[dependabot]

Bumps the actions group with 1 update: hyperpolymath/cicd-squabbler/.github/actions/squabble.

Updates hyperpolymath/cicd-squabbler/.github/actions/squabble from b34cd53f9157d1b8a4f9c5c8d843846557f8622c to 14f853fde902ab2d7631070d87a9dc9122e01013

Changelog

Sourced from hyperpolymath/cicd-squabbler/.github/actions/squabble's changelog.

== Changelog

All notable changes to this project will be documented in this file.

The format is based on https://keepachangelog.com/en/1.1.0/[Keep a Changelog], and this project adheres to https://semver.org/spec/v2.0.0.html[Semantic Versioning].

=== [Unreleased]

==== Added

• .github/actions/squabble — a composite action that installs the squabble v0.1.0 release binary for other workflows and, optionally, runs it. It refuses any download whose sha256 is not the pinned digest, or whose build attestation does not name this repository's release.yml, the v0.1.0 tag and its source commit, on a GitHub-hosted runner; nothing runs until both pass. tests/squabble_action_test.sh (27 cases, with planted tampered downloads and planted action.yml mutants) runs in the new squabble-action.yml workflow. Linux x86_64 only.
• squabble chains — read-only cross-repo CI dependency chains (Phase A of docs/proposals/squabble-modes-and-app-layer.adoc). Pure analysis in squabble-core::chains: cycles and dead upstreams (blocking), diamonds, pin skew and tag/branch pins (warnings), an upstreams-first landing order, and the longest chain (a max-plus longest path, hop-weighted for now). Sources mix freely: local checkouts, and gh:owner/repo read through GitHub GraphQL. --follow N probes upstreams; action repos are probed for existence only, and reusable-workflow upstreams contribute only the files actually called. New exit code 4 = blocking chain finding.
• squabble-forge crate — GitHub GraphQL via gh api graphql, batched with aliases, owner/name passed as variables. Every query is validated in tests against a committed schema snapshot (graphql/github-schema.graphql, refresh with just graphql-schema-refresh). Records rateLimit cost; an exhausted budget marks the remaining repos unavailable rather than guessing. Truncated or binary blobs and renamed repos are reported as notes.
• fetch: PinWorkflowActions, ReconcileActionsPolicy and SetActionsAllowedAll moves, plus the Actions-policy why-probe (actions/permissions + .../selected-actions) that fires when a required context resolves to STARTUP_FAILURE — issue #15. Includes examples/actions-policy-deadlock.json offline fixture coverage.
• Structural scan now surfaces latent Actions-policy deadlocks (empty/gappy selected allowlists, tag-pinned uses: under sha_pinning_required) before any run refuses to start.
• ADR 0002 (docs/decisions/), the spec for representing vacuous greens in the Outcome contract — the spec-first remainder of issue #58.

==== Fixed

• verify-satisfied: a PR with an unsigned or unverified commit no longer reads as done when the base requires signed commits. GitHub blocks that

... (truncated)

Commits

• 14f853f [ImgBot] Optimize images (#136)
• 88e9a3c ci: re-pin every standards caller to 75bd599 and rebuild the lock closure (#135)
• 91d2cb6 chore(deps): bump the actions group with 2 updates (#134)
• faace16 fix(mise): replace 13 unresolvable tool names; stop the activation warning spam
• 60e8f7a fix(shell): use [[ ]] conditionals in check-lock-sync.sh (SonarCloud bracket ...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 5a3fbc52-76c4-4477-91c2-818e916fc0fa

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-22T05:25:50.530551Z	1ae2d9c	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.