Repository navigation
chore(deps): Bump the actions group with 2 updates - #37
Merged
Merged
Conversation
Bumps the actions group with 2 updates: [ruby/setup-ruby](https://github.com/ruby/setup-ruby) and [SonarSource/sonarqube-scan-action](https://github.com/sonarsource/sonarqube-scan-action). Updates `ruby/setup-ruby` from 1.326.0 to 1.327.0 - [Release notes](https://github.com/ruby/setup-ruby/releases) - [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb) - [Commits](ruby/setup-ruby@v1.326.0...v1.327.0) Updates `SonarSource/sonarqube-scan-action` from 8.2.2 to 8.3.0 - [Release notes](https://github.com/sonarsource/sonarqube-scan-action/releases) - [Commits](SonarSource/sonarqube-scan-action@v8.2.2...v8.3.0) --- updated-dependencies: - dependency-name: ruby/setup-ruby dependency-version: 1.327.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: SonarSource/sonarqube-scan-action dependency-version: 8.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Contributor
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| steps: | ||
| - uses: actions/checkout@v7.0.1 | ||
| - uses: ruby/setup-ruby@v1.326.0 | ||
| - uses: ruby/setup-ruby@v1.327.0 |
| - name: SonarQube Scan | ||
| if: steps.cfg.outputs.configured == 'true' | ||
| uses: SonarSource/sonarqube-scan-action@v8.2.2 | ||
| uses: SonarSource/sonarqube-scan-action@v8.3.0 |
hyperpolymath
approved these changes
Oct 6, 2026
hyperpolymath
enabled auto-merge (squash)
October 6, 2026 21:28
hyperpolymath
disabled auto-merge
October 6, 2026 21:29
hyperpolymath
enabled auto-merge (squash)
October 6, 2026 21:29
| steps: | ||
| - uses: actions/checkout@v7.0.1 | ||
| - uses: ruby/setup-ruby@v1.326.0 | ||
| - uses: ruby/setup-ruby@v1.327.0 |
| - name: SonarQube Scan | ||
| if: steps.cfg.outputs.configured == 'true' | ||
| uses: SonarSource/sonarqube-scan-action@v8.2.2 | ||
| uses: SonarSource/sonarqube-scan-action@v8.3.0 |
hyperpolymath
approved these changes
Oct 6, 2026
hyperpolymath
disabled auto-merge
October 6, 2026 21:30
7 of 14 tasks
hyperpolymath
added a commit
that referenced
this pull request
Oct 7, 2026
…9 record (#39) <!-- SPDX-License-Identifier: CC-BY-SA-4.0 Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk> --> ## Summary Fixes the `lint-workflows` red on `main` (c09e531) and the startup failures behind it. Those failures produce no check runs, so they do not appear in the check list at all. - **lint-workflows**, run 37534419872. The Dependabot bump (#37) moved `jekyll.yml` to `ruby/setup-ruby@v1.327.0` and `sonarqube.yml` to `SonarSource/sonarqube-scan-action@v8.3.0`, but did not update `actions.lock`. The decisive line was: `ERROR: these action refs are neither SHA-pinned nor covered by the lockfile: jekyll.yml:16 … sonarqube.yml:68 …`. - **Startup failures (jobs=0) on c09e531.** - governance 37534425564, mirror 37534421622 and secret-scanner 37534428119 all failed with: `lockfile missing pin for actions/checkout@3d3c42e5…`. - jekyll 37534424490 failed with: `lockfile could not be validated`. - hypatia-scan 37534423059 and sonarqube 37534426885 also failed at startup. I could not retrieve their annotation text. - Cause: #38 listed `hyperpolymath/standards@11ba299` under the five job-level reusable callers, but gave it a dependency record with no `uses:` list. GitHub then requires the callee's transitive actions in the caller lock. This is the same failure shape that `scripts/check-lock-sync.sh` in rsr-template-repo documents for cicd-squabbler. The other reds on this head are not changed here. They are owner items, listed under Testing. ## Changes - `.github/workflows/actions.lock`, hand-edited and diffed. Fix mode was not used. - `ruby/setup-ruby`: v1.326.0 → **v1.327.0**, commit `14594264cd68ce8a2345dd349bc3d138a4ef85c8`. - `sonarsource/sonarqube-scan-action`: v8.2.2 → **v8.3.0**, commit `d209202bc7d53ff1cc128f7f907dac145c9d6ae9`. This is the same record that harvard-dehallucinator's sonarqube run starts with. That run was green on 1d9faa2, with the same `SonarSource/` workflow casing and a lowercase lock key. - The `hyperpolymath/standards@11ba299dca221b6d4e970eeb58dd17ccbb825a9a` record gains a `uses:` list. - The list is the union of the callee actions recorded in standards' own `actions.lock` at 11ba299, for the governance, hypatia-scan, mirror, scorecard and secret-scanner reusables. - Eight new leaf records close it: `actions/cache@55cc8345`, `actions/upload-artifact@043fb46d`, `dtolnay/rust-toolchain@02cb101e`, `editorconfig-checker/action-editorconfig-checker@51f63319`, `erlef/setup-beam@54075bcc`, `github/codeql-action@b96794f0`, `ossf/scorecard-action@2d114668`, `webfactory/ssh-agent@e8387483`. - Two SHAs leave the lock, both deliberately: the superseded tag commits `762794c1` (setup-ruby v1.326.0) and `ba9859ea` (scan-action v8.2.2). Every other prior SHA survives (`comm -23` over the 40-hex sets). - Workflow files are unchanged. The standards pins stay at 11ba299, because its gates pass locally here (see Testing). ## Type of change CI fix (lockfile only). No product code changed. ## 📌 New pins - Head SHA: **d2c8e89a93e3d21d452bab5568a3a92d5cfd9da1** - `actions.lock` entries changed: - **`ruby/setup-ruby@v1.327.0` → `14594264cd68ce8a2345dd349bc3d138a4ef85c8`** - **`sonarsource/sonarqube-scan-action@v8.3.0` → `d209202bc7d53ff1cc128f7f907dac145c9d6ae9`** - `actions.lock` records added (transitive closure of `hyperpolymath/standards@11ba299dca221b6d4e970eeb58dd17ccbb825a9a`): - **`actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9`** - **`actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a`** - **`dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de`** - **`editorconfig-checker/action-editorconfig-checker@51f63319f592f97930c73d9c46184d20bd206393`** (v3.0.0) - **`erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124`** - **`github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63`** - **`ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc`** - **`webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555`** - Workflow `uses:` pins: none changed. ## RSR Quality Checklist ### Required - [ ] Tests pass: not run. The change touches only `actions.lock`, and no test reads it. - [ ] Code is formatted: no source code changed. - [x] Linter is clean: `bun scripts/check-action-pinning.js` (the lint-workflows step) exits 0. Before this change it exited 1. - [x] No banned language patterns: no new files, and the lockfile is YAML that the tool demands. - [x] No `unsafe` blocks: no code changed. - [x] No banned functions: no code changed. - [x] SPDX headers: no new or modified source files. `actions.lock` is machine-format and carries none upstream. - [x] No secrets, credentials or `.env` files. ### As Applicable - [ ] `STATE` / `ECOSYSTEM` / `META` descriptiles: not applicable. No project-state change, and A2ML is retired (AGENTS.md §2a), so no `.a2ml` is touched. - [ ] Documentation: not applicable; nothing user-facing. - [ ] `TOPOLOGY.md`: not applicable. - [ ] CHANGELOG: not applicable to a CI lock resync. - [x] New dependencies reviewed: none added. These are the same actions the standards reusables already run; they are now listed in the caller lock. - [ ] ABI/FFI: not applicable. ## Testing Run locally in the worktree at the head SHA. Every check below exits non-zero on failure, and none had its stderr suppressed. | Command | Before (origin/main c09e531) | After (d2c8e89) | |---|---|---| | `bun scripts/check-action-pinning.js` | rc=1, `sonarqube.yml:68 … v8.3.0` (and jekyll) | rc=0, `32 ref(s) resolvable`, `all action refs are pinned` | | `gh actions-lock --verify-local` (v0.1.6) | rc=1, `2 of 32 workflows failed: 2 ref-changed, 2 stale` | rc=0, `All 32 workflows have complete lockfile coverage.` | | `gh actions-lock --verify` | not run | rc=0, `Scanning 32 workflows` | | template `scripts/check-lock-sync.sh` (copy from harvard-dehallucinator, rsr-template-repo) | rc=1, 4 FAIL lines (refs missing or stale for jekyll and sonarqube) | rc=0, `in sync and transitively closed` | | standards@7d51f30f `check-actions-lock-gate.sh` (the governance `Actions lockfile verify` gate) | not run | rc=0, `Immutable direct and transitive lockfile coverage verified.` | | standards@11ba299 `check-workflow-staleness.sh` (job.workflow_sha) | not run | rc=0, `All workflow staleness checks passed.` | Positive control: I planted `uses: evil-org/bogus-action@v9.9.9` in a scratch workflow. `check-action-pinning.js` exited 1 and named it. The scratch file was removed before commit. **Not verified until CI runs on this head:** - Whether GitHub now starts governance, mirror, secret-scanner, hypatia-scan, scorecard, jekyll and sonarqube. GitHub's startup validation cannot be run locally. The evidence is harvard-dehallucinator, whose lock has the same closed-record shape and whose workflows start. - What those workflows report once they start: - **governance / UUID v7 conformance is expected red.** The tree carries v5 clade IDs (`a5ea1382-…-5334-…` in CLAUDE.md and the CLADE descriptile, `e216170e-…` in `build/templates/CLADE.a2ml.in`). The checker fails on them at both 11ba299 and 7d51f30f. Fixing this needs an owner ruling (a clade-v5 exemption or an ADR-008 P3 remint), not a mechanical change. - Mirror jobs depend on the mirror SSH secrets being set. **Reds on this head that this PR does not touch (owner items):** - **`analyze (actions, none)`**: dual CodeQL config. Default setup has been configured since 2026-08-26, and the advanced `codeql.yml` upload is refused ("cannot be processed when the default setup is enabled"). Owner action under standards#1031: disable default setup (Settings → Code security → CodeQL → switch to advanced), or remove the duplicate. `codeql.yml` is left in place. - **`dispatch`** (instant-sync.yml): `Parameter token or opts.auth is required`. The secret **`FARM_DISPATCH_TOKEN`** is not set on this repo. - **`estate-rules`**: `FAIL: 33 root entries are not on the allowlist`. This is a structural decision about the repo root. - **`openssf-compliance`**: `FAIL: 35 file(s) contain unfilled {{PLACEHOLDER}} tokens`. These need owner values (`just init`), and I did not invent them. ## Screenshots Not applicable; terminal output is quoted above. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01X3hgXxWm6umMgZkjYyHnnm Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the actions group with 2 updates: ruby/setup-ruby and SonarSource/sonarqube-scan-action.
Updates
ruby/setup-rubyfrom 1.326.0 to 1.327.0Release notes
Sourced from ruby/setup-ruby's releases.
Commits
1459426Update CRuby releases on WindowsUpdates
SonarSource/sonarqube-scan-actionfrom 8.2.2 to 8.3.0Release notes
Sourced from SonarSource/sonarqube-scan-action's releases.
Commits
d209202Update GitHub Actions dependencies (major) (#271)0333cb3Update dependency@actions/execto v3 (#270)da4450eUpdate npm dependencies (#268)c5094d1SQSCANGHA-168 Update actions/cache action to v5.1.0 (#269)001613fSQSCANGHA-162 Configure Renovate (#267)6abe0a7SQSCANGHA-165 Fix GPG key retrieval through HTTPS proxies (#265)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions