Repository navigation
chore(deps): bump the actions group with 2 updates - #77
Merged
Merged
Conversation
Bumps the actions group with 2 updates: [hyperpolymath/deed-ecosystem/validate-action](https://github.com/hyperpolymath/deed-ecosystem) and [hyperpolymath/k9-ecosystem/validate-action](https://github.com/hyperpolymath/k9-ecosystem). Updates `hyperpolymath/deed-ecosystem/validate-action` from aa4b836bd969df2bc58128cb8e3d20bbc88d5e79 to 4cb8886be67cf0d67e150679d1213ea519c3806f - [Commits](hyperpolymath/deed-ecosystem@aa4b836...4cb8886) Updates `hyperpolymath/k9-ecosystem/validate-action` from 89f3c2702f4f650a92aa7411502f38da06abd562 to 20f6be5b5a14a48680b236955b5c4ad9033d00d4 - [Changelog](https://github.com/hyperpolymath/k9-ecosystem/blob/main/pandoc/CHANGELOG.adoc) - [Commits](hyperpolymath/k9-ecosystem@89f3c27...20f6be5) --- updated-dependencies: - dependency-name: hyperpolymath/deed-ecosystem/validate-action dependency-version: 4cb8886be67cf0d67e150679d1213ea519c3806f dependency-type: direct:production dependency-group: actions - dependency-name: hyperpolymath/k9-ecosystem/validate-action dependency-version: 20f6be5b5a14a48680b236955b5c4ad9033d00d4 dependency-type: direct:production dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
This comment was marked as low quality.
This comment was marked as low quality.
|
🔍 Hypatia Security ScanFindings: 83 issues detected
View findings[
{
"reason": "No test directory or test files found",
"type": "no_tests",
"file": "/home/runner/work/formatrix-docs/formatrix-docs",
"level": "epi",
"rule_module": "honest_completion",
"action": "flag",
"severity": "high",
"deduction": 20,
"evidence": [
{
"span": {
"file": "/home/runner/work/formatrix-docs/formatrix-docs",
"end_line": 0,
"start_line": 0
},
"rule": "honest_completion/no_tests",
"observations": 1,
"rule_version": "0.1.0"
}
],
"support": {
"kind": "pattern"
}
},
{
"reason": "Job `triage` in label-triage.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
"type": "missing_timeout_minutes",
"file": ".github/workflows/label-triage.yml",
"level": "epi",
"rule_module": "workflow_audit",
"action": "flag",
"severity": "medium",
"recipe_id": "recipe-add-workflow-timeout-minutes",
"job": "triage",
"evidence": [
{
"span": {
"file": ".github/workflows/label-triage.yml",
"end_line": 0,
"start_line": 0
},
"rule": "workflow_audit/missing_timeout_minutes",
"observations": 1,
"rule_version": "0.1.0"
}
],
"support": {
"kind": "pattern"
}
},
{
"reason": "Job `sync` in labels.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
"type": "missing_timeout_minutes",
"file": ".github/workflows/labels.yml",
"level": "epi",
"rule_module": "workflow_audit",
"action": "flag",
"severity": "medium",
"recipe_id": "recipe-add-workflow-timeout-minutes",
"job": "sync",
"evidence": [
{
"span": {
"file": ".github/workflows/labels.yml",
"end_line": 0,
"start_line": 0
},
"rule": "workflow_audit/missing_timeout_minutes",
"observations": 1,
"rule_version": "0.1.0"
}
],
"support": {
"kind": "pattern"
}
},
{
"reason": "Step uses `peter-evans/repository-dispatch` with `token: ${{ secrets.FARM_DISPATCH_TOKEN }}` but has no `if: secrets.FARM_DISPATCH_TOKEN != ''` gate. On repos where the secret hasn't been propagated the action fails on every push, red-maining the repo. Add the step-level gate (or env+if pattern) so the missing-secret path is a clean skip instead of a red.",
"type": "secret_action_without_presence_gate",
"file": ".github/workflows/instant-sync.yml",
"level": "epi",
"rule_module": "workflow_audit",
"action": "peter-evans/repository-dispatch",
"severity": "high",
"fix_recipe": "add_secret_presence_gate",
"evidence": [
{
"span": {
"file": ".github/workflows/instant-sync.yml",
"end_line": 0,
"start_line": 0
},
"rule": "workflow_audit/secret_action_without_presence_gate",
"observations": 1,
"rule_version": "0.1.0"
}
],
"support": {
"kind": "pattern"
}
},
{
"reason": "Step uses `webfactory/ssh-agent` with `ssh-private-key: ${{ secrets.GITLAB_SSH_KEY }}` but has no `if: secrets.GITLAB_SSH_KEY != ''` gate. On repos where the secret hasn't been propagated the action fails on every push, red-maining the repo. Add the step-level gate (or env+if pattern) so the missing-secret path is a clean skip instead of a red.",
"type": "secret_action_without_presence_gate",
"file": ".github/workflows/mirror.yml",
"level": "epi",
"rule_module": "workflow_audit",
"action": "webfactory/ssh-agent",
"severity": "high",
"fix_recipe": "add_secret_presence_gate",
"evidence": [
{
"span": {
"file": ".github/workflows/mirror.yml",
"end_line": 0,
"start_line": 0
},
"rule": "workflow_audit/secret_action_without_presence_gate",
"observations": 1,
"rule_version": "0.1.0"
}
],
"support": {
"kind": "pattern"
}
},
{
"reason": "Step uses `webfactory/ssh-agent` with `ssh-private-key: ${{ secrets.BITBUCKET_SSH_KEY }}` but has no `if: secrets.BITBUCKET_SSH_KEY != ''` gate. On repos where the secret hasn't been propagated the action fails on every push, red-maining the repo. Add the step-level gate (or env+if pattern) so the missing-secret path is a clean skip instead of a red.",
"type": "secret_action_without_presence_gate",
"file": ".github/workflows/mirror.yml",
"level": "epi",
"rule_module": "workflow_audit",
"action": "webfactory/ssh-agent",
"severity": "high",
"fix_recipe": "add_secret_presence_gate",
"evidence": [
{
"span": {
"file": ".github/workflows/mirror.yml",
"end_line": 0,
"start_line": 0
},
"rule": "workflow_audit/secret_action_without_presence_gate",
"observations": 1,
"rule_version": "0.1.0"
}
],
"support": {
"kind": "pattern"
}
},
{
"reason": "Step uses `webfactory/ssh-agent` with `ssh-private-key: ${{ secrets.CODEBERG_SSH_KEY }}` but has no `if: secrets.CODEBERG_SSH_KEY != ''` gate. On repos where the secret hasn't been propagated the action fails on every push, red-maining the repo. Add the step-level gate (or env+if pattern) so the missing-secret path is a clean skip instead of a red.",
"type": "secret_action_without_presence_gate",
"file": ".github/workflows/mirror.yml",
"level": "epi",
"rule_module": "workflow_audit",
"action": "webfactory/ssh-agent",
"severity": "high",
"fix_recipe": "add_secret_presence_gate",
"evidence": [
{
"span": {
"file": ".github/workflows/mirror.yml",
"end_line": 0,
"start_line": 0
},
"rule": "workflow_audit/secret_action_without_presence_gate",
"observations": 1,
"rule_version": "0.1.0"
}
],
"support": {
"kind": "pattern"
}
},
{
"reason": "Step uses `webfactory/ssh-agent` with `ssh-private-key: ${{ secrets.SOURCEHUT_SSH_KEY }}` but has no `if: secrets.SOURCEHUT_SSH_KEY != ''` gate. On repos where the secret hasn't been propagated the action fails on every push, red-maining the repo. Add the step-level gate (or env+if pattern) so the missing-secret path is a clean skip instead of a red.",
"type": "secret_action_without_presence_gate",
"file": ".github/workflows/mirror.yml",
"level": "epi",
"rule_module": "workflow_audit",
"action": "webfactory/ssh-agent",
"severity": "high",
"fix_recipe": "add_secret_presence_gate",
"evidence": [
{
"span": {
"file": ".github/workflows/mirror.yml",
"end_line": 0,
"start_line": 0
},
"rule": "workflow_audit/secret_action_without_presence_gate",
"observations": 1,
"rule_version": "0.1.0"
}
],
"support": {
"kind": "pattern"
}
},
{
"reason": "Step uses `webfactory/ssh-agent` with `ssh-private-key: ${{ secrets.DISROOT_SSH_KEY }}` but has no `if: secrets.DISROOT_SSH_KEY != ''` gate. On repos where the secret hasn't been propagated the action fails on every push, red-maining the repo. Add the step-level gate (or env+if pattern) so the missing-secret path is a clean skip instead of a red.",
"type": "secret_action_without_presence_gate",
"file": ".github/workflows/mirror.yml",
"level": "epi",
"rule_module": "workflow_audit",
"action": "webfactory/ssh-agent",
"severity": "high",
"fix_recipe": "add_secret_presence_gate",
"evidence": [
{
"span": {
"file": ".github/workflows/mirror.yml",
"end_line": 0,
"start_line": 0
},
"rule": "workflow_audit/secret_action_without_presence_gate",
"observations": 1,
"rule_version": "0.1.0"
}
],
"support": {
"kind": "pattern"
}
},
{
"reason": "Step uses `webfactory/ssh-agent` with `ssh-private-key: ${{ secrets.GITEA_SSH_KEY }}` but has no `if: secrets.GITEA_SSH_KEY != ''` gate. On repos where the secret hasn't been propagated the action fails on every push, red-maining the repo. Add the step-level gate (or env+if pattern) so the missing-secret path is a clean skip instead of a red.",
"type": "secret_action_without_presence_gate",
"file": ".github/workflows/mirror.yml",
"level": "epi",
"rule_module": "workflow_audit",
"action": "webfactory/ssh-agent",
"severity": "high",
"fix_recipe": "add_secret_presence_gate",
"evidence": [
{
"span": {
"file": ".github/workflows/mirror.yml",
"end_line": 0,
"start_line": 0
},
"rule": "workflow_audit/secret_action_without_presence_gate",
"observations": 1,
"rule_version": "0.1.0"
}
],
"support": {
"kind": "pattern"
}
}
]Powered by Hypatia Neurosymbolic CI/CD Intelligence |
hyperpolymath
approved these changes
Nov 13, 2026
hyperpolymath
enabled auto-merge (squash)
November 13, 2026 16:38
hyperpolymath
approved these changes
Nov 13, 2026
hyperpolymath
approved these changes
Nov 13, 2026
hyperpolymath
disabled auto-merge
November 13, 2026 19:06
hyperpolymath
deleted the
dependabot/github_actions/actions-20b5f920fe
branch
November 13, 2026 19:06
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the actions group with 2 updates: hyperpolymath/deed-ecosystem/validate-action and hyperpolymath/k9-ecosystem/validate-action.
Updates
hyperpolymath/deed-ecosystem/validate-actionfrom aa4b836bd969df2bc58128cb8e3d20bbc88d5e79 to 4cb8886be67cf0d67e150679d1213ea519c3806fCommits
4cb8886docs(clade): uuid follows the GitHub path, it is not immortal (#77)039cdf2chore(deps): Bump the actions group with 2 updates (#76)5b1d7f5chore(deps): Bump hyperpolymath/smtp-notify-action from 0.5.0 to 0.5.1 in the...edb3640chore(deps): Bump the actions group with 2 updates (#74)ec02380chore(deps): Bump the actions group with 2 updates (#73)eb89a33chore(deps): Bump the actions group with 3 updates (#72)3e69929ci(secret-scan): rename caller job key secret-scan -> scan (D291) (#71)dfb5f2edocs: add Signed commits section to CONTRIBUTING (#69)537d394feat(deed-read): Rust .deed reader + fail-closed (updates) vocabulary (#70)40229f3chore(deps): Bump the actions group with 2 updates (#68)Updates
hyperpolymath/k9-ecosystem/validate-actionfrom 89f3c2702f4f650a92aa7411502f38da06abd562 to 20f6be5b5a14a48680b236955b5c4ad9033d00d4Changelog
Sourced from hyperpolymath/k9-ecosystem/validate-action's changelog.
Commits
20f6be5docs: add Signed commits section to CONTRIBUTING (#49)707761cchore(ci): generate actions.lock ahead of the 2026-10-01 lock gate (#48)b129a7dci(secret-scan): rename caller job key secret-scan -> scan (D243) (#50)6dde9fbfix(ci): pin third-party actions to full commit SHAs (#47)c1a3488e-pin the estate reusables to the last accepted standards ref (#46)cd78f29fix(ci): call the estate reusables by their real ref — root and nested copies...3071d51refactor(root): relocate the contributing guide into .github/ (#44)2155aa2Repair external symlinks that prevent the validator action from unpacking (#43)347ee5dfix(validate-action): repair estate K9 validation (#41)8e6787achore(ci): repoint push-email-notify to smtp-notify-action (#40)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions