directive lifts it
• archive-contents (directory that cannot be listed) (stricter): A directory that cannot be listed while archive_path is looked for stops the run (exit 2) when the pattern can match below it. Before, it was skipped (#678) Migration: Make the directory readable, or give archive_path a literal prefix that does not reach it
• command (base-tests report file) (none): With no JUnit XML in the command's output, the report read is the first *.xml in name order at the top of the working directory that holds cases. Before, it was whichever the directory listing gave first (#678) Migration: A runner that writes several reports prints one, or names the one to read so it sorts first
• test-floor (pytest python_files entry that is not a glob) (looser): An entry that does not compile as a glob is no longer matched as text inside a file name. A file no other entry matches is counted with collection not determined, and a note says why (#678) Migration: Write the entry as a glob
• suppression-delta (qualified and file-level annotations) (stricter): Now reported: an annotation is read by the last segment of its name, so Java @java.lang.SuppressWarnings, Scala @scala.annotation.nowarn and @annotation.nowarn, and Kotlin @kotlin.Suppress are sites, and so is the Kotlin file annotation @file:Suppress(...). Imports are not resolved: an annotation of another package with the same simple name is reported too (#685) Migration: Remove the suppression, or add allow-suppression: <rule-or-path> <reason>
• suppression-delta (comment spellings the tools accept) (stricter): Now reported: a RuboCop directive with any blanks or none after # and around the colon; Python noqa in any letter-case, # type:ignore with any spacing, # pylint: disable-next=, and a noqa after other comment text; a Java comment holding NOSONAR and a // comment opening with noinspection <id>; a Kotlin comment opening with NOSONAR. Java and Kotlin comments were not read before. A Python comment carrying a second tool's noqa (# type: ignore # noqa: E501) is one more site; the first keeps its rule, snippet and fingerprint (#685) Migration: Remove the suppression, or add allow-suppression: <rule-or-path> <reason>
• suppression-delta (Kotlin annotation named by its first segment) (looser): No longer reported: a Kotlin annotation whose first identifier is Suppress or SuppressWarnings but whose type's last segment is another name, such as @Suppress.Inner("x") (#685) Migration: A baseline entry for such a site no longer matches anything
• Every language pack, baseline fingerprints (sources of many like items) (none): A change holding hundreds of AssertJ catchThrowable calls in one Java method, Kotlin runCatching results bound to names, a JavaScript promise chain of hundreds of links, a long chain of calls in a JavaScript or TypeScript file, Rust catch_unwind closures hundreds deep, a Python class of hundreds of methods, a Go file of hundreds of tests, or hundreds of findings in one file is checked in work that grows with its size. Before, each cost the square: a Python class of 1,000 methods cost about 1e11 instructions in an unoptimised build and now 3.6e9 (#672). Findings and fingerprints are unchanged Migration: none; a Rust caller of the library passes a GoPackageLevel to extract_go_cases_in_package
• assertion-reduction/test-helper-weakened (Rust helper outside a test-support path) (stricter): Now reported: a Rust helper in a #[cfg(test)] module outside a test-support path (a src/**/test_support.rs declared by #[cfg(test)] mod, an inline #[cfg(test)] mod, a #[cfg(test)] function) that loses checks or is deleted, when a test's call resolves to it through the crate's modules. The finding names the calling tests. Before, such a helper could be weakened with its tests untouched and nothing was reported, including after a move that is no longer a finding (#688) Migration: Restore the checks, or add allow-assertion-drop: <helper> <reason>
• Every language pack (assertions of many literals, caught assertions) (none): A change holding an assertion with hundreds of expected values or bounds, a Rust test that rebinds one name to catch_unwind results, a Kotlin test with many expected exceptions, or a Python try with many assertions is checked and reported. Before, the run could fail to return: 18 lines of let r = std::panic::catch_unwind(..) cost about a trillion instructions, and a 24 kB file of suites inside one expect did not finish (#672). Findings are unchanged Migration: none; a Rust caller of the library reads Expectation.calls as a slice instead of a Vec<String>
• audit --format html (hidden characters) (stricter): In text the page quotes from the history, the configuration or the forge (a commit subject, a file name, a directive name, a configuration key or value, a parse error, a cited reference), a control character other than tab, line feed and carriage return, a bidirectional control, a line or paragraph separator, a zero-width character, the soft hyphen and a tag character are each written as U+FFFD. Before, they were written as they were, so a subject or a file name could reorder or hide text in a row (#681). A zero-width joiner inside an emoji sequence is replaced too. Verdicts, exit codes and the JSON output are unchanged Migration: none; a page compared byte for byte with an earlier one differs only where the history holds such a character
