ci: Bump the github-actions group across 1 directory with 7 updates#14
Open
dependabot[bot] wants to merge 14 commits into
Open
ci: Bump the github-actions group across 1 directory with 7 updates#14dependabot[bot] wants to merge 14 commits into
dependabot[bot] wants to merge 14 commits into
Conversation
The test_claude_md_has_version_rules test was failing on CI because CLAUDE.md is in .gitignore and not pushed to the repository. Added pytest.skip() to gracefully skip this test when running on CI where the file doesn't exist, while still testing locally where CLAUDE.md is present.
- Add encoding='utf-8' to all read_text() calls to prevent Windows cp1252 decoding errors when reading release.sh - Skip executable permission check on Windows (no Unix mode bits) - Import sys module for platform detection
## Security Fixes (CRITICAL) - Add flock-based locking to release.sh to prevent concurrent execution - Add validate_branch_name() function for shell injection prevention - Pin 23 GitHub Actions to commit SHAs (supply chain protection) - Add explicit permissions blocks to 5 workflow files ## Reliability Fixes (CRITICAL) - Add job timeouts to all 6 workflows (ci: 30min, e2e: 45min, quality: 15min) - Add E2E test retry logic using nick-fields/retry (max 3 attempts) - Add comprehensive rollback_release() function for failed releases - Replace '|| true' patterns with proper error handling ## Test Coverage Fixes (HIGH) - Add 17 behavior tests for version release functions - Tests use subprocess to validate actual bash function execution - Cover: get_base_version, get_version_stage, get_stage_value, compare_base_versions ## Documentation Fixes (HIGH) - Remove 141 lines of deleted CCPM plugin documentation - Document 5 hidden justfile commands (promote, sync-main, equalize, backport-hotfix, port-commit) - Add detailed usage examples and warnings for dangerous operations Files changed: 10 - 6 workflow files (security + reliability) - scripts/release.sh (security + reliability) - CONTRIBUTING.md (outdated docs removal) - JUST COMMANDS FOR THIS PROJECT.md (hidden commands) - tests/test_version_release_rules.py (behavior tests)
Add test suite for --text2path CLI flag functionality: - TestText2PathCLIValidation: Verify --text2path-strict requires --text2path - TestText2PathPackageCheck: Test import error handling when package missing - TestText2PathConversion: Test actual conversion (skipped when package not installed) Tests verify: 1. CLI flag validation works correctly 2. Helpful error messages when svg-text2path not installed 3. Text elements converted to paths when package is available All tests pass: 3 passed, 1 skipped (svg-text2path optional dependency)
The previous SHA a42d72ef6e036f11894cdae57460f64a65b6a495 does not exist in the trufflesecurity/trufflehog repository, causing all Quality and CI/CD Pipeline workflows to fail with "action could not be found" error. Updated to current main branch SHA: a450544f0b7c12e99bd78b4f02fe67d5c5e56711
Prevents future incidents where invalid SHAs are pinned to workflow files. New safeguards: 1. scripts/validate_action_shas.py - Validates all pinned SHAs exist 2. validate.sh now includes SHA validation in pre-push checks 3. just validate-action-shas - Manual SHA validation command Root cause: Previous agent fabricated SHA a42d72ef... which didn't exist in trufflesecurity/trufflehog repo, causing all CI/CD runs to fail. This validation now runs: - Before every git push (via validate.sh) - Before every release (via release.sh) - On demand: just validate-action-shas
Pipeline reliability improvements:
- Add concurrency controls to all workflows (cancel outdated runs)
- Add path filters to skip CI on docs-only changes
- Remove redundant TruffleHog from ci.yml (already in quality.yml)
- Fix auto-triage.yml caching with setup-uv action
New safeguards:
- Add validate-workflows.yml to validate workflow YAML on PR
- Add dependabot.yml for automated weekly dependency updates
- Integrate SHA validation into pre-push validation (validate.sh)
Concurrency groups use: ${{ github.workflow }}-${{ github.ref }}
Path filters include: src/**, tests/**, pyproject.toml, uv.lock
This prevents:
- Duplicate CI runs on same branch
- Wasted resources on doc-only changes
- Invalid action SHAs reaching production
gh CLI is already pre-installed on GitHub-hosted runners, so no additional action is needed.
