From 1fb498eecc2d80c98a5337d1447536b8298fec58 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 27 Aug 2026 21:13:55 +0000 Subject: [PATCH 1/2] chore(deps): bump the actions group across 1 directory with 4 updates Bumps the actions group with 4 updates in the / directory: [taiki-e/install-action](https://github.com/taiki-e/install-action), [dawidd6/action-send-mail](https://github.com/dawidd6/action-send-mail), [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) and [actions/setup-java](https://github.com/actions/setup-java). Updates `taiki-e/install-action` from 2.86.5 to 2.86.7 - [Release notes](https://github.com/taiki-e/install-action/releases) - [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/taiki-e/install-action/compare/v2.86.5...v2.86.7) Updates `dawidd6/action-send-mail` from 3.12.0 to 18 - [Release notes](https://github.com/dawidd6/action-send-mail/releases) - [Commits](https://github.com/dawidd6/action-send-mail/compare/v3.12.0...v18) Updates `trufflesecurity/trufflehog` from 3.97.0 to 3.97.1 - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](https://github.com/trufflesecurity/trufflehog/compare/v3.97.0...v3.97.1) Updates `actions/setup-java` from 5.7.0 to 6.0.0 - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](https://github.com/actions/setup-java/compare/v5.7.0...v6.0.0) --- updated-dependencies: - dependency-name: taiki-e/install-action dependency-version: 2.86.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: dawidd6/action-send-mail dependency-version: '18' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: trufflesecurity/trufflehog dependency-version: 3.97.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: actions/setup-java dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions ... Signed-off-by: dependabot[bot] --- .github/workflows/build-gossamer-gui.yml | 2 +- .github/workflows/ci.yml | 2 +- .github/workflows/push-email-notify.yml | 2 +- .github/workflows/security-policy.yml | 8 ++++---- .github/workflows/tests.yml | 2 +- .github/workflows/verify-proofs.yml | 2 +- 6 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/build-gossamer-gui.yml b/.github/workflows/build-gossamer-gui.yml index db9f8bce..10f75d2b 100644 --- a/.github/workflows/build-gossamer-gui.yml +++ b/.github/workflows/build-gossamer-gui.yml @@ -142,7 +142,7 @@ jobs: targets: wasm32-unknown-unknown - name: Install just - uses: taiki-e/install-action@v2.86.5 + uses: taiki-e/install-action@v2.86.7 with: # Pin an explicit modern just: the Justfile uses `import?` # (optional import, just >= 1.19.0). Unversioned `tool: just` diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e68698bc..635b0aca 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -112,7 +112,7 @@ jobs: components: llvm-tools-preview - name: Install cargo-llvm-cov - uses: taiki-e/install-action@v2.86.5 + uses: taiki-e/install-action@v2.86.7 with: tool: cargo-llvm-cov diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml index ebd553b3..60f827b8 100644 --- a/.github/workflows/push-email-notify.yml +++ b/.github/workflows/push-email-notify.yml @@ -17,7 +17,7 @@ jobs: timeout-minutes: 5 steps: - name: Send push notification email - uses: dawidd6/action-send-mail@v3.12.0 + uses: dawidd6/action-send-mail@v18 with: server_address: ${{ secrets.SMTP_HOST }} server_port: ${{ secrets.SMTP_PORT }} diff --git a/.github/workflows/security-policy.yml b/.github/workflows/security-policy.yml index fd929958..d331acbd 100644 --- a/.github/workflows/security-policy.yml +++ b/.github/workflows/security-policy.yml @@ -69,7 +69,7 @@ jobs: uses: actions/checkout@v7.0.1 - name: Install cargo-deny - uses: taiki-e/install-action@v2.86.5 + uses: taiki-e/install-action@v2.86.7 with: tool: cargo-deny @@ -91,7 +91,7 @@ jobs: fetch-depth: 0 - name: TruffleHog Secret Scan - uses: trufflesecurity/trufflehog@v3.97.0 + uses: trufflesecurity/trufflehog@v3.97.1 with: path: ./ base: ${{ github.event.repository.default_branch }} @@ -331,7 +331,7 @@ jobs: uses: actions/checkout@v7.0.1 - name: Install cargo-deny - uses: taiki-e/install-action@v2.86.5 + uses: taiki-e/install-action@v2.86.7 with: tool: cargo-deny @@ -527,7 +527,7 @@ jobs: fetch-depth: 0 - name: TruffleHog Secret Scan - uses: trufflesecurity/trufflehog@v3.97.0 + uses: trufflesecurity/trufflehog@v3.97.1 with: path: ./ base: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 97566642..ca53e18e 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -519,7 +519,7 @@ jobs: components: llvm-tools-preview - name: Install cargo-llvm-cov - uses: taiki-e/install-action@v2.86.5 + uses: taiki-e/install-action@v2.86.7 with: tool: cargo-llvm-cov diff --git a/.github/workflows/verify-proofs.yml b/.github/workflows/verify-proofs.yml index f833fb06..2323ca72 100644 --- a/.github/workflows/verify-proofs.yml +++ b/.github/workflows/verify-proofs.yml @@ -212,7 +212,7 @@ jobs: uses: actions/checkout@v7.0.1 - name: Set up Eclipse Temurin 21 JRE - uses: actions/setup-java@v5.7.0 + uses: actions/setup-java@v6.0.0 with: distribution: temurin java-version: '21' From 9d83a4cd926897aa25f5a208301f043d36d36f75 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 28 Aug 2026 01:27:51 +0100 Subject: [PATCH 2/2] fix(ci): regenerate actions.lock for the four bumped actions MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Dependabot bumped four actions across six workflows but did not touch actions.lock, so every bumped workflow requested a version its lock entry did not record. This is the estate's recurring startup_failure shape. NOT PREDICTED — MEASURED. Across the last 60 runs repo-wide there were exactly five `startup_failure` conclusions, and all five were on this PR's head sha 1fb498ee: Tests, Verify Proofs, CI, Security, Build Gossamer GUI. That is five of the six workflows the PR modified; the sixth (push-email-notify) is push-triggered and does not run on a PR, so the coverage is exact rather than partial. Within-sha control, which is what rules out the alternatives: on the SAME head sha, every workflow the PR did not touch started and passed — Hypatia Security Scan, Secret Scanner, CodeQL, Rust CI, Dogfood Gate, bridge-gate. Same commit, same runner allowlist, same repo policy. Only the modified workflows died at startup, so this is lock drift and not a wiped allowlist. Recorded, with each tag resolved to a real commit and verified to exist: taiki-e/install-action v2.86.5 -> v2.86.7 b6ff580856c41316412a0b9b60540fbc6f8c82cc dawidd6/action-send-mail v3.12.0 -> v18 94de994a9f6fffee200243214e17002e2920bb59 trufflesecurity/trufflehog v3.97.0 -> v3.97.1 20652fbbdefffcdaa493a5bf57ab2ac6b1db715b actions/setup-java v5.7.0 -> v6.0.0 dd06d9cba3e5552c54d9f8ea23572deb30010f7c owner_id/repo_id carried across and cross-checked against the existing entries. Hand-edited rather than regenerated. `gh actions-lock` has a measured history in this estate of rewriting far more files than asked, downgrading a SHA pin to a tag, and inserting its banner above the SPDX header. Eight request lines and four definition blocks changed; the diff contains nothing else. Verified: YAML parses (27 workflows tracked); zero stale references to the four old versions remain; SPDX banner still on line 1. PRE-EXISTING AND NOT ADDRESSED HERE: 16 further `uses:` references have no lock entry (codeql-action sub-paths, actions/cache/{restore,save}, Swatinem/rust-cache, the clusterfuzzlite actions, the hyperpolymath reusable-workflow callers and the two validate-actions). That count was 20 before this change and is 16 after, so this commit reduces the gap rather than adding to it. Worth its own pass. STILL NEEDS AN OWNER DECISION, independent of this fix: action-send-mail v3.12.0 -> v18 is a fifteen-major jump whose input contract may have changed, in a push-triggered workflow no PR check can exercise. Regenerating the lock lets it start; it does not establish that the step still works. Co-Authored-By: Claude Opus 5 --- .github/workflows/actions.lock | 36 +++++++++++++++++----------------- 1 file changed, 18 insertions(+), 18 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index cd19867d..cf55d815 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -11,7 +11,7 @@ workflows: - 'actions/setup-node@v7.0.0' - 'actions/upload-artifact@v7.0.1' - 'dtolnay/rust-toolchain@master' - - 'taiki-e/install-action@v2.86.5' + - 'taiki-e/install-action@v2.86.7' '.github/workflows/ci-health-sweep.yml': - 'actions/checkout@v7.0.1' '.github/workflows/ci.yml': @@ -24,7 +24,7 @@ workflows: - 'haskell-actions/hlint-setup@v2.4.10' - 'haskell-actions/setup@v2.12.0' - 'swatinem/rust-cache@v2.9.2' - - 'taiki-e/install-action@v2.86.5' + - 'taiki-e/install-action@v2.86.7' '.github/workflows/clusterfuzzlite.yml': - 'actions/checkout@v7.0.1' - 'google/clusterfuzzlite@v1' @@ -58,7 +58,7 @@ workflows: - 'actions/deploy-pages@v5.0.0' - 'actions/upload-pages-artifact@v5.0.0' '.github/workflows/push-email-notify.yml': - - 'dawidd6/action-send-mail@v3.12.0' + - 'dawidd6/action-send-mail@v18' '.github/workflows/quality.yml': - 'actions/checkout@v7.0.1' - 'actions/deploy-pages@v5.0.0' @@ -96,8 +96,8 @@ workflows: - 'github/codeql-action@v4.37.8' - 'gitleaks/gitleaks-action@v3.0.0' - 'returntocorp/semgrep-action@v1' - - 'taiki-e/install-action@v2.86.5' - - 'trufflesecurity/trufflehog@v3.97.0' + - 'taiki-e/install-action@v2.86.7' + - 'trufflesecurity/trufflehog@v3.97.1' '.github/workflows/tests.yml': - 'actions/cache@v6.1.0' - 'actions/checkout@v7.0.1' @@ -109,11 +109,11 @@ workflows: - 'dtolnay/rust-toolchain@master' - 'erlef/setup-beam@v1.24.1' - 'swatinem/rust-cache@v2.9.2' - - 'taiki-e/install-action@v2.86.5' + - 'taiki-e/install-action@v2.86.7' '.github/workflows/verify-proofs.yml': - 'actions/cache@v6.1.0' - 'actions/checkout@v7.0.1' - - 'actions/setup-java@v5.7.0' + - 'actions/setup-java@v6.0.0' - 'actions/upload-artifact@v7.0.1' dependencies: 'actions/attest-build-provenance@v4.2.2': @@ -168,9 +168,9 @@ dependencies: commit: 'sha1-ed597411d8f924073f98dfc5c65a23a2325f34cd' owner_id: 44036562 repo_id: 205262760 - 'actions/setup-java@v5.7.0': - ref: 'v5.7.0' - commit: 'sha1-b6effb05e454b25005698d916606bdc6ffcbf961' + 'actions/setup-java@v6.0.0': + ref: 'v6.0.0' + commit: 'sha1-dd06d9cba3e5552c54d9f8ea23572deb30010f7c' owner_id: 44036562 repo_id: 196057608 'actions/setup-node@v7.0.0': @@ -218,8 +218,8 @@ dependencies: repo_id: 200299178 uses: - 'actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd' - 'dawidd6/action-send-mail@v3.12.0': - ref: 'v3.12.0' + 'dawidd6/action-send-mail@v18': + ref: 'v18' commit: 'sha1-94de994a9f6fffee200243214e17002e2920bb59' owner_id: 9713907 repo_id: 222439721 @@ -328,13 +328,13 @@ dependencies: commit: 'sha1-6323deb102c322ba6fcbdcafc7e3dddab59af2b6' owner_id: 580492 repo_id: 298565987 - 'taiki-e/install-action@v2.86.5': - ref: 'v2.86.5' - commit: 'sha1-ba47c86ac325773530516bb756137ac718732518' + 'taiki-e/install-action@v2.86.7': + ref: 'v2.86.7' + commit: 'sha1-b6ff580856c41316412a0b9b60540fbc6f8c82cc' owner_id: 43724913 repo_id: 442947557 - 'trufflesecurity/trufflehog@v3.97.0': - ref: 'v3.97.0' - commit: 'sha1-bcfcf73aaf4759d4dadc2783177c245a02792318' + 'trufflesecurity/trufflehog@v3.97.1': + ref: 'v3.97.1' + commit: 'sha1-20652fbbdefffcdaa493a5bf57ab2ac6b1db715b' owner_id: 79229934 repo_id: 77726177