build(deps): bump the actions-deps group across 1 directory with 5 updates - #75
Merged
github-actions[bot] merged 1 commit intoJul 30, 2026
Conversation
…dates Bumps the actions-deps group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `7.0.0` | `7.0.1` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.37.3` | `4.37.4` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.37.3` | `4.37.4` | | [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) | `1.14.1` | `1.14.2` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.37.3` | `4.37.4` | Updates `actions/checkout` from 7.0.0 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v7...3d3c42e) Updates `github/codeql-action/init` from 4.37.3 to 4.37.4 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@e4fba86...f205ea1) Updates `github/codeql-action/analyze` from 4.37.3 to 4.37.4 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@e4fba86...f205ea1) Updates `pypa/gh-action-pypi-publish` from 1.14.1 to 1.14.2 - [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases) - [Commits](pypa/gh-action-pypi-publish@ba38be9...dc37677) Updates `github/codeql-action/upload-sarif` from 4.37.3 to 4.37.4 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@e4fba86...f205ea1) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-deps - dependency-name: github/codeql-action/init dependency-version: 4.37.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-deps - dependency-name: github/codeql-action/analyze dependency-version: 4.37.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-deps - dependency-name: pypa/gh-action-pypi-publish dependency-version: 1.14.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-deps - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-deps ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
dependabot
Bot
deleted the
dependabot/github_actions/actions-deps-287f0b2e32
branch
July 30, 2026 17:19
wshallwshall
added a commit
that referenced
this pull request
Aug 5, 2026
#193) * fix(ci): dependabot auto-merge decided by exclusion — invert #3 to an allow-set (BACKLOG #336) Guardrail #3 was a 16-name Python deny-list with no ecosystem qualifier: anything not named auto-merged if it was a patch, on every ecosystem. Inverted to HOLD-UNLESS-NAMED. Only `actions/`, `github/` and `dependabot/` are eligible, and only on github-actions; the uv, pip and npm rows ship EMPTY, an unrecognised ecosystem token holds, and the fail-safe whole-group denial is preserved. Measured against the live PR #75, not recalled: its body carries five `Updates` entries — four on the allow row (actions/checkout and three github/codeql-action/*) and pypa/gh-action-pypi-publish, which is not — so that batch would HOLD as a whole. Expect auto-merge to fire RARELY; that is the intent of hold-unless-named, not a regression. Hardening, not an incident. There is no evidence of exploitation, the attacker must already own an upstream publisher account, and merging to main is not publication (PyPI release is gated on an owner tag push). MessageFoundry is a not-deployed beta with zero production instances, so this is stated as what the shipped code WOULD allow on first deployment, never as a present exposure. §4 RELEASE AGE, with an honest account of its reach. A new `id: age` step holds a SECURITY-track PR whose candidate version was published under MIN_RELEASE_AGE_HOURS (24), failing closed on an API error, an absent or unparseable upload timestamp, an unexpected name or version shape, or an ecosystem with no publish-date source wired. It is INERT with respect to the merge decision as shipped: age_ok=true is reachable only for uv/pip, eligible=true only for github-actions, and the merge `if` requires both — disjoint sets. Confirmed by executing the shipped allow-set body over exactly the ecosystems the age gate can pass (uv and pip both return eligible=false; only github_actions returns true). The header and the BACKLOG banner now say exactly that instead of presenting it as an operating control; recording an unreachable control as operative is the false-premise class docs/Secure_Development_Standards.md §3 forbids. The step is gated on `steps.allowset.outputs.eligible == 'true'`, which changes no merge outcome — the merge `if` already requires that conjunct — but removes an unauthenticated outbound GET made from a job holding `contents: write` for a PR that was going to be held anyway. §5 the header's backstop claim, corrected without over-claiming in the other direction. Dropped: "the only gate that inspects a dependency's shipped bytes at all is security.yml's trivy step". security.yml:265 marks trivy `continue-on-error: true` and :271 restricts it to schedule/dispatch, so it is advisory AND never runs on a Dependabot PR. The replacement is the weaker true form: no REQUIRED check reads a dependency's shipped bytes. The sentence describes what semgrep cannot SEE rather than where it looks, so the unmerged plan-semgrep-scope widening (BACKLOG #334) cannot falsify it. Provenance made honest. The header cited DEPENDENCY-POSTURE-REVIEW.md as the numbered source for guardrails it does not carry: #3 is INVERTED from the deny-list that document describes, and #4 