Bumps the npm-all group in /tests with 1 update: [puppeteer](https://github.com/puppeteer/puppeteer). Updates `puppeteer` from 22.15.0 to 24.36.1 - [Release notes](https://github.com/puppeteer/puppeteer/releases) - [Changelog](https://github.com/puppeteer/puppeteer/blob/main/CHANGELOG.md) - [Commits](puppeteer/puppeteer@puppeteer-v22.15.0...puppeteer-v24.36.1) --- updated-dependencies: - dependency-name: puppeteer dependency-version: 24.36.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: npm-all ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
The tests/sessions/ directory contains copies of SVG frames from examples/ that are regenerated for each test run. Tracking these was unnecessary: - 476 files removed from tracking (59MB) - Source data in examples/ is still tracked - Test sessions can be regenerated by running tests Added tests/sessions/ to .gitignore to prevent future tracking.
Bumps the github-actions group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `4.2.2` | `6.0.2` | | [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `5` | `7` | | [actions/setup-node](https://github.com/actions/setup-node) | `4` | `6` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.4.3` | `7.0.0` | | [codecov/codecov-action](https://github.com/codecov/codecov-action) | `5` | `6` | | [nick-fields/retry](https://github.com/nick-fields/retry) | `3.0.0` | `4.0.0` | | [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) | `a450544f0b7c12e99bd78b4f02fe67d5c5e56711` | `6171fa9f6676edf21e15bba41f049b18399d7372` | Updates `actions/checkout` from 4.2.2 to 6.0.2 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@11bd719...de0fac2) Updates `astral-sh/setup-uv` from 5 to 7 - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@v5...v7) Updates `actions/setup-node` from 4 to 6 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@v4...v6) Updates `actions/upload-artifact` from 4.4.3 to 7.0.0 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@b4b15b8...bbbca2d) Updates `codecov/codecov-action` from 5 to 6 - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](codecov/codecov-action@v5...v6) Updates `nick-fields/retry` from 3.0.0 to 4.0.0 - [Release notes](https://github.com/nick-fields/retry/releases) - [Commits](nick-fields/retry@7152eba...ad98453) Updates `trufflesecurity/trufflehog` from a450544f0b7c12e99bd78b4f02fe67d5c5e56711 to 6171fa9f6676edf21e15bba41f049b18399d7372 - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@a450544...6171fa9) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: astral-sh/setup-uv dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/setup-node dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/upload-artifact dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: codecov/codecov-action dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: nick-fields/retry dependency-version: 4.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: trufflesecurity/trufflehog dependency-version: 6171fa9f6676edf21e15bba41f049b18399d7372 dependency-type: direct:production dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
the
dependencies
Contributor
Author
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #14 +/- ##
=====================================
Coverage 0.44% 0.44%
=====================================
Files 2 2
Lines 226 226
Branches 54 54
=====================================
Hits 1 1
Misses 225 225 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
github-actions
Bot
force-pushed
the
main
branch
from
2718225 to
5221059
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the github-actions group with 7 updates in the / directory:
4.2.26.0.257464.4.37.0.0563.0.04.0.0a450544f0b7c12e99bd78b4f02fe67d5c5e567116171fa9f6676edf21e15bba41f049b18399d7372Updates
actions/checkoutfrom 4.2.2 to 6.0.2Release notes
Sourced from actions/checkout's releases.
... (truncated)
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
de0fac2Fix tag handling: preserve annotations and explicit fetch-tags (#2356)064fe7fAdd orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set (...8e8c483Clarify v6 README (#2328)033fa0dAdd worktree support for persist-credentials includeIf (#2327)c2d88d3Update all references from v5 and v4 to v6 (#2314)1af3b93update readme/changelog for v6 (#2311)71cf226v6-beta (#2298)069c695Persist creds to a separate file (#2286)ff7abcdUpdate README to include Node.js 24 support details and requirements (#2248)08c6903Prepare v5.0.0 release (#2238)Updates
astral-sh/setup-uvfrom 5 to 7Release notes
Sourced from astral-sh/setup-uv's releases.
... (truncated)
Commits
37802adFetch uv from Astral's mirror by default (#809)9f00d18chore(deps): bump zizmorcore/zizmor-action from 0.5.0 to 0.5.2 (#808)fd8f376Switch to ESM for source and test, use CommonJS for dist (#806)f9070deBump deps (#805)cadb67bchore: update known checksums for 0.10.10 (#804)e06108dUse astral-sh/versions as primary version provider (#802)0f6ec07docs: replace copilot instructions with AGENTS.md (#794)821e5c9docs: add cross-client dependabot rollup skill (#793)6ee6290chore(deps): bump versions (#792)9f332a1Add riscv64 architecture support to platform detection (#791)Updates
actions/setup-nodefrom 4 to 6Release notes
Sourced from actions/setup-node's releases.
... (truncated)
Commits
53b8394Bump minimatch from 3.1.2 to 3.1.5 (#1498)54045abScope test lockfiles by package manager and update cache tests (#1495)c882bffReplace uuid with crypto.randomUUID() (#1378)774c1d6feat(node-version-file): support parsingdevEnginesfield (#1283)efcb663fix: remove hardcoded bearer (#1467)d02c89dFix npm audit issues (#1491)6044e13Docs: bump actions/checkout from v5 to v6 (#1468)8e49463Fix README typo (#1226)621ac41README.md: bump to latest released checkout version v6 (#1446)2951748Bump@actions/cacheto v5.0.1 (#1449)Updates
actions/upload-artifactfrom 4.4.3 to 7.0.0Release notes
Sourced from actions/upload-artifact's releases.
... (truncated)
Commits
bbbca2dSupport direct file uploads (#764)589182cUpgrade the module to ESM and bump dependencies (#762)47309c9Merge pull request #754 from actions/Link-/add-proxy-integration-tests02a8460Add proxy integration testb7c566aMerge pull request #745 from actions/upload-artifact-v6-releasee516bc8docs: correct description of Node.js 24 support in READMEddc45eddocs: update README to correct action name for Node.js 24 support615b319chore: release v6.0.0 for Node.js 24 support017748bMerge pull request #744 from actions/fix-storage-blob38d4c79chore: rebuild distUpdates
codecov/codecov-actionfrom 5 to 6Release notes
Sourced from codecov/codecov-action's releases.
... (truncated)
Changelog
Sourced from codecov/codecov-action's changelog.
... (truncated)
Commits
57e3a13Th/6.0.0 (#1928)f67d33dRevert "Revert "build(deps): bump actions/github-script from 7.0.1 to 8.0.0""...Updates
nick-fields/retryfrom 3.0.0 to 4.0.0Release notes
Sourced from nick-fields/retry's releases.
Commits
ad98453Merge pull request #165 from nick-fields/nrf/node2416b9199major: upgrade to node249417ab4Merge pull request #148 from xavier2k6/nf_retry_p107cd61dMerge branch 'master' into nf_retry_p1ce71cc2Merge pull request #150 from nick-fields/nrf/bump-sem-relsb3eed5apatch: bump semantic-release packagesd6b241cMerge branch 'master' into nf_retry_p141b1e1aBump action versions, fix tag step in release, regen js (#149)8d92921Bump ci_cd workflow actions3610882refactor: update actions from nick-invision to nick-fields (#147)Updates
trufflesecurity/trufflehogfrom a450544f0b7c12e99bd78b4f02fe67d5c5e56711 to 6171fa9f6676edf21e15bba41f049b18399d7372Commits
6171fa9fix: replace release-guard workflow with revert-latest job (#4838)61d57c1skipping TestAPKHandler because the apk file being used in this test is unava...586f66duse struct-based SourceMetadataFunc signature across git sources (#4813)6c64db9Expand tilde manually in TUI (#4827)afd5336Confine symlink state handling to scanSymlink in Filesystem source (#4807)d17df48Add test cases for escaped unicode (#4812)aeb1278Update README formatting and CLI help output (#4758)42b02efAdd anypoint oauth2 detector to defaults.go (#4722)4860052Analysis info now uses snake case (#4765)f9d1850[INS-241] Datadogapikey detector (#4627)You can trigger a rebase of this PR by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions