[sadrbot]

What this PR does

Sadr moved the newest Python in the CI matrix to 3.15.2 and moved two action pins to their newest releases that cleared the 7-day cooldown. It also fixed a pins test that failed on main from 2026-10-27 on, because it compared a fixture date with the wall clock. All six Semgrep findings on main are triaged as false positives.

Changes

• Python 3.15.1 → 3.15.2 in the CI test matrix (.github/workflows/ci.yml). The oldest leg stays at 3.10.22.
• actions/setup-python v7.0.0 → v7.1.0 (.github/workflows/ci.yml)
• anthropics/claude-code-action v1.0.252 → v1.0.266 (.github/workflows/org.yml, .github/workflows/run.yml). v1.0.266 installs Claude Code 2.1.316 and changes no input that the workflows use.
• tests/test_pins.py: test_main_exit_codes_and_json_before_subcommand now runs at the shared test time NOW, so the fixture release actions/fresh v1.2.0 stays inside the window.
• policy.md Known traps: a line on verifying locally when uv python install lacks a CPython patch that setup-python ships, with a CHANGELOG entry.

Supply chain

• cooldown: unchanged (the repo has no package manager, manifest, lockfile or dependency bot)
• pins: actions/setup-python v7.1.0 (6d4fd22), anthropics/claude-code-action v1.0.266 (d535f51)
• cooldown exceptions: none
• inside the cooldown (already merged): none
• waiting for cooldown: none

Security findings

• untriaged: 0 → 0 (Semgrep API and semgrep ci --dry-run)
• open: 6 → 6
• fixed: 0
• false positive: 6 (1043364694, 1043364695: branch_names_issue in issues.py builds a regular expression from an issue number, and the repo has no LDAP query | 1043364696, 1043364697, 1043364698, 1043364699: each urlopen in semgrep_api.py, pins.py, osv.py and lockage.py opens a constant https base or refuses a URL whose scheme is not https)
• accepted risk: 0
• other: 0
• suppressions reviewed: 0

Holds

• None.

AGENTS.md

• None.

Merging

• auto-merge: all (owner Settings in Cygnus-Strategy/.github, upkeep PRs)
• left for a maintainer: the repo does not allow auto-merge
• left for a maintainer: main requires no status check

Needs you

• python3 -m unittest discover tests fails on main today: test_pins.CheckTest.test_main_exit_codes_and_json_before_subcommand fails. Merge this PR to fix it.
• Turn on "Allow auto-merge" in the repo's settings, under General, Pull Requests.
• Require the CI checks on main with a ruleset, so that auto-merge waits for them.

Verification

• python3 -m unittest discover tests on Python 3.10.22, 3.14.4 and 3.15.2: 186 tests passed on each.
• python3 -m unittest discover tests on main (cb273d6) on 2026-11-08: 1 failure (test_pins.CheckTest.test_main_exit_codes_and_json_before_subcommand), fixed in this PR.
• python3 .github/scripts/check-release.py: exit 0
• bash -n .github/scripts/app-token.sh: exit 0
• python3 plugins/sadr/skills/sadr/scripts/pins.py check .github/workflows/*.yml: 20 pins checked, 0 with problems, 3 skipped (a matrix expression and two local workflows). Sadr checked the matrix versions by hand: both are exact.
• semgrep ci --dry-run on main and on this branch: the same 6 code findings, 0 supply-chain findings
• gitleaks git on the branch commits and on the full history of main: no leaks found

Run

• 8 minutes, US$2.35

Not done or not checked

• None.

---

Opened by Sadr, a dark factory for software.