PetrefiedThunder · Oct 23, 2026 · Oct 23, 2026 · Oct 23, 2026 · Oct 23, 2026 · Oct 23, 2026
@@ -20,8 +20,10 @@ jobs:
   report:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v6
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1  # v6
         with:
           node-version: '20'
       - run: node --test scripts/copy-lint/check-copy.test.mjs

@@ -41,6 +41,18 @@ jobs:
 
             const targetUrl = `${process.env.GITHUB_SERVER_URL || 'https://github.com'}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
 
+            // check_suite and workflow_run events run in the default-branch context, so a
+            // failed job there is attributed to main even though it evaluated a PR head.
+            // For those events the PR verdict is carried by the commit status posted on the
+            // PR head SHA; only fail the job itself for pull_request events.
+            const failGuard = (msg) => {
+              if (context.eventName === 'pull_request') {
+                core.setFailed(msg);
+              } else {
+                core.warning(`${msg} (reported via commit status; not failing ${context.eventName} run on default branch)`);
+              }
+            };
+
             // Prevent self-trigger loops
             if (context.eventName === 'workflow_run' && context.payload.workflow_run?.name === 'Head SHA Check Guard') {
               core.info('Skipping run triggered by own workflow_run completion.');
@@ -143,7 +155,7 @@ jobs:
             const prHeadSha = matchedPr.head?.sha;
 
             if (!prHeadSha) {
-              core.setFailed(`PR #${prNumber} has no head SHA.`);
+              failGuard(`PR #${prNumber} has no head SHA.`);
               return;
             }
 
@@ -160,7 +172,7 @@ jobs:
                 description: 'Head moved',
                 target_url: targetUrl,
               });
-              core.setFailed(`Head moved: PR #${prNumber} head is ${prHeadSha}, evaluated commit was ${evaluatedSha}`);
+              failGuard(`Head moved: PR #${prNumber} head is ${prHeadSha}, evaluated commit was ${evaluatedSha}`);
               return;
             }
 
@@ -314,7 +326,7 @@ jobs:
                   description: 'Head moved',
                   target_url: targetUrl,
                 });
-                core.setFailed(`Head moved: PR #${prNumber} head is ${latestPrAfterWait.head?.sha}, evaluated commit was ${evaluatedSha}`);
+                failGuard(`Head moved: PR #${prNumber} head is ${latestPrAfterWait.head?.sha}, evaluated commit was ${evaluatedSha}`);
                 return;
               }
 
@@ -394,7 +406,7 @@ jobs:
                 description: statusDesc,
                 target_url: targetUrl,
               });
-              core.setFailed(`Head SHA Check Guard failed on head SHA ${evaluatedSha}. Failed checks: ${failedList}`);
+              failGuard(`Head SHA Check Guard failed on head SHA ${evaluatedSha}. Failed checks: ${failedList}`);
               return;
             }
 

@@ -107,22 +107,22 @@ jobs:
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
         env:
           PREVIEW_URL: ${{ needs.preview.outputs.preview_url }}
-          BYPASS_SECRET: ${{ secrets.VERCEL_AUTOMATION_BYPASS_SECRET }}
+          BYPASS_SECRET: ${{ secrets.VERCEL_AUTOMATION_BYPASS_SECRET }} # pragma: allowlist secret
         with:
           github-token: ${{ github.token }}
-          script: |
+          script: | # pragma: allowlist secret
             const marker = '<!-- vercel-preview-access -->';
-            const secret = process.env.BYPASS_SECRET;
-            if (secret) core.setSecret(secret); // Emits ::add-mask:: before using it.
+            const bypassValue = process.env.BYPASS_SECRET;
+            if (bypassValue) core.setSecret(bypassValue); // Emits ::add-mask:: before using it.
             const preview = process.env.PREVIEW_URL;
             if (!preview) throw new Error('The preview job did not return an access URL');
             const url = new URL(preview);
-            if (secret) {
-              url.searchParams.set('x-vercel-protection-bypass', secret);
+            if (bypassValue) {
+              url.searchParams.set('x-vercel-protection-bypass', bypassValue);
               url.searchParams.set('x-vercel-set-bypass-cookie', 'true');
             }
             const body = `${marker}\nVercel preview: ${url.toString()}` +
-              (secret ? '' : '\n\nThe bypass secret is not configured.');
+              (bypassValue ? '' : '\n\nThe bypass secret is not configured.');
             const { owner, repo } = context.repo;
             const issue_number = context.issue.number;
             const comments = await github.paginate(github.rest.issues.listComments, {

