From bc1a38a4964f91b287e5be36cfee5dc95b649617 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 2 Nov 2026 01:51:25 +0000 Subject: [PATCH 1/3] chore(deps): bump the actions-minor-patch group across 1 directory with 4 updates Bumps the actions-minor-patch group with 4 updates in the / directory: [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action), [github/codeql-action](https://github.com/github/codeql-action), [google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml](https://github.com/google/osv-scanner-action) and [release-plz/action](https://github.com/release-plz/action). Updates `anthropics/claude-code-action` from 1.0.225 to 1.0.263 - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](https://github.com/anthropics/claude-code-action/compare/bf38e86e58df9ebf3420326d019f955bb3be64dd...8041f1d17e0e7d2f2cfe35002962e9f26237c0bb) Updates `github/codeql-action` from 4.38.0 to 4.39.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/v4.38.0...v4.39.1) Updates `google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml` from 2.6.0 to 2.7.0 - [Release notes](https://github.com/google/osv-scanner-action/releases) - [Commits](https://github.com/google/osv-scanner-action/compare/v2.6.0...v2.7.0) Updates `release-plz/action` from 0.5.137 to 0.5.146 - [Release notes](https://github.com/release-plz/action/releases) - [Commits](https://github.com/release-plz/action/compare/8e61445f0b34e7c6d985255f2f1f05a36eb350dc...b2baf303c463c223526d52a8a91b0777f052cf3f) --- updated-dependencies: - dependency-name: anthropics/claude-code-action dependency-version: 1.0.248 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-minor-patch - dependency-name: github/codeql-action dependency-version: 4.38.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-minor-patch - dependency-name: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml dependency-version: 2.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-minor-patch - dependency-name: release-plz/action dependency-version: 0.5.141 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-minor-patch ... Signed-off-by: dependabot[bot] --- .github/workflows/claude-review.yml | 2 +- .github/workflows/codeql.yml | 4 ++-- .github/workflows/osv-scanner.yml | 2 +- .github/workflows/release-plz.yml | 4 ++-- 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/claude-review.yml b/.github/workflows/claude-review.yml index 7ed6b0c91..3715e6137 100644 --- a/.github/workflows/claude-review.yml +++ b/.github/workflows/claude-review.yml @@ -97,7 +97,7 @@ jobs: - name: Review pull request id: claude-review - uses: anthropics/claude-code-action@bf38e86e58df9ebf3420326d019f955bb3be64dd # v1.0.225 + uses: anthropics/claude-code-action@8041f1d17e0e7d2f2cfe35002962e9f26237c0bb # v1.0.263 with: # Without this the action trades the job's OIDC token for a Claude # GitHub App installation token with write access to contents, pull diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 56a6ce7da..b01b1ab8e 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -31,11 +31,11 @@ jobs: uses: actions/checkout@v6 - name: Initialize CodeQL - uses: github/codeql-action/init@v4.38.0 + uses: github/codeql-action/init@v4.39.1 with: languages: ${{ matrix.language }} - name: Perform CodeQL Analysis - uses: github/codeql-action/init@v4.38.0 + uses: github/codeql-action/init@v4.39.1 with: category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/osv-scanner.yml b/.github/workflows/osv-scanner.yml index 3d009896d..87f372a3b 100644 --- a/.github/workflows/osv-scanner.yml +++ b/.github/workflows/osv-scanner.yml @@ -19,7 +19,7 @@ permissions: jobs: osv-scan: name: OSV Vulnerability Scan - uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.6.0 + uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.7.0 with: fail-on-vuln: false scan-args: |- diff --git a/.github/workflows/release-plz.yml b/.github/workflows/release-plz.yml index 3e65aee13..0097b972c 100644 --- a/.github/workflows/release-plz.yml +++ b/.github/workflows/release-plz.yml @@ -176,7 +176,7 @@ jobs: git_tag_gpgsign: true - name: Run release-plz release - uses: release-plz/action@8e61445f0b34e7c6d985255f2f1f05a36eb350dc # v0.5 + uses: release-plz/action@b2baf303c463c223526d52a8a91b0777f052cf3f # v0.5 with: command: release # Required here and absent upstream: a composite action's steps do not @@ -298,7 +298,7 @@ jobs: git_tag_gpgsign: true - name: Run release-plz release (root workspace) - uses: release-plz/action@8e61445f0b34e7c6d985255f2f1f05a36eb350dc # v0.5 + uses: release-plz/action@b2baf303c463c223526d52a8a91b0777f052cf3f # v0.5 with: command: release manifest_path: Cargo.toml From 028e234a849297ad8593fe547faf40fa5a3dad33 