build(deps): bump ossf/scorecard-action from 2.4.0 to 2.4.3#3
Closed
dependabot[bot] wants to merge 1 commit into
Closed
build(deps): bump ossf/scorecard-action from 2.4.0 to 2.4.3#3dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
dependabot
Bot
force-pushed
the
dependabot/github_actions/ossf/scorecard-action-2.4.3
branch
from
April 22, 2026 22:09
eab2894 to
07f1954
Compare
Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.4.0 to 2.4.3. - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](ossf/scorecard-action@v2.4.0...v2.4.3) --- updated-dependencies: - dependency-name: ossf/scorecard-action dependency-version: 2.4.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/github_actions/ossf/scorecard-action-2.4.3
branch
from
April 22, 2026 22:12
07f1954 to
2ffcd5f
Compare
Owner
|
Superseded by 768c9da which bumps all actions in one commit. |
theagenticguy
deleted the
dependabot/github_actions/ossf/scorecard-action-2.4.3
branch
April 22, 2026 22:14
Contributor
Author
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
5 tasks
theagenticguy
added a commit
that referenced
this pull request
May 10, 2026
## Summary V1-launch readiness sweep: cherry-picks three known-good upstream bug fixes from the post-filter testbed, closes two residual smoke gaps, and deeply refreshes the v1 docs against current reality. ### Bug fixes (5 of 7 from UPSTREAM_BUGS.md) | Severity | Bug | Fix | |---|---|---| | HIGH (data corruption) | #2 — `codehub scan <path>` ingested SARIF into operator's CWD instead of the scanned repo | `c43c5aa fix(cli): scan ingests SARIF into the scanned repo, not CWD` | | HIGH (CI gate) | #3 — `scripts/smoke-mcp.sh` asserted EXPECTED_TOOLS=19; server registers 29 | `433f684 fix(repo): smoke-mcp asserts 29 tools, matching the v1.0 server` | | HIGH (CI dashboard) | #4 — `codehub bench` surfaced 9 of 17 acceptance gates (some titles also stale) | `c5f9047 fix(cli): bench dashboard surfaces all 17 acceptance gates` | | MEDIUM | #1 + #6 — `codehub doctor` false-WARN on tree-sitter / @duckdb / @LadybugDB under pnpm strict isolation; `duckdb close()` undefined on `@duckdb/node-api@1.x` | `c218c31 fix(cli): doctor resolves native bindings from owner workspaces` | | LOW (test hygiene) | #7 — `http-embedder.test.ts` cases failed when `CODEHUB_EMBEDDING_*` env was set in operator's shell | `317bdf1 fix(embedder): isolate http-embedder tests from operator env` | Bug #5 (testbed-only pytest-timeout) does not apply upstream. Bug fixes #1+#6, #2, #3 are direct cherry-picks of `def988b`, `6924b1b`, `ec66d4a` from the post-filter sibling — every changed file:line coordinate verified to match upstream HEAD before pick. ### Spec-coordinate hygiene - `fad766f` — scrub `AC-A-7` / `AC-A-10` from `scripts/m7-parity-audit.sh` header (per the durable lesson; scripts are not ADRs). - `e186aea` — restore ADR-permanent spec coordinates in `docs/adr/0013-m7-default-flip-and-abstraction.md` and `docs/adr/0014-scip-references-and-embedder-fingerprint.md` after an earlier docs-sweep commit over-scrubbed them. Per PR #74's carve-out, ADR text is the explicit place where coordinates ARE allowed. Final sweep: `rg -n 'AC-[A-Z]-[0-9]' packages/ scripts/` returns zero hits. ### Docs refresh - `898192e` — README: status flipped from "v0.1.0 initial public release" to "v1 — feature-complete on M1–M7" (the prerelease caveat stays since `package.json` is still `0.1.x`); 28 → 29 MCP tools across the mermaid diagram, table heading, and mcp-package row; new "Parse runtime — WASM default" section cross-linking ADR `0013-parse-runtime-wasm-default.md`; Repository Layout regenerated against `ls packages/` (now 17 packages — adds `cobol-proleap`, `frameworks`, `pack`, `policy`, `wiki`; drops `eval` and `gym` with a sibling-testbed note); 14 → 15 GA languages (COBOL via regex provider); requirements bumped to Node 22-or-24; tool table expanded to enumerate the cross-repo federation tools and `pack_codebase`. - `69eac8f` — ADR 0011 `Proposed → Accepted`; ADR 0013-m7 `Proposed → Accepted`; sibling-ADR cross-link banner on the duplicate-0013 collision (`0013-parse-runtime-wasm-default.md` and `0013-m7-default-flip-and-abstraction.md` both landed concurrently); ADR 0014 References block swapped from `.erpaval/specs/...