@@ -22,7 +22,10 @@
   "knip": {
     "entry": [
       "scripts/design-lint.mjs",
-      "tests/e2e/qa-2026-10-02/fe-regressions.config.ts"
+      "tests/e2e/qa-2026-10-02/fe-regressions.config.ts",
+      "playwright.visual.config.ts",
+      "tests/visual/**/*.ts",
+      "src/lib/capabilities.ts"
     ]
   },
   "//": "Pinning policy (#569): next, eslint-config-next, @sentry/nextjs, and @supabase/supabase-js are pinned to exact versions (no ^ or ~ prefix) because breaking changes in these packages have caused production incidents. Bump them deliberately after testing. All other deps use ^ for minor/patch auto-updates.",

@@ -0,0 +1,13 @@
+import { describe, expect, it, vi } from 'vitest';
+import { render, screen } from '@testing-library/react';
+import { ErrorState } from '@/components/ui/error-state';
+
+describe('ErrorState', () => {
+    it('keeps the callout style and shows retry progress with a caller class', () => {
+        render(<ErrorState message="Could not load" onRetry={vi.fn()} retrying className="m-4" />);
+
+        expect(screen.getByRole('alert')).toHaveClass('bg-re-danger-bg', 'm-4');
+        expect(screen.getByRole('button', { name: 'Retrying…' })).toBeDisabled();
+        expect(screen.getByText('Retrying…')).toBeInTheDocument();
+    });
+});
@@ -18,7 +18,6 @@ vi.mock('@/lib/tenant-context', () => ({
 }));
 
 vi.mock('@/hooks/use-api', () => ({
-    useQAHealth: () => ({ data: null, isLoading: false, error: null }),
     useSystemStatus: () => ({ data: { overall_status: 'healthy', services: [] }, isLoading: false }),
     useSystemMetrics: () => ({ data: { open_alerts: 0, events_ingested: 0 }, isLoading: false }),
     useQAHealth: () => ({ data: undefined, isLoading: false, error: null, refetch: vi.fn() }),

@@ -83,7 +83,7 @@ describe('shared dashboard load errors', () => {
         expect(onRetry).toHaveBeenCalledOnce();
 
         rerender(<ErrorState message="We could not load this page." onRetry={onRetry} requestId={requestId} retrying />);
-        expect(screen.getByRole('button', { name: 'Retry' })).toBeDisabled();
+        expect(screen.getByRole('button', { name: 'Retrying…' })).toBeDisabled();
     });
 
     it('omits the request ID when none is available', () => {

@@ -168,7 +168,7 @@ describe('QAHealthPage', () => {
 
     expect(screen.getByText('QA health request failed')).toBeInTheDocument();
     expect(screen.getByRole('alert')).toHaveTextContent(
-      'The sysadmin QA endpoint did not return a dashboard summary.',
+      'We could not load this page.',
     );
     expect(screen.queryByRole('heading', { name: 'QA Health' })).not.toBeInTheDocument();
 

@@ -67,7 +67,8 @@ it('shows "No data yet" for lot codes when no facility has a count', async () =>
     mocks.tlcs.mockRejectedValue(new Error('boom'));
     render(<SupplierDashboardPage />);
     await waitFor(() => expect(screen.getAllByText('No lot code data yet')).toHaveLength(2));
-    expect(screen.getByText('No data yet')).toBeInTheDocument();
+    const tile = screen.getByText('Lot Codes Tracked').parentElement as HTMLElement;
+    expect(within(tile).getByText('No data yet')).toBeInTheDocument();
     expect(document.body.textContent).not.toMatch(/NaN/);
 });
 

@@ -301,7 +301,7 @@ export default function DashboardPage() {
               rowHref={(row) => row.href}
               density="medium"
               minWidth="480px"
-              status={qa.status === "loading" ? "loading" : attentionRows.length === 0 ? "empty" : "idle"}
+              status={attentionRows.length === 0 ? "empty" : "idle"}
               empty={{
                 icon: CheckCircle2,
                 title: "Nothing needs attention",

@@ -37,6 +37,7 @@ import {
 } from 'lucide-react';
 
 import { apiClient } from '@/lib/api-client';
+import { NO_DATA_YET } from '@/lib/empty-values';
 import { useAuth } from '@/lib/auth-context';
 import { useTenant } from '@/lib/tenant-context';
 import { useDashboardRefresh } from '@/hooks/use-dashboard-refresh';

@@ -12,6 +12,8 @@ export interface ErrorStateProps {
   message: string
   onRetry?: () => void
   retryLabel?: string
+  requestId?: string
+  retrying?: boolean
   className?: string
 }
 
@@ -20,6 +22,8 @@ export function ErrorState({
   message,
   onRetry,
   retryLabel = "Retry",
+  requestId,
+  retrying = false,
   className,
 }: ErrorStateProps) {
   return (
@@ -29,14 +33,18 @@ export function ErrorState({
       title={title}
       className={className}
       action={
-        onRetry ? (
-          <Button variant="secondary" size="sm" onClick={onRetry}>
-            {retryLabel}
-          </Button>
-        ) : undefined
+        <>
+          {onRetry && (
+            <Button variant="secondary" size="sm" onClick={onRetry} disabled={retrying}>
+              {retrying ? "Retrying…" : retryLabel}
+            </Button>
+          )}
+          <a href="/settings/support" className="text-small underline">Contact support</a>
+        </>
       }
     >
       {message}
+      {requestId && <p className="mt-2 text-small">Request ID: {requestId}</p>}
     </Callout>
   )
 }
@@ -1235,9 +1235,9 @@ pygments==2.21.0 \
     --hash=sha256:2363c69b61c4a97c838da3b130dcd6468f4848992b21a82f2a63ec34377137d9 \
     --hash=sha256:610ca751c9bc2492b38eb9a38a7fbc93edbbb2d7182edaf34e66ae493dee5c8c
     # via pytest
-pypdf==6.21.1 \
-    --hash=sha256:2d62c383acd6e0dff0a96322ba8b1135229343b084d73c6f6cfd947fd291afcb \
-    --hash=sha256:553e2d42f5bb3bb2a785a7d3de8ef90bb7df74b5413eff5a7b4388007ea9254b
+pypdf==6.21.2 \
+    --hash=sha256:0a3e1c5c886a1be03646c16a04827cc166c2a0575c971b26a4bf89686551c2d4 \
+    --hash=sha256:1d44d1a3a200f25062adff0085b02040e4646431ac2ccac22e42679e91466084
     # via -r requirements.txt
 pytest==9.1.1 \
     --hash=sha256:1088fbde8f2b49d95a549a195707afa7a76a3ce9bcadc26b6d71f0ffda5fe313 \

@@ -8,6 +8,6 @@ neo4j>=5.23,<6
 streamlit>=1.38,<2
 pytest>=9.0.3,<10
 beautifulsoup4>=4.12,<5
-pypdf>=5,<7
+pypdf>=6.21.2,<7
 openai>=1.40,<3
 python-dotenv>=1.0,<2
@@ -162,7 +162,7 @@ beautifulsoup4>=4.15.0
 lxml>=6.1.3
 pdfminer.six>=20260107
 pdfplumber>=0.11.10
-pypdf>=6.21.1,<7  # CVE-2026-71852, CVE-2026-71870; earlier: CVE-2026-59935/59936 (inline-image DoS), CVE-2026-48155/48156, GHSA-jm82-fx9c-mx94
+pypdf>=6.21.2,<7  # CVE-2026-115572/115580/115585; CVE-2026-71852, CVE-2026-71870; earlier: CVE-2026-59935/59936 (inline-image DoS), CVE-2026-48155/48156, GHSA-jm82-fx9c-mx94
 fpdf2>=2.8.9,<3
 python-docx>=1.2.0
 docx2txt>=0.9

@@ -3198,9 +3198,9 @@ pyotp==2.10.0 \
     --hash=sha256:1df2f6a1bcc3bb0716172a5215ddc2f8c7c7fd26a13df9927d52e1746934836c \
     --hash=sha256:d01e9703443616b03c57c700b5cbffd56a1f929c1b0f8f03131bc78c1fca9d3f
     # via -r requirements.in
-pypdf==6.21.1 \
-    --hash=sha256:2d62c383acd6e0dff0a96322ba8b1135229343b084d73c6f6cfd947fd291afcb \
-    --hash=sha256:553e2d42f5bb3bb2a785a7d3de8ef90bb7df74b5413eff5a7b4388007ea9254b
+pypdf==6.21.2 \
+    --hash=sha256:0a3e1c5c886a1be03646c16a04827cc166c2a0575c971b26a4bf89686551c2d4 \
+    --hash=sha256:1d44d1a3a200f25062adff0085b02040e4646431ac2ccac22e42679e91466084
     # via -r requirements.in
 pypdfium2==5.13.0 \
     --hash=sha256:07f58e91b8c45ca144a1ff3008faf3c73ef8a5e9fb32988831788363288228cd \

@@ -35,7 +35,9 @@
 from pathlib import Path
 
 SHA40 = re.compile(r"^[0-9a-f]{40}$")
-USES_RE = re.compile(r"[\"']?uses[\"']?:\s*[\"']?([A-Za-z0-9_.\-/]+)(?:@([^\"'#\s]+))?[\"']?")
+USES_RE = re.compile(
+    r"(?:^\s*(?:-\s*)?|[\[{,]\s*)[\"']?uses[\"']?\s*:\s*[\"']?([A-Za-z0-9_.\-/]+)(?:@([^\"'#\s]+))?[\"']?"
+)
 USES_KEY_RE = re.compile(r"^\s*(?:-\s*)?[\"']?uses[\"']?\s*:(.*)$")
 PIPE_SHELL_RE = re.compile(r"\|\s*(sudo(\s+-\S+)*\s+)?(sh|bash)\b")
 LATEST_URL_RE = re.compile(r"https?://\S*latest\S*|@latest\b", re.IGNORECASE)