chore(ci): Maximize CI/CD values (Dependabot & Permissions)#1
Conversation
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 440ba8a2f7
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| @@ -0,0 +1,10 @@ | |||
| version: 2 | |||
| updates: | |||
| - package-ecosystem: "github-actions" | |||
There was a problem hiding this comment.
Add update entries for the repo's actual dependencies
This config only enables Dependabot for github-actions, but the repository's shipped code depends on manifests such as dashboard/Cargo.toml, shared-context/Cargo.toml, and bots/gsbot/requirements.txt. As a result, the new automation will bump workflow actions while all Rust/Python dependencies continue to drift with no version-update PRs, which defeats most of the value of adding Dependabot here.
Useful? React with 👍 / 👎.
Items #2 (clippy sweep) and #1 (close the CI gap) from the follow-up list, as one PR — the lint fixes and the gate that enforces them belong together so CI is self-consistent. ## Why The only Rust CI was CodeQL in build-mode `none` (**buildless**) — nothing compiled or tested `robot-repo-automaton` / `shared-context` / `dashboard`. That's exactly how the non-compiling content-match path reached `main` before #299 fixed it. This closes that gap. ## The gate — `.github/workflows/rust.yml` Per-crate matrix (modeled on `e2e.yml`: SHA-pinned checkout, `permissions: contents: read`, SPDX header): - `cargo build --all-targets` - `cargo test` - `cargo clippy --all-targets -- -D warnings` *(blocking)* - `cargo fmt --check` *(informational, `continue-on-error`)* — there's ~180 hunks of **pre-existing** formatting drift; gating it would mean a giant reformat that buries this change, so it's surfaced but not yet enforced. A dedicated `cargo fmt` pass can flip it to blocking later. ## Clippy fixes (to make the gate green) | File | Finding | Fix | |---|---|---| | `fixer.rs` | `.replace("hyperpolymath", "hyperpolymath")` | no-op — removed | | `registry_guard.rs` | manual `splitn(2, '/')` | `split_once('/')` | | `exclusion_registry.rs` | `from_str` shadows `FromStr` | rename inherent `from_str` → `parse` (matches `Catalog::parse`; 2 internal call sites) | | `exclusion_registry.rs` | `.ok()` + `if let Some` | `if let Ok(..)` | | `hypatia.rs`, `main.rs` | `&PathBuf` arg | `&Path` | | `Cargo.toml` ×2 | `toml = "1.1.2+spec-1.1.0"` | drop ignored `+spec` build-metadata (resolution-neutral; silences cargo warning) | | `benches/fleet_benchmarks.rs` | deprecated `criterion::black_box` | import `std::hint::black_box` (one import swap covers all call sites) | ## Verification All three crates: **clippy `-D warnings` clean**, build clean. Tests: **101** (robot-repo-automaton) + **84** (shared-context) pass. Locally simulated the full matrix (build + test + clippy) green per crate; `rust.yml` parses as valid YAML. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01RozeeLxpJsd3WWFngaZWz3 --- _Generated by [Claude Code](https://claude.ai/code/session_01RozeeLxpJsd3WWFngaZWz3)_ --------- Co-authored-by: Claude <noreply@anthropic.com>
This automated PR updates your CI/CD configurations to maximize value and security.
github-actionsis monitored for updates.permissions: read-allto workflows missing explicit permissions.