is introduced here. The block is retitled AUTO-MERGE GUARDRAILS, #3 is moved out from under the security-track framing (it gates every PR), and the test docstring carries the same correction. Amending the vault copy stays the owner's separate obligation — the repo simply stops asserting it has already happened. Restated facts removed. The header repeated three cooldown values that live in .github/dependabot.yml; only two had a test bound, and that file records github-actions' window as approximate because it ages off the tag's commit date. The header now points at the source instead (CLAUDE.md §11 — state a load-bearing fact once and link to it). .github/dependabot.yml comments corrected. The uv block told a maintainer "routine patches auto-merge AFTER aging; security patches auto-merge now" — both halves false once uv's allow row ships empty. The github-actions block's "an advisory fix is unaffected" now says it opens as a PR unaffected but reaches main by human review, because the advisory gate is pip-keyed and never confirms an action. docs/testing/master-test-plan/01-environments-data-and-tooling.md:350 still advertised the deleted auth/token/crypto deny-list as a live control of this workflow. No test pinned that doc, so it drifted silently; the row now describes what ships. TESTS - The behavioural harness runs the shipped bodies under `bash -e`, which is what Actions applies by default on Linux (no `shell:` is declared anywhere). Plain bash keeps going where CI aborts the step, and `assert proc.returncode == 0` was exactly the assertion that would mask that class. No shipped row changes its decision: ten rows were compared head-to-head under plain bash and under `bash -e` and agreed on both exit code and emitted output, and the full 20-row parametrised set passes under `-e`. So this is a fidelity fix, not a behaviour change — but `_run_step_body` now RETURNS the returncode rather than asserting it, so an abort path can be expressed as an expected outcome instead of being indistinguishable from a harness bug. test_no_step_overrides_the_default_shell is the tripwire for a future `shell:` silently invalidating the premise that `bash -e` is what CI runs. - _load_dependabot's skip is deleted. It skipped on the premise that .github/dependabot.yml is "private-only, deny-listed on the OSS mirror". .gitignore names that file under DELIBERATELY NOT LISTED as content meant to ship; `git ls-files --error-unmatch` resolves it and `git check-ignore` exits 1. The refactor had routed THREE tests through that skip, including the cooldown test whose entire reason for existing is that a missing cooldown was invisible to CI. It now asserts presence. - The jq skip reason claimed the test "runs on the ubuntu CI leg and skips locally". The windows-2022 and windows-2025 images ship jq and Git Bash, and both are REQUIRED contexts in .github/required-contexts.txt, so it runs there too. The reason now says so — a maintainer reading it after a Windows-only red should not be told to expect ubuntu. ADR 0034 CONSEQUENCE, recorded because leaving it unrecorded is what that ADR warns against: this file grew 190 -> 403 lines and the `Why pull_request` anchor moved from line 42 to 76. Under the ADR's convergence rule, dismissed alert #87 re-fires as a new alert number and needs re-dismissing after merge. VERIFICATION - ruff check . -> All checks passed! - ruff format --check . -> 1042 files already formatted - mypy messagefoundry -> 21 errors, ALL PRE-EXISTING and NOT from this change: absent [fhir]/[dicom]/[webauthn] extras (fhirpathpy, fhir, pynetdicom, pydicom and webauthn are all ABSENT from this venv; 12 import-not-found plus their 7 no-any-return / 2 unused-ignore consequences). This change touches no file under messagefoundry/, so mypy's inputs are byte-identical to HEAD. CI installs the extras and is the authority. The quartet is NOT green locally and this commit does not claim it is. - pytest -q -> 10291 passed, 841 skipped, 22 warnings in 1282.01s (0:21:22). The pre-change baseline measured on this tree was 10289 passed / 841 skipped, so the delta is exactly the two tests added here. Run on a byte-frozen tree (sha256 of all five changed files recorded before the run and unchanged after), because two comment edits had landed after an earlier run started and six tests read docs/BACKLOG.md. - Falsification: 18 mutations of the workflow and dependabot.yml, plus deleting dependabot.yml outright, each confirmed to turn the matching test RED and then restored byte-identically (sha256 checked after every case). Among them: the allow-set admitting `pypa/`, losing its trailing slash, matching by substring, treating an empty name list as eligible, and failing open on an unrecognised ecosystem; the age step failing open on an undatable ecosystem, hard-coding a PASS on the version-track exit, re-deriving the security track, and losing its allow-set gate; a step declaring `shell:`; the merge `if` dropping either the age_ok or the allow-set conjunct; and each cooldown being removed or shortened. The four jq-gated rows were falsified separately (threshold deleted, missing-timestamp failing open, curl error failing open, and the discriminating PASS removed) against a purpose-built jq stand-in implementing the two shipped filters, because this box has no jq at all; execution against real jq happens on CI. * docs(backlog): flip #336 to SHIPPED and supersede one clause of its 2026-08-03 amendment Banner lines of item #336 ONLY. VERIFIED BY NUMBER, not by banner text — a byte-identical banner pasted under the wrong item survives every well-formedness check. `git diff -U0 -- docs/BACKLOG.md` is two hunks, @@ -3353 +3353 @@ and @@ -3358,0 +3359,2 @@; the enclosing `## ` heading computed backwards from each of the three changed lines (3353, 3359, 3360) is `## 336. Dependabot auto-merge shields review with a deny-list` in all three cases. The ranked table and the four census distribution lines are untouched. THE CENSUS WAS NOT RECOMPUTED. This commit flips one item's banner and deliberately does not touch the distribution lines. The banner records guardrail #4 as a FORWARD guard that is inert with respect to the merge decision as shipped, rather than as an operating control: age_ok=true is reachable only for uv/pip, eligible=true only for github-actions, and the merge `if` requires both. Recording an unreachable control as operative is the false-premise class docs/Secure_Development_Standards.md §3 forbids. The added blockquote uses the glyph-free `**AMENDED 2026-08-04 — ...**` convention. It supersedes ONE clause of the dated 2026-08-03 note — "The deny-list itself is untouched, so the rest of the item stands ... §§1, 3, 4, 5 and 6 are unaffected" — which was accurate when measured and is deliberately left as written rather than rewritten. The deny-list no longer exists, so §6 is discharged by deletion rather than annotation, and the 16 names survive only as a PROPERTY under test (`_DENY_PACKAGES` asserts none of them reaches any allow row). scripts/docs/backlog_status_check.py exits 0 ("290 backlog items, each declaring exactly one status") — reported as corroboration only. That gate validates that one banner is present and self-consistent, never that it belongs to this item, so it cannot see the corruption class this commit had to avoid. The by-number check above is the evidence; the green gate is not.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the actions-deps group with 5 updates in the / directory:
7.0.07.0.14.37.34.37.44.37.34.37.41.14.11.14.24.37.34.37.4Updates
actions/checkoutfrom 7.0.0 to 7.0.1Release notes
Sourced from actions/checkout's releases.
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
Updates
github/codeql-action/initfrom 4.37.3 to 4.37.4Release notes
Sourced from github/codeql-action/init's releases.
Changelog
Sourced from github/codeql-action/init's changelog.
... (truncated)
Commits
f205ea1Merge pull request #4053 from github/update-v4.37.4-9130ce0f7e40d079Update changelog for v4.37.49130ce0Merge pull request #4051 from github/update-bundle/codeql-bundle-v2.26.2c62d824Add changelog noteda0c190Update default bundle to codeql-bundle-v2.26.218420e3Merge pull request #4043 from github/mbg/ts/changelog7e8d897Merge pull request #4046 from github/mbg/repo-prop/code-quality2d4c474Log!analysisKindSupportedcase98c05a1Fix argument validation inrollback-changelog.ts8289a49Ignore repository property for unsupported analysis kindsUpdates
github/codeql-action/analyzefrom 4.37.3 to 4.37.4Release notes
Sourced from github/codeql-action/analyze's releases.
Changelog
Sourced from github/codeql-action/analyze's changelog.
... (truncated)
Commits
f205ea1Merge pull request #4053 from github/update-v4.37.4-9130ce0f7e40d079Update changelog for v4.37.49130ce0Merge pull request #4051 from github/update-bundle/codeql-bundle-v2.26.2c62d824Add changelog noteda0c190Update default bundle to codeql-bundle-v2.26.218420e3Merge pull request #4043 from github/mbg/ts/changelog7e8d897Merge pull request #4046 from github/mbg/repo-prop/code-quality2d4c474Log!analysisKindSupportedcase98c05a1Fix argument validation inrollback-changelog.ts8289a49Ignore repository property for unsupported analysis kindsUpdates
pypa/gh-action-pypi-publishfrom 1.14.1 to 1.14.2Release notes
Sourced from pypa/gh-action-pypi-publish's releases.
... (truncated)
Commits
dc37677Merge pull request #417 from trail-of-forks/ft/bump-deps8b2f234Bumppypi-attestationsandsigstore78b72dbMerge pull request #416 from takluyver/twine-v792f4d2aUpdate twine to v7Updates
github/codeql-action/upload-sariffrom 4.37.3 to 4.37.4Release notes
Sourced from github/codeql-action/upload-sarif's releases.
Changelog
Sourced from github/codeql-action/upload-sarif's changelog.
... (truncated)
Commits
f205ea1Merge pull request #4053 from github/update-v4.37.4-9130ce0f7e40d079Update changelog for v4.37.49130ce0Merge pull request #4051 from github/update-bundle/codeql-bundle-v2.26.2c62d824Add changelog noteda0c190Update default bundle to codeql-bundle-v2.26.218420e3Merge pull request #4043 from github/mbg/ts/changelog7e8d897Merge pull request #4046 from github/mbg/repo-prop/code-quality2d4c474Log!analysisKindSupportedcase98c05a1Fix argument validation inrollback-changelog.ts8289a49Ignore repository property for unsupported analysis kindsDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions