ci: actions/checkout v7.0.0 with consistent SHA-pin comments (supersedes #605)#610
Merged
Conversation
Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.0. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@df4cb1c...9c091bb) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Follow-up tidy on the Dependabot bump (#605). The checkout SHA moved to v7.0.0 (9c091bb) uniformly, but several checkout lines kept a stale `# v4` comment — they had been relabeled `# v4` in #604/#606, where that SHA (df4cb1c) was actually v6.0.3, not v4. Normalize every `actions/checkout` comment to `# v7.0.0`, add the missing comment on publish-jsr's bare line, and refresh the ci.yml pin note. `setup-node` / `upload-artifact` remain genuinely v4 and are untouched. Comments only — no SHA or logic change; YAML validated. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Lz7pRcec2Z3tVtaAhvB3M8
🔍 Hypatia Security ScanFindings: 43 issues detected
View findings[
{
"reason": "Action denoland/setup-deno@v2 needs attention",
"type": "unpinned_action",
"file": "publish-jsr.yml",
"action": "pin_sha",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in scorecard-enforcer.yml",
"type": "scorecard_publish_with_run_step",
"file": "scorecard-enforcer.yml",
"action": "split_scorecard_publish_job",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Issue in instant-sync.yml",
"type": "secret_action_without_presence_gate",
"file": "instant-sync.yml",
"action": "peter-evans/repository-dispatch",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Shell execution -- validate input before passing to shell (1 occurrences, CWE-78)",
"type": "js_exec_sync",
"file": "/home/runner/work/affinescript/affinescript/packages/affinescript-cli/mod.js",
"action": "flag",
"rule_module": "code_safety",
"severity": "high"
},
{
"reason": "Shell execution -- validate input before passing to shell (2 occurrences, CWE-78)",
"type": "js_exec_sync",
"file": "/home/runner/work/affinescript/affinescript/packages/affine-vscode/mod.js",
"action": "flag",
"rule_module": "code_safety",
"severity": "high"
},
{
"reason": "Shell execution -- validate input before passing to shell (1 occurrences, CWE-78)",
"type": "js_exec_sync",
"file": "/home/runner/work/affinescript/affinescript/affinescript-vite/src/affine-plugin-improved.js",
"action": "flag",
"rule_module": "code_safety",
"severity": "high"
},
{
"reason": "expect() in hot path (32 occurrences, CWE-754)",
"type": "expect_in_hot_path",
"file": "/home/runner/work/affinescript/affinescript/affinescriptiser/src/codegen/wasm_gen.rs",
"action": "flag",
"rule_module": "code_safety",
"severity": "medium"
},
{
"reason": "expect() in hot path (29 occurrences, CWE-754)",
"type": "expect_in_hot_path",
"file": "/home/runner/work/affinescript/affinescript/affinescriptiser/src/codegen/affine_gen.rs",
"action": "flag",
"rule_module": "code_safety",
"severity": "medium"
},
{
"reason": "unsafe block -- requires SAFETY comment (2 occurrences, CWE-676)",
"type": "unsafe_block",
"file": "/home/runner/work/affinescript/affinescript/runtime/src/panic.rs",
"action": "flag",
"rule_module": "code_safety",
"severity": "medium"
},
{
"reason": "unsafe block -- requires SAFETY comment (1 occurrences, CWE-676)",
"type": "unsafe_block",
"file": "/home/runner/work/affinescript/affinescript/runtime/src/alloc.rs",
"action": "flag",
"rule_module": "code_safety",
"severity": "medium"
}
]Powered by Hypatia Neurosymbolic CI/CD Intelligence |
This was referenced Jun 21, 2026
hyperpolymath
added a commit
that referenced
this pull request
Jun 21, 2026
## What Merges current `main` into `feat/solo-core-metatheory-proofs` and resolves all conflicts, so that **#614 stops being `mergeable_state: dirty`**. While #614 is dirty, GitHub cannot build the merge commit, so its entire CI suite is suppressed (only `lint-workflows` runs). Merging this PR into the feature branch un-blocks #614's CI. ## Why it was needed #614 branched off an old `main` (merge-base 61 commits back) and conflicts with the standalone-CI + codegen work that has since landed (#602, #603, #604, #606, #609, #610, #611, #612, #613). ## Conflict resolutions (5 files) | File(s) | Resolution | |---|---| | `governance.yml`, `scorecard.yml`, `scorecard-enforcer.yml`, `hypatia-scan.yml` | Take `main`'s **standalone** versions. The branch re-adopted the estate `standards` reusables that `main` deliberately dropped (#603/#604) to stop run-creation `startup_failure`s. `main`'s `hypatia-scan.yml` also restores the permissions Hypatia needs (`security-events: write`, `pull-requests: write`, `secrets: inherit`) and the `MPL-2.0` SPDX id the Palimpsest license doc mandates for tooling. | | `docs/PROOF-NEEDS.md` | Drop the branch's stale 103-line `.md`; keep `main`'s canonical 359-line `.adoc` (#609). Also satisfies DOC-FORMAT. | | `docs/history/MODULE-SYSTEM-PROGRESS` | Keep the branch's `.md`→`.adoc` migration; **port** `main`'s additive #138 codegen-follow-up note + status-table row into the `.adoc` so `main`'s work is preserved. | `spark-theatre-gate.yml` and `mirror.yml` were identical to `main`. ## Verification (merged tree) - `dune build` — clean - `dune test` — **534/534 pass** (incl. `cross-module constructor linking, Wasm (#138)`, `Wasm nested tuple patterns`, `Deno-ESM / JS no duplicate Option/Result constructor`) - wasm-runtime harness (`tools/run_codegen_wasm_tests.sh`) — all pass - workflow scan — no `startup_failure` risk introduced ## How to use Merge this into `feat/solo-core-metatheory-proofs`. #614 then becomes mergeable and its full CI runs. > Routed via this branch because the environment only permits pushes to `claude/inspiring-newton-dg5wov`, not directly to the feature branch. Un-blocks #614. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01Lz7pRcec2Z3tVtaAhvB3M8 --- _Generated by [Claude Code](https://claude.ai/code/session_01Lz7pRcec2Z3tVtaAhvB3M8)_ --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: hyperpolymath <paraordinate@yahoo.co.uk>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supersedes #605 with the cosmetic defect from my
/reviewresolved. (I couldn't push the fix onto #605's branch — GitHub returns403ondependabot/*branches — so this carries Dependabot's exact bump commit plus the correction.)What's here
69f7fcc) —actions/checkoutv6.0.3 → v7.0.0 (df4cb1c…→9c091bb…), unchanged.0df4a5e) — everyactions/checkoutline now reads# v7.0.0. ci: bump actions/checkout from 6.0.3 to 7.0.0 #605 left 14 lines tagged# v4(they'd been mislabeled# v4in ci: fix standalone-CI fallout — SHA-pin actions, de-trip secret scanner #604/fix(codegen-deno): don't re-declare preamble Option/Result constructors #606, where that SHA was actually v6.0.3), so the v7 SHA was carrying a# v4comment. Also adds the missing comment onpublish-jsr.yml's bare line and refreshes theci.ymlpin note.setup-node/upload-artifactremain genuinely v4 and are untouched. Comments only beyond Dependabot's commit — no SHA or logic change.Why it's safe
9c091bb…), so compatible with the repo's "allowed actions" policy (tag refs wouldstartup_fail).pull_request_target/workflow_run) does not apply — the repo uses neither trigger.Action for you
Merge this and close #605 (this is its corrected equivalent). If you'd rather keep #605, close this instead and I'll land the comment fix as a follow-up once #605 merges.
🤖 Generated with Claude Code
https://claude.ai/code/session_01Lz7pRcec2Z3tVtaAhvB3M8
Generated by Claude Code