` (gitignored, will rot once packet graduates) to durable code-path citations. - `edb362e` — CHANGELOG `[Unreleased]` entry summarizing this PR; AGENTS.md 28 → 29 tools and a divergence banner where it intentionally drops session-local coordinates that CLAUDE.md still carries; OBJECTIVES.md tool count + language count + sibling-testbed note. ## Validation - `pnpm install --frozen-lockfile` ✅ - `mise run check` (lint + typecheck + test + banned-strings + verdict) ✅ - `pnpm -F @opencodehub/cli test` — **236/236** pass (was 235; +1 from the new `[SKIP]` parsing case in `bench.test.ts`) - `pnpm -F @opencodehub/embedder test` — 79 pass / 0 fail / 1 skipped - `bash scripts/smoke-mcp.sh` — **PASS (29 tools listed)** - `node packages/cli/dist/index.js doctor` — `tree-sitter native binding: OK`, `duckdb native binding: OK`, `graph-db native binding: FAIL` (real opt-in build status — the `@ladybugdb/core` binding is not installed on this dev box, which is what `doctor` is supposed to surface; the false-WARN this PR fixes is gone) - `rg -n 'AC-[A-Z]-[0-9]' packages/ scripts/` — zero hits ## Test plan - [ ] CI green on `chore/v1-upstream-bug-sweep` - [ ] `codehub doctor` reports OK on tree-sitter + duckdb in CI matrix (Node 22 + Node 24) - [ ] `codehub scan /tmp/<fixture>` ingests into `<fixture>` not CWD (manual verification on a downstream repo) - [ ] `codehub bench` table now renders all 17 rows, none stuck on "skipped — script crashed" - [ ] License audit / banned-strings / commitlint stay green ## Out of scope - Bug #5 (testbed-only pytest-timeout). Listed for reference in UPSTREAM_BUGS.md; does not affect upstream.
theagenticguy
added a commit
that referenced
this pull request
May 10, 2026
## Summary V1-launch readiness sweep: cherry-picks three known-good upstream bug fixes from the post-filter testbed, closes two residual smoke gaps, and deeply refreshes the v1 docs against current reality. ### Bug fixes (5 of 7 from UPSTREAM_BUGS.md) | Severity | Bug | Fix | |---|---|---| | HIGH (data corruption) | #2 — `codehub scan <path>` ingested SARIF into operator's CWD instead of the scanned repo | `c43c5aa fix(cli): scan ingests SARIF into the scanned repo, not CWD` | | HIGH (CI gate) | #3 — `scripts/smoke-mcp.sh` asserted EXPECTED_TOOLS=19; server registers 29 | `433f684 fix(repo): smoke-mcp asserts 29 tools, matching the v1.0 server` | | HIGH (CI dashboard) | #4 — `codehub bench` surfaced 9 of 17 acceptance gates (some titles also stale) | `c5f9047 fix(cli): bench dashboard surfaces all 17 acceptance gates` | | MEDIUM | #1 + #6 — `codehub doctor` false-WARN on tree-sitter / @duckdb / @LadybugDB under pnpm strict isolation; `duckdb close()` undefined on `@duckdb/node-api@1.x` | `c218c31 fix(cli): doctor resolves native bindings from owner workspaces` | | LOW (test hygiene) | #7 — `http-embedder.test.ts` cases failed when `CODEHUB_EMBEDDING_*` env was set in operator's shell | `317bdf1 fix(embedder): isolate http-embedder tests from operator env` | Bug #5 (testbed-only pytest-timeout) does not apply upstream. Bug fixes #1+#6, #2, #3 are direct cherry-picks of `def988b`, `6924b1b`, `ec66d4a` from the post-filter sibling — every changed file:line coordinate verified to match upstream HEAD before pick. ### Spec-coordinate hygiene - `fad766f` — scrub `AC-A-7` / `AC-A-10` from `scripts/m7-parity-audit.sh` header (per the durable lesson; scripts are not ADRs). - `e186aea` — restore ADR-permanent spec coordinates in `docs/adr/0013-m7-default-flip-and-abstraction.md` and `docs/adr/0014-scip-references-and-embedder-fingerprint.md` after an earlier docs-sweep commit over-scrubbed them. Per PR #74's carve-out, ADR text is the explicit place where coordinates ARE allowed. Final sweep: `rg -n 'AC-[A-Z]-[0-9]' packages/ scripts/` