Skip to content

chore(deps): bump the actions group with 2 updates#125

Merged
hyperpolymath merged 2 commits into
mainfrom
dependabot/github_actions/actions-1f643bbc31
May 29, 2026
Merged

chore(deps): bump the actions group with 2 updates#125
hyperpolymath merged 2 commits into
mainfrom
dependabot/github_actions/actions-1f643bbc31

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github May 29, 2026

Copy link
Copy Markdown
Contributor

Bumps the actions group with 2 updates: actions/checkout and hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml.

Updates actions/checkout from 4.1.1 to 6.0.2

Release notes

Sourced from actions/checkout's releases.

v6.0.2

What's Changed

Full Changelog: actions/checkout@v6.0.1...v6.0.2

v6.0.1

What's Changed

Full Changelog: actions/checkout@v6...v6.0.1

v6.0.0

What's Changed

Full Changelog: actions/checkout@v5.0.0...v6.0.0

v6-beta

What's Changed

Updated persist-credentials to store the credentials under $RUNNER_TEMP instead of directly in the local git config.

This requires a minimum Actions Runner version of v2.329.0 to access the persisted credentials for Docker container action scenarios.

v5.0.1

What's Changed

Full Changelog: actions/checkout@v5...v5.0.1

v5.0.0

What's Changed

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

Changelog

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

v4.2.0

v4.1.7

v4.1.6

... (truncated)

Commits

Updates hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml from 136b38b305e5b04847de461cfbcdf73e1ff289f2 to ea88be7da68e07249ae7df8b948ecb8ecfb9664c

Changelog

Sourced from hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml's changelog.

Changelog

[Unreleased] — 2026-04-18

Added

  • User-classification registry (assail::UserClassification, load_user_classifications, apply_user_classifications): panic-attack now reads an optional project-local classification file at every assail pass and flips matching findings to suppressed = true after the kanren structural-suppression pass. Two lookup paths:
    • <project_root>/audits/assail-classifications.a2ml (preferred)
    • <project_root>/.panic-attack-classifications.a2ml (fallback) File format is a simple A2ML S-expression with (classification (file …) (category …) (audit …) (rationale …)) blocks; ;; line comments ignored. The registry pattern lets repositories record audited findings out-of-band from the source under scan so a PR adding a new unsafe block cannot self-suppress without a reviewable companion edit to the registry.
  • Rocq scaffold classifier (analyze_coq + count_rocq_unverified_postulates + is_rocq_abstraction_parameter): the Rocq detector no longer counts Section-scoped Variable / Hypothesis / Parameter declarations (they discharge at End Section) and classifies module-level Parameter declarations by stated type: carrier types (Type, Set), decidability witnesses (forall _, { _ = _ } + { _ <> _ }), and function types with a concrete non-Prop codomain are treated as abstraction parameters. Prop-valued declarations (classical excluded-middle, choice, unresolved theorem statements) remain counted. Removes the false-positive stream that surfaced on every canonical-proof-suite scaffold.

Changed

  • Suppression pipeline: analyze() and analyze_verbose() now chain apply_suppression → apply_user_classifications in that order; the explicit post-analyze calls in assail::analyze and assail::analyze_verbose at the module boundary are retained for API-contract clarity but are no-ops when an Analyzer pass has already run.
  • Rocq test coverage: 12 new unit tests across analyzer.rs (Section-scoped Variables / module-level Type carriers / decidable equality / concrete-codomain functions / Prop-valued axioms / missing type annotation / full scaffold shape — 7 tests) and mod.rs (missing-registry / single-entry / multiple-entry / comment handling / end-to-end suppression-flip — 5 tests).

Verified

  • 007 canonical-proof-suite scan: active finding count 8 → 0 (the 6 scaffold ProofDrifts via the detector enhancement, the 2 zig_bridge.rs UnsafeCode findings via the classification registry pointing at audits/audit-ffi-unsafe.md §1). No in-source

... (truncated)

Commits
  • ea88be7 ci(hypatia-scan): repin reusable to merge-commit SHA (#81)
  • 897159a feat(bridge): cohort overrides for vendored-pin (#74) + Dioxus/GTK transitive...
  • 5266c4b feat(assail): downgrade flake.lock-only SupplyChain to Severity::Low (mechani...
  • b2e58a9 feat(assail): exclude vendored-snapshot dirs from analysis (refile of #72 aft...
  • 03fdd9f feat(bridge): split phantom into phantom-declared vs phantom-transitive (#76)
  • 1811b7b feat(assail): exempt Julia *Ext.jl from DynamicCodeExecution (idiomatic packa...
  • 7935204 feat(query): facts-backed (crosslang :from :to) evaluator (issue #33 follow-u...
  • dcfb96b feat(storage): persist kanren CrossLangInteraction as hexads (issue #33 follo...
  • acd329f feat(campaign): panic-attack campaign poll — GitHub PR transitions (issue #33...
  • 5e86c1e feat(query): (crosslang ...) + (since ...) forms (issue #33 S3b+c) (#58)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the actions group with 2 updates
936999e 
Bumps the actions group with 2 updates: [actions/checkout](https://github.com/actions/checkout) and [hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml](https://github.com/hyperpolymath/panic-attack).


Updates `actions/checkout` from 4.1.1 to 6.0.2
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4.1.1...de0fac2)

Updates `hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml` from 136b38b305e5b04847de461cfbcdf73e1ff289f2 to ea88be7da68e07249ae7df8b948ecb8ecfb9664c
- [Release notes](https://github.com/hyperpolymath/panic-attack/releases)
- [Changelog](https://github.com/hyperpolymath/panic-attack/blob/main/CHANGELOG.md)
- [Commits](hyperpolymath/panic-attack@136b38b...ea88be7)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml
  dependency-version: ea88be7da68e07249ae7df8b948ecb8ecfb9664c
  dependency-type: direct:production
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels May 29, 2026
@hyperpolymath
hyperpolymath merged commit 56a8275 into main May 29, 2026
35 of 41 checks passed
@hyperpolymath
hyperpolymath deleted the dependabot/github_actions/actions-1f643bbc31 branch May 29, 2026 10:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@hyperpolymath hyperpolymath hyperpolymath approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@hyperpolymath