chore(deps): bump the actions group across 1 directory with 4 updates - #830
Merged
hyperpolymath merged 2 commits intoSep 22, 2026
Merged
Conversation
dependabot
Bot
added
dependencies
Contributor
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Owner
|
@dependabot rebase |
Bumps the actions group with 4 updates in the / directory: [taiki-e/install-action](https://github.com/taiki-e/install-action), [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action). Updates `taiki-e/install-action` from 2.87.15 to 2.87.16 - [Release notes](https://github.com/taiki-e/install-action/releases) - [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md) - [Commits](taiki-e/install-action@v2.87.15...v2.87.16) Updates `github/codeql-action/init` from 4.38.0 to 4.38.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@b96794f...1c5b675) Updates `github/codeql-action/analyze` from 4.38.0 to 4.38.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@b96794f...1c5b675) Updates `github/codeql-action/upload-sarif` from 4.38.0 to 4.38.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@b96794f...1c5b675) --- updated-dependencies: - dependency-name: github/codeql-action/analyze dependency-version: 4.38.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: github/codeql-action/init dependency-version: 4.38.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.38.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: taiki-e/install-action dependency-version: 2.87.16 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/github_actions/actions-686d9c056c
branch
from
September 22, 2026 14:00
58f0dd1 to
2e0e7bb
Compare
hyperpolymath
approved these changes
Sep 22, 2026
hyperpolymath
enabled auto-merge (squash)
September 22, 2026 14:21
hyperpolymath
deleted the
dependabot/github_actions/actions-686d9c056c
branch
September 22, 2026 14:22
hyperpolymath
added a commit
that referenced
this pull request
Sep 22, 2026
…OC drift surface (#835) ## What this is `033193c` (#821) deleted the six duplicated `src/abi/*.idr` modules. Its title says it "repointed every reference"; it did not. Eight references to the deleted files survived on `main`. This PR closes that gap and corrects what the references were saying. **Acceptance test, measured both sides:** ``` git grep -nE 'src/abi/[A-Za-z]+\.idr' -- . ':!data/' ``` | | hits | |---|---| | `origin/main` @ `0aa8972` | **8** | | this branch | **1** | The one remaining hit is `test/unified-api-adapter-contract_test.exs:11`, which names the dead path **in the past tense** as a comment explaining why the guard was repointed in #120. That is history and is correct. ## What is deliberately *not* touched * **Every directory-level `src/abi/` reference stays.** The directory legitimately survives — it holds `hypatia-abi.ipkg`, `hypatia-abi-gen.ipkg` and a README. `verify-proofs.yml`'s `src/abi/**` paths filter is therefore still correct, and **no workflow file is modified by this PR**. * `data/verisim/**` telemetry, which records events about a *different* repo and names files that never existed in hypatia. Rewriting event records would falsify them. * The past-tense sites in `docs/DEBT-REGISTER.adoc`, `test/zig_ffi_smoke_test.exs` and `docs/proofs/HANDOVER-neural-convergence.adoc`. ## The four files **`ffi/zig/src/main.zig:4`** pointed at `src/abi/Foreign.idr` — wrong in *two* ways, since no file of that name has ever existed under either directory. Repointed to `src/Hypatia/ABI/FFI.idr`, where `FFIFunction` and `ffiReturnsApiResponse` actually live. **`verification/PROOF-STATUS.adoc`** — the six ABI rows repointed to `src/Hypatia/ABI/`. Each content claim was re-verified against the live module before being carried across, rather than relocated blind: | Row | Claim | Verdict | |---|---|---| | `Types.idr` | "Confidence refined type" | **true** — `{auto prf : So (value >= 0.0 && value <= 1.0)}` | | `Types.idr` | "Severity ordering" | **FALSE** — replaced | | `RuleEngine.idr` | all six properties | **true** — Sections 1, 2, 4, 5, 7, 8 | | `GraphQL.idr` / `GRPC.idr` / `REST.idr` / `FFI.idr` | as written | **true** | The `Types.idr` "Severity ordering" claim is contradicted by that module's own comment at lines 157-159: *"has never existed in this module; `connectorCount` is the real pin."* Replaced with the property the module does prove, `connectorCount : length allConnectors = 16`. **The hand-written LOC column is deleted** from both inventory tables, with the two derived total lines and the duplicate "File Locations" file tree. Every one of the twenty figures was wrong: | File | documented | actual | |---|---|---| | `GRPC.idr` | ~150 | **64** | | `GraphQL.idr` | ~200 | **93** | | `REST.idr` | ~150 | **95** | | `FFI.idr` | ~100 | **66** | | `Types.idr` | 140 | **250** | | `VerisimdbConnector.idr` | ~110 | **175** | | `KinGate.tla` | ~130 | **198** | | …and 13 more | | | Nothing consumes them, so they are pure drift surface. A `NOTE` in the document records why the column is gone, so it is not helpfully restored. **`verification/README.adoc`** had two real bugs: a link to `PROOF-STATUS.md`, which does not exist, and a build line `cd src/abi && idris2 --build hypatia-verify.ipkg` that is wrong in both directory *and* mechanism. Replaced with what CI actually runs — the per-file `idris2 --check` loop at `.github/workflows/verify-proofs.yml:100-107` — plus the three real packages. **`.machine_readable/INTENT.contractile:45`** repointed. Checked first that `SD022` in `lib/rules/structural_drift.ex` tests directory *existence* only and never a content claim, so this edit has no consumer and breaks no test. ## On #816 This **advances #816 on ACs 1-3** and does not close it. * **AC1** asked for LOC re-derived from `wc -l`. Superseded: measuring proved every figure wrong, so the column is deleted rather than re-derived. Rationale in a comment on the issue. * **AC2** (correct paths) and **AC3** (name `connectorCount = Refl`) land here. * **AC4** demands a live CI check and **AC5** a mutant proving it red. Neither can be satisfied in this PR — see the issue comment for the measurement. ## Related findings, filed as issues rather than folded in Per the standing rule that a new finding is an issue, not a merge blocker: 1. hypatia's entire ExUnit suite is dead in CI — the repo's only `mix test` sits in a job whose `needs:` points at a permanently failing one, so it resolves to `skipped`. 2. `tests.yml` is `startup_failure` on `main`, and `governance / Actions lockfile verify` is red there, both since the Dependabot pin bumps in #830. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_0113HQM9LVGkNCzU1WwkJZSV Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the actions group with 4 updates in the / directory: taiki-e/install-action, github/codeql-action/init, github/codeql-action/analyze and github/codeql-action/upload-sarif.
Updates
taiki-e/install-actionfrom 2.87.15 to 2.87.16Release notes
Sourced from taiki-e/install-action's releases.
Changelog
Sourced from taiki-e/install-action's changelog.
Commits
9114bf4Release 2.87.16bef0ddfUpdateuv@latestto 0.12.1636f0b2eUpdaterelease-plz@latestto 0.3.168d2e5cdaUpdateprotoc@latestto 3.36.2257b23dUpdatemise@latestto 2026.9.1135afe79Update kingfisher manifest64a0f28Update kache manifest2df4de4Update git-cliff manifestc5119b6Update cargo-leptos manifestUpdates
github/codeql-action/initfrom 4.38.0 to 4.38.1Release notes
Sourced from github/codeql-action/init's releases.
Changelog
Sourced from github/codeql-action/init's changelog.
... (truncated)
Commits
1c5b675Merge pull request #4152 from github/update-v4.38.1-a65b83a73a97cdcaAdd changelog entry for #4146cc6c691Update changelog for v4.38.1a65b83aMerge pull request #4146 from github/henrymercer/per-language-bundles-pr07fa87dClarify the latest-nightly eligibility exceptionf18f353Describe the bundle URL resolverecec9b5Share per-language telemetry fields without renaming79fe3a1Move download telemetry into the status-report directoryead1f7dRename the platform module549d498Simplify per-language platform eligibility checksUpdates
github/codeql-action/analyzefrom 4.38.0 to 4.38.1Release notes
Sourced from github/codeql-action/analyze's releases.
Changelog
Sourced from github/codeql-action/analyze's changelog.
... (truncated)
Commits
1c5b675Merge pull request #4152 from github/update-v4.38.1-a65b83a73a97cdcaAdd changelog entry for #4146cc6c691Update changelog for v4.38.1a65b83aMerge pull request #4146 from github/henrymercer/per-language-bundles-pr07fa87dClarify the latest-nightly eligibility exceptionf18f353Describe the bundle URL resolverecec9b5Share per-language telemetry fields without renaming79fe3a1Move download telemetry into the status-report directoryead1f7dRename the platform module549d498Simplify per-language platform eligibility checksUpdates
github/codeql-action/upload-sariffrom 4.38.0 to 4.38.1Release notes
Sourced from github/codeql-action/upload-sarif's releases.
Changelog
Sourced from github/codeql-action/upload-sarif's changelog.
... (truncated)
Commits
1c5b675Merge pull request #4152 from github/update-v4.38.1-a65b83a73a97cdcaAdd changelog entry for #4146cc6c691Update changelog for v4.38.1a65b83aMerge pull request #4146 from github/henrymercer/per-language-bundles-pr07fa87dClarify the latest-nightly eligibility exceptionf18f353Describe the bundle URL resolverecec9b5Share per-language telemetry fields without renaming79fe3a1Move download telemetry into the status-report directoryead1f7dRename the platform module549d498Simplify per-language platform eligibility checks