ci: bump the actions group across 1 directory with 2 updates - #1
Closed
dependabot[bot] wants to merge 23 commits into
Closed
ci: bump the actions group across 1 directory with 2 updates#1dependabot[bot] wants to merge 23 commits into
dependabot[bot] wants to merge 23 commits into
Conversation
Fourteen network monitoring, DNS hardening and investigation tools that
had accumulated across ~/.local/bin and /usr/local/bin, collected into an
installable suite with a licence, an installer and CI.
Tools, by area:
DNS audit-dns.sh harden-dns.sh checkdns dns-toggle dns-status.sh
dns-tray
Watch netwatch probesource nettop netcheck
Repair netmaster wifi-recover.sh warp-killswitch warp-tray
Assembly notes:
- netcheck was taken from the installed copy, not the older one in
netwatch-deploy/bin. The packaged copy predated the Wi-Fi work and
was missing SSID, band and bitrate reporting; shipping it would have
been a regression.
- probesource was never in any package. It is the largest tool here at
1144 lines and existed only at /usr/local/bin/probesource.
- checkdns was a shell function in ~/.zshrc. It is now a standalone
script; it keeps the function wrapper because it uses `local`, and
invokes itself at the end.
- dnsleaktest was deliberately NOT included. It is the third-party
bash.ws tool, not original work, and is not ours to relicense.
Everything carries an MIT header. install.sh splits system tools into
/usr/local/bin and user tools into ~/.local/bin, honours SUDO_USER so the
tray applets land in the right home, and supports --dry-run, --dns-only
and --user. Nothing is enabled as a service by the installer.
CI gates on `shellcheck -S error` plus bash syntax, ruff and py_compile
for the two Python tray applets, and a licence-header check. Style
warnings are reported without failing the build: these are field-tested
operational tools and rewriting them to silence SC2034 would be the
riskier change.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Y1MnEkBkR1ezmWykBNAz3F
The first run failed because py_compile created bin/__pycache__ and the next loop then ran `head` on a directory, which is fatal under `bash -e`. Every bin/* loop now skips non-files, and py_compile runs with -B so it writes no bytecode at all. Ruff is pinned to --select E9,F (syntax errors plus pyflakes: undefined names, unused imports) and --isolated so a stray config cannot change what the gate means. The 11 findings on the tray applets were all style opinions - import ordering, blind except, context managers, implicit subprocess check - with no pyflakes hits among them. Those are now reported in a non-blocking step, matching how the bash tools treat shellcheck warnings. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y1MnEkBkR1ezmWykBNAz3F
The real cause of both failed runs. Writing
files=$(for f in bin/*; do head -1 "$f" | grep -q X && printf ...; done)
makes the command substitution inherit the exit status of the LAST loop
iteration. bin/* ends alphabetically at wifi-recover.sh, so for the
python selector grep returns 1, the substitution exits 1, and `bash -e`
kills the step before ruff ever runs - which is why the log showed a
bare exit 1 with no ruff output. The shellcheck job passed only by luck:
that same last file IS bash, so its grep succeeded.
Every selector is now an explicit if/then accumulator, with a comment at
the top of the file explaining why, so it does not get "simplified" back
into the broken form later. install.sh and uninstall.sh are now linted
too, and the ruff step exits cleanly if no python tools are present.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Y1MnEkBkR1ezmWykBNAz3F
Shell (19 warnings -> 0):
- 9 SC2034: verified dead in scope before touching anything. Unused loop
counters and a discarded `read` field became `_`; genuinely dead
assignments (netcheck ch_line, probesource ports/http/netwatch_hits/
entry/ip2, and an orphaned `local i`) were removed.
- 6 SC2046: ALL intentional. A file list splitting into tar arguments, and
tactic-id lists splitting into run_set arguments. Quoting any of them
would break the tool, so each carries an inline disable stating why.
The three in investigate()'s case statement needed one directive above
the whole `case` - shellcheck rejects them in front of individual
branches (SC1124).
- 2 SC2155, 1 SC1090, 1 SC2010. The ls|grep test for dhclient config became
existence tests; verified equivalent against present/empty/missing/real
directories under bash, where an unmatched glob stays literal.
Python (11 findings -> 0):
- SIM115 on warp-tray's lock file was a FALSE POSITIVE and is now a noqa
with a warning attached: that handle is held open for process lifetime
to hold the flock, and a `with` block would release it and defeat the
single-instance guard.
- Two blind `except Exception` narrowed to what can actually be raised.
- subprocess.run gained an explicit check=False, which is its own default.
- Import sorting applied, then verified gi.require_version() still precedes
every gi.repository import.
Regressions I introduced in the previous commit, now fixed: inserting the
25-line MIT header shifted the line numbers that netmaster, harden-dns.sh
and wifi-recover.sh used to print their own usage, so all three printed the
licence instead of help. All now extract by content, so a future header
change cannot silently break them again. netmaster's use of `$SED` rather
than `sed` hid it from the first grep.
Verified by running the tools, not just linting them: netcheck still
reports SSID/band/channel/bitrate, warp-killswitch state, checkdns, and
audit-dns.sh's rewritten dhclient branch all behave as before.
CI now gates on `shellcheck -S warning` and the full default ruff ruleset,
since the tree is clean at both. README updated to match.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Y1MnEkBkR1ezmWykBNAz3F
Previously any argument was silently ignored and the interactive TUI launched regardless, so `probesource --help` dropped the user into a dialog menu. The guard is parsed before everything else, which matters twice over: --help now works with dialog absent (verified against a PATH containing no dialog at all), and it exits without touching the master log or creating the state directory (verified against a clean HOME: zero entries created). Usage lives in the tool's own doc comment and is extracted by content, matching the pattern the other tools now use, so there is one source of truth and no line numbers to break. Unrecognised arguments exit 2 with a pointer to --help rather than starting a scan session the caller did not ask for. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y1MnEkBkR1ezmWykBNAz3F
`probesource <ip>` skips the target picker and goes straight to mode selection, then runs one investigation and exits rather than dropping into the menu loop. Deliberately still asks for the mode: nothing is sent to the target until you choose one, so a command-line target cannot become an unattended active scan. Validation happens in main(), not in the early argument guard, because the address helpers are not defined that early. It reports on stderr and exits 2 rather than calling die(), which opens a dialog msgbox - the wrong response to a CLI typo, and one that needs a UI the caller may not have. Hostnames are rejected with a hint to resolve first. investigate() takes the preset as an optional argument. With one set there is no picker to return to, so cancelling the mode menu leaves instead of looping forever on a picker that would never be shown again. The guard still rejects unknown options and more than one argument. Verified: bad address, extra args and unknown options all exit 2; a valid address skips straight to the mode menu and, when cancelled, exits having registered zero scans. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y1MnEkBkR1ezmWykBNAz3F
The mark is a shield around a six-blade camera aperture with a live red core, over the PANOPTES wordmark whose O is a padlock network node. Drawn as real vector geometry rather than traced from a raster: the aperture blades are solved as line/circle intersections tiling a hexagonal opening, and every glyph is baked to a <path> outline, so the file carries no font dependency and renders identically everywhere. Wordmark is Monaco Bold outline-expanded to a synthetic ExtraBold, since Monaco ships no ExtraBold cut. Tagline is JetBrains Mono Bold, tracked so its ink edges land exactly on the wordmark's. Contains no <filter> elements — the neon halo and core bloom are baked as layered strokes, so nothing is lost if a sanitizer strips filters. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RB5N5QU512AgakKKqCBKmN
Added a newline at the end of the dependabot.yml file.
SECURITY.md sets the private reporting route and scopes what counts. The interesting surface here is that probesource takes a target out of the UFW journal, the netwatch log or the ss table and hands it to whois, dig, tcpdump and p0f — a hostile scanner controls what lands in those logs, so an address that escapes into a shell is a real finding. Also in scope: a hardening tool that fails open, and a killswitch that reports `killed` while still reachable. Out of scope: bugs in the tools Panoptes drives, and the read-only investigation tools revealing your own network, which is the point. Both files warn about what a diagnostic paste leaks. nettop, netcheck and probesource print MACs, SSIDs and addresses; the pcap/tshark/p0f tactics capture live traffic; the netwatch log is a record of everything that has touched the machine. CONTRIBUTING.md carries a read-only diagnostic bundle, splits the suite into its read-only and writing halves, and reproduces all three CI gates in one block. That block collects into arrays where lint.yml uses a space-joined string plus an SC2086 disable — same files, same gates, but it also survives being pasted into zsh, where an unquoted $var does not word-split and the string form silently selects nothing and reports success. EndeavourOS added everywhere distributions are listed. The README now says plainly that an unlisted distribution should work too: nothing here is tied to a package manager or a release, only to systemd-resolved and NetworkManager. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RB5N5QU512AgakKKqCBKmN
The Contributor Covenant 2.1 verbatim, with a short preamble saying what this project actually wants: technical disagreement is welcome, say why something is wrong and what you tested. The enforcement address doubles as the private security address, so the file says plainly that a vulnerability is not a conduct report and to label the email. Issue forms rather than markdown templates, so the structure CONTRIBUTING.md asks for is enforced instead of hoped for. The bug form requires the tool, the exact command line including environment overrides, the distro, the commit, and three confirmations — on current main, redacted, and not a security issue. It names the environment variables harden-dns.sh reads, because a default-policy bug and an override bug have different causes and the report rarely says which. Blank issues are disabled: both routes out lead somewhere useful, SECURITY.md for vulnerabilities and CONTRIBUTING.md for the diagnostic bundle. The feature form asks for the outage rather than the feature. Every tool here came from a real failure, and the manual commands someone ran to diagnose it by hand are usually most of the tool. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RB5N5QU512AgakKKqCBKmN
Three new tools, and an installer that no longer assumes you have already
installed what the suite calls.
ech-build.sh builds an ECH-capable curl. No distribution ships one, because no
released OpenSSL implements Encrypted Client Hello. It compiles the OpenSSL ECH
branch into /opt/openssl-ech and curl against it into /usr/local -- neither
prefix is owned by a package manager, so system updates cannot overwrite the
result. OpenSSL is linked statically (no-shared) on purpose: a development TLS
stack must not end up on any other program's library search path. --verify runs
a live --ech hard handshake, which refuses to fall back to a cleartext SNI, so a
pass means the SNI was genuinely encrypted. Verified end to end against the
existing install on this machine, including that libcurl still resolves through
RUNPATH rather than a global ld.so.conf.d entry.
ech-browsers.sh finds every browser on the machine -- native, Flatpak and Snap,
Firefox-family and Chromium-family -- and enables ECH plus the secure DNS it
depends on. Enabling ECH alone accomplishes nothing: the browser must fetch the
site's HTTPS DNS record over a protected channel to learn the ECH key, and
Firefox will not attempt ECH at all with TRR off, so both are set together.
Firefox settings go to user.js (survives a preferences reset), Chromium to
Local State through a same-directory atomic replace. Verified idempotent over
three consecutive runs, and cleanly reverted.
Three behaviours worth calling out, each of which cost a bug:
- It never touches Tor Browser or Mullvad Browser. Those resolve through
their proxy circuit deliberately; pointing them at a DoH resolver would
send lookups around it. That is a deanonymisation bug, not hardening.
- It refuses to run under sudo, where it would find root's empty home and
configure nothing while looking like it had succeeded.
- It skips config directories left behind by uninstalled browsers, and skips
a running Chromium rather than making an edit the browser overwrites on
exit. Vivaldi and Opera number their own releases, so the "predates ECH
support" check only judges version numbers plausibly on Chromium's scale.
panoptes-deps.sh identifies the distribution and package manager and installs
what is missing across dnf5/dnf/yum, apt, pacman, zypper and apk. Detection
reads /etc/os-release ID and ID_LIKE and never probes for a package-manager
binary -- this Fedora machine carries /usr/bin/pacman, and it is the arcade
game. Requirements are probed by capability (a command in PATH, a pkg-config
module, a Python import, a typelib file) rather than by package name; a failed
batch retries individually so the report names exactly what a distribution
lacks; and everything is re-probed afterwards so the exit status reflects
reality rather than the package manager's opinion.
install.sh runs it first, and gains --ech-only, --deps-only and --no-deps.
Clean under the repository's own gates: bash -n, shellcheck at style level
(stricter than the fatal warning gate), and the SPDX header check.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JELHhRZTALnm4ycDwv6VAW
…plain ECH Running the tool for real on this machine surfaced three defects, one of which meant an advertised safety property had never worked. chromium_running tested [ -e SingletonLock ]. That lock is a symlink to "hostname-pid", which is not a real path, so -e follows it and returns false every time. The "will not edit a running Chromium" protection was decorative. Only -L can see a dangling symlink. Replacing it exposed the next two. Both detectors now look for an open file descriptor under the profile directory, which is the only evidence that means anything for a sandboxed browser -- a Flatpak or Snap browser writes its namespace pid into the lock, and testing that against host pids is not merely unreliable but actively wrong: the stale Flatpak lock on this box names pid 2, and pid 2 is kthreadd, alive on every Linux system ever booted. That is why LibreWolf was reported as running when it was closed. Lock files are now consulted only for non-sandboxed profiles. The descriptor scan then failed silently under pipefail. "find -print -quit | grep -q ." lets grep close the pipe as soon as it matches, find dies of SIGPIPE with status 141, and pipefail reports the pipeline as failed -- so the function returned "not running" precisely when it had found something. It passed in isolation because the shell I tested it in had no pipefail. Same family as the CI loop bug already documented in lint.yml. Command substitution, no pipe. Verified against a live file descriptor holder: refuses while held, applies once released despite a stale SingletonLock left in place, and no longer reports the closed LibreWolf as running. Separately, applying the tool to profiles that already had ECH set by hand left each pref defined twice. Harmless while the values agreed and a silent conflict the moment they did not. Pre-existing copies are now commented out with a PANOPTES-SUPERSEDED tag, and --revert restores them -- round-trip verified byte-for-byte against the original file. Tor Browser and Mullvad Browser tarball paths added to the skip table. Safety never rested on that list, since the browser table is an allowlist and an unlisted profile is never written to, but a skip you cannot see in the output is not a skip anyone should have to take on faith. README gains a section on what ECH is and why it matters: that HTTPS leaves the hostname in the clear in the ClientHello, that encrypting DNS hides the question while SNI still announces the answer, and that ECH and secure DNS are one mechanism rather than two features. It also says plainly what ECH does not do -- the IP is still visible, the site has to publish a config, traffic analysis survives -- because overselling it helps nobody. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JELHhRZTALnm4ycDwv6VAW
…ver (2.1.0) Toggling WARP off left the resolver answering from a poisoned cache, which reads as "no internet" while the network is fine. Tearing the tunnel down kills every DNS lookup in flight over it. Those fail DNSSEC validation with failed-auxiliary -- the transport carrying the DS and DNSKEY chain vanished mid-lookup -- and systemd-resolved caches the failure. Firefox's captive-portal probe is usually among the casualties, and one failed probe is enough for it to declare the link down. The tunnel teardown itself is clean, which I verified rather than assumed: with WARP disconnected the nftables table, the ip rule and routing table 65743 are all gone, the route falls back to the LAN gateway, and both ping and DNS work. Only the cache is stale. warp-tray now runs resolvectl flush-caches and reset-server-features after any state change, on a thread so the tray's event loop is not blocked, and the killswitch menu path flushes too. Measured across a teardown with lookups deliberately in flight: 4 of 12 probes failed without the flush, 0 of 12 with it. One run, small sample -- directional, not a proof. dns-toggle now appends Quad9 to DNS=, because FallbackDNS= is not a failover and never was. Per resolved.conf(5) it is "only used if no other DNS server information is known", meaning only when DNS= is empty; it is never consulted because the servers in DNS= went quiet, which is exactly the case people assume it covers. Both branches previously listed only one provider, so both entries failed together. The trade-off is documented in the script: resolved sticks with whichever server last worked, so after a failover you stay on Quad9 -- malware filtering, no ad blocking -- until it restarts. Also fixes a packaging bug: both trays load their icons by absolute path from ~/.local/share/icons, but the repository never contained them. A fresh install produced trays with no artwork, which looks like a crash. All four SVGs now ship in share/icons and install.sh places them. README gains a section on the two tray toggles with an annotated screenshot, and the repo description was corrected from 14 tools to 17. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JELHhRZTALnm4ycDwv6VAW
2.1.0 fixed warp-tray and stopped there. Auditing every path in the suite that changes WARP state turned up three more that needed the same treatment. netmaster's `warp off` and `warp on` each have two branches: one delegating to warp-killswitch, and a fallback for when the killswitch is not installed. The killswitch branches were already fine, because warp-killswitch restarts systemd-resolved, and a restart drops the cache and the learned per-server feature grades together. The fallback branches, and the whole of `warp reset`, brought the tunnel up or down and left the cache alone -- which is exactly the failure 2.1.0 was supposed to fix. Verified in dry-run that all three now emit the flush, and that every `warp-cli connect` in the file is followed by either flush_resolver or a systemd-resolved restart. Audited and found already correct, recorded in the changelog so this does not get re-checked: warp-killswitch down/up, netmaster's S5/S6 repair ladder, dns-toggle, checkdns (read-only), and netcheck -- whose resolvectl flush-caches is unrelated, since it exists to provoke a real upstream round-trip so the DoT probe is not answered from cache. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JELHhRZTALnm4ycDwv6VAW
The "what ECH does not do" list said flatly that your IP address is still visible. That is true of ECH standing alone and misleading for anyone running a tunnel, which is a large share of the people this suite is aimed at -- it ships a WARP tray and a WARP killswitch. Corrected to the real shape: behind a VPN the destination IP travels inside the tunnel and is out of the ISP's view, but the visibility moves rather than disappears, because the tunnel operator sees both ends. With WARP that operator is Cloudflare, who is already the far end of most ECH-enabled connections, so the pairing buys less than it looks like it does. Also flags split-tunnel excludes, which is the case people forget. Anything on the exclude list travels outside the tunnel, so its destination IP is back on the wire and ECH is the only thing still hiding the hostname -- on this machine that covers Apple's ranges plus two explicitly excluded hosts. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JELHhRZTALnm4ycDwv6VAW
The suite shipped warp-tray, warp-killswitch and netmaster's WARP subcommands, and no way to actually get WARP. On a fresh machine those installed fine and then failed with no explanation, because warp-cli was not there and nothing said so. warp-setup.sh adds Cloudflare's own repository -- an RPM repo file with gpgcheck=1, or an APT list with the key dearmoured into /usr/share/keyrings -- installs the client, registers the device and connects. Fedora/RHEL and Debian/Ubuntu, which is what Cloudflare publishes for. Arch is told to build cloudflare-warp-bin from the AUR and re-run with --register, rather than being handed a command that will not work. It sets tunnel_only mode by default, and that is the interesting decision. WARP's other modes proxy DNS themselves, which fights every other tool here: harden-dns.sh pins DNSSEC and DoT in systemd-resolved, dns-toggle switches the resolver underneath it, and checkdns audits the result. tunnel_only carries traffic and leaves resolution to resolved, so the two stop arguing. --mode overrides it. Registration asks before running, because it creates a device record on Cloudflare's side rather than only changing local state. It flushes the resolver after connecting, for the same reason warp-tray and netmaster do. panoptes-deps.sh gains a `warp` group holding warp-cli, marked unpackaged everywhere. Rather than the generic "install it yourself", it now says "no distro packages WARP -- run: warp-setup.sh". Both branches tested against a copy with the probe pointed at a name that does not exist. Also documents something worth being explicit about: AdGuard needs no installation and was never missing. It is a public resolver reached over DoT, not software -- the DNS tools simply point systemd-resolved at 94.140.14.14. WARP was the only component running a local daemon, which is why it was the only gap. Verified on this machine: --check reports the live install correctly, --dry-run touches nothing and leaves WARP connected, the mode and argument guards reject bad input, and verify confirms warp=on from Cloudflare's trace endpoint. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JELHhRZTALnm4ycDwv6VAW
The file was still the GitHub starter template with an empty package-ecosystem, which Dependabot rejects -- so it was watching nothing. github-actions is the only ecosystem that applies here. The workflow pins actions/checkout@v4 three times and actions/setup-python@v5 once, and those are the only version-pinned dependencies in the repository. Grouped into a single PR rather than one per action, since two actions producing two PRs a week is noise. Recorded in the file why the obvious second candidate is absent: pip would watch nothing, because ruff is installed inline in the workflow with `pip install ruff` and Dependabot does not parse `run:` steps. The comment carries the block to paste in if ruff is ever pinned in a manifest. Everything else the suite depends on is system packages, which no dependency bot tracks. That is panoptes-deps.sh's job. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JELHhRZTALnm4ycDwv6VAW
Author
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JELHhRZTALnm4ycDwv6VAW
The protection now enforced on this repository, as files rather than as settings someone clicked once and cannot reproduce or review. main: no deletion, no force-push. v* tags: no deletion, no moving, no force-push -- creating new version tags is untouched. bypass_actors is empty deliberately. A repository-admin bypass would mean the rules do not bind the only person pushing, which is the entire point; the README documents flipping enforcement to disabled for the rare case that needs it. The README also records the four rules left off and why -- pull_request, required_status_checks, required_signatures and required_linear_history all assume a workflow this repository does not have, and each would fail in a way that looks like a bug rather than a policy. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JELHhRZTALnm4ycDwv6VAW
…atch The README told you to flip enforcement with a single -f field. That call succeeds and silently drops every rule, because PUT replaces the ruleset rather than patching it. Send the whole body instead, and verify the rules survived afterwards. Also records what was actually tested rather than assumed: creating a v* tag succeeded, deleting it was rejected with GH013, and a normal fast-forward push to main was unaffected. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JELHhRZTALnm4ycDwv6VAW
Bumps the actions group with 2 updates in the / directory: [actions/checkout](https://github.com/actions/checkout) and [actions/setup-python](https://github.com/actions/setup-python). Updates `actions/checkout` from 4 to 7 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4...v7) Updates `actions/setup-python` from 5 to 7 - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@v5...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/setup-python dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/github_actions/actions-e91bde37dc
branch
from
August 24, 2026 20:09
71a9769 to
20ba2ef
Compare
Author
|
This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests. To ignore these dependencies, configure ignore rules in dependabot.yml |
dependabot
Bot
deleted the
dependabot/github_actions/actions-e91bde37dc
branch
August 31, 2026 04:46
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the actions group with 2 updates in the / directory: actions/checkout and actions/setup-python.
Updates
actions/checkoutfrom 4 to 7Release notes
Sourced from actions/checkout's releases.
... (truncated)
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
3d3c42eprep v7.0.1 release (#2531)2880268escape values passed to --unset (#2530)12cd223trim only ascii whitespace for branch (#2521)62661c4skip running unsafe pr check if input is default (#2518)e8d4307Bump the minor-actions-dependencies group with 2 updates (#2499)631c942eslint 9 (#2474)4f1f4aeBump actions/upload-artifact from 4 to 7 (#2476)ba09753Bump actions/checkout from 6 to 7 (#2488)b9e0990Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)e8cb398Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)Updates
actions/setup-pythonfrom 5 to 7Release notes
Sourced from actions/setup-python's releases.
... (truncated)
Commits
5fda3b9Pin SHA commits and update docs with latest versions (#1338)4ab7e95Merge pull request #1337 from actions/philip-gai/bump-actions-cache-6-2-00f3a009Remove the pip-install input (#1336)f8cf429Migrate to ESM and upgrade dependencies (#1330)54baeeaValidate and retry manifest fetch to prevent silent failures (#1332)c709277Annotation code fix (#1335)6849080remove EOL Python versions and Bumps numpy text fixture (#1333)0903b46Bump certifi from 2020.6.20 to 2024.7.4 in /tests/data (#1328)ece7cb0Fix pip cache error handling on Windows. (#1040)1d18d7aUpdate advanced-usage.md (#811)