chore(deps): bump the actions group with 9 updates#8
Merged
Conversation
Bumps the actions group with 9 updates: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `4` | `6` | | [github/codeql-action](https://github.com/github/codeql-action) | `3` | `4` | | [actions/first-interaction](https://github.com/actions/first-interaction) | `1` | `3` | | [actions/upload-pages-artifact](https://github.com/actions/upload-pages-artifact) | `3` | `4` | | [actions/labeler](https://github.com/actions/labeler) | `4` | `6` | | [webfactory/ssh-agent](https://github.com/webfactory/ssh-agent) | `0.9.0` | `0.9.1` | | [codecov/codecov-action](https://github.com/codecov/codecov-action) | `3` | `5` | | [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.3.1` | `2.4.3` | | [actions/stale](https://github.com/actions/stale) | `5` | `10` | Updates `actions/checkout` from 4 to 6 - [Release notes](https://github.com/actions/checkout/releases) - [Commits](actions/checkout@v4...v6) Updates `github/codeql-action` from 3 to 4 - [Release notes](https://github.com/github/codeql-action/releases) - [Commits](github/codeql-action@v3...v4) Updates `actions/first-interaction` from 1 to 3 - [Release notes](https://github.com/actions/first-interaction/releases) - [Commits](actions/first-interaction@v1...v3) Updates `actions/upload-pages-artifact` from 3 to 4 - [Release notes](https://github.com/actions/upload-pages-artifact/releases) - [Commits](actions/upload-pages-artifact@v3...v4) Updates `actions/labeler` from 4 to 6 - [Release notes](https://github.com/actions/labeler/releases) - [Commits](actions/labeler@v4...v6) Updates `webfactory/ssh-agent` from 0.9.0 to 0.9.1 - [Release notes](https://github.com/webfactory/ssh-agent/releases) - [Changelog](https://github.com/webfactory/ssh-agent/blob/master/CHANGELOG.md) - [Commits](webfactory/ssh-agent@dc588b6...a6f90b1) Updates `codecov/codecov-action` from 3 to 5 - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](codecov/codecov-action@v3...v5) Updates `ossf/scorecard-action` from 2.3.1 to 2.4.3 - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](ossf/scorecard-action@v2.3.1...v2.4.3) Updates `actions/stale` from 5 to 10 - [Release notes](https://github.com/actions/stale/releases) - [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md) - [Commits](actions/stale@v5...v10) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: github/codeql-action dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/first-interaction dependency-version: '3' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/upload-pages-artifact dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/labeler dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: webfactory/ssh-agent dependency-version: 0.9.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: codecov/codecov-action dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: ossf/scorecard-action dependency-version: 2.4.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: actions/stale dependency-version: '10' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
hyperpolymath
deleted the
dependabot/github_actions/actions-667af3f80e
branch
December 16, 2025 13:48
This was referenced Jun 2, 2026
hyperpolymath
added a commit
that referenced
this pull request
Jun 4, 2026
## Sub-PR #3 of the Android Kotlin→Rust/Gossamer migration epic Part of epic **#83**, RFC PR **#97**, tracking sub-issue **#109**. Scope of #3 is **scaffolding only** — stand up the minimal Gossamer Android shell so sub-PRs #4–#7 can port the actual components. No behaviour change to existing crates. ### Files added / changed | File | Change | |------|--------| | `android/gossamer.conf.json` | **NEW** — Gossamer app config (analogous to the former `tauri.conf.json`). Schema `https://gossamer.dev/schemas/config/v1`, modelled on `hyperpolymath/panll` + `hyperpolymath/gossamer`. Includes a `bundle.mobile.android` block (`minSdk 26` / `targetSdk 34`, mirroring the legacy `AndroidManifest.xml`). | | `android/app/src/main/java/ai/neurophone/gossamer/NeurophoneMainActivity.java` | **NEW** — Java shim extending `io.gossamer.GossamerActivity`; overrides `getInitialHtml()` to load placeholder HTML in the Gossamer webview. | | `crates/neurophone-android/Cargo.toml` | Commented-out `gossamer-rs` placeholder + TODO (unpublished; see below). | | `android/app/build.gradle.kts` | Commented-out Gossamer Android library dependency + TODO. | | `android/app/src/main/AndroidManifest.xml` | Commented-out registration of `NeurophoneMainActivity` + TODO (legacy `.MainActivity` stays LAUNCHER for now). | Every new file carries `SPDX-License-Identifier: MPL-2.0`. ### `gossamer-rs` resolvability outcome **Not resolvable in this workspace — left as a commented placeholder, by design.** Estate precedent (`hyperpolymath/panll`) consumes it only as a **path dependency to a sibling checkout**: `gossamer-rs = { path = "../gossamer/bindings/rust" }`. The crate (`gossamer-rs` v0.1.0) is **not published to crates.io**, and there is no sibling `gossamer` checkout in neurophone CI. Adding it as a hard dependency would break `cargo build --workspace`, so per the hard constraint it is commented out with a TODO(#83 sub-PR #5) documenting the git/path/registry options. Likewise the **Gossamer Android library** (`io.gossamer.GossamerActivity`/`GossamerBridge`) ships upstream as a raw Java source tree + prebuilt `libgossamer.so`, **not** a Maven/AAR artifact, so the Gradle dependency and the manifest activity registration are also commented placeholders. ### What I verified - `cargo metadata --no-deps` → **OK** (all workspace manifests, including my Cargo.toml edit, parse). - `cargo build --workspace` → **fails, but with a PRE-EXISTING failure unrelated to this PR.** The `esn` and `lsm` crates do not compile on `main` (commit `0a88e45`) due to a `rand` 0.10 / `ndarray-rand` 0.16 API incompatibility (`no method named random`/`sample`, `RngExt`/`DerefMut` bounds). This PR touches **zero** compiling Rust: the diff in `crates/esn`, `crates/lsm`, `crates/neurophone-core` is empty, and the only Rust change is a **commented** block in `crates/neurophone-android/Cargo.toml`. **Build/test error delta introduced by this PR: 0.** `cargo test --workspace` is blocked by the same pre-existing compile failure, not by anything here. - No new `gossamer-rs` hard dependency added → CI green-ness is not regressed by this PR. >⚠️ The pre-existing `esn`/`lsm` `rand` breakage on `main` is out of scope for this scaffolding sub-PR and should be fixed separately. ### `GossamerActivity` API assumptions Read directly from `hyperpolymath/gossamer` `android/src/main/java/io/gossamer/GossamerActivity.java`: - Package `io.gossamer`; subclass and override `getInitialHtml()` (non-null ⇒ `webView.loadData`) **or** `getInitialUrl()` (used when HTML is null). - Parent loads `libgossamer.so` via `System.loadLibrary("gossamer")` in a static block and registers the `GossamerBridge` JS interface (`window.GossamerBridge.postMessage(json)`) for native IPC. - Assumed `gossamer.conf.json` v1 schema is the correct mobile config surface and that `bundle.mobile.android` is the right place for SDK/permission config (matches the gossamer reference config; not independently validated against a live gossamer mobile build, since Gossamer Android is webview-only today). ### TODOs / risks for sub-PRs #4–#8 - **#4**: replace placeholder HTML with the real bundled web UI (`getInitialUrl()` / `build.frontendDist`); enable the manifest activity + move LAUNCHER intent-filter; retire `.MainActivity`. - **#5**: enable `gossamer-rs` (vendor / git dep / registry) once resolvable; port the 11 `NativeLib` JNI methods (init/start/stop/processSensor/queryLocal/queryClaude/query/getNeuralContext/getState/reset/isRunning) onto the Gossamer IPC bridge, backed by `crates/neurophone-android` + `crates/neurophone-core`. - **#6**: port the sensor pipeline (accel/gyro/mag/light/proximity → LSM→ESN loop). - **#7**: port `NeurophoneService` (foreground service), `BootReceiver`, and the home-screen widgets; re-add `BODY_SENSORS`/`FOREGROUND_SERVICE`/`RECEIVE_BOOT_COMPLETED`/`WAKE_LOCK` to `gossamer.conf.json`. - **#8**: remove the legacy `android/` Kotlin tree and drop the `.hypatia-baseline.json` carve-out once migration lands. - **Risk**: gossamer Android library distribution mechanism (Maven coord vs vendored source vs prebuilt `.so` path) is unconfirmed — sub-PR #4/#5 must pick one. Mobile `gossamer.conf.json` fields beyond the desktop reference are assumed, not validated against a live mobile build. https://claude.ai/code/session_01Gu1JFCZHuBtBhAWPr4sMQw --- _Generated by [Claude Code](https://claude.ai/code/session_01Gu1JFCZHuBtBhAWPr4sMQw)_ Co-authored-by: Claude <noreply@anthropic.com>
hyperpolymath
added a commit
that referenced
this pull request
Jun 6, 2026
**Sub-PR #3** of the Android Kotlin→Rust/Gossamer migration epic (#83, RFC PR #97, tracking sub-issue #109). **Scaffolding only.** No behaviour change to existing crates; the legacy Kotlin `android/app/` tree is untouched. ## Files added (all under `android/gossamer/`, all `SPDX-License-Identifier: MPL-2.0`) | File | Purpose | |---|---| | `gossamer.conf.json` | Gossamer app config (analogous to `tauri.conf.json`). Schema mirrored from `hyperpolymath/gossamer` and `hyperpolymath/panll`. Carries identity `ai.neurophone`, the `bundle.mobile.android` block (minSdk 26 / targetSdk 34 + the permission set from the legacy `AndroidManifest.xml`), dev/build runner config. | | `app/src/main/java/ai/neurophone/NeurophoneMainActivity.java` | Java shim extending `io.gossamer.GossamerActivity`; overrides `getInitialHtml()` to load placeholder HTML in the Gossamer WebView. | | `Cargo.toml` | Standalone (non-workspace) scaffold manifest for the future `neurophone-gossamer` cdylib. `gossamer-rs` dep commented out (see below). | | `src/lib.rs` | Inert placeholder lib so the standalone crate compiles; documents wiring TODOs. | | `README.adoc` | Documents resolvability, `GossamerActivity` API assumptions, TODOs/risks for #4–#8. | | `Cargo.lock` | Lock for the standalone scaffold crate (pins serde/serde_json placeholder deps). | The `android/**` subtree is exempt from the banned-language CI gate via `.hypatia-baseline.json` on `main`, so the hand-written Java shim is acceptable here. ## `gossamer-rs` resolvability outcome **`gossamer-rs` v0.1.0 is NOT published to crates.io.** In the estate it is consumed as a **path dependency** from the sibling `hyperpolymath/gossamer` repo at `bindings/rust` — precedent from `hyperpolymath/panll`: ```toml gossamer-rs = { path = "../gossamer/bindings/rust" } ``` That sibling checkout doesn't exist in a neurophone clone, so wiring it as a hard dependency would break the build. Per the hard constraint (CI green > "complete" dep), it is **left commented out** with `TODO(#83 sub-PR #8)`. The scaffold manifest is also kept **out of the root workspace `members`** and carries an empty `[workspace]` table, so neither `cargo build --workspace` nor `cargo test --workspace` ever touches it. ## What I verified (build/test) - `cargo metadata --no-deps` for the root workspace → the 8 existing crates only; `neurophone-gossamer` is **not** a member. My additions are inert to the workspace. - Standalone scaffold: `cargo test --manifest-path android/gossamer/Cargo.toml` → **compiles + 1 test passes**. - `cargo build --workspace` / `cargo test --workspace` fail **only** in `crates/esn` and `crates/lsm` (`ndarray-rand` 0.16 vs `rand` 0.10 API skew: `random`/`sample`/`random_using`). **This failure pre-exists on `main`** — reproduced in a pristine `main` worktree (`cargo build -p esn` exits 101 on `0a88e45`). My PR neither introduces nor worsens it.⚠️ Pre-existing red workspace flagged below. ## `GossamerActivity` API assumptions (read from `hyperpolymath/gossamer` `android/src/main/java/io/gossamer/`) - `io.gossamer.GossamerActivity extends android.app.Activity`. - Loads `libgossamer.so` via `System.loadLibrary("gossamer")` in a static block. - `onCreate()` builds a full-screen `WebView`, enables JS + DOM storage, **disables** `file://`/content access, registers the `GossamerBridge` JS interface (`window.GossamerBridge.postMessage(json)`), and calls native `nativeInit(activity, webview)`. - Content via overriding **`getInitialHtml()`** (HTML `String`) or **`getInitialUrl()`** (URL `String`); `getInitialHtml()` takes precedence — we override it. - Gossamer on Android is **webview-only today**. - Assumed: the gossamer Android sources + `libgossamer.so` are vendored/linked into the app module at build time (sub-PR #8), so `io.gossamer.GossamerActivity` is on the classpath. The shim is therefore not part of any CI build step yet. ## TODOs / risks for sub-PRs #4–#8 - **#4** — Port `NativeLib`: map the 11 JNI methods (init/start/stop/processSensor/queryLocal/queryClaude/query/getNeuralContext/getState/reset/isRunning) to Gossamer IPC command handlers calling the Rust core (`crates/neurophone-core`, `crates/neurophone-android`). IPC name/payload contract is **undefined**. - **#5** — Port `NeurophoneService` foreground sensor loop. - **#6** — Port `BootReceiver`. - **#7** — Port the home-screen widgets. - **#8** — Real frontend bundle (`frontendDist`) + full IPC wiring; **enable `gossamer-rs`** (resolve the sibling-checkout/build-integration question); decide `gossamer` CLI vs Gradle for the APK build; then remove the legacy Kotlin `android/app/` tree. - **Licensing risk**: `gossamer-rs` is `AGPL-3.0-or-later`; everything added here is `MPL-2.0`. Whether the cdylib linking `gossamer-rs` can stay MPL-2.0 or must adopt a compatible license is an **open question** to resolve before #8. Refs #83, #97, #109. https://claude.ai/code/session_01Gu1JFCZHuBtBhAWPr4sMQw --- _Generated by [Claude Code](https://claude.ai/code/session_01Gu1JFCZHuBtBhAWPr4sMQw)_ Co-authored-by: Claude <noreply@anthropic.com>
hyperpolymath
added a commit
that referenced
this pull request
Jun 6, 2026
#127) ## Sub-PR #8 — AffineScript UI in the Gossamer webview Part of the Android Kotlin→Rust/Gossamer migration (epic #83, RFC PR #97, sub-issue #114). Reimplements the UI currently in `android/app/src/main/java/ai/neurophone/MainActivity.kt` + `res/layout/activity_main.xml` as the **AffineScript** webview UI that the Gossamer Android shell loads. The Kotlin sources are left in place; their removal happens at migration cutover. ### Dependency note Needs **#3** (Gossamer scaffolding / webview host) and **#4** (NativeLib→Rust JNI) — both in parallel and **not merged**. Based off `main`; their structure is assumed and every assumption is marked `TODO(#83 rebase)` / `TODO(#83)`. ### Files added All new files carry `SPDX-License-Identifier: MPL-2.0`. Under `android/app/src/main/assets/gossamer-ui/`: | File | Purpose | |------|---------| | `src/bridge.affine` | Typed bridge to the native Rust core (was `NativeLib` JNI): `init`, `start`, `stop`, `process_sensor`, `query`, `query_local`, `query_claude`, `get_neural_context`, `get_state`, `reset`, `is_running`. Config ported verbatim from `MainActivity.createConfig()`. | | `src/ui.affine` | View/controller logic ported 1:1 from `MainActivity`: init-on-load, Start/Stop toggle, 500 ms neural-context poll, query + "Prefer Local" routing. | | `index.html` | Webview entry; element ids match `ui.affine` queries. | | `styles.css` | Visual parity with `activity_main.xml` (16dp padding, centred header, monospace neural-context panel, spinner, etc.). | | `deno.json` | Deno build/check/fmt tasks (no npm/Node). | | `build.sh` | AffineScript → Deno-ESM build wiring. | | `dist/ui.mjs` | Committed compiler-output **stub** (see below). | | `README.adoc` | Documents bridge assumptions + TODOs. | Plus a scoped `.gitignore` negation so the committed `dist/ui.mjs` stub is tracked while the general `dist/` ignore stays. ### AffineScript build wiring + assumptions - AffineScript (`.affine`) compiles to Deno-ESM via the estate `affinescript` toolchain (OCaml/Dune CLI: `check` / `fmt` / `compile --target deno-esm`), driven through Deno tasks: `deno task check:ui` / `build:ui` / `fmt:ui`. `build.sh` is the single CI-ready entry point. - **The `affinescript` compiler is not yet vendored** in this repo/CI. So `dist/ui.mjs` is a hand-written **generated-output stub** faithfully mirroring `src/ui.affine` + `src/bridge.affine`, keeping the webview loadable/reviewable today. `build.sh` falls back to the committed stub when the compiler is absent (and says so loudly). `TODO(#83)`: vendor/pin the toolchain, flip `USE_STUB=0`, regenerate, delete the stub, wire `deno task build:ui` into CI. - **Bridge contract assumed** (owned by #3/#4): Gossamer injects `globalThis.gossamer` with `invoke(cmd, args): Promise<string>`; command names are snake_case forms of the old `NativeLib` methods; host serves `index.html` as the webview root. All marked `TODO(#83 rebase)`. - Sensor *acquisition* intentionally not in this UI — the foreground Rust service (#4) registers sensors natively; `bridge.process_sensor` stays exposed for parity. ### Verification - `build.sh` runs clean with the stub fallback (exit 0). - All 8 new files carry the MPL-2.0 SPDX header; `deno.json` is valid JSON. - **Cargo workspace:** no Rust/Cargo files touched (web assets + `.gitignore` only). `cargo build --workspace` currently fails on `main` in the `lsm`/`esn` crates due to a pre-existing `rand` 0.10 API drift (`.random()`/`.sample()`), present on `origin/main` before this branch and unaffected by these changes. ### TODOs / risks - `TODO(#83 rebase)`: reconcile the bridge object name/call convention and DOM-host bindings against #3/#4 once merged. - `TODO(#83)`: vendor the AffineScript toolchain and replace the `dist/ui.mjs` stub with real compiled output; wire into CI. - Pre-existing `lsm`/`esn` `rand` API build failure on `main` is out of scope for this UI PR. ### Language policy AffineScript (primary app language) + HTML/CSS + a Deno-run Bash build script. No TypeScript, Node, or npm. The single `.mjs` is a compiler-output stub, not hand-authored application logic. https://claude.ai/code/session_01Gu1JFCZHuBtBhAWPr4sMQw --- _Generated by [Claude Code](https://claude.ai/code/session_01Gu1JFCZHuBtBhAWPr4sMQw)_ Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> Co-authored-by: Claude <noreply@anthropic.com>
hyperpolymath
added a commit
that referenced
this pull request
Jun 6, 2026
…gacy android/ tree (#124) ##⚠️ BLOCKED — DO NOT MERGE (gated draft) **This is the TERMINAL, GATED step of the Android Kotlin→Rust/Gossamer migration** (epic #83, RFC PR #97, sub-issue #115). It is **gated on sub-PRs #3–#8** (scaffolding + all component ports), which are **NOT done**. Deleting `android/` now removes the **only working Android frontend**, so this PR **MUST NOT be merged until #3–#8 have landed**. - Status: **DRAFT / BLOCKED** - Merge only after: **#3, #4, #5, #6, #7, #8** are all merged - After those land, **rebase this branch on `main`** so the diff removes only what is truly legacy (the Kotlin/Gradle files), leaving the Java shims + Rust + AffineScript UI delivered by #3–#8 in place. > Because #3–#8 are not merged into this branch, the diff here simply deletes the **current** `android/` tree. That is expected for this staging draft. --- ## What was removed The legacy Kotlin/Gradle `android/` app — **20 files**: - **7 `*.kt`**: `BootReceiver.kt`, `MainActivity.kt`, `NativeLib.kt`, `NeurophoneService.kt`, `widget/NeurophoneAppWidget.kt`, `widget/NeurophoneWidgetActions.kt`, `widget/NeurophoneWidgetConfigureActivity.kt` - **3 `*.gradle.kts`**: `android/build.gradle.kts`, `android/settings.gradle.kts`, `android/app/build.gradle.kts` - Plus `gradle.properties`, `AndroidManifest.xml`, and the `res/` XML (drawables, layouts, values, widget info). After migration these are replaced by the Java shims under `android/` + Rust (`crates/`) + AffineScript UI from #3–#8. ## Carve-out removal (now stale) The `android/**` banned-language carve-out existed in **three mirrored locations**, all justified only while banned Kotlin lived in `android/`. With the tree gone they are stale and a stale-baseline detector would otherwise warn, so all three are removed: 1. **`.hypatia-baseline.json`** — the glob `file_pattern: "android/**"` entry removed; file is now an empty array `[]` (it was the only entry). *(A pure-JSON array schema cannot carry an SPDX comment without breaking the schema the detector reads; the original file had no SPDX header either.)* 2. **`.hypatia-ignore`** — the per-file `cicd_rules/banned_language_file:android/...` lines removed (these mirrored the canonical glob). 3. **`.github/workflows/language-policy.yml`** — the `android/` prune in the *Check for Java/Kotlin files* step removed; the check is now an unconditional scan. ## Expected end state With the legacy tree gone and no carve-out: - ✅ **`Check for Banned Languages`** — green, no exemption needed. - ✅ **`governance / Language / package anti-pattern policy`** — green, no exemption needed. ## Verification - **Rust workspace unaffected.** The `android/` Gradle tree is **not** a cargo member — `cargo metadata` resolves cleanly and references the `android/` tree **0 times**. The Rust JNI crate `crates/neurophone-android` is a separate workspace member and is **untouched**. - **Pre-existing build failure (NOT caused by this PR).** `cargo build --workspace` / `cargo test --workspace` currently fail to compile in `crates/esn` and `crates/lsm` due to a `rand`-crate API breakage (`.random()` / `.sample()` no longer resolve under the locked `rand` version). This failure reproduces on **pristine `main` with `android/` still present** (verified by building `-p esn` on `origin/main`), so it is **entirely independent** of this deletion. This PR neither introduces nor fixes that failure and does not touch `Cargo.lock`. ## Out of scope (noted) Narrative docs (`EXPLAINME.adoc`, `TESTING-REPORT.adoc`, `docs/BT-PRESENCE-PLAN.adoc`) still mention the old `android/app/...` Kotlin paths. They are non-build prose describing the legacy app and are intentionally left for the migration-docs update accompanying #3–#8; nothing in the build/CI consumes them. --- PART OF: epic #83 · RFC PR #97 · sub-issue #115 https://claude.ai/code/session_01Gu1JFCZHuBtBhAWPr4sMQw --- _Generated by [Claude Code](https://claude.ai/code/session_01Gu1JFCZHuBtBhAWPr4sMQw)_ Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the actions group with 9 updates:
46341334460.9.00.9.1352.3.12.4.3510Updates
actions/checkoutfrom 4 to 6Release notes
Sourced from actions/checkout's releases.
... (truncated)
Commits
8e8c483Clarify v6 README (#2328)033fa0dAdd worktree support for persist-credentials includeIf (#2327)c2d88d3Update all references from v5 and v4 to v6 (#2314)1af3b93update readme/changelog for v6 (#2311)71cf226v6-beta (#2298)069c695Persist creds to a separate file (#2286)ff7abcdUpdate README to include Node.js 24 support details and requirements (#2248)08c6903Prepare v5.0.0 release (#2238)9f26565Update actions checkout to use node 24 (#2226)Updates
github/codeql-actionfrom 3 to 4Release notes
Sourced from github/codeql-action's releases.
... (truncated)
Commits
c4efbdaOverlay: Check database metadata for overlayBaseSpecifierdd89143CodeQL: Add resolveDatabase method78357d3Merge pull request #3341 from github/mbg/ci/update-cs-config-cli-testsd61a6faUpdate CLI config test to account for overlay db changes on PRsce27e95Rebuild43224ebBump@eslint/eslintrcfrom 3.3.1 to 3.3.3 in the npm-minor groupf0ac9bfMerge pull request #3337 from github/mergeback/v4.31.6-to-main-fe4161a2c1ca379Rebuildc3455c5Update changelog and version after v4.31.6fe4161aMerge pull request #3336 from github/update-v4.31.6-ecec1f887Updates
actions/first-interactionfrom 1 to 3Release notes
Sourced from actions/first-interaction's releases.
... (truncated)
Commits
1c46889Merge pull request #363 from actions/dependabot/npm_and_yarn/npm-development-...76a99ddDisable checks for dist2ead13cBump the npm-development group across 1 directory with 10 updates2e8e200Merge pull request #361 from actions/dependabot/npm_and_yarn/rollup/rollup-li...df55979Merge pull request #357 from actions/dependabot/npm_and_yarn/octokit/types-15...c056c18Bump@rollup/rollup-linux-x64-gnufrom 4.50.2 to 4.52.3dac371dBump@octokit/typesfrom 14.1.0 to 15.0.033689d3Merge pull request #354 from actions/ncalteen/event8e69b57Merge branch 'main' into ncalteen/event69c5373Merge pull request #351 from actions/dependabot/npm_and_yarn/github/local-act...Updates
actions/upload-pages-artifactfrom 3 to 4Release notes
Sourced from actions/upload-pages-artifact's releases.
Commits
7b1f4a7Merge pull request #127 from heavymachinery/pin-sha4cc19c7Pinactions/upload-artifactto SHA2d163beMerge pull request #107 from KittyChiu/mainc704843fix: linted README9605915Merge pull request #106 from KittyChiu/kittychiu/update-readme-1e59cdfeUpdate README.mda2d6704doc: updated usage section in readme984864eMerge pull request #105 from actions/Jcambass-patch-145dc788Add workflow file for publishing releases to immutable action packageefaad07Merge pull request #102 from actions/hidden-filesUpdates
actions/labelerfrom 4 to 6Release notes
Sourced from actions/labeler's releases.
... (truncated)
Commits
634933epublish-action upgrade to 0.4.0 from 0.2.2 (#901)f1a63e8Update Node.js version to 24 in action and dependencies (#891)b0a1180Bump@octokit/request-errorfrom 5.0.1 to 5.1.1 (#846)110d441Update README.md (#871)bee50feBump undici from 5.28.4 to 5.28.5 (#842)6463cdbBump eslint-plugin-jest from 28.9.0 to 28.11.0 (#839)c209686Bump typescript from 5.7.2 to 5.7.3 (#835)5184940Bump@vercel/nccfrom 0.38.1 to 0.38.3 (#830)3629d55Document update - permission section (#840)d24f7f3Bump ts-jest from 29.1.2 to 29.2.5 (#831)Updates
webfactory/ssh-agentfrom 0.9.0 to 0.9.1Release notes
Sourced from webfactory/ssh-agent's releases.
Changelog
Sourced from webfactory/ssh-agent's changelog.
... (truncated)
Commits
a6f90b1Release v0.9.172c0bfdImprove documentation on why we use os.userInfo()e3f1a8eAcknowledge custom command inputs in cleanup.js (#235)b504c19Update CHANGELOG.mdUpdates
codecov/codecov-actionfrom 3 to 5Release notes
Sourced from codecov/codecov-action's releases.
... (truncated)
Changelog
Sourced from codecov/codecov-action's changelog.
... (truncated)
Commits
671740achore(release): 5.5.2 (#1902)96b38e9chore:disable_searchalignment (#1881)9b6d1f8check gpg only when skip-validation = false (#1894)5a10915chore(release): 5.5.1 (#1873)3e0ce21fix: overwrite pr number on fork (#1871)c4741c8build(deps): bump actions/checkout from 4.2.2 to 5.0.0 (#1868)17370e8build(deps): bump github/codeql-action from 3.29.9 to 3.29.11 (#1867)18fdacffix: update to use local app/ dir (#1872)206148cdocs: fix typo in README (#1866)3cb13a1Document acodecov-cliversion reference example (#1774)Updates
ossf/scorecard-actionfrom 2.3.1 to 2.4.3Release notes
Sourced from ossf/scorecard-action's releases.