[dependabot]

Bumps the github-actions group with 4 updates in the / directory: useblacksmith/begin-testbox, useblacksmith/run-testbox, github/codeql-action/init and github/codeql-action/analyze.

Updates useblacksmith/begin-testbox from 233448af4bfdc6fca509a7f0974411ac6d8a8043 to 22ff2ea5697369864347140857d218e42815b33c

Commits

• 22ff2ea begin-testbox: treat metadata HTTP errors as missing values instead of sendin...
• cb1bda5 retry phone-home while the backend binding is pending and fail the job if it ...
• ad4fbed Discover the agent address from BLACKSMITH_AGENT_ADDR (#12)
• See full diff in compare view

Updates useblacksmith/run-testbox from 3f60ff9ceb2c10c3feefa87dc0c6490cffae059d to 9b976c32aa3bcbffb348889673585a5deee1b2f3

Commits

• 9b976c3 run-testbox: count established sshd connections as activity on macOS (#19)
• fc2c779 run-testbox: read the activity marker mtime with BSD stat on macOS (#17)
• See full diff in compare view

Updates github/codeql-action/init from 4.38.3 to 4.39.1

Release notes

Sourced from github/codeql-action/init's releases.

v4.39.1

• Update default CodeQL bundle version to 2.27.3. #4256

v4.39.0

• Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205
• The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148
• Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206
• The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

• Update default CodeQL bundle version to 2.27.4. #4284

4.39.1 - 21 Oct 2026

• Update default CodeQL bundle version to 2.27.3. #4256

4.39.0 - 15 Oct 2026

• Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205
• The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148
• Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206
• The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

4.38.3 - 08 Oct 2026

• Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
• Update default CodeQL bundle version to 2.27.2. #4203
• Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

4.38.2 - 24 Sept 2026

• Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

• Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

... (truncated)

Commits

• 9b32540 Merge pull request #4257 from github/update-v4.39.1-c5a2f4b0f
• b5e1ed9 Trigger workflows
• 20f5ec3 Update changelog for v4.39.1
• c5a2f4b Merge pull request #4245 from github/henrymercer/graduate-overlay-trap-caching
• 61a5a80 Merge pull request #4256 from github/update-bundle/codeql-bundle-v2.27.3
• 3dd33f8 Merge pull request #4249 from github/mbg/upload-improvements-for-4223
• b96e339 Change comment for getConfig call in upload-sarif
• 7fa4518 Use shouldSkipSarifUpload in analyze-action.ts
• a69c7cb Document that setting the env vars to false takes precedence
• 74ddcd9 Fix typo in comment
• Additional commits viewable in compare view

Updates github/codeql-action/analyze from 4.38.3 to 4.39.1

Release notes

Sourced from github/codeql-action/analyze's releases.

v4.39.1

• Update default CodeQL bundle version to 2.27.3. #4256

v4.39.0

• Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205
• The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148
• Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206
• The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

Changelog

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

• Update default CodeQL bundle version to 2.27.4. #4284

4.39.1 - 21 Oct 2026

• Update default CodeQL bundle version to 2.27.3. #4256

4.39.0 - 15 Oct 2026

• Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205
• The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148
• Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206
• The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

4.38.3 - 08 Oct 2026

• Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
• Update default CodeQL bundle version to 2.27.2. #4203
• Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

4.38.2 - 24 Sept 2026

• Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

• Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

... (truncated)

Commits

• 9b32540 Merge pull request #4257 from github/update-v4.39.1-c5a2f4b0f
• b5e1ed9 Trigger workflows
• 20f5ec3 Update changelog for v4.39.1
• c5a2f4b Merge pull request #4245 from github/henrymercer/graduate-overlay-trap-caching
• 61a5a80 Merge pull request #4256 from github/update-bundle/codeql-bundle-v2.27.3
• 3dd33f8 Merge pull request #4249 from github/mbg/upload-improvements-for-4223
• b96e339 Change comment for getConfig call in upload-sarif
• 7fa4518 Use shouldSkipSarifUpload in analyze-action.ts
• a69c7cb Document that setting the env vars to false takes precedence
• 74ddcd9 Fix typo in comment
• Additional commits viewable in compare view

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
clawhub	Ready	Preview	Nov 2, 2026 5:14pm UTC

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: blocked before merge.

What this changes

This PR updates two Blacksmith Testbox action pins and both CodeQL action pins.

Example: Testbox phone-home receives HTTP 503 while its backend binding is pending.

• Before: Setup continues in degraded mode without receiving the SSH key.
• After: Setup retries for a bounded period and fails if the handshake never succeeds.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	A focused, useful update with no definite defect; unresolved Testbox runner compatibility limits landing confidence.
Proof confidence	🌊 off-meta tidepool	Not applicable: This bot-authored dependency PR is outside the ordinary contributor-proof gate; passing CodeQL checks and upstream validation support it, while the inspected historical website screenshot is unrelated.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: Maintainers need current scanner tooling and reliable remote Testbox sessions.
Reason: The upstream fixes serve existing workflows without introducing a new ClawHub product surface.

Merge readiness

⛔ Blocked before merge - 2 items remain

Keep this PR open: current main still uses the older action revisions, and the update remains useful. No definite introduced defect was found; Testbox runner compatibility needs confirmation before landing.

Priority: P3
Reviewed head: e031778cf7f91bc5d4254385bac4cc1b0474627f
Owner decision: Required. See Decision needed.

Decision needed

• Question: Can ClawHub's Testbox runner support the new BLACKSMITH_AGENT_ADDR requirement before its action pin changes?
• Recommendation: Confirm runner compatibility: Have the CI owner confirm the environment contract for blacksmith-8vcpu-ubuntu-2404, then retain the grouped update.
• Why: Upstream smoke verifies a generic Blacksmith runner, while the supplied ClawHub runs do not establish compatibility for the configured runner class.

Before merge

• Resolve merge risk - Before merge, the CI owner must confirm that blacksmith-8vcpu-ubuntu-2404 supplies BLACKSMITH_AGENT_ADDR: the updated action skips Testbox initialization when it is absent, replacing discovery that previously used a fixed address.
• Resolve maintainer decision - Resolve the maintainer decision shown above before merge.

Findings

None.

Tests

• Missing end-to-end proof: No candidate Testbox dispatch demonstrates metadata discovery, phone-home, and idle-session completion on ClawHub's configured runner.

Agent review details

How this fits together

GitHub workflows invoke these actions to initialize remote Testbox sessions and publish CodeQL security-analysis results.

flowchart LR
  A[GitHub workflow events] --> B[ClawHub workflows]
  B --> C[Blacksmith Testbox actions]
  C --> D[Metadata and Testbox backend]
  D --> E[Remote SSH session]
  B --> F[CodeQL actions]
  F --> G[Security analysis results]

Loading

Technical review

Best possible solution:

Land the focused action-pin update after confirming the existing Testbox runner supports the new metadata-discovery contract.

Do we have a high-confidence way to reproduce the issue?

This is dependency maintenance rather than a reported ClawHub bug; source inspection verifies the changed action behavior without executing target code.

Is this the best way to solve the issue?

Best-fix verdict: best location and minimal scope; updating existing pins avoids vendoring upstream fixes or adding workflow wrappers.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against eea13f249ea5.

Merge-risk options

Maintainer options:

1. Confirm the configured runner contract (recommended)
   The CI owner confirms BLACKSMITH_AGENT_ADDR is supplied on ClawHub's configured runner before adopting the new Testbox action.
2. Defer Testbox pins
   Keep the existing Testbox action revisions until their runner requirement is confirmed.

Provenance checked

• Testbox action pins keeps the original intent (fix(ci): report testbox hydration failures #2787: Preserve lifecycle reporting when Testbox preparation fails; the newer run-testbox action retains that reporting.)
• CodeQL action pins keeps the original intent (chore(deps): bump the github-actions group across 1 directory with 3 updates #3945: Maintain the existing lightweight CodeQL scanning workflow through pinned dependency updates.)

Testing

Proof path: none.

Security

None.

Evidence

What I checked:

• Verified introduced change and current main: The pinned base-to-head diff contains exactly four action-reference replacements across two workflows; the base retains all four older references. (.github/workflows/ci-check-testbox.yml:29, e031778cf7f9)
• Exact-head checks and discussion: All five CodeQL profiles, static, and types-build passed on the reviewed head. The cancelled auto-response has a successful replacement. Discussion contains deployment and review-status bots, with no maintainer direction or candidate Testbox execution evidence. (.github/workflows/codeql-light.yml:91, e031778cf7f9)
• Executed dependency contract: ClawHub directly executes this composite action. Its new revision replaces hard-coded metadata discovery with BLACKSMITH_AGENT_ADDR, retries transient phone-home failures, and removes degraded continuation. Upstream smoke passed its environment assertion on a generic blacksmith runner, but does not establish the contract for ClawHub's blacksmith-8vcpu-ubuntu-2404 runner. (action.yml:27, 22ff2ea56973)
• Executed finalizer dependency: ClawHub directly executes this action with always(). The update preserves lifecycle reporting and changes activity detection to the VM's SSH port, adding macOS netstat and BSD stat support. (action.yml, 9b976c32aa3b)
• Executed scanner dependency: ClawHub directly executes init and analyze from this repository. The update selects CodeQL 2.27.3; ClawHub supplies no older tools override and checks out at the workspace root, matching the changed checkout validation. (src/defaults.json:2, 9b3254085494)
• Feature history and preserved intent: History identifies Vincent Koc's CodeQL introduction and Testbox hydration repair, plus Patrick Erichsen's Crabbox integration. fix(ci): report testbox hydration failures #2787 establishes why lifecycle reporting must survive setup failure. Follow-history traversal eventually encountered an unavailable old object; directly inspected commits and current-main blame support the routing. (.github/workflows/ci-check-testbox.yml:90, d4205c8a7eb9)

Likely related people:

• Vincent Koc: Raw commit 3bfdbfc adds .github/workflows/ci-check-testbox.yml:21 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 3bfdbfc00484; files: .github/workflows/ci-check-testbox.yml)

Review metrics

Metric	Value	Why it matters
Patch size	+4/-4 across 2 workflow files	The patch stays limited to existing action references and introduces no application machinery.

Labels

Label changes:

• add P3: Routine CI dependency maintenance with no established urgent user-facing regression.
• add merge-risk: 🚨 automation: The Testbox dependency changes metadata discovery and can skip remote-session initialization if the configured runner lacks its newly required environment value.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.

Label justifications:

• P3: Routine CI dependency maintenance with no established urgent user-facing regression.
• merge-risk: 🚨 automation: The Testbox dependency changes metadata discovery and can skip remote-session initialization if the configured runner lacks its newly required environment value.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Confirm BLACKSMITH_AGENT_ADDR is supplied by ClawHub's configured Testbox runner.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 28, 2026, 12:25 PM ET / 16:25 UTC.