From 562605b8591677643664297d9e1dfed28f671395 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 21 Oct 2026 09:50:11 +0000 Subject: [PATCH 1/3] ci(deps): bump the github-actions group across 1 directory with 6 updates Bumps the github-actions group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [jdx/mise-action](https://github.com/jdx/mise-action) | `5.1.1` | `5.2.0` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.38.3` | `4.39.0` | | [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.4` | `2.5.0` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.38.3` | `4.39.0` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.38.3` | `4.39.0` | | [bridgecrewio/checkov-action](https://github.com/bridgecrewio/checkov-action) | `12.3131.0` | `12.3134.0` | Updates `jdx/mise-action` from 5.1.1 to 5.2.0 - [Release notes](https://github.com/jdx/mise-action/releases) - [Changelog](https://github.com/jdx/mise-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/jdx/mise-action/compare/2d8d4cafcbd33be2ea37d2b6f5ad595363d1f1ca...9b200bcecbfd6303e69a4a261b2e09e3757440a7) Updates `github/codeql-action/upload-sarif` from 4.38.3 to 4.39.0 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee) Updates `ossf/scorecard-action` from 2.4.4 to 2.5.0 - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](https://github.com/ossf/scorecard-action/compare/2d1146689b8cda280b9bc96326124645441f03bc...fa7117db83c52d787ae5a89f350999701505d78e) Updates `github/codeql-action/init` from 4.38.3 to 4.39.0 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee) Updates `github/codeql-action/analyze` from 4.38.3 to 4.39.0 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee) Updates `bridgecrewio/checkov-action` from 12.3131.0 to 12.3134.0 - [Release notes](https://github.com/bridgecrewio/checkov-action/releases) - [Commits](https://github.com/bridgecrewio/checkov-action/compare/c13aafd679d3814a25067d10fcaf98c4f7594931...6f26dc90000b74feb589a906cdfae540f5119895) --- updated-dependencies: - dependency-name: bridgecrewio/checkov-action dependency-version: 12.3134.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: github/codeql-action/analyze dependency-version: 4.39.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: github/codeql-action/init dependency-version: 4.39.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.39.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: jdx/mise-action dependency-version: 5.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: ossf/scorecard-action dependency-version: 2.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions ... Signed-off-by: dependabot[bot] --- .github/workflows/ci.yml | 2 +- .github/workflows/docker-build.yml | 2 +- .github/workflows/scorecard.yml | 4 ++-- .github/workflows/security.yml | 12 ++++++------ 4 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ab9bd659..bfbd8920 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -24,7 +24,7 @@ jobs: cache: "npm" - name: Provision pinned standards tools - uses: jdx/mise-action@2d8d4cafcbd33be2ea37d2b6f5ad595363d1f1ca # v5.1.1 + uses: jdx/mise-action@9b200bcecbfd6303e69a4a261b2e09e3757440a7 # v5.2.0 - name: Install dependencies run: npm ci diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml index 0128580e..8704f3f6 100644 --- a/.github/workflows/docker-build.yml +++ b/.github/workflows/docker-build.yml @@ -131,7 +131,7 @@ jobs: # must not turn a failed vulnerability gate into a successful publish. if: ${{ !cancelled() && github.event_name != 'pull_request' }} continue-on-error: true # kit-self-audit: allow-continue-on-error - uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 + uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 with: sarif_file: trivy-results.sarif diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 43ae65d1..cb1f4fed 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -30,7 +30,7 @@ jobs: # Informational metric; Code Scanning is not enabled on this repo, so # SARIF upload errors should not fail master CI. continue-on-error: true # kit-self-audit: allow-continue-on-error - uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4 + uses: ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e # v2.5.0 with: results_file: scorecard-results.sarif results_format: sarif @@ -48,6 +48,6 @@ jobs: # Lands in repo's Security → Code scanning tab. if: always() continue-on-error: true # kit-self-audit: allow-continue-on-error - uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 + uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 with: sarif_file: scorecard-results.sarif diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 88654607..868d793f 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -159,12 +159,12 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Initialize CodeQL - uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 + uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 with: languages: javascript-typescript queries: security-extended - name: Analyze JavaScript and TypeScript - uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 + uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 with: category: "/language:javascript-typescript" @@ -212,7 +212,7 @@ jobs: # Don't fail the job if Code Scanning is off — scan result is the gate. if: always() continue-on-error: true # kit-self-audit: allow-continue-on-error - uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 + uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 with: sarif_file: trivy-results.sarif @@ -230,7 +230,7 @@ jobs: - name: Checkov (terraform + kubernetes) # Baseline of pre-existing findings in .checkov.yaml skip-check. # Gating on net-new findings only — see .checkov.yaml header for context. - uses: bridgecrewio/checkov-action@c13aafd679d3814a25067d10fcaf98c4f7594931 # v12.3131.0 + uses: bridgecrewio/checkov-action@6f26dc90000b74feb589a906cdfae540f5119895 # v12.3134.0 with: directory: . config_file: .checkov.yaml @@ -248,7 +248,7 @@ jobs: # SARIF upload requires Code Scanning enabled in repo settings. if: always() continue-on-error: true # kit-self-audit: allow-continue-on-error - uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 + uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 with: sarif_file: checkov.sarif @@ -382,7 +382,7 @@ jobs: node-version: "22" cache: "npm" - run: npm ci && npm run build - - uses: jdx/mise-action@2d8d4cafcbd33be2ea37d2b6f5ad595363d1f1ca # v5.1.1 + - uses: jdx/mise-action@9b200bcecbfd6303e69a4a261b2e09e3757440a7 # v5.2.0 # Triage verifies each tool's upstream repo through the GitHub API. Anonymous calls share # a 60/hour limit per runner IP, and triage correctly fails closed when it cannot verify. - name: Provision declared tools via kit install (triage-gated) From 06c51166c6c7106d7ee5813ec31d0add5732c43c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Peter=20Sandstr=C3=B6m?= Date: Wed, 21 Oct 2026 13:32:36 +0200 Subject: [PATCH 2/3] test: update the action pins for the bumped CodeQL and mise-action Dependabot moved github/codeql-action to v4.39.0 and jdx/mise-action to v5.2.0. The pin tests still named the old versions. The new SHAs were checked against the upstream tags. Co-Authored-By: Claude Sonnet 5.5 Claude-Session: https://claude.ai/code/session_01RSop9MyLof8XxLTkFnF4KG --- src/github-codeql-workflow.test.ts | 4 ++-- src/github-workflow-hardening.test.ts | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/src/github-codeql-workflow.test.ts b/src/github-codeql-workflow.test.ts index 13cf9a60..ffb6c1f7 100644 --- a/src/github-codeql-workflow.test.ts +++ b/src/github-codeql-workflow.test.ts @@ -5,7 +5,7 @@ import { dirname, resolve } from "node:path"; import { fileURLToPath } from "node:url"; const root = resolve(dirname(fileURLToPath(import.meta.url)), ".."); -const CODEQL_ACTION_SHA = "24c54180a607b1449ed407dd24f251e4e9147c8d"; +const CODEQL_ACTION_SHA = "6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee"; describe("CodeQL workflow action", () => { it("uses one supported v4 action commit for every CodeQL step", () => { @@ -20,7 +20,7 @@ describe("CodeQL workflow action", () => { assert.ok(references.length > 0, "expected at least one CodeQL action step"); for (const reference of references) { assert.equal(reference.sha, CODEQL_ACTION_SHA, `${reference.name} has a stale CodeQL pin`); - assert.equal(reference.version, "v4.38.3", `${reference.name} must identify supported major`); + assert.equal(reference.version, "v4.39.0", `${reference.name} must identify supported major`); } }); }); diff --git a/src/github-workflow-hardening.test.ts b/src/github-workflow-hardening.test.ts index 6f31c2ee..a0868741 100644 --- a/src/github-workflow-hardening.test.ts +++ b/src/github-workflow-hardening.test.ts @@ -103,7 +103,7 @@ describe("informational CI jobs can still fail", () => { describe("GitHub workflow standards gate", () => { it("provisions the pinned standards tools and runs the full standards gate in CI", () => { const ci = workflow("ci.yml"); - assert.match(ci, /uses:\s*jdx\/mise-action@[a-f0-9]{40}\s*#\s*v5\.1\.1/); + assert.match(ci, /uses:\s*jdx\/mise-action@[a-f0-9]{40}\s*#\s*v5\.2\.0/); assert.match(ci, /run:\s*node dist\/cli\.js standards --enforce/); assert.doesNotMatch( ci, From 54fe78a57783bd3db5f17dbe4be9c480f3680736 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Peter=20Sandstr=C3=B6m?= Date: Wed, 21 Oct 2026 14:40:00 +0200 Subject: [PATCH 3/3] test: retry temp cleanup in the tests that copy node.exe on Windows Windows keeps a copied .exe locked for a moment after the child exits, so rm failed with EBUSY (seen in check-secrets-infisical on #594). Five more tests copy the executable and now retry like the others do. Co-Authored-By: Claude Sonnet 5.5 Claude-Session: https://claude.ai/code/session_01RSop9MyLof8XxLTkFnF4KG --- src/browser-strategy.test.ts | 4 ++-- src/check-secrets-infisical.test.ts | 2 +- src/publish-workflow.test.ts | 6 +++--- src/triage-cwd.test.ts | 2 +- src/upgrade-provenance.test.ts | 2 +- 5 files changed, 8 insertions(+), 8 deletions(-) diff --git a/src/browser-strategy.test.ts b/src/browser-strategy.test.ts index fc268af3..a701ba12 100644 --- a/src/browser-strategy.test.ts +++ b/src/browser-strategy.test.ts @@ -163,7 +163,7 @@ describe("system Chrome selection", () => { assert.equal(result.status, "blocker"); assert.equal(result.strategy, "none"); } finally { - rmSync(path, { recursive: true, force: true }); + rmSync(path, { recursive: true, force: true, maxRetries: 10, retryDelay: 200 }); } }); }); @@ -224,7 +224,7 @@ describe("system Chrome fallback", () => { join(second, valid), ); } finally { - rmSync(root, { recursive: true, force: true }); + rmSync(root, { recursive: true, force: true, maxRetries: 10, retryDelay: 200 }); } }); }); diff --git a/src/check-secrets-infisical.test.ts b/src/check-secrets-infisical.test.ts index e2917b69..98ea3f34 100644 --- a/src/check-secrets-infisical.test.ts +++ b/src/check-secrets-infisical.test.ts @@ -142,7 +142,7 @@ function fallback( .map((line) => JSON.parse(line)), }; } finally { - rmSync(dir, { recursive: true, force: true }); + rmSync(dir, { recursive: true, force: true, maxRetries: 10, retryDelay: 200 }); } } diff --git a/src/publish-workflow.test.ts b/src/publish-workflow.test.ts index 3f9cfcbe..4d3d66aa 100644 --- a/src/publish-workflow.test.ts +++ b/src/publish-workflow.test.ts @@ -228,7 +228,7 @@ describe( const neutered = script.replace(/exit 1/g, "true"); assert.equal(runScript(neutered, root, { TAG: "v9.9.9" }).status, 0, "the check bites"); } finally { - rmSync(root, { recursive: true, force: true }); + rmSync(root, { recursive: true, force: true, maxRetries: 10, retryDelay: 200 }); } }); @@ -245,7 +245,7 @@ describe( const neutered = script.replace(/exit 1/g, "true"); assert.equal(runScript(neutered, root, { TAG: "v1.2.4" }).status, 0, "the check bites"); } finally { - rmSync(root, { recursive: true, force: true }); + rmSync(root, { recursive: true, force: true, maxRetries: 10, retryDelay: 200 }); } }); }, @@ -428,7 +428,7 @@ describe("publish.yml — published versions bind to the source tree", () => { assert.equal(offline.status, 1, offline.stderr); assert.match(offline.stderr, /registry lookup failed/); } finally { - rmSync(root, { recursive: true, force: true }); + rmSync(root, { recursive: true, force: true, maxRetries: 10, retryDelay: 200 }); } }); }); diff --git a/src/triage-cwd.test.ts b/src/triage-cwd.test.ts index 3ef6d882..ae5b8984 100644 --- a/src/triage-cwd.test.ts +++ b/src/triage-cwd.test.ts @@ -137,7 +137,7 @@ async function withServer( } finally { await client.close(); await transport.close(); - rmSync(root, { recursive: true, force: true }); + rmSync(root, { recursive: true, force: true, maxRetries: 10, retryDelay: 200 }); } } diff --git a/src/upgrade-provenance.test.ts b/src/upgrade-provenance.test.ts index c49f3eeb..1dde9b96 100644 --- a/src/upgrade-provenance.test.ts +++ b/src/upgrade-provenance.test.ts @@ -64,7 +64,7 @@ describe("kit upgrade CLI lock provenance", () => { "committed locks must not contain machine-specific absolute paths", ); } finally { - rmSync(project, { recursive: true, force: true }); + rmSync(project, { recursive: true, force: true, maxRetries: 10, retryDelay: 200 }); } }); });