chore(deps): bump actions/setup-node from 6.0.0 to 6.4.0 in the actions group#45
Merged
Merged
Conversation
Bumps the actions group with 1 update: [actions/setup-node](https://github.com/actions/setup-node). Updates `actions/setup-node` from 6.0.0 to 6.4.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@2028fbc...48b55a0) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: 6.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
🔍 Hypatia Security ScanFindings: 93 issues detected
View findings[
{
"reason": "Issue in quality.yml",
"type": "missing_workflow",
"file": "quality.yml",
"action": "create",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Issue in security-policy.yml",
"type": "missing_workflow",
"file": "security-policy.yml",
"action": "create",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
"type": "unpinned_action",
"file": "governance.yml",
"action": "pin_sha",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Action actions/upload-artifact@v4 needs attention",
"type": "unpinned_action",
"file": "release.yml",
"action": "pin_sha",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Action actions/download-artifact@v4 needs attention",
"type": "unpinned_action",
"file": "release.yml",
"action": "pin_sha",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "believe_me undermines formal verification (1 occurrences, CWE-704)",
"type": "believe_me",
"file": "/home/runner/work/typed-wasm/typed-wasm/src/abi/TypedWasm/ABI/SessionProtocol.idr",
"action": "flag",
"rule_module": "code_safety",
"severity": "critical"
},
{
"reason": "assert_total bypasses totality checker (1 occurrences, CWE-704)",
"type": "assert_total",
"file": "/home/runner/work/typed-wasm/typed-wasm/src/abi/TypedWasm/ABI/SessionProtocol.idr",
"action": "flag",
"rule_module": "code_safety",
"severity": "high"
},
{
"reason": "believe_me undermines formal verification (1 occurrences, CWE-704)",
"type": "believe_me",
"file": "/home/runner/work/typed-wasm/typed-wasm/src/abi/TypedWasm/ABI/Echo.idr",
"action": "flag",
"rule_module": "code_safety",
"severity": "critical"
},
{
"reason": "assert_total bypasses totality checker (1 occurrences, CWE-704)",
"type": "assert_total",
"file": "/home/runner/work/typed-wasm/typed-wasm/src/abi/TypedWasm/ABI/Echo.idr",
"action": "flag",
"rule_module": "code_safety",
"severity": "high"
},
{
"reason": "believe_me undermines formal verification (1 occurrences, CWE-704)",
"type": "believe_me",
"file": "/home/runner/work/typed-wasm/typed-wasm/src/abi/TypedWasm/ABI/ResourceCapabilities.idr",
"action": "flag",
"rule_module": "code_safety",
"severity": "critical"
}
]Powered by Hypatia Neurosymbolic CI/CD Intelligence |
6 tasks
hyperpolymath
approved these changes
May 24, 2026
hyperpolymath
added a commit
that referenced
this pull request
May 24, 2026
## Summary PR #42 merged with 8 red CI jobs; PR #44 repaired 2 (smoke test, workflow-security-linter) but left 6 still failing on every PR run. This PR repairs 4 of the remaining 6 — purely CI infrastructure fixes, no code-behaviour changes. ## Diagnosis (from PR #44 check_runs + PR #45 confirming persistence) | Job | Root cause | Status after this PR | |---|---|---| | Cargo build + test (typed-wasm-verify) | "Install Rust toolchain" exit 1 — `dtolnay/rust-toolchain@<SHA>` action returned non-zero. Local `cargo test --workspace --locked` passes 10/10. | fixed (swap action for rustup) | | Build + E2E (Idris2 + Zig) | "Install Zig" curl exit 22 (HTTP 404) — Zig 0.14+ flipped tarball naming from `zig-OS-ARCH-VERSION` to `zig-ARCH-OS-VERSION`. | fixed (URL + symlink path) | | Structural E2E (no-build) | `tests/e2e.sh` section 5 asserted gitignored `.mjs` build outputs exist; section 9 invoked the smoke test which import-fails when those outputs are absent. Locally passed because cached artifacts existed; CI clean checkouts always failed. | fixed (separate sources from outputs; skip smoke cleanly when artifacts missing) | | governance / Language / package anti-pattern policy | Shared workflow flags 6 tracked `.res` files. Honors per-repo `.hypatia-ignore`. | fixed (add `.hypatia-ignore` with 6 entries) | | Validate A2ML manifests | Third-party `hyperpolymath/a2ml-validate-action` exit 1 — log contents not readable without auth. | **not fixed** — separate investigation | | Validate K9 contracts | Third-party `hyperpolymath/k9-validate-action` exit 1 — same. | **not fixed** — separate investigation | ## Changes - **`.github/workflows/e2e.yml`** — cargo-verify uses `rustup toolchain install stable` directly (ubuntu-latest preinstalls rustup); Zig install URL + symlink updated to 0.14+ naming. - **`tests/e2e.sh`** — section 5 now distinguishes `PARSER_SOURCES` (required) from `PARSER_OUTPUTS` (skip-if-absent); section 9 skips the smoke invocation when `Parser.mjs` or `node_modules/@rescript` is absent. - **`.hypatia-ignore`** — new file exempting the 6 tracked ReScript source files (`src/parser/{Parser,Lexer,Checker,Ast}.res`, `examples/SafeDOMExample.res`, `tests/parser/ParserTests.res`) per the rule format honored by `hyperpolymath/standards/.github/workflows/governance-reusable.yml`. Documented that the exemptions go away when the tree-sitter + Idris2 parser migration lands. ## Verification Reproduced the structural failure in a clean clone (no node_modules, no rescript build): - **Before**: 49 passed, 4 failed, 1 skipped → FAILED - **After**: 49 passed, 0 failed, 5 skipped → PASSED Local artifact-populated tree still passes (53 passed, 0 failed, 1 skipped). Cargo workspace verified locally: `cargo build --workspace --locked` ✓, `cargo test --workspace --locked` 10/10 ✓. Zig URL fix is a static rename; will be exercised when the build-e2e job runs. ## Out of scope - A2ML + K9 validator failures (need log access to diagnose) - ReScript removal proper (Track A: tree-sitter grammar → Idris2 parser → ReScript cut) - Property tests, Security aspect dimension, proof-level regression tests (Track C cleanup) ## Test plan - [ ] Cargo build + test (typed-wasm-verify) → green - [ ] Build + E2E (Idris2 + Zig) → green (or fail at idris2/zig build, not at install) - [ ] Structural E2E (no-build) → green - [ ] governance / Language / package anti-pattern policy → green - [ ] Smoke test (Node.js ReScript parser) → still green (unaffected) - [ ] governance / Workflow security linter → still green (unaffected) --- _Generated by [Claude Code](https://claude.ai/code/session_01ExgUTJmU5UQQNLKynwxDjm)_ --------- Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the actions group with 1 update: actions/setup-node.
Updates
actions/setup-nodefrom 6.0.0 to 6.4.0Release notes
Sourced from actions/setup-node's releases.
... (truncated)
Commits
48b55a0Update Node.js versions in versions.yml and bump package to v6.4.0 (#1533)ab72c7eUpgrade@actionsdependencies (#1525)53b8394Bump minimatch from 3.1.2 to 3.1.5 (#1498)54045abScope test lockfiles by package manager and update cache tests (#1495)c882bffReplace uuid with crypto.randomUUID() (#1378)774c1d6feat(node-version-file): support parsingdevEnginesfield (#1283)efcb663fix: remove hardcoded bearer (#1467)d02c89dFix npm audit issues (#1491)6044e13Docs: bump actions/checkout from v5 to v6 (#1468)8e49463Fix README typo (#1226)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions