chore(deps): bump the actions group across 1 directory with 4 updates - #736
chore(deps): bump the actions group across 1 directory with 4 updates#736dependabot[bot] wants to merge 3 commits into
Conversation
dependabot
Bot
added
dependencies
Up to standards ✅🟢 Issues
|
![codacy-production[bot]](https://avatars.githubusercontent.com/in/56611?s=60&v=4){kind=small}
| steps: | ||
| - name: Send push notification email | ||
| uses: dawidd6/action-send-mail@v3.12.0 | ||
| uses: dawidd6/action-send-mail@v18 |
There was a problem hiding this comment.
🔴 HIGH RISK
This step handles sensitive SMTP secrets. To protect against credential theft via supply chain compromise, pin the action to a full 40-character commit SHA instead of the v18 tag.
|
|
||
| - name: TruffleHog Secret Scan | ||
| uses: trufflesecurity/trufflehog@v3.97.0 | ||
| uses: trufflesecurity/trufflehog@v3.97.1 |
There was a problem hiding this comment.
🔴 HIGH RISK
Pinning the secret scanner action to a commit SHA is critical. Since this tool actively scans for credentials, ensuring the code being executed is immutable prevents a scenario where a compromised action harvests the very secrets it is intended to detect.
|
|
||
| - name: Install cargo-llvm-cov | ||
| uses: taiki-e/install-action@v2.86.5 | ||
| uses: taiki-e/install-action@v2.86.7 |
There was a problem hiding this comment.
🔴 HIGH RISK
Pinning third-party actions to a specific commit SHA is the only way to guarantee the action's code hasn't been tampered with after the version was released. Tags can be moved by repository owners, whereas a SHA is immutable. For a tool like install-action that fetches binaries, this ensures integrity of the build tools.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
@dependabot rebase |
|
Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry! If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request |
…oor (#739) ## What Removes three carve-out classes from `cicd_rules.ex` whose unblock conditions are now met, and reframes one: | Carve-out | Rules it leaves | Proof it's dead | |---|---|---| | `avow-protocol/telegram-bot/avow-telegram-bot/` | typescript, rescript, rescript_interface | Bot rewritten in AffineScript — avow-protocol@main has **0 `.ts`, 0 `.res`** under `telegram-bot/` | | `affinescript-deno-test/` | **all six** rules | 100% `.affine` on affinescript@main (PRs #735/#736); the developer-ecosystem mirror is also all-`.affine`; no rule-matching file exists under this substring anywhere in the estate | | `tsconfig.json` | typescript | Unreachable: the rule's glob is `*.ts`, a `.json` path never reaches the allowlist | | `affinescript-cli/` | typescript, rescript, rescript_interface, javascript_jsx — **stays in nodejs + javascript** | Reframed from "bootstrap shim" to permanent **npm front door** (runtime-agnostic JS distribution shim: downloads the pinned native binary, SHA-256-verifies, execs). Its 4 JS files + lockfile are legitimately permanent; `.ts`/`.res`/`.jsx` there never is. | Because `path_allow_prefixes` matches with `String.contains?/2` (substring, estate-wide), every removal was verified against **every** location tracking these paths, not just one repo. ## Tests Former exemption tests are flipped to flag tests — the flipped test is the gate that keeps the retirement from silently regressing. `mix test test/rules/` → **187 tests, 0 failures**. ## Companion standards `.claude/CLAUDE.md` mirror tables (TS/ReScript/npm/JavaScript) updated in a companion PR, per the SSOT footer ("the detection rule … is the single source of truth; this table mirrors that"). 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
|
Closing as factually dead: the compare against main shows an empty diff — all 4 action bumps in this group landed on main via 408339a (chore: bump standards workflow pins). Nothing left for this PR to change. The CI failures here were the pre-existing set (44 anonymous baseline entries fail the exemption ratchet on every PR; Rust CI blocked by DEBT-REGISTER CI-1), not caused by this PR. |
Pull request was closed
|
This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests. To ignore these dependencies, configure ignore rules in dependabot.yml |
2 participants
Bumps the actions group with 4 updates in the / directory: taiki-e/install-action, dawidd6/action-send-mail, trufflesecurity/trufflehog and actions/setup-java.
Updates
taiki-e/install-actionfrom 2.86.5 to 2.86.7Release notes
Sourced from taiki-e/install-action's releases.
Changelog
Sourced from taiki-e/install-action's changelog.
Commits
b6ff580Release 2.86.7a4b7b62Updatetombi@latestto 1.4.17f5d2c4Updaterafn@latestto 0.1.50223cb3Update mise manifest80434f8Update kingfisher manifest45d93f4Update cargo-zigbuild manifest7754905Updatecargo-binstall@latestto 1.22.06cd1350Release 2.86.60110a1eUpdate tombi manifest48a83f9Update rafn manifestUpdates
dawidd6/action-send-mailfrom 3.12.0 to 18Release notes
Sourced from dawidd6/action-send-mail's releases.
... (truncated)
Commits
94de994fix: Use extended HELLO with github.com domain (#302)6e50282build(deps): bump actions/checkout from 6 to 7 (#300)1d138f3build(deps): bump nodemailer from 9.0.0 to 9.0.1 (#299)1369c5bnode_modules: update (#297)d86d472build(deps): bump nodemailer from 8.0.11 to 9.0.0 (#296)19dc783build(deps): bump nodemailer from 8.0.10 to 8.0.11 (#295)0dd1be8build(deps): bump nodemailer from 8.0.9 to 8.0.10 (#294)6bf8b9cbuild(deps): bump nodemailer from 8.0.8 to 8.0.9 (#293)51e2c0dbuild(deps): bump nodemailer from 8.0.7 to 8.0.8 (#292)076b075build(deps): bump brace-expansion from 5.0.5 to 5.0.6 (#291)Updates
trufflesecurity/trufflehogfrom 3.97.0 to 3.97.1Release notes
Sourced from trufflesecurity/trufflehog's releases.
Commits
20652fbCarry GitHub App installation ID on repo units (#5215)3ab759fRefine SECURITY.md (#5216)2cdb97d[SCAN-101] s3 source accept persisted unit envelopes in UnmarshalSourceUnit (...4ec7749preallocate bindings capacity in dockerhub and groq, with unit tests (#5213)9610306Doubled timeout, as MongoDB secrets are repeatedly hitting this and failing t...9d3f5d1[SCAN-1020] neon scram pgx (#5217)925c1d0fix(detectors/docker): don't greedy match in keyPat (#5214)e12da3cdocs: add generic config-secret custom detector example (#5195)bcbcab2Fix GHEC with Data Residency (*.ghe.com) base URL (#4777)bc3a3aeUpdate module github.com/go-git/go-git/v5 to v5.19.2 [SECURITY] (#5196)Updates
actions/setup-javafrom 5.7.0 to 6.0.0Release notes
Sourced from actions/setup-java's releases.
... (truncated)
Commits
dd06d9cPrepare documentation for v6 release (#1253)59b3450chore(deps): combine open Dependabot npm updates (#1252)b96213dSet default signature verification for supported distributions (#1246)1dbac3cdocs: expose contributing guide to GitHub (#1245)11741d6ci: constrain cache e2e job modes (#1244)ff99aa1Fix Oracle macOS E2E version (#1243)416c6d1Add Red Hat Build of OpenJDK support (#1241)5f75b27Add Maven dependency-resolution repositories (#1240)a42a52cAdd multiple Maven server credentials (#1239)fb4abd7test: cover JDK 26 from SDKMAN (#1238)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions