Repository navigation
chore(deps): bump the actions group across 1 directory with 3 updates - #954
Merged
Merged
Conversation
Bumps the actions group with 3 updates in the / directory: [Swatinem/rust-cache](https://github.com/swatinem/rust-cache), [ruby/setup-ruby](https://github.com/ruby/setup-ruby) and [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog). Updates `Swatinem/rust-cache` from 2.9.2 to 2.9.3 - [Release notes](https://github.com/swatinem/rust-cache/releases) - [Changelog](https://github.com/Swatinem/rust-cache/blob/master/CHANGELOG.md) - [Commits](Swatinem/rust-cache@v2.9.2...v2.9.3) Updates `ruby/setup-ruby` from 1.329.0 to 1.331.0 - [Release notes](https://github.com/ruby/setup-ruby/releases) - [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb) - [Commits](ruby/setup-ruby@v1.329.0...v1.331.0) Updates `trufflesecurity/trufflehog` from 3.99.2 to 3.99.3 - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@v3.99.2...v3.99.3) --- updated-dependencies: - dependency-name: Swatinem/rust-cache dependency-version: 2.9.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: ruby/setup-ruby dependency-version: 1.331.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: trufflesecurity/trufflehog dependency-version: 3.99.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Contributor
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
hyperpolymath
approved these changes
Oct 25, 2026
hyperpolymath
deleted the
dependabot/github_actions/actions-ec35d693f4
branch
October 25, 2026 21:18
6 of 7 tasks
hyperpolymath
added a commit
that referenced
this pull request
Oct 26, 2026
## Summary `hyperpolymath/standards` now redirects (HTTP 301) to **`metadatastician/standards`**. Git clone and fetch follow that redirect. **GitHub Actions does not follow it for a reusable workflow**, so every caller pinned at `hyperpolymath/standards@333b06a` fails at startup: ``` Invalid workflow file: .github/workflows/governance.yml#L19 error parsing called workflow ... "hyperpolymath/standards/.github/workflows/governance-reusable.yml@333b06a…" : workflow was not found. ``` - Governance on main has ended in `startup_failure` with no jobs since 2026-10-25 21:18 UTC (#954, then #956). - Scorecard has failed the same way since 2026-10-26. Its last green run was 2026-10-25 04:15 at `9a5db53`. - `333b06a` is still on standards' `main`, so this is the move, not a lost commit. This PR re-points the 5 reusable callers (governance, hypatia-scan, mirror, scorecard, secret-scanner), plus the gitleaks-baseline `repository:` checkout in security-policy, to `metadatastician/standards` at **the same SHAs**. No behaviour change is intended. ### Lockfile `actions.lock` is tool-owned and must not be hand-edited. This session has no working `gh` credential, so a **one-off workflow on this branch** does the regeneration (precedent: #936). It: 1. runs `gh actions-lock` v0.2.0 with `github.token`; 2. runs the estate repair chain from standards `333b06a` (`relock-sha-keys`, `complete-job-refs`, `close-lock`, `prune-stale`). This is `regen_lock` from `scripts/regen-dependabot-locks.sh`: the lock alone changes, and the workflow YAML is restored; 3. verifies the result with `update-actions-lock.sh --verify-local`, `check-lock-sync.sh` and the governance gate's own `check-actions-lock-gate.sh`; 4. commits **only** the lock back to this branch. The one-off has no `uses:`, so it starts without a lock entry. It removes itself from the tree before the tool runs, so the lock never records it. I delete it in a separate commit before this leaves draft. ## Type of change - [x] 🐛 Bug fix (CI regression from an upstream repository move) - [x] 🔧 Build / CI / tooling ## How has this been verified? - `actionlint` 1.7.7: 0 messages on all 6 changed workflows and the one-off. - `shellcheck`: 0 messages on the one-off's script. - hypatia's own `WorkflowHardening.scan/1` gives no finding on the one-off. WH002 first flagged a top-level `contents: write`, so that permission now sits on the job. - I confirmed the cause by `curl -sI https://github.com/hyperpolymath/standards` → `Location: https://github.com/metadatastician/standards`, and by the run-page error above. - I confirmed that standards' reusables at `333b06a` make **no** nested `uses:` call to `hyperpolymath/standards`, so re-pointing the callers is enough. They do `actions/checkout` it by `repository:` 18 + 2 + 2 + 2 times; git follows the redirect for those, and this PR's governance run is the end-to-end check. - **Pending:** the one-off's run, then this PR's first green governance run after the lock commit. ## Notes for reviewers - **Beyond this repo:** every estate caller of `hyperpolymath/standards/...` breaks the same way. The ratchet census counted about 368 governance callers, and echidna is one of them. This PR is the hypatia pilot and could become the gitbot-fleet propagation recipe. - The `with: hypatia-ref:` scanner pin is unchanged. ## Checklist - [ ] My commits are **signed**. The session's signing shim is platform-mediated. - [x] I ran the project's own checks/tests locally and they pass (scoped as above). - [x] New files carry the correct SPDX (MPL-2.0 on the one-off). - [x] Docs are updated, and no public claim now overstates what the code does. - [x] I have not introduced a soundness hole. --- _Generated by [Claude Code](https://claude.ai/code/session_01CYR5bf5FBLS7cXQK72aVNM)_
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the actions group with 3 updates in the / directory: Swatinem/rust-cache, ruby/setup-ruby and trufflesecurity/trufflehog.
Updates
Swatinem/rust-cachefrom 2.9.2 to 2.9.3Release notes
Sourced from Swatinem/rust-cache's releases.
Changelog
Sourced from Swatinem/rust-cache's changelog.
Commits
d1527c82.9.3f0fca6fupdate dependencies and rebuildb49b17fadd missing awaits6a7bc3eBump the dev-minor group across 1 directory with 2 updates (#383)4ece996Bump the actions group across 1 directory with 6 updates (#392)8103affBump the prd-minor group across 1 directory with 2 updates (#389)0e361f3fix: log rustup toolchain list failure as info instead of warning (#393) (#394)f0d9c38Merge pull request #380 from Swatinem/dependabot/github_actions/actions-8ff58...ccd9742Bump the actions group with 2 updates258712bfix: stop cleanup timestamp pruning after the first entry (#377)Updates
ruby/setup-rubyfrom 1.329.0 to 1.331.0Release notes
Sourced from ruby/setup-ruby's releases.
Commits
824c0e2Use ruby'sGem::Versioninstead of npm'ssemverto parse rubygems versiona89e929Tweak wording in the README, update link and simplifyfbbff8dSuggest the latest patch release when a version is unavailableUpdates
trufflesecurity/trufflehogfrom 3.99.2 to 3.99.3Release notes
Sourced from trufflesecurity/trufflehog's releases.
Commits
e63326dgithub: name the missing permission when a comment listing is refused (#5438)048de9fUpdate module google.golang.org/grpc to v1.83.2 [SECURITY] (#5431)31d7303Add per-logger debug level override for source logging (#5432)feea7f9Add SonarQube Server token detector (#5419)27d8ea2fix(github): use a single "app client registry" to make sure we reuse client ...b40e7fe[INT-1051] Fix GitHub comment scans stopping early on large repositories (#5405)9e93a20Update module google.golang.org/grpc to v1.83.1 [SECURITY] (#5426)4b56723Update module go.opentelemetry.io/otel/exporters/otlp/otlptrace to v1.45.0 [S...37a6f6eReplace deprecated google.CredentialsFromJSON with CredentialsFromJSONWithTyp...6404b63Update module filippo.io/edwards25519 to v1.1.1 [SECURITY] (#5421)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions