Skip to content

chore(deps): bump the actions group with 5 updates - #102

Merged
hyperpolymath merged 1 commit into
mainfrom
dependabot/github_actions/actions-113d374f55
Sep 15, 2026
Merged

chore(deps): bump the actions group with 5 updates#102
hyperpolymath merged 1 commit into
mainfrom
dependabot/github_actions/actions-113d374f55

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 14, 2026

Copy link
Copy Markdown
Contributor

Bumps the actions group with 5 updates:

Package From To
actions/checkout 6.0.2 7.0.1
Swatinem/rust-cache 2.8.2 2.9.2
github/codeql-action/init 4.37.9 4.38.0
github/codeql-action/analyze 4.37.9 4.38.0
hyperpolymath/smtp-notify-action 0.2.0 0.3.0

Updates actions/checkout from 6.0.2 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

Full Changelog: actions/checkout@v7...v7.0.1

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

What's Changed

New Contributors

Full Changelog: actions/checkout@v6...v6.0.3

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

... (truncated)

Commits

Updates Swatinem/rust-cache from 2.8.2 to 2.9.2

Release notes

Sourced from Swatinem/rust-cache's releases.

v2.9.2

What's Changed

New Contributors

Full Changelog: Swatinem/rust-cache@v2.9.1...v2.9.2

v2.9.1

Fix regression in hash calculation

Full Changelog: Swatinem/rust-cache@v2.9.0...v2.9.1

v2.9.0

What's Changed

New Contributors

Full Changelog: Swatinem/rust-cache@v2.8.2...v2.9.0

Changelog

Sourced from Swatinem/rust-cache's changelog.

Changelog

2.9.2

  • Fix credentials.toml cleanup
  • Improvements to cleanup, preserving more valid targets
  • Improvements to cargo install handling
  • Correctly sort/dedupe Rust versions

2.9.1

  • Fix regression in hash calculation

2.9.0

  • Update to node24
  • Support running from within a nix shell
  • Consider all installed toolchains for cache key
  • Use case-insensitive comparison to determine exact cache hit

2.8.2

  • Don't overwrite env for cargo-metadata call

2.8.1

  • Set empty CARGO_ENCODED_RUSTFLAGS when retrieving metadata
  • Various dependency updates

2.8.0

  • Add support for warpbuild cache provider
  • Add new cache-workspace-crates feature

2.7.8

  • Include CPU arch in the cache key

2.7.7

  • Also cache cargo install metadata

2.7.6

  • Allow opting out of caching $CARGO_HOME/bin
  • Add runner OS in cache key
  • Adds an option to do lookup-only of the cache

2.7.5

... (truncated)

Commits
  • 6323deb 2.9.2
  • b16e8d7 bump rollup and rebuild
  • 3bf42ac invert target/profile check in cleanup
  • 6e5b278 correctly sort and dedupe Rust versions
  • 5adc05f Bump the actions group across 1 directory with 3 updates (#368)
  • 66b1e95 fix: support Cargo V2 build dir layout (#371)
  • 72d126e Merge pull request #367 from Swatinem/dependabot/npm_and_yarn/dev-patch-2b495...
  • 48968d2 Bump the dev-patch group with 2 updates
  • 9f151ac update dependencies, rebuild
  • 0e24e5d Bump the actions group across 1 directory with 6 updates (#364)
  • Additional commits viewable in compare view

Updates github/codeql-action/init from 4.37.9 to 4.38.0

Release notes

Sourced from github/codeql-action/init's releases.

v4.38.0

  • On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
  • The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
  • Update default CodeQL bundle version to 2.27.0. #4129
Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.38.0 - 09 Sept 2026

  • On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
  • The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
  • Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

  • Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

  • Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

  • Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

  • Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

  • This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
  • Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

  • The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
  • The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

... (truncated)

Commits
  • b96794f Merge pull request #4131 from github/update-v4.38.0-7e08580a9
  • 02d5093 Update changelog for v4.38.0
  • 7e08580 Merge pull request #4130 from github/henrymercer/workflow-runner-sizing
  • bfcc52b Run slow macOS checks on larger runners
  • 8c251e7 Merge pull request #4129 from github/update-bundle/codeql-bundle-v2.27.0
  • 0b7ca40 Add changelog note
  • 40484b3 Update default bundle to codeql-bundle-v2.27.0
  • 977e6ce Merge pull request #4124 from github/henrymercer/toolcache-bundle-cleanup
  • 40a6b38 Address toolcache cleanup review feedback
  • deece8f Apply suggestion from @​henrymercer
  • Additional commits viewable in compare view

Updates github/codeql-action/analyze from 4.37.9 to 4.38.0

Release notes

Sourced from github/codeql-action/analyze's releases.

v4.38.0

  • On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
  • The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
  • Update default CodeQL bundle version to 2.27.0. #4129
Changelog

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.38.0 - 09 Sept 2026

  • On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
  • The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
  • Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

  • Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

  • Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

  • Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

  • Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

  • This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
  • Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

  • The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
  • The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

... (truncated)

Commits
  • b96794f Merge pull request #4131 from github/update-v4.38.0-7e08580a9
  • 02d5093 Update changelog for v4.38.0
  • 7e08580 Merge pull request #4130 from github/henrymercer/workflow-runner-sizing
  • bfcc52b Run slow macOS checks on larger runners
  • 8c251e7 Merge pull request #4129 from github/update-bundle/codeql-bundle-v2.27.0
  • 0b7ca40 Add changelog note
  • 40484b3 Update default bundle to codeql-bundle-v2.27.0
  • 977e6ce Merge pull request #4124 from github/henrymercer/toolcache-bundle-cleanup
  • 40a6b38 Address toolcache cleanup review feedback
  • deece8f Apply suggestion from @​henrymercer
  • Additional commits viewable in compare view

Updates hyperpolymath/smtp-notify-action from 0.2.0 to 0.3.0

Release notes

Sourced from hyperpolymath/smtp-notify-action's releases.

v0.3.0

Static, byte-reproducible smtp-notify binaries. CI rebuilt them from this tag and verified they hash to exactly the SHA-256 pins inside this tag's action.yml before publishing.

Changelog

Sourced from hyperpolymath/smtp-notify-action's changelog.

// SPDX-License-Identifier: MPL-2.0 = Changelog :toc: macro :toclevels: 2

All notable changes to this action are recorded here. The format follows https://keepachangelog.com/en/1.1.0/[Keep a Changelog]; versions follow https://semver.org/spec/v2.0.0.html[Semantic Versioning].

The unit of release is the action ref: the tag or commit you pin determines both action.yml and, through the SHA-256 pins inside it, the exact binary that runs.

toc::[]

== v0.3.0 — 2026-09-09

[IMPORTANT]

main is not a release, and pinning @main is not supported.

Between a release commit landing on main and its tag being pushed, action.yml on main names assets that do not exist yet, so @main fails at the download step. This window is unavoidable rather than an oversight: the release workflow refuses to publish unless the asset URL in the tagged commit already names the tag being released, so the commit must precede the tag. The window is minutes long and is one more reason @main is not a supported ref.

Pin a tag, or a commit SHA that is an ancestor of one.

=== Added

  • STARTTLS on the submission port. secure: false or secure: starttls now starts in the clear on port 587 and upgrades the same connection in place per RFC 3207, including the mandatory second EHLO after the upgrade. The upgrade is not opportunistic: a server that does not advertise STARTTLS fails the step, and that check runs before the command is sent, so no credential is ever written to a cleartext stream. Certificate verification is identical on both TLS paths.
  • EHLO capability parsing (issue #9). The EHLO reply is parsed into a Capabilities value — STARTTLS, the AUTH mechanism list (including the Exchange AUTH=LOGIN spelling), SIZE and 8BITMIME — and an AUTH failure now names what the server actually advertised. A mechanism mismatch and a wrong password no longer look alike in the log.
  • The proven state machine now carries two tables, selected by transport, each proven separately: the implicit-TLS table is proven to contain no upgrade rows, and the STARTTLS table is proven to reach them from the start state. A row that is present but unreachable would have authenticated in the clear while every prior proof stayed green.
  • AUTH LOGIN, and mechanism selection (issue #10). The mechanism is chosen

... (truncated)

