chore(deps): bump the actions group with 3 updates (#46)

dependabot[bot] · web-flow · commit deaa958209d5 · 2026-07-15T20:23:37.000+01:00
Bumps the actions group with 3 updates: [hyperpolymath/a2ml-validate-action](https://github.com/hyperpolymath/a2ml-validate-action), [hyperpolymath/k9-validate-action](https://github.com/hyperpolymath/k9-validate-action) and [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog). Updates `hyperpolymath/a2ml-validate-action` from cb3c1e298169dc5ac2b42e257068b0fb5920cd5e to 05bcb78917c09702e90ed18004298a6728753914 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/hyperpolymath/a2ml-validate-action/blob/main/CHANGELOG.md">hyperpolymath/a2ml-validate-action's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <p>All notable changes to this project will be documented in this file.</p> <p>The format is based on <a href="https://keepachangelog.com/en/1.1.0/">Keep a Changelog</a>, and this project adheres to <a href="https://semver.org/spec/v2.0.0.html">Semantic Versioning</a>.</p>   <h2>[Unreleased]</h2> <h2>[1.0.0] - 2026-05-29</h2> <h3>Added</h3> <ul> <li>Initial Marketplace-ready composite action for validating <code>.a2ml</code> manifests.</li> <li>Configurable <code>path</code>, <code>strict</code>, and <code>paths-ignore</code> inputs.</li> <li>GitHub Actions outputs for scanned files, validation errors, and warnings.</li> </ul> <h3>Fixed</h3> <ul> <li>Allow local smoke runs outside GitHub Actions by defaulting missing <code>GITHUB_OUTPUT</code> to <code>/dev/null</code>.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/hyperpolymath/a2ml-validate-action/commit/05bcb78917c09702e90ed18004298a6728753914"><code>05bcb78</code></a> ci: Secret Scanner caller must grant the reusable's job permissions (<a href="https://redirect.github.com/hyperpolymath/a2ml-validate-action/issues/56">#56</a>)</li> <li><a href="https://github.com/hyperpolymath/a2ml-validate-action/commit/e558e79200c06226e7b9477004d6792b9c215b33"><code>e558e79</code></a> fix(ci): clear OSSF Scorecard startup_failure (<a href="https://redirect.github.com/hyperpolymath/a2ml-validate-action/issues/55">#55</a>)</li> <li><a href="https://github.com/hyperpolymath/a2ml-validate-action/commit/a1898b7803d21f81eab564954980efef6f2a1c95"><code>a1898b7</code></a> Revert <a href="https://redirect.github.com/hyperpolymath/a2ml-validate-action/issues/53">#53</a>: TOML is not canonical A2ML (spec is S-expr/Djot-like) (<a href="https://redirect.github.com/hyperpolymath/a2ml-validate-action/issues/54">#54</a>)</li> <li><a href="https://github.com/hyperpolymath/a2ml-validate-action/commit/db22cd51f07eb7eac8ec0b2acd01bf7186ef1d56"><code>db22cd5</code></a> feat: canonical A2ML dialect = TOML (warn-by-default, enforce flag) (<a href="https://redirect.github.com/hyperpolymath/a2ml-validate-action/issues/53">#53</a>)</li> <li><a href="https://github.com/hyperpolymath/a2ml-validate-action/commit/7e1cd7ede4d8671db82106fc0a73d3a5842c4bca"><code>7e1cd7e</code></a> chore(deps): bump the actions group with 3 updates (<a href="https://redirect.github.com/hyperpolymath/a2ml-validate-action/issues/52">#52</a>)</li> <li><a href="https://github.com/hyperpolymath/a2ml-validate-action/commit/c14a51a4f3766e239b5b912332828474dc2ae103"><code>c14a51a</code></a> chore(deps): bump the actions group with 2 updates (<a href="https://redirect.github.com/hyperpolymath/a2ml-validate-action/issues/51">#51</a>)</li> <li><a href="https://github.com/hyperpolymath/a2ml-validate-action/commit/abcc1a0e99acae357af500685c0478c51327de60"><code>abcc1a0</code></a> fix(clade): correct CLADE uuid (deterministic v5, was template residue) (<a href="https://redirect.github.com/hyperpolymath/a2ml-validate-action/issues/50">#50</a>)</li> <li><a href="https://github.com/hyperpolymath/a2ml-validate-action/commit/4ae6b4828e55aa08db690b25db72427feea88bfa"><code>4ae6b48</code></a> docs: post-canon reference + factual fixes (<a href="https://redirect.github.com/hyperpolymath/a2ml-validate-action/issues/49">#49</a>)</li> <li><a href="https://github.com/hyperpolymath/a2ml-validate-action/commit/ac1392ac5ddb4cf3b015a16a6d9228efc825e0b7"><code>ac1392a</code></a> chore(hooks): version-controlled pre-commit + SPDX split by file-type (<a href="https://redirect.github.com/hyperpolymath/a2ml-validate-action/issues/48">#48</a>)</li> <li><a href="https://github.com/hyperpolymath/a2ml-validate-action/commit/e8b80797957a55faaee201cf7540609fd578fc57"><code>e8b8079</code></a> ci: refresh standards reusable pins to current HEAD (d7c2271) (<a href="https://redirect.github.com/hyperpolymath/a2ml-validate-action/issues/47">#47</a>)</li> <li>Additional commits viewable in <a href="https://github.com/hyperpolymath/a2ml-validate-action/compare/cb3c1e298169dc5ac2b42e257068b0fb5920cd5e...05bcb78917c09702e90ed18004298a6728753914">compare view</a></li> </ul> </details> <br /> Updates `hyperpolymath/k9-validate-action` from 236f0035cc159051c8dd5dc7cd8af1e8cf961462 to 7c3c0e9fa5165626e74ecce78109b3295b798b92 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/hyperpolymath/k9-validate-action/blob/main/CHANGELOG.md">hyperpolymath/k9-validate-action's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <p>All notable changes to this project will be documented in this file.</p> <p>The format is based on <a href="https://keepachangelog.com/en/1.1.0/">Keep a Changelog</a>, and this project adheres to <a href="https://semver.org/spec/v2.0.0.html">Semantic Versioning</a>.</p>   <h2>[Unreleased]</h2> <h2>[1.0.0] - 2026-05-29</h2> <h3>Added</h3> <ul> <li>Initial Marketplace-ready composite action for validating <code>.k9</code> and <code>.k9.ncl</code> files.</li> <li>Configurable <code>path</code>, <code>strict</code>, and <code>paths-ignore</code> inputs.</li> <li>GitHub Actions outputs for scanned files, validation errors, and warnings.</li> </ul> <h3>Fixed</h3> <ul> <li>Allow local smoke runs outside GitHub Actions by defaulting missing <code>GITHUB_OUTPUT</code> to <code>/dev/null</code>.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/hyperpolymath/k9-validate-action/commit/7c3c0e9fa5165626e74ecce78109b3295b798b92"><code>7c3c0e9</code></a> chore(deps): bump the actions group with 5 updates (<a href="https://redirect.github.com/hyperpolymath/k9-validate-action/issues/36">#36</a>)</li> <li><a href="https://github.com/hyperpolymath/k9-validate-action/commit/bddcd9109ee96f9ea3fdb4bf51084fe9cd0909ce"><code>bddcd91</code></a> ci: Secret Scanner caller must grant the reusable's job permissions (<a href="https://redirect.github.com/hyperpolymath/k9-validate-action/issues/35">#35</a>)</li> <li><a href="https://github.com/hyperpolymath/k9-validate-action/commit/3e091a341022b8c1bfa8cc86ebc1271bd20c1fdb"><code>3e091a3</code></a> chore(deps): bump the actions group with 4 updates (<a href="https://redirect.github.com/hyperpolymath/k9-validate-action/issues/34">#34</a>)</li> <li><a href="https://github.com/hyperpolymath/k9-validate-action/commit/91e2b6b170fb1ed7232dcdf404922d89a64be5c0"><code>91e2b6b</code></a> fix(clade): correct identity uuid (deterministic v5) (<a href="https://redirect.github.com/hyperpolymath/k9-validate-action/issues/33">#33</a>)</li> <li><a href="https://github.com/hyperpolymath/k9-validate-action/commit/b9acd2a2987e5cd175cd9d841cd245961171b258"><code>b9acd2a</code></a> chore(deps): bump the actions group with 2 updates (<a href="https://redirect.github.com/hyperpolymath/k9-validate-action/issues/32">#32</a>)</li> <li><a href="https://github.com/hyperpolymath/k9-validate-action/commit/eea3a8488e7b6bc6fe60e1691fd5235c0f6310e1"><code>eea3a84</code></a> docs(readme): convert README.adoc -&gt; Markdown (renders on Glama/profile/commu...</li> <li><a href="https://github.com/hyperpolymath/k9-validate-action/commit/9f9561436b302ee445fd589bb41ed63f3e62e4cd"><code>9f95614</code></a> chore(ci): add dormant push-email notification workflow (<a href="https://redirect.github.com/hyperpolymath/k9-validate-action/issues/30">#30</a>)</li> <li><a href="https://github.com/hyperpolymath/k9-validate-action/commit/90ac96b05add68467b4db4867153a1fca7256d30"><code>90ac96b</code></a> chore(clade): backfill [status] lifecycle block (<a href="https://redirect.github.com/hyperpolymath/k9-validate-action/issues/29">#29</a>)</li> <li><a href="https://github.com/hyperpolymath/k9-validate-action/commit/814972979e84ca836496698d5195441d9cb35dc4"><code>8149729</code></a> chore(licence): normalise to MPL-2.0 + CC-BY-SA-4.0 (canonical pair) (<a href="https://redirect.github.com/hyperpolymath/k9-validate-action/issues/28">#28</a>)</li> <li><a href="https://github.com/hyperpolymath/k9-validate-action/commit/4a64df71896bc3e0f27844af3e74009f8d3429d3"><code>4a64df7</code></a> chore(ci): bump standards reusable workflow pins (<a href="https://redirect.github.com/hyperpolymath/k9-validate-action/issues/27">#27</a>)</li> <li>Additional commits viewable in <a href="https://github.com/hyperpolymath/k9-validate-action/compare/236f0035cc159051c8dd5dc7cd8af1e8cf961462...7c3c0e9fa5165626e74ecce78109b3295b798b92">compare view</a></li> </ul> </details> <br /> Updates `trufflesecurity/trufflehog` from 3.95.8 to 3.95.9 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/trufflesecurity/trufflehog/releases">trufflesecurity/trufflehog's releases</a>.</em></p> <blockquote> <h2>v3.95.9</h2> <h2>What's Changed</h2> <ul> <li>feat: add OpenRouter detector by <a href="https://github.com/McPatate"><code>@​McPatate</code></a> in <a href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4500">trufflesecurity/trufflehog#4500</a></li> <li>Integrations fully codeowns detectors by <a href="https://github.com/trufflesteeeve"><code>@​trufflesteeeve</code></a> in <a href="https://redirect.github.com/trufflesecurity/trufflehog/pull/5104">trufflesecurity/trufflehog#5104</a></li> <li>[INS-332] Add New Relic Insights Insert key detector by <a href="https://github.com/mustansir14"><code>@​mustansir14</code></a> in <a href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4778">trufflesecurity/trufflehog#4778</a></li> <li>[INS-351] Added Duffel Token Detector by <a href="https://github.com/MuneebUllahKhan222"><code>@​MuneebUllahKhan222</code></a> in <a href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4795">trufflesecurity/trufflehog#4795</a></li> <li>[INS-341] Added Shippo detector by <a href="https://github.com/MuneebUllahKhan222"><code>@​MuneebUllahKhan222</code></a> in <a href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4820">trufflesecurity/trufflehog#4820</a></li> <li>[INS-467] Add IPinfo detector to default detectors list by <a href="https://github.com/mustansir14"><code>@​mustansir14</code></a> in <a href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4970">trufflesecurity/trufflehog#4970</a></li> <li>fix: reject --include-repos/--exclude-repos with --repo in github scan by <a href="https://github.com/kashifkhan0771"><code>@​kashifkhan0771</code></a> in <a href="https://redirect.github.com/trufflesecurity/trufflehog/pull/5112">trufflesecurity/trufflehog#5112</a></li> <li>[INS-468] Add improved lob detector to defaults.go by <a href="https://github.com/mustansir14"><code>@​mustansir14</code></a> in <a href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4971">trufflesecurity/trufflehog#4971</a></li> <li>feat(action): add image input to allow registry mirror overrides by <a href="https://github.com/eightseventhreethree"><code>@​eightseventhreethree</code></a> in <a href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4965">trufflesecurity/trufflehog#4965</a></li> <li>feat: Support archived repo exclusion from GH org scans by <a href="https://github.com/hibare"><code>@​hibare</code></a> in <a href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4875">trufflesecurity/trufflehog#4875</a></li> <li>[INT-715] Retry transient failures when verifying OpenAI keys by <a href="https://github.com/bill-rich"><code>@​bill-rich</code></a> in <a href="https://redirect.github.com/trufflesecurity/trufflehog/pull/5117">trufflesecurity/trufflehog#5117</a></li> <li>[INS-410] Added batch token detector by <a href="https://github.com/MuneebUllahKhan222"><code>@​MuneebUllahKhan222</code></a> in <a href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4824">trufflesecurity/trufflehog#4824</a></li> <li>[INT-650] Don't log as error when git diff is too long by <a href="https://github.com/bill-rich"><code>@​bill-rich</code></a> in <a href="https://redirect.github.com/trufflesecurity/trufflehog/pull/5113">trufflesecurity/trufflehog#5113</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/McPatate"><code>@​McPatate</code></a> made their first contribution in <a href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4500">trufflesecurity/trufflehog#4500</a></li> <li><a href="https://github.com/eightseventhreethree"><code>@​eightseventhreethree</code></a> made their first contribution in <a href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4965">trufflesecurity/trufflehog#4965</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/trufflesecurity/trufflehog/compare/v3.95.8...v3.95.9">https://github.com/trufflesecurity/trufflehog/compare/v3.95.8...v3.95.9</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/trufflesecurity/trufflehog/commit/27b0417c16317ca9a472a9a8092acce143b49c55"><code>27b0417</code></a> Don't log as error when git diff is too long (<a href="https://redirect.github.com/trufflesecurity/trufflehog/issues/5113">#5113</a>)</li> <li><a href="https://github.com/trufflesecurity/trufflehog/commit/d328285962406cf0c11e593fdce224a0e1334038"><code>d328285</code></a> [INS-410] Added batch token detector (<a href="https://redirect.github.com/trufflesecurity/trufflehog/issues/4824">#4824</a>)</li> <li><a href="https://github.com/trufflesecurity/trufflehog/commit/33d9daddb1f521c32e89aeb2ca5fce45e9980aac"><code>33d9dad</code></a> [INT-715] Retry transient failures when verifying OpenAI keys (<a href="https://redirect.github.com/trufflesecurity/trufflehog/issues/5117">#5117</a>)</li> <li><a href="https://github.com/trufflesecurity/trufflehog/commit/d7dcc6d3fe80206bc1bdcfb15db1dd8d890956fd"><code>d7dcc6d</code></a> feat: Support archived repo exclusion from GH org scans (<a href="https://redirect.github.com/trufflesecurity/trufflehog/issues/4875">#4875</a>)</li> <li><a href="https://github.com/trufflesecurity/trufflehog/commit/f845f184e44d45a8f5aa189a85bad263cbb18d60"><code>f845f18</code></a> feat(action): add image input to allow registry mirror overrides (<a href="https://redirect.github.com/trufflesecurity/trufflehog/issues/4965">#4965</a>)</li> <li><a href="https://github.com/trufflesecurity/trufflehog/commit/6c979705861339b7e6ca6229545904769240d75f"><code>6c97970</code></a> [INS-468] Add improved lob detector to defaults.go (<a href="https://redirect.github.com/trufflesecurity/trufflehog/issues/4971">#4971</a>)</li> <li><a href="https://github.com/trufflesecurity/trufflehog/commit/1675e1743f7ad74b11c91f232a3ed131f5281a27"><code>1675e17</code></a> fix: reject --include-repos/--exclude-repos with --repo in github scan (<a href="https://redirect.github.com/trufflesecurity/trufflehog/issues/5112">#5112</a>)</li> <li><a href="https://github.com/trufflesecurity/trufflehog/commit/5c2762667cca2c6bc9bce2ff6e2a04eb22fbd453"><code>5c27626</code></a> [INS-467] Add IPinfo detector to default detectors list (<a href="https://redirect.github.com/trufflesecurity/trufflehog/issues/4970">#4970</a>)</li> <li><a href="https://github.com/trufflesecurity/trufflehog/commit/53e63918ad831e2dfd8d568c07071912d2fbf05f"><code>53e6391</code></a> [INS-341] Added Shippo detector (<a href="https://redirect.github.com/trufflesecurity/trufflehog/issues/4820">#4820</a>)</li> <li><a href="https://github.com/trufflesecurity/trufflehog/commit/d3b54872981534871af5a94b33ca9ae9bc540148"><code>d3b5487</code></a> [INS-351] Added Duffel Token Detector (<a href="https://redirect.github.com/trufflesecurity/trufflehog/issues/4795">#4795</a>)</li> <li>Additional commits viewable in <a href="https://github.com/trufflesecurity/trufflehog/compare/00155c9dc586f34d189adc83d3ac2698c2ec551f...27b0417c16317ca9a472a9a8092acce143b49c55">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml
@@ -42,7 +42,7 @@ jobs:
 
       - name: Validate A2ML manifests
         if: steps.detect.outputs.count > 0
-        uses: hyperpolymath/a2ml-validate-action@cb3c1e298169dc5ac2b42e257068b0fb5920cd5e # main
+        uses: hyperpolymath/a2ml-validate-action@05bcb78917c09702e90ed18004298a6728753914 # main
         with:
           path: '.'
           strict: 'false'
@@ -91,7 +91,7 @@ jobs:
 
       - name: Validate K9 contracts
         if: steps.detect.outputs.k9_count > 0
-        uses: hyperpolymath/k9-validate-action@236f0035cc159051c8dd5dc7cd8af1e8cf961462 # main
+        uses: hyperpolymath/k9-validate-action@7c3c0e9fa5165626e74ecce78109b3295b798b92 # main
         with:
           path: '.'
           strict: 'false'
diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml
@@ -26,7 +26,7 @@ jobs:
         run: |
           find . -type f -perm /111 -name "*.sh" | head -10 || true
       - name: Check for secrets
-        uses: trufflesecurity/trufflehog@00155c9dc586f34d189adc83d3ac2698c2ec551f # v3.93.3
+        uses: trufflesecurity/trufflehog@27b0417c16317ca9a472a9a8092acce143b49c55 # v3.93.3
         with:
           path: ./
           base: ${{ github.event.pull_request.base.sha || github.event.before }}