Mon Sep 17 00:00:00 2001 From: Toby Hede Date: Fri, 6 Nov 2026 14:02:25 +1100 Subject: [PATCH 2/3] ci: pin reviewed claude-code-action v1.0.263 and release-plz CLI 0.3.167 Reviewed claude-code-action v1.0.225..v1.0.263: the only logic change (PR head SHA pinning in setupBranch) is reached from tag mode alone, and claude-review.yml runs agent mode; the rest bumps Claude Code to 2.1.311, the Agent SDK to 0.3.311 and Bun to 1.4.4, with no change to token, OIDC, permission or prompt handling. Point the test's ACTION_SHA at 8041f1d1. release-plz: pin version 0.3.167 because CLI 0.4.1 (#3279) rewrites the registry-token vs Trusted Publishing lookup and 0.3.173 (#3251) drops the post-publish registry wait, both on our `release` publish path. Comment the action pins as v0.5.146. --- .github/workflows/release-plz.yml | 12 ++++++++++-- scripts/__tests__/claude-review-workflow.test.mjs | 2 +- 2 files changed, 11 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release-plz.yml b/.github/workflows/release-plz.yml index 0097b972c..f2e9a4e9d 100644 --- a/.github/workflows/release-plz.yml +++ b/.github/workflows/release-plz.yml @@ -176,8 +176,12 @@ jobs: git_tag_gpgsign: true - name: Run release-plz release - uses: release-plz/action@b2baf303c463c223526d52a8a91b0777f052cf3f # v0.5 + uses: release-plz/action@b2baf303c463c223526d52a8a91b0777f052cf3f # v0.5.146 with: + # Pinned: the action default moved to CLI 0.4.1, whose changes touch + # the publish path (registry token vs Trusted Publishing lookup, + # post-publish wait). Revisit after reviewing a newer CLI. + version: "0.3.167" command: release # Required here and absent upstream: a composite action's steps do not # inherit the caller's working-directory, so without these release-plz @@ -298,8 +302,12 @@ jobs: git_tag_gpgsign: true - name: Run release-plz release (root workspace) - uses: release-plz/action@b2baf303c463c223526d52a8a91b0777f052cf3f # v0.5 + uses: release-plz/action@b2baf303c463c223526d52a8a91b0777f052cf3f # v0.5.146 with: + # Pinned: the action default moved to CLI 0.4.1, whose changes touch + # the publish path (registry token vs Trusted Publishing lookup, + # post-publish wait). Revisit after reviewing a newer CLI. + version: "0.3.167" command: release manifest_path: Cargo.toml config: release-plz.toml diff --git a/scripts/__tests__/claude-review-workflow.test.mjs b/scripts/__tests__/claude-review-workflow.test.mjs index 631a9be21..3f4efda48 100644 --- a/scripts/__tests__/claude-review-workflow.test.mjs +++ b/scripts/__tests__/claude-review-workflow.test.mjs @@ -3,7 +3,7 @@ import { describe, expect, it } from 'vitest' import { readWorkflow } from './lib/workflows.mjs' const WORKFLOW = '.github/workflows/claude-review.yml' -const ACTION_SHA = 'bf38e86e58df9ebf3420326d019f955bb3be64dd' +const ACTION_SHA = '8041f1d17e0e7d2f2cfe35002962e9f26237c0bb' // v1.0.263 const gha = (expression) => `\${{ ${expression} }}` const workflow = readWorkflow(WORKFLOW) From 6bcf96c6abbb691f30c00fea505546949ff7c6f7 Mon Sep 17 00:00:00 2001 From: Toby Hede Date: Fri, 6 Nov 2026 16:46:04 +1100 Subject: [PATCH 3/3] ci: run CodeQL analyze, SHA-pin the scanners, guard the release-plz CLI pin The "Perform CodeQL Analysis" step called codeql-action/init a second time instead of analyze, so CodeQL never built a database, ran queries or uploaded SARIF while the job stayed green. codeql-workflow.test.mjs now requires init followed by analyze at one release. codeql-action (v4.39.1) and the osv-scanner reusable workflow (v2.7.0) are pinned to commit SHAs with a version comment, so a moved upstream tag cannot change what runs under security-events: write. release-plz-cli-pin.test.mjs fails if a release-plz step drops its `version:` input (falling back to the action's unreviewed default CLI) or if the eql-bindings and root-workspace steps pin different CLIs. The no-cache audit in lint-no-workflow-caching.mjs now records the release-plz/action commit it was read at (b2baf303, v0.5.146); it and its three nested actions were re-read and none uses the Actions cache. --- .github/workflows/codeql.yml | 4 +- .github/workflows/osv-scanner.yml | 2 +- scripts/__tests__/codeql-workflow.test.mjs | 31 +++++++++++++++ .../__tests__/release-plz-cli-pin.test.mjs | 38 +++++++++++++++++++ scripts/lint-no-workflow-caching.mjs | 3 +- 5 files changed, 74 insertions(+), 4 deletions(-) create mode 100644 scripts/__tests__/codeql-workflow.test.mjs create mode 100644 scripts/__tests__/release-plz-cli-pin.test.mjs diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index b01b1ab8e..6226dae9b 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -31,11 +31,11 @@ jobs: uses: actions/checkout@v6 - name: Initialize CodeQL - uses: github/codeql-action/init@v4.39.1 + uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 with: languages: ${{ matrix.language }} - name: Perform CodeQL Analysis - uses: github/codeql-action/init@v4.39.1 + uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 with: category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/osv-scanner.yml b/.github/workflows/osv-scanner.yml index 87f372a3b..b5afb96d0 100644 --- a/.github/workflows/osv-scanner.yml +++ b/.github/workflows/osv-scanner.yml @@ -19,7 +19,7 @@ permissions: jobs: osv-scan: name: OSV Vulnerability Scan - uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.7.0 + uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@b1d267aea5211fa648d9d442fa64b90dbdcbdd36 # v2.7.0 with: fail-on-vuln: false scan-args: |- diff --git a/scripts/__tests__/codeql-workflow.test.mjs b/scripts/__tests__/codeql-workflow.test.mjs new file mode 100644 index 000000000..585a4af0a --- /dev/null +++ b/scripts/__tests__/codeql-workflow.test.mjs @@ -0,0 +1,31 @@ +import { describe, expect, it } from 'vitest' +import { readWorkflow } from './lib/workflows.mjs' + +/** + * CodeQL must run `init` and then `analyze`. + * + * `init` starts the CodeQL tracer and `analyze` builds the database, runs the + * queries and uploads the SARIF. A job with `init` twice and no `analyze` went + * green on every run while producing no code-scanning results at all: `init` + * accepts no `category` input, so the second step silently ignored it. A + * Dependabot bump carried the wrong action forward rather than catching it. + */ + +const WORKFLOW = '.github/workflows/codeql.yml' +const steps = readWorkflow(WORKFLOW).jobs.analyze.steps +const codeql = steps + .map((step) => String(step.uses ?? '')) + .filter((uses) => uses.startsWith('github/codeql-action/')) +const actionOf = (uses) => + uses.split('@')[0].replace('github/codeql-action/', '') +const refOf = (uses) => uses.split('@')[1] + +describe('CodeQL workflow', () => { + it('initialises CodeQL and then analyses, in that order', () => { + expect(codeql.map(actionOf)).toEqual(['init', 'analyze']) + }) + + it('pins init and analyze to the same codeql-action release', () => { + expect(new Set(codeql.map(refOf)).size).toBe(1) + }) +}) diff --git a/scripts/__tests__/release-plz-cli-pin.test.mjs b/scripts/__tests__/release-plz-cli-pin.test.mjs new file mode 100644 index 000000000..6d6645e68 --- /dev/null +++ b/scripts/__tests__/release-plz-cli-pin.test.mjs @@ -0,0 +1,38 @@ +import { describe, expect, it } from 'vitest' +import { readWorkflow } from './lib/workflows.mjs' + +/** + * Every release-plz step pins the release-plz CLI, and all of them pin the + * same version. + * + * Without a `version:` input `release-plz/action` installs its own default + * CLI, so a later action bump (or an edit that drops the input) silently moves + * the crates.io publish onto a CLI nobody has reviewed. The two publish lines — + * `eql-bindings` and the root stack-* crates — must also agree, or one of them + * publishes on a different CLI from the other. + */ + +const WORKFLOW = '.github/workflows/release-plz.yml' +const jobs = readWorkflow(WORKFLOW).jobs +const releasePlzSteps = Object.entries(jobs).flatMap(([job, { steps = [] }]) => + steps + .filter((step) => String(step.uses ?? '').startsWith('release-plz/action@')) + .map((step) => ({ job, name: step.name, version: step.with?.version })), +) + +describe('release-plz CLI pin', () => { + it('finds the release-plz steps it guards', () => { + expect(releasePlzSteps.length).toBeGreaterThanOrEqual(2) + }) + + it.each(releasePlzSteps)( + '$job › $name pins an exact CLI version', + ({ version }) => { + expect(String(version ?? '')).toMatch(/^\d+\.\d+\.\d+$/) + }, + ) + + it('pins the same CLI version in every release-plz step', () => { + expect(new Set(releasePlzSteps.map((step) => step.version)).size).toBe(1) + }) +}) diff --git a/scripts/lint-no-workflow-caching.mjs b/scripts/lint-no-workflow-caching.mjs index 2fbb7d88b..e70a4f87f 100644 --- a/scripts/lint-no-workflow-caching.mjs +++ b/scripts/lint-no-workflow-caching.mjs @@ -189,7 +189,8 @@ const AUDITED_ACTIONS = new Map([ // cargo-bins/cargo-binstall, release-plz/git-config) that this gate cannot // read; it opens local `./` composites only. So this is an audit of the // pinned version, not a standing property: re-read it when the pin moves. - // Read at 2eb1d8bc — all three download binaries, none touches the cache. + // Read at b2baf303 (v0.5.146) — all three download binaries, none touches + // the cache. ['release-plz/action', { cacheInput: null }], // ---- Docker, for the postgres-eql image ------------------------------