Commits
  • 22e7bdb release: v0.3.0 — action.yml fetches the STARTTLS binaries
  • 11c4ba9 feat: reach Microsoft 365 and Google Workspace on the submission port (STARTT...
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the actions group with 5 updates
0d004e6 
Bumps the actions group with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `6.0.2` | `7.0.1` |
| [Swatinem/rust-cache](https://github.com/swatinem/rust-cache) | `2.8.2` | `2.9.2` |
| [github/codeql-action/init](https://github.com/github/codeql-action) | `4.37.9` | `4.38.0` |
| [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.37.9` | `4.38.0` |
| [hyperpolymath/smtp-notify-action](https://github.com/hyperpolymath/smtp-notify-action) | `0.2.0` | `0.3.0` |


Updates `actions/checkout` from 6.0.2 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v6.0.2...3d3c42e)

Updates `Swatinem/rust-cache` from 2.8.2 to 2.9.2
- [Release notes](https://github.com/swatinem/rust-cache/releases)
- [Changelog](https://github.com/Swatinem/rust-cache/blob/master/CHANGELOG.md)
- [Commits](Swatinem/rust-cache@v2.8.2...6323deb)

Updates `github/codeql-action/init` from 4.37.9 to 4.38.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@cdf488f...b96794f)

Updates `github/codeql-action/analyze` from 4.37.9 to 4.38.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@cdf488f...b96794f)

Updates `hyperpolymath/smtp-notify-action` from 0.2.0 to 0.3.0
- [Release notes](https://github.com/hyperpolymath/smtp-notify-action/releases)
- [Changelog](https://github.com/hyperpolymath/smtp-notify-action/blob/main/CHANGELOG.adoc)
- [Commits](hyperpolymath/smtp-notify-action@ede1191...22e7bdb)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: Swatinem/rust-cache
  dependency-version: 2.9.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: github/codeql-action/init
  dependency-version: 4.38.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.38.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: hyperpolymath/smtp-notify-action
  dependency-version: 0.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Sep 14, 2026
@dependabot
dependabot Bot requested a review from hyperpolymath as a code owner September 14, 2026 17:09
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Sep 14, 2026
@coderabbitai

coderabbitai Bot commented Sep 14, 2026 •
edited
Loading

Copy link
Copy Markdown

Review Change StackReview Change Stack

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 150652eb-3089-447d-a3b3-0fd5f30afc35

📥 Commits

Reviewing files that changed from the base of the PR and between 7658693 and 0d004e6.

📒 Files selected for processing (4)
  • .github/workflows/codeql.yml
  • .github/workflows/e2e.yml
  • .github/workflows/push-email-notify.yml
  • .github/workflows/satellite-crates-gate.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details
⚠️ CI failures not shown inline (7)

GitHub Actions: REUSE compliance / 0_reuse-lint.txt: chore(deps): bump the actions group with 5 updates

Conclusion: failure

View job details

##[group]Run reuse lint
 �[36;1mreuse lint�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 # MISSING LICENSES
 'PMPL-1.0-or-later' found in:
 * .github/workflows/governance.yml
 * .github/workflows/hypatia-scan.yml
 * .github/workflows/scorecard.yml
 # UNUSED LICENSES
 The following licenses are not used:
 * AGPL-3.0-or-later
 # MISSING COPYRIGHT AND LICENSING INFORMATION
 The following files have no copyright and licensing information:
 * MAINTAINERS
 * mise.toml
 The following files have no copyright information:
 * guix.scm
 # SUMMARY
 * Bad licenses: 0
 * Deprecated licenses: 0
 * Licenses without file extension: 0
 * Missing licenses: PMPL-1.0-or-later
 * Unused licenses: AGPL-3.0-or-later
 * Used licenses: CC-BY-SA-4.0, MPL-2.0, PMPL-1.0-or-later
 * Read errors: 0
 * Invalid SPDX License Expressions: 0
 * Files with copyright information: 471 / 474
 * Files with license information: 472 / 474
 Unfortunately, your project is not compliant with version 3.3 of the REUSE Specification :-(
 # RECOMMENDATIONS
 * Fix missing licenses: For at least one of the license identifiers provided by
   the 'SPDX-License-Identifier' tags, there is no corresponding license text
   file in the 'LICENSES' directory. For SPDX license identifiers, you can simply
   run 'reuse download --all' to get any missing ones. For custom licenses
   (starting with 'LicenseRef-'), you need to add these files yourself.
 * Fix unused licenses: At least one of the license text files in 'LICENSES' is
   not referenced by any file, e.g. by an 'SPDX-License-Identifier' tag. Please
   make sure that you either tag the accordingly licensed files properly, or
   delete the unused license text if you are sure that no file or code snippet is
   licensed as such.
 * Fix missing copyright/licensing information: For one or more files, the tool
   cannot find copyright and/or licensing information. You typically do this by
   adding 'SPDX-FileCopyrightText' and 'SPDX-License-Identifier' tags to each
   fil...

GitHub Actions: Static Analysis Gate / 0_Deposit findings for gitbot-fleet.txt: chore(deps): bump the actions group with 5 updates

Conclusion: failure

View job details

##[group]Run actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
 with:
   name: hypatia-findings
   path: findings/
   merge-multiple: false
   repository: hyperpolymath/vcl-ut
   run-id: 34873014877
   skip-decompress: false
   digest-mismatch: error
 env:
   REPO_OWNER: hyperpolymath
 ##[endgroup]
 Downloading single artifact
 ##[error]Unable to download artifact(s): Artifact not found for name: hypatia-findings

GitHub Actions: Static Analysis Gate / 1_Hypatia neurosymbolic scan.txt: chore(deps): bump the actions group with 5 updates

Conclusion: failure

View job details

##[group]Run set +e
 �[36;1mset +e�[0m
 �[36;1mHYPATIA_FORMAT=json "$HOME/hypatia/hypatia-cli.sh" scan . --exit-zero > hypatia-findings.json�[0m
 �[36;1mHYP_EXIT=$?�[0m
 �[36;1mset -e�[0m
 �[36;1m�[0m
 �[36;1m# --exit-zero is Hypatia's own documented CI recipe (lib/hypatia/cli.ex),�[0m
 �[36;1m# for exactly this case: "use in CI when a downstream step gates on�[0m
 �[36;1m# severity counts". Findings go to stdout, the one-line summary to�[0m
 �[36;1m# stderr, and the process exits 0 unless the SCANNER itself failed.�[0m
 �[36;1m#�[0m
 �[36;1m# Do NOT redirect stderr into the payload with `2>&1`: that folds the�[0m
 �[36;1m# summary line into the JSON, so every parse fails, the old `[]`�[0m
 �[36;1m# fallback substituted a clean result, CRITICAL was always 0, and the�[0m
 �[36;1m# gate below could never fire on any input. Keep stderr on the log.�[0m
 �[36;1mif [ "$HYP_EXIT" -ne 0 ]; then�[0m
 �[36;1m  echo "::error::Hypatia scanner execution failed with exit ${HYP_EXIT}"�[0m

GitHub Actions: Dogfood Gate / 1_Validate K9 contracts.txt: chore(deps): bump the actions group with 5 updates

Conclusion: failure

View job details

##[group]K9 Configuration Validation
 Scanning . for K9 files (.k9, .k9.ncl)...
 Found 7 K9 file(s)
   Validating: ./.machine_readable/self-validating/examples/ci-config.k9.ncl
   Validating: ./.machine_readable/self-validating/examples/project-metadata.k9.ncl
   Validating: ./.machine_readable/self-validating/examples/setup-repo.k9.ncl
   Validating: ./.machine_readable/self-validating/template-hunt.k9.ncl
   Validating: ./.machine_readable/self-validating/template-kennel.k9.ncl
   Validating: ./.machine_readable/self-validating/template-yard.k9.ncl
   Validating: ./container/deploy.k9.ncl
 ##[error]Missing K9! magic number. First non-empty line must be exactly 'K9!'

GitHub Actions: Dogfood Gate / 2_Groove manifest check.txt: chore(deps): bump the actions group with 5 updates

Conclusion: failure

View job details

##[group]Run # Check for static or dynamic Groove endpoints
 �[36;1m# Check for static or dynamic Groove endpoints�[0m
 �[36;1mHAS_MANIFEST="false"�[0m
 �[36;1mHAS_GROOVE_CODE="false"�[0m
 �[36;1m�[0m
 �[36;1mif [ -f ".well-known/groove/manifest.json" ]; then�[0m
 �[36;1m  HAS_MANIFEST="true"�[0m
 �[36;1m  # Validate the manifest JSON�[0m
 �[36;1m  if ! jq empty .well-known/groove/manifest.json 2>/dev/null; then�[0m
 �[36;1m    echo "::error file=.well-known/groove/manifest.json::Invalid JSON in Groove manifest"�[0m

GitHub Actions: Dogfood Gate / 3_Validate eclexiaiser manifest.txt: chore(deps): bump the actions group with 5 updates

Conclusion: failure

View job details

##[group]Run if [ ! -f "eclexiaiser.toml" ]; then
 �[36;1mif [ ! -f "eclexiaiser.toml" ]; then�[0m
 �[36;1m  # Check if repo has a Containerfile — if so, recommend eclexiaiser�[0m
 �[36;1m  if [ -f "Containerfile" ]; then�[0m
 �[36;1m    echo "::warning::Containerfile present but no eclexiaiser.toml. Run \`eclexiaiser init\` to scaffold energy/carbon budgets."�[0m
 �[36;1m  fi�[0m
 �[36;1m  echo "has_manifest=false" >> "$GITHUB_OUTPUT"�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1mecho "has_manifest=true" >> "$GITHUB_OUTPUT"�[0m
 �[36;1m�[0m
 �[36;1m# Validate TOML structure using Python 3.11+ tomllib�[0m
 �[36;1mpython3 -c "�[0m
 �[36;1mimport tomllib, sys�[0m
 �[36;1mwith open('eclexiaiser.toml', 'rb') as f:�[0m
 �[36;1m    data = tomllib.load(f)�[0m
 �[36;1mproject = data.get('project', {})�[0m
 �[36;1mif not project.get('name', '').strip():�[0m
 �[36;1m    print('ERROR: project.name is required', file=sys.stderr)�[0m
 �[36;1m    sys.exit(1)�[0m
 �[36;1mfunctions = data.get('functions', [])�[0m
 �[36;1mif not functions:�[0m
 �[36;1m    print('ERROR: at least one [[functions]] entry is required', file=sys.stderr)�[0m
 �[36;1m    sys.exit(1)�[0m
 �[36;1mfor fn in functions:�[0m
 �[36;1m    if not fn.get('name', '').strip():�[0m
 �[36;1m        print('ERROR: function name cannot be empty', file=sys.stderr)�[0m
 �[36;1m        sys.exit(1)�[0m
 �[36;1m    if not fn.get('source', '').strip():�[0m
 �[36;1m        print(f'ERROR: function {fn[\"name\"]} has no source path', file=sys.stderr)�[0m
 �[36;1m        sys.exit(1)�[0m
 �[36;1mprint(f'Valid: {project[\"name\"]} ({len(functions)} function(s))')�[0m
 �[36;1m" || {�[0m
 �[36;1m  echo "::error file=eclexiaiser.toml::Invalid eclexiaiser.toml — see step output for details"�[0m

GitHub Actions: Dogfood Gate / 5_Validate A2ML manifests.txt: chore(deps): bump the actions group with 5 updates

Conclusion: failure

View job details

##[group]A2ML Manifest Validation
 Scanning . for .a2ml files...
 ##[notice]Skipped 1 file(s) matching paths-ignore
 Found 121 .a2ml file(s)
   Validating: ./.github/0.1-AI-MANIFEST.a2ml
 ##[warning]Missing SPDX-License-Identifier in first 10 lines
   Validating: ./.machine_readable/0.1-AI-MANIFEST.a2ml
   Validating: ./.machine_readable/6a2/AGENTIC.a2ml
   Validating: ./.machine_readable/6a2/ECOSYSTEM.a2ml
   Validating: ./.machine_readable/6a2/META.a2ml
   Validating: ./.machine_readable/6a2/NEUROSYM.a2ml
   Validating: ./.machine_readable/6a2/PLAYBOOK.a2ml
   Validating: ./.machine_readable/6a2/STATE.a2ml
   Validating: ./.machine_readable/CLADE.a2ml
   Validating: ./.machine_readable/ENSAID_CONFIG.a2ml
   Validating: ./.machine_readable/STATE.a2ml
   Validating: ./.machine_readable/ai/0.2-AI-MANIFEST.a2ml
   Validating: ./.machine_readable/ai/AI.a2ml
 ##[warning]Missing SPDX-License-Identifier in first 10 lines
   Validating: ./.machine_readable/anchors/0.2-AI-MANIFEST.a2ml
   Validating: ./.machine_readable/anchors/ANCHOR.a2ml
   Validating: ./.machine_readable/bot_directives/coverage.a2ml
   Validating: ./.machine_readable/bot_directives/debt.a2ml
   Validating: ./.machine_readable/bot_directives/echidnabot.a2ml
   Validating: ./.machine_readable/bot_directives/methodology.a2ml
   Validating: ./.machine_readable/configs/0.2-AI-MANIFEST.a2ml
   Validating: ./.machine_readable/contractiles/INDEX.a2ml
   Validating: ./.machine_readable/contractiles/adjust/Adjustfile.a2ml
   Validating: ./.machine_readable/contractiles/bust/Bustfile.a2ml
   Validating: ./.machine_readable/contractiles/dust/Dustfile.a2ml
   Validating: ./.machine_readable/contractiles/intend/Intentfile.a2ml
   Validating: ./.machine_readable/contractiles/must/Mustfile.a2ml
   Validating: ./.machine_readable/contractiles/trust/Trustfile.a2ml
   Validating: ./.machine_readable/integrations/feedback-o-tron.a2ml
   Validating: ./.machine_readable/integrations/proven.a2ml
   Validating: ./.machine_re...
🔇 Additional comments (2)
.github/workflows/e2e.yml (1)

43-43: LGTM!

Also applies to: 54-54

.github/workflows/satellite-crates-gate.yml (1)

56-56: LGTM!

📝 Summary

Summary by CodeRabbit

  • Chores
    • Updated pinned workflow actions to newer versions for security and maintenance.
    • Refreshed CodeQL, Rust cache, email notification, and repository checkout actions without changing workflow behaviour.

Walkthrough

Four GitHub Actions workflows update pinned action commits. CodeQL, Rust cache, SMTP notification, and Checkout references change. Existing workflow inputs, permissions, gates, and analysis settings remain unchanged.

Changes

Workflow action maintenance

Layer / File(s) Summary
Static analysis action pins
.github/workflows/codeql.yml		 CodeQL initialisation and analysis use a newer pinned commit. Existing language, build mode, and analysis settings remain unchanged.
Test workflow cache pins
.github/workflows/e2e.yml		 The e2e and property jobs use the same newer v2 Swatinem/rust-cache commit.
Notification and checkout pins
.github/workflows/push-email-notify.yml, .github/workflows/satellite-crates-gate.yml		 The SMTP notification action and repository Checkout action use newer pinned commits. Existing notification inputs and workflow settings remain unchanged.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Suggested reviewers: hyperpolymath

Merge Risk: ⚪ Minimal · up to 0d004

No actionable merge-blocking risk remains from the reviewed workflow action updates.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Description check ⚠️ Warning The description accurately lists the five dependency updates and includes relevant release information. It does not follow the repository template because it omits the Summary, Changes, RSR Quality Ch… Add the required template sections. Summarise the purpose and changes, complete the RSR Quality Checklist, describe the testing performed or state that no tests were required, and state whether screenshots are not applicable.
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly identifies a grouped dependency update for five GitHub Actions. It is concise and related to the main change.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Full details: Description check

Explanation

The description accurately lists the five dependency updates and includes relevant release information. It does not follow the repository template because it omits the Summary, Changes, RSR Quality Checklist, Testing, and Screenshots sections.

🤖 Coding task started

✨ Finishing Touches 💡 1
🛠️ Fix failing CI checks 💡
  • Create stacked PR
  • Commit on current branch

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

A rabbit checks each action pin,
Fresh commits hop neatly in.
CodeQL scans and caches gleam,
Emails travel through the stream.
Checkout lands on newer ground,
No workflow changes are found.

Comment @coderabbitai help to get the list of available commands.

@hyperpolymath
hyperpolymath enabled auto-merge (squash) September 14, 2026 17:27
@coderabbitai

coderabbitai Bot commented Sep 14, 2026 •
edited
Loading

Copy link
Copy Markdown

✅ Coding task complete — no changes needed

@coderabbitai

coderabbitai Bot commented Sep 14, 2026

Copy link
Copy Markdown

Rate Limit Exceeded

@hyperpolymath have exceeded the limit for the number of chat messages per hour. Please wait 17 minutes and 41 seconds before sending another message.

@hyperpolymath
hyperpolymath merged commit 5fc2d48 into main Sep 15, 2026
18 of 24 checks passed
@hyperpolymath
hyperpolymath deleted the dependabot/github_actions/actions-113d374f55 branch September 15, 2026 11:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@hyperpolymath hyperpolymath hyperpolymath approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@hyperpolymath