diff --git a/.github/dependabot.yml b/.github/dependabot.yml index b4d5ec6..3d92726 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -9,10 +9,34 @@ updates: directory: "/" schedule: interval: "weekly" + # Why a hold lives here at all. `.github/workflows/actions.lock` is what the + # estate publishes into the organisation's "specific actions allowed" list, so + # a bump that lands WITHOUT a lock refresh moves the workflow onto a ref the + # org no longer matches - and GitHub then rejects the whole workflow at + # validation time: no jobs, no check run, no annotation. That killed E2E + # Validation, Static Analysis Gate and CodeQL Security Analysis here for 9 + # days (see 87d5bc8). The durable guard is standards' own + # `.github/workflows/dependabot-lock-regen.yml`, which regenerates each open + # dependabot PR's lockfile. As of 2026-10-10 it sweeps nothing: its two + # "Mint an App installation token" steps are `if: vars.APP_ID != ''` and both + # are SKIPPED on run 37859881345, because the applier App (STD-R-3) is not + # configured - so the job warns and exits 0, by design, rather than pretending + # to have swept. Until that credential exists, a bump must be followed by a + # manual `gh actions-lock` commit, and refs that must not move are held here. + ignore: + # Second, independent reason for this one: v4.38.1+ fails workflow-startup + # validation estate-wide (hyperpolymath/phantom-metal-taste#71), and + # actions.lock resolves this repo's CodeQL to v4.38.0 (b96794f015df). + - dependency-name: "github/codeql-action" groups: actions: patterns: - "*" + # `ignore` alone does not suppress a grouped bump - measured on + # phantom-metal-taste#76, where the group rewrote the ref anyway. + # exclude-patterns is what actually keeps a held ref out of the group. + exclude-patterns: + - "github/codeql-action" open-pull-requests-limit: 2 # Rust/Cargo @@ -25,29 +49,16 @@ updates: update-types: ["version-update:semver-patch"] open-pull-requests-limit: 0 - # Elixir/Mix - - package-ecosystem: "mix" - directory: "/" - schedule: - interval: "weekly" - open-pull-requests-limit: 3 - - # Node.js/npm + # Node.js/npm - the tree has exactly one JS manifest, the tree-sitter grammar. + # This entry declared directory: "/", where no package.json exists, so it scanned + # a root with nothing to update while the real manifest went unwatched. - package-ecosystem: "npm" - directory: "/" + directory: "/tools/tree-sitter-twasm" schedule: interval: "weekly" open-pull-requests-limit: 3 - # Python/pip - - package-ecosystem: "pip" - directory: "/" - schedule: - interval: "weekly" - open-pull-requests-limit: 3 - - # Nix flakes - - package-ecosystem: "nix" - directory: "/" - schedule: - interval: "weekly" +# Removed 2026-10-10 as dead weight, measured with `git ls-files`: mix (no mix.exs), +# pip (no pyproject/requirements/setup.py), nix (no flake.nix or shell.nix). An +# ecosystem with no manifest cannot open a PR, it can only imply coverage. Each is +# one block to re-add if the manifest ever lands. diff --git a/.github/workflows/c5-regenerate.yml b/.github/workflows/c5-regenerate.yml index 2b1b44d..0655035 100644 --- a/.github/workflows/c5-regenerate.yml +++ b/.github/workflows/c5-regenerate.yml @@ -51,7 +51,7 @@ jobs: path: affinescript - name: Install OCaml - uses: ocaml/setup-ocaml@v3.9.0 + uses: ocaml/setup-ocaml@v3.8.0 with: ocaml-compiler: '4.14.2' diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 2f55afa..f783fad 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -40,12 +40,12 @@ jobs: uses: actions/checkout@v7.0.1 - name: Initialize CodeQL - uses: github/codeql-action/init@v4.38.2 + uses: github/codeql-action/init@v4.38.0 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4.38.2 + uses: github/codeql-action/analyze@v4.38.0 with: category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml index eee3880..a6ec77b 100644 --- a/.github/workflows/e2e.yml +++ b/.github/workflows/e2e.yml @@ -53,7 +53,7 @@ jobs: uses: actions/checkout@v7.0.1 - name: Set up Node.js - uses: actions/setup-node@v7.1.0 + uses: actions/setup-node@v7.0.0 with: node-version: '25' @@ -158,7 +158,7 @@ jobs: # ---- Node (for smoke test within E2E script) ---- - name: Set up Node.js - uses: actions/setup-node@v7.1.0 + uses: actions/setup-node@v7.0.0 with: node-version: '25' diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 7ce96ba..7162c52 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -14,4 +14,4 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9 + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540 diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index a8ce322..c534530 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -14,7 +14,11 @@ on: permissions: contents: read security-events: write + # standards#1035: hypatia-scan-reusable uploads SARIF (codeql-action/upload-sarif) + # and deposits a report artifact. The callee cannot escalate, and its job-level + # block replaces this map rather than merging with it - so the grant belongs here. + actions: read jobs: hypatia: - uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9 + uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540 diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 66ce90e..c003271 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -12,5 +12,5 @@ permissions: jobs: mirror: - uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236 + uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540 secrets: inherit diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 3841579..4939a2d 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -77,7 +77,7 @@ jobs: git cliff --output CHANGELOG.md - name: Upload updated CHANGELOG.md - uses: actions/upload-artifact@v7.0.2 + uses: actions/upload-artifact@v7.0.1 with: name: changelog path: CHANGELOG.md diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index cd8c045..c9aa653 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -12,8 +12,13 @@ permissions: jobs: scorecard: - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9 + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540 permissions: contents: read security-events: write id-token: write + # standards#1035: scorecard-reusable runs actions/upload-artifact in the same job + # (043fb46d, v7.0.1). This block REPLACES the workflow-level map, so actions:read + # has to be granted here or the upload step fails - and 3 of 7 estate callers of + # this reusable omit it. + actions: read diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 988e3bb..4256c8f 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -21,5 +21,5 @@ jobs: # caller must grant at least that or the run startup-fails. permissions: contents: read - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586 + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540 secrets: inherit diff --git a/.github/workflows/static-analysis-gate.yml b/.github/workflows/static-analysis-gate.yml index 280523b..c1e67b8 100644 --- a/.github/workflows/static-analysis-gate.yml +++ b/.github/workflows/static-analysis-gate.yml @@ -117,7 +117,7 @@ jobs: echo "Skipped: panic-attack not available in this environment." >> "$GITHUB_STEP_SUMMARY" - name: Upload panic-attack findings - uses: actions/upload-artifact@v7.0.2 + uses: actions/upload-artifact@v7.0.1 with: name: panic-attack-findings path: panic-attack-findings.json @@ -251,7 +251,7 @@ jobs: echo "Skipped: Hypatia scanner not available in this environment." >> "$GITHUB_STEP_SUMMARY" - name: Upload hypatia findings - uses: actions/upload-artifact@v7.0.2 + uses: actions/upload-artifact@v7.0.1 with: name: hypatia-findings path: hypatia-findings.json @@ -341,7 +341,7 @@ jobs: echo "Skipped: panic-attack not available in this environment." >> "$GITHUB_STEP_SUMMARY" - name: Upload bridge report - uses: actions/upload-artifact@v7.0.2 + uses: actions/upload-artifact@v7.0.1 with: name: bridge-report path: bridge-report.json @@ -365,19 +365,19 @@ jobs: steps: - name: Download panic-attack findings - uses: actions/download-artifact@v8.0.2 + uses: actions/download-artifact@v8.0.1 with: name: panic-attack-findings path: findings/ - name: Download hypatia findings - uses: actions/download-artifact@v8.0.2 + uses: actions/download-artifact@v8.0.1 with: name: hypatia-findings path: findings/ - name: Download bridge report - uses: actions/download-artifact@v8.0.2 + uses: actions/download-artifact@v8.0.1 with: name: bridge-report path: findings/ @@ -439,7 +439,7 @@ jobs: echo "low=$LOW" >> "$GITHUB_OUTPUT" - name: Upload unified findings (fleet scanner picks these up) - uses: actions/upload-artifact@v7.0.2 + uses: actions/upload-artifact@v7.0.1 with: name: unified-findings path: findings/unified-findings.json