• assertion-reduction (Rust helper moved to another module) (looser): No longer reported: a Rust test whose helper moved unchanged to another module of its crate, when the call resolves to the helper through the mod declarations and the use items or path, the helper is #[cfg(test)] code and it still holds the checks. A note names the helper and its file. A call that cannot be resolved to one helper is reported as before (#683) Migration: allow-assertion-drop lines written for such moves are no longer needed
• assertion-reduction (Rust crate helper no longer called) (stricter): Now reported: a Rust test that stops calling a resolved crate helper, starts calling a different new helper and drops assertions of its own is not excused by the new helper alone (#683) Migration: Restore the checks, or add allow-assertion-drop: <test> <reason>
• test-budget/fuzz-target-removed (manifest parsed) (stricter): A fuzz manifest's targets are read from its parsed TOML. Now reported: a removed target whose name is not the first key of its [[bin]] entry, sits under a header with a trailing comment, is written as a literal string, or is in an inline bin = [..] array; and a target whose entry is gone while a comment or a string still spells it (#678) Migration: Restore the target, or add allow-test-shrink: <target> <reason>
• test-budget/fuzz-target-removed (false positives) (looser): No longer reported for a target that is still listed after its keys were reordered, a comment was added above name or its quoting changed, nor for text in a comment or a string that was never a target (#678) Migration: A baseline entry for such a finding no longer matches anything; discipline baseline --write drops it
• test-budget (fuzz manifest that does not parse) (stricter): A head fuzz/Cargo.toml that does not parse as TOML stops the run (exit 2, gate test-budget), naming the file and line. Before, it read as a manifest with no targets. A base manifest that does not parse adds a note and no finding (#678) Migration: Fix the manifest
• Could-not-check text, lease errors (order) (none): The read errors kept for a tree with several unreadable Rust files, and the lease named when several lease files are invalid, are the same on every run, in path and name order (#678) Migration: none
• ci-integrity (output order) (none): rollup-needs-incomplete lists the missing jobs in name order, several rollup-needs-removed findings come in job then dependency name order, and the note for a workflow treated as a move lists its jobs in name order. Before, the same input could give different text on each run (#675). Fingerprints are unchanged Migration: none
• test-budget (output order) (none): Several fuzz-target-removed or seed-corpus-decreased findings come in name and path order on every run (#675) Migration: none
• test-floor/tests-moved-out-of-default-run (several targets) (none): A module that several test targets stopped declaring is reported at the same target on every run, the last in path order. Before, the target named, and so the finding's fingerprint, could change between runs (#675) Migration: A baseline entry recorded while another target was named no longer matches and the finding shows once; discipline baseline --write records it again
• harness-tampering (a file that is a test target more than once) (none): A file that is a test target of several packages, or of several [[test]] entries, is described as a harness = false target when any of them sets it. Before, the wording depended on the order the manifests were read (#675). Message wording only Migration: none
• hook install --upgrade (local edits), new --force (stricter): A generated script, workflow or plugin now carries a line with a digest of its own content. --upgrade rewrites such a file only when the digest matches, or when a file with no digest equals this release's output apart from that line. A file changed after it was written, or written by v0.18.0 or earlier and different from this release's output, is left as it is, with a unified diff and exit 1; before, it was overwritten without a message. A generated JSON hook file whose check timeout is below the default is no longer reset silently. In a JSON hook file that holds other hooks or settings, entries of ours that differ are refused with a diff. New --force (with --upgrade) overwrites and prints what was discarded; it never replaces a --pin-sums bootstrap with an unpinned one, and in such a JSON file it replaces only our entries. The digest detects an edit; it is not a signature. Migration: Read the diff, then --upgrade --force. --upgrade --timeout <n> keeps a timeout.
• Every language pack (deeply nested sources) (none): A source nested hundreds of levels deep is read in work that grows with its size. Before, a few kilobytes of nested functions or chained calls could keep a run from finishing (#669). Findings are unchanged. Nested function declarations and classes in JavaScript and TypeScript, nested #[test] functions in Rust and nested t.Run in Go still cost the nesting times the size of what is nested, bounded by the depth limit Migration: none
• Every language pack, pre-tool hook, ci-skip-set (deeply nested text) (stricter): The binary does its work on a thread with a 256 MiB stack, and a source whose syntax tree nests deeper than 4,096 levels is refused as could not parse `<path>`: the source nests <n> levels deep, past the 4096 this tool reads: exit 2 under the gates that need every file's facts, a note from the rest. Before, a deeply nested source ended the process with a stack overflow and no report (about 1,200 nested calls in Go, #667). A Rust assertion-macro argument or a Python string skip condition that a pack parses on its own is held to the same limit and to its parse budget, where it was read as not an expression. The pre-tool hook refuses a command nested past the limit. ci-skip-set reports Skip Decision Unverifiable for a workflow condition nested more than 64 levels or holding more than 256 && or ||, where it ended the process. The deepest of about 30,000 real sources measured nests 2,056 levels. Migration: None expected.
• vacuous-tests, assertion-reduction (self-comparison assertions) (additive): Two new findings, both warnings: vacuous-tests/self-comparison-assertion-added for a new test that can fail and also holds an equality assertion whose two operands are the same tokens, and assertion-reduction/self-comparison-assertion-introduced for an existing test that gains one while its counts hold. When the count drops, the existing assertions-reduced finding names the self-comparison lines, and a vacuous new test's message names them too, so a test carries one finding. Not reported: a pair holding a call or a macro invocation; an assertion inside a macro definition; an operand the same test also compares with something else. Exact form only, with no alias or value-flow analysis. Migration: None.
• vacuous-tests, assertion-reduction (what counts as a tautology or an equality assertion) (stricter): Operand identity is by token, so white space, comments and wrapping parentheses no longer hide a tautology. Java assertThat(x).isEqualTo(x), isSameAs and isSameInstanceAs, JavaScript assert.deepEqual and deepStrictEqual, and a parenthesised Python, Catch2 or C condition are tautologies. C# Assert.AreEqual, AreNotEqual, AreSame, AreNotSame and NUnit Assert.That(a, Is.EqualTo(b)) / Is.SameAs are equality-strength assertions, so weakening one is an assertion drop and Assert.AreEqual(x, x) is a tautology; before, they counted as plain assertions. Migration: Carry allow-vacuous-test: <test name> <reason> or allow-assertion-drop: <test name> <reason>.
• New gate harness-tampering (off by default) (additive): When enabled, it reports a change that adds one of these to a file the test runner loads: a Go TestMain that never calls m.Run() or drops its result before os.Exit (test-main-result-discarded); a pytest report hook that assigns outcome, or a collection hook that removes items while reading no marker, keyword or option (pytest-hook-masks-results); a unittest result method assigned, or overridden by an empty body (unittest-result-method-replaced), each at the gate's severity; and an exit with status zero and no condition around it in a conftest, a start-up file, a Jest or Vitest configuration or set-up file, or the root of a Cargo test target (harness-exits-zero, a warning at most). A harness file is one by its name or by the runner's configuration, never by a word in its path. Exact forms only, with no value-flow analysis; the reference lists what is not caught. Lifted by allow-harness-tampering: <path or path:line> <reason>. Not evaluated on a whole-tree run. Migration: None; opt in with [gates.harness-tampering] enabled = true.
• SARIF, JUnit and GitLab reports (policy refusals) (additive): A refusal that fails the run is an entry in the three reports: policy/max-overrides-exceeded, policy/max-inline-overrides-exceeded and policy/approval-required, at SARIF error, as a failed JUnit test case in a new policy test suite, and at GitLab major. A hidden directive that was not read, which does not fail the run, is policy/hidden-directive-refused at SARIF note, a passing JUnit test case, and GitLab info. Each entry carries the rule id, where the refusal is and fixed wording; counts, logins and directive text stay in the JSON and text reports. Exit codes, the JSON report and the text report are unchanged, and a run with no refusal writes the three reports as before. A run failed by fail_on_overrides is not carried, since the JSON report does not hold it either. Migration: None. A consumer that fails on any SARIF error or JUnit failure now sees a refused run there, where before only the exit code showed it; one that counts JUnit test cases sees the policy suite.
• ignored-tests (skip markers and CI early returns read from the tree) (looser): A display name, description, parameter value, fixture name or test name that contains Skip, skip:, .skip, enabled = false or [. no longer marks a test as skipped in C#, Python, Ruby, JavaScript, Java, Kotlin and Catch2; the marker itself is still read, and @Test(enabled = false) is now read at any spacing. An early return whose condition names a CI variable only inside a longer string or a comment is no longer a CI skip; a real environment read is unchanged. Migration: None.
• error-swallowing (Go), config-integrity (base_report) (stricter): Go _ = f() is Result Discarded when f is on the list of fallible callees the two-value form already uses; before, only a left side with a comma was read. base_report added beside an existing test_report is reported as a change of evidence, since the base side of the comparison then comes from a runner file. Migration: Handle the error, or carry allow-swallow: <path>:<line> <reason>. allow-gate-weakening: test-floor <reason> for the report.
• replay, audit, commit-provenance (reading commits) (stricter): A pull request number is read only where a subject ends with (#N), by one function; before, replay and audit read the last one anywhere in the subject, and ([#0](https://github.com/orieg/discipline/issues/0)) counted. A commit message that is not UTF-8 is read lossily, as check reads it: audit records its directives where it recorded nothing, and replay no longer rebuilds it with an empty message. An override's source in replay names the replayed commit, so replay --json is the same on every run. A ref that is not a commit is named in the error. Migration: None.
• Job summary, pull request comment, baseline and repository messages (text) (stricter): In the job summary and the comment, a word that is an issue or pull request reference, a commit id, a mail address or a run of seven or more hex digits is written as a code span, in quoted text and in the tool's own message text alike, so it cannot become a link; references the report writes itself stay links. The baseline subcommand names a file outside the repository by its file name only. A core.worktree in the user's git configuration that names a missing or another directory stops the run with exit 2 and names the key; before, the second case read that other directory. Migration: A consumer matching the raw Markdown of the summary or comment.
• test-floor (tests-moved-out-of-default-run, more rules) (stricter): The finding is also reported when a change switches a Cargo target's tests off in its own manifest (test = false or harness = false on a [[test]], [lib] or [[bin]], autotests = false), or removes a mod declaration, over tests that still exist while the count does not fall; and for a Deno exclude or vendor added over tests that Deno's default names collected. A removed mod line is reported on the file that held the declaration. Migration: Take the rule back, or carry allow-test-shrink: <file holding the rule> <reason>.

... (truncated)

Commits

• 1c8ea1b fix(scripts): support array input in gh run list json output for release tagg...
• 1a9391c build(deps): Bump the cargo group with 2 updates (#719)
• f66c7ab chore(release): record final v0.19.0 behaviour changes in compatibility ledge...
• 79ec3fd fix(guards): support thousands grouping and percent in figures, and condition...
• 212b347 fix(guards): validate ratio run commit and inherit kotest class skips (Refs #...
• eabb66e ci(test): raise test job timeout-minutes to 40 for macos runner (Refs #697) (...
• 8a03813 fix(report): replace zero-width, bidi, and tag characters with replacement sy...
• a2f0cda fix(assertion-reduction): prevent masking in helper call gain and restrict cr...
• 0deae1a chore(release): bump version to 0.19.0 with its ledger rows (#716)
• d4dfa8e refactor(guards): consolidate override handling with lift_or_push (Refs #493)...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions