From 2619a9fb821515603dcebe80d9bd1bb2c10b05cb Mon Sep 17 00:00:00 2001 From: Arena Agent Date: Tue, 22 Sep 2026 11:21:05 +0000 Subject: [PATCH] fix(dependabot): full hold on github/codeql-action (versions-ignore failed, PR #101) PR #101 proved within ~1h of #100 landing that dependabot re-raises the blocked 4.38.1 bump in SHA form even with versions: ["4.38.1"] ignored - it swapped b96794f0 (v4.38.0 commit) for 1c5b675 (v4.38.1 commit) while copying the inline warning comment verbatim. #101 closed unmerged. This switches to an unconditional hold on the dependency until upstream clears 4.38.1 or a new release is verified green. --- .github/dependabot.yml | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 3d9fe16..00599d2 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -9,12 +9,16 @@ updates: patterns: - "*" ignore: - # v4.38.1 fails GitHub workflow-startup validation estate-wide - # (codeql.yml/hypatia-scan.yml startup_failure on every repo that merged - # the grouped bump; v4.38.0 is green). Rollback: PR #100. Revisit once - # 4.38.1 is cleared upstream. + # HOLD: github/codeql-action at v4.38.0 (SHA-pinned). v4.38.1 fails + # GitHub workflow-startup validation estate-wide (codeql.yml / + # hypatia-scan.yml startup_failure on every repo that took the bump; + # rollback: #100). The earlier `versions: ["4.38.1"]` rule did NOT hold: + # dependabot re-raised the bump in SHA form within hours (PR #101), + # even copying the inline warning comment while swapping the SHA. Full + # hold until upstream clears 4.38.1 or a newer release verifies green; + # revisit deliberately, not nightly. - dependency-name: "github/codeql-action" - versions: ["4.38.1"] + # Rust core crate. NOTE: deliberately no entry for /desktop — its path # dependency on an external sibling checkout (../../gossamer) would make # dependabot error.