[dependabot]

Bumps the actions group with 2 updates: hyperpolymath/gitbot-fleet/.github/workflows/fleet-report-back-reusable.yml and leanprover/lean-action.

Updates hyperpolymath/gitbot-fleet/.github/workflows/fleet-report-back-reusable.yml from e44af8144789594fcce891ccc7b77fc9a464a520 to 64ebfbed21942e7d2a68d46273e54cfc1a3a0580

Changelog

Sourced from hyperpolymath/gitbot-fleet/.github/workflows/fleet-report-back-reusable.yml's changelog.

Changelog

All notable changes to gitbot-fleet will be documented in this file.

This file is generated from conventional commits by the changelog-reusable.yml workflow (hyperpolymath/standards#206). Adopt the workflow in this repo's CI to keep this file in sync automatically — see templates/cliff.toml for the canonical config.

The format follows Keep a Changelog; this project aims to follow Semantic Versioning.

[Unreleased]

Added

• feat(sustainabot): migrate bot-integration from ReScript to AffineScr… (#199)
• feat(scripts): add fix-tracked-package-lock.sh for standards#67 enforcement (#170)
• feat(robot-repo-automaton): canonical RSR skeleton generator (rsr-template-repo#48) (#160)
• feat(rhodibot): add offline check CLI subcommand for CI gating (#150)
• feat(gsbot)!: faithful Rust/SPARK port — eliminate Python from the fleet (#145)

Fixed

• fix(examples): migrate SafeDOMExample.affine to current AffineScript grammar (closes #208) (#210)
• fix(sustainabot): parse-blocking OCaml-isms and HANDLE-keyword name (Refs #148) (#206)
• fix(licence): clear scaffold-placeholder leak (isolated; dirty repo) (#167)
• fix(ci): pin upload-artifact to valid SHA in fix-unpinned-actions.sh generator (Refs standards#48) (#163)
• fix(ci): bump a2ml/k9-validate-action pins to canonical (standards#85) (#162)
• fix(ci): sync hypatia-scan.yml to canonical (kill cd-scanner build drift) (#161)
• fix: resolve gitbot-fleet legacy hypatia findings at source; de-baseline (#152)
• fix(ci): adopt canonical hypatia-scan.yml (env.HOME/scanner-layout + Comment-step gate) (#151)
• fix(shared-context): clear pre-existing clippy -D warnings debt (item B) (#149)
• fix: stagger estate push to stop CI thundering-herd (#147)

Documentation

• docs(archive): session record for sustainabot #148 hand-port validation (#209)
• docs: promote stub .adoc to faithful AsciiDoc from canonical .md (Item 11 Group A) (#159)

CI

• ci: redistribute concurrency-cancel guard to read-only check workflows (#165)
• ci(hypatia-scan): restore hardened workflow (supersedes #129) (#142)

... (truncated)

Commits

• 64ebfbe fix(ci): restore canonical standards closure evidence after fleet owner migra...
• 5379c6e fix(ci): canonical standards owner in fleet callers and propagation sender (#...
• 7bf2fd6 ci(lock): prove closure against SHA-bound receipts; prepare (not apply) scann...
• 51298a9 ci: migrate fleet secret scanner to bounded suite (#632)
• 83e35bc Fix test expectations for F3 envelope fields and F1 priority-sorted plan outp...
• c38bf75 F1/F2/F3: Canonical priority, enrolment lint, envelope provenance (#629)
• See full diff in compare view

Updates leanprover/lean-action from 1.6.2 to 1.7.0

Release notes

Sourced from leanprover/lean-action's releases.

v1.7.0

Changed

• set MATHLIB_CACHE_GET_URL to https://cache.mathlib.org/mathlib4 for lake exe cache get, so Mathlib cache clients that read this variable download from cache.mathlib.org. A value that the workflow sets takes precedence. An empty value unsets the variable, so the cache client uses its own default endpoint

Fixed

• pass --no-modify-path to elan-init so installing elan no longer edits the runner's persistent environment (HKCU\Environment\PATH on Windows, ~/.profile and friends elsewhere). lean-action already puts $HOME/.elan/bin on $GITHUB_PATH, so this is a no-op on GitHub-hosted runners; on self-hosted runners it stops every job from accumulating PATH entries that outlive it

Changelog

Sourced from leanprover/lean-action's changelog.

v1.7.0 - 2026-10-27

Changed

• set MATHLIB_CACHE_GET_URL to https://cache.mathlib.org/mathlib4 for lake exe cache get, so Mathlib cache clients that read this variable download from cache.mathlib.org. A value that the workflow sets takes precedence. An empty value unsets the variable, so the cache client uses its own default endpoint

Fixed

• pass --no-modify-path to elan-init so installing elan no longer edits the runner's persistent environment (HKCU\Environment\PATH on Windows, ~/.profile and friends elsewhere). lean-action already puts $HOME/.elan/bin on $GITHUB_PATH, so this is a no-op on GitHub-hosted runners; on self-hosted runners it stops every job from accumulating PATH entries that outlive it

Commits

• fe40864 feat: set MATHLIB_CACHE_GET_URL to cache.mathlib.org (#202)
• a2cd0b8 fix: do not let elan-init modify the runner's persistent PATH (#189)
• 28dca45 chore: add missing CHANGELOG entries for #153 and #181 (#184)
• f8f95d2 chore: finalize v1.6.2 release (#201)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 19f61cb9-c902-48eb-bb6f-18ded185a1a3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud