chore(deps): bump dtolnay/rust-toolchain from 2c7215f132e9ebf062739d9130488b56d53c060c to 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 in the github-actions group - #155
Merged
hyperpolymath merged 1 commit intoAug 5, 2026
Conversation
Bumps the github-actions group with 1 update: [dtolnay/rust-toolchain](https://github.com/dtolnay/rust-toolchain). Updates `dtolnay/rust-toolchain` from 2c7215f132e9ebf062739d9130488b56d53c060c to 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 - [Release notes](https://github.com/dtolnay/rust-toolchain/releases) - [Commits](dtolnay/rust-toolchain@2c7215f...6c977a6) --- updated-dependencies: - dependency-name: dtolnay/rust-toolchain dependency-version: 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 dependency-type: direct:production dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
hyperpolymath
approved these changes
Aug 5, 2026
hyperpolymath
deleted the
dependabot/github_actions/github-actions-0192c2c068
branch
August 5, 2026 17:51
hyperpolymath
added a commit
that referenced
this pull request
Aug 7, 2026
…ecard, Governance) (#158) Dependabot bumps #155 and #157 changed action SHAs without regenerating `.github/workflows/actions.lock` — the churn flagged when the lockfile first landed. Result on main: **7 of 15 workflows stale**, CodeQL and OSSF Scorecard back to 0-second `startup_failure`, and the Governance job red because its own `gh actions-lock --verify-local` step (standards #574) correctly detected the staleness. Full recipe applied: 1. `gh actions-lock` regenerate 2. restore the inline SHA pins (estate doctrine — `sha_pinning_required` stays ON) 3. `relock-sha-keys.sh` to re-key the lockfile to those SHAs 4. **restore the reusable-caller entries the generator drops** (the six standards wrappers), with the transitive `uses:` union 5. re-pin the wrappers to standards `08586a1` Verification: `--verify-local` → *All 15 workflows have complete lockfile coverage*; `--no-fix` → valid, zero errors.⚠️ **This will recur on every dependabot action bump.** Step 4 is not scriptable with the shipped tool alone; I'm contributing `relock-caller-entries.sh` to standards so the estate has the whole recipe in one place. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
hyperpolymath
added a commit
that referenced
this pull request
Aug 7, 2026
…rnance) (#164) **Third occurrence of DEBT I-1 today.** Dependabot #163 bumped four workflows' action SHAs without regenerating `actions.lock`, so 4 of 15 went stale — CodeQL back to 0-second `startup_failure`, Governance red on its own `gh actions-lock --verify-local` step. Regenerated with the full four-step recipe (regenerate → restore inline SHA pins → `relock-sha-keys.sh` → restore reusable-caller entries). `--verify-local`: all 15 covered. `--no-fix`: valid, zero errors. ### This is now demonstrably unsustainable by hand Three times in one day (#155/#157, then #163). Every dependabot action bump re-breaks the board, and the fix is not a single command — step 4 has no upstream equivalent, because `gh actions-lock` drops reusable-workflow callers. **I-1 needs automating**, not repeating. ### Incidental finding `actions/checkout@3d3c42e` now records a bare SHA as its `ref:` because the same commit carries **conflicting tag comments** in the tree — `# v5` in `cflite_batch.yml`/`cflite_pr.yml` versus `# v7.0.1` in `codeql.yml` — so the generator cannot narrow it. Pre-existing mislabelling; enforcement checks the digest rather than the ref, so this is cosmetic, but one of those comments is wrong and should be corrected. ### Separately: Secret Scanner is red for an unrelated *upstream* reason Not fixed here — see the standards-side issue. `gitleaks` fails with: ``` FTL failed to load extended config, err: open config/gitleaks/estate-baseline.toml: no such file ``` The secret-scanner reusable sparse-checks-out standards' **own** `.gitleaks.toml` and copies it into consumers as the estate baseline — but that file `[extend]`s `config/gitleaks/estate-baseline.toml`, a CWD-relative path that exists only inside standards. It should copy the baseline file itself. This breaks every consumer without its own `.gitleaks.toml`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the github-actions group with 1 update: dtolnay/rust-toolchain.
Updates
dtolnay/rust-toolchainfrom 2c7215f132e9ebf062739d9130488b56d53c060c to 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772Commits
6c977a6Merge pull request #182 from dtolnay/namef3510ffRender better step namesDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions