chore(deps): bump r-lib/actions/setup-pandoc from 2.11.4 to 2.13.0 - #2020
dependabot[bot] wants to merge 47 commits into
Conversation
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
29d9d5ec6a02f5c23b315b70f8315a582dac5d1b. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- CodeQL PR/CodeQL compatibility analysis (actions): FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/34128561417/job/101813808889)
- CodeQL PR/CodeQL compatibility analysis (python): FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/34128561417/job/101813810130)
- CodeQL compatibility analysis (actions) check run: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/34128561417/job/101813808889)
- CodeQL compatibility analysis (python) check run: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/34128561417/job/101813810130)
- Required Noema Review/noema-review: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/34128559945/job/101776739593)
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/34128559931/job/101776872071)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/34128559931/job/101776872071)
- noema-review check run: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/34128559945/job/101776739593)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: r-package-check.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: r-package-check.yml"]
R1 --> V1["actionlint plus required checks"]
OpenCode Review Overview
Coverage evidence did not pass, so approval is blocked. The formal pull-request review is the source-backed diff review, not this status comment. |
29d9d5e to
31bcd7a
Compare
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
31bcd7aad85d2c8b373534a02aef93404a33ebe2. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- CodeQL PR/CodeQL compatibility analysis (actions): FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/34182982358/job/101946716527)
- CodeQL compatibility analysis (actions) check run: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/34182982358/job/101946716527)
- Required Noema Review/noema-review: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/34182981045/job/101928167719)
- noema-review check run: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/34182981045/job/101928167719)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: r-package-check.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: r-package-check.yml"]
R1 --> V1["actionlint plus required checks"]
31bcd7a to
57769e0
Compare
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
77dde3e to
3786032
Compare
dependabot
Bot
changed the title
3786032 to
549ad0c
Compare
![cwl-noema-review[bot]](https://avatars.githubusercontent.com/u/295022177?s=60&v=4){kind=small}
There was a problem hiding this comment.
Noema LLM review
PR #2020 bumps r-lib/actions/setup-pandoc from v2.11.4 to v2.13.0 at .github/workflows/r-package-check.yml:110. The change is a single-line SHA update within the same major version (v2), the action is invoked without inputs, and no regression hypotheses could be confirmed. Approving.
Reviewed changed lines
.github/workflows/r-package-check.yml:110 (RIGHT): SHA pin updated from r-lib/actions@6f6e5bc (# v2) to 465b7d8e732ca3921382b1674c59bada9cbf3399 (# v2), a minor bump within the v2 major version. The action is used without inputs; no other workflow lines change.
Adversarial validation
.github/workflows/r-package-check.yml:110 (RIGHT)falsified: Minor version bump of setup-pandoc could change default installation behavior and break the workflow. — The action is invoked at line 110 (right side) without any inputs, so it relies on the default pandoc installation. The update stays within the v2 major version of an official r-lib action, and minor bumps are designed to be backward-compatible. No other workflow lines are changed, and the previous SHA was also used for setup-tinytex (which remains unchanged), indicating the bump is scoped to setup-pandoc only..github/workflows/r-package-check.yml:110 (RIGHT)falsified: Changing the setup-pandoc SHA alone could introduce a mismatch with the unchanged setup-tinytex SHA, causing workflow failure. — The setup-tinytex step at line 112 is not part of this diff and retains its own pinned SHA (6f6e5bc62fba3a704f74e7ad7ef7676c5c6a2590). The setup-pandoc and setup-tinytex actions are independent steps with no documented coupling between their pinned versions, so keeping setup-tinytex unchanged while bumping setup-pandoc does not create a functional inconsistency. The workflow's order (pandoc before tinytex) is preserved.- Residual risk: The updated SHA is a minor bump within the v2 major version; no concrete regression hypotheses were confirmed, but the actual upstream release notes were not independently verified in this review.
Findings
- No blocking findings.
- Result: APPROVE
- Head SHA:
549ad0cc94cf13d82351d0bf989858c20e678599 - Reviewer credential:
noema-review-github-app-refresh - Actor:
cwl-noema-review[bot]
2f465bc to
4ab02f8
Compare
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
4ab02f857e7264b25d00435d03ae0d32b0189bcd. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- CodeQL PR/CodeQL compatibility analysis (actions): FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/34852064224/job/104109678329)
- CodeQL PR/CodeQL compatibility analysis (python): FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/34852064224/job/104109678300)
- CodeQL compatibility analysis (actions) check run: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/34852064224/job/104109678329)
- CodeQL compatibility analysis (python) check run: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/34852064224/job/104109678300)
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/34852062201/job/104121459231)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/34852062201/job/104121459231)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: r-package-check.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: r-package-check.yml"]
R1 --> V1["actionlint plus required checks"]
baad0a1 to
da607b4
Compare
Bumps [r-lib/actions/setup-pandoc](https://github.com/r-lib/actions) from 2.11.4 to 2.13.0. - [Release notes](https://github.com/r-lib/actions/releases) - [Changelog](https://github.com/r-lib/actions/blob/v2-branch/NEWS.md) - [Commits](r-lib/actions@6f6e5bc...465b7d8) --- updated-dependencies: - dependency-name: r-lib/actions/setup-pandoc dependency-version: 2.13.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
da607b4 to
8085e2a
Compare
Semgrep OSS and Bandit B310 Medium alerts on main flagged dynamic urllib use in CodeQL identity and Strix evidence helpers. Fail closed unless the URL is https://api.github.com so file:// and arbitrary hosts cannot reach urlopen. Co-authored-by: Cursor <cursoragent@cursor.com>
…e the consumer root Green step for a8d6261. The 24 specialized cases in test_strix_quick_gate.sh installed the trusted gate/model/binder into $repo_root_dir/scripts/ci and ran ./scripts/ci/strix_quick_gate.sh, so a consumer-root binder lookup could never fail there and masked the #2292 defect. Each case now materializes into $tmp_dir/trusted-source/scripts/ci and runs the gate from that directory with STRIX_REPO_ROOT=$repo_root_dir, which keeps the old repo-root semantics (the gate defaults REPO_ROOT to SCRIPT_DIR/../..). Evidence: - tests/test_strix_trusted_fixture_boundary.py: fails on a8d6261 (CI job 106083294309), passes here. - bash scripts/ci/test_strix_quick_gate.sh on Linux, umask 022: a8d6261 PASS (rc=0, 727s) and this commit PASS (rc=0, 726s). - strix-related pytest (8 files): 242 passed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01P5o6j4zfxGPdRaH4Lug8UY
Remove the unused queue-health collector and CLI, validate run IDs at the shared parsing boundary, and exercise document-reader and scheduler edge cases. The main baseline failed the 100% gate before PR #2358.
- Select a target-scoped credential that can actually read code-scanning analyses before the GHAS base/head configuration identity check, instead of the first non-empty token (the OpenCode app token returns 403). Ported from #2275. - Replace the set-membership URL assertion flagged by CodeQL py/incomplete-url-substring-sanitization with an issubset check. Ported from #2351.
Preserve #2385, #2359, and #2286 as explicit parents while composing their byte-identical overlapping locks and endpoint contract. This creates one exact-head bootstrap stack for the coverage-image, 100% coverage, AnyIO audit, and CodeQL dispatch failures without force-push, rebase, or delta disposal.
|
Exact-head admission audit: 현재 blocker: 활성 CHANGES_REQUESTED 1건; terminal workflow: Python Security:failure, SAST Semgrep:failure, CodeQL PR:cancelled. 유효 commit·diff·review evidence를 보존한 채 Draft/Proposed로 교정합니다. Base 이동이나 queue 대기만을 이유로 Close하지 않으며, Force Push·synthetic status/approval·manual rerun·bypass는 사용하지 않습니다. Blocker 수리 후 새 exact head에서 Checks와 review admission을 다시 받아야 합니다. |
Exact-head failed-check RCA and repair evidencePredecessor evidence. At the former exact head Those two source files were outside this PR's one-file PR-local RED→GREEN. The focused contract then exposed a real local defect: Published non-force history. Local exact-tree verification. Focused owner/security/workflow/baseline suite: Fresh hosted exact-head runs have been triggered. Queued/in-progress/skipped work is not considered passing. This PR remains Draft, open, and unmerged while exact-head evidence and independent review complete. |
This branch has not been deployed
1 participant
Bumps r-lib/actions/setup-pandoc from 2.11.4 to 2.13.0.
Changelog
Sourced from r-lib/actions/setup-pandoc's changelog.
... (truncated)
Commits
465b7d8NEWS for 2.13.0 (#1105)d06a540[setup-r] retry transient r-hub.io request failures (#1088)ed9aa85fix(setup-r): export correct RTOOLS HOME env vars on Windows ARM64 and x64 (#...c86f32csetup-r-dependencies: set JAVA_HOME on Windows runners from Java 21 env vars ...2a66450setup-r-dependencies: switch back to classic sudo on runners with sudo-rs (#1...5cc1f0dFix minor typo (#1098)33d09fbfix: Remove stray::group::(#1103)aae88a2Special-case CRAN mirror for Windows ARM64 (#1101)b7484da[setup-r] Support installing RTools without installing R (#1093)d3c5be5Update NEWS for v1.12.1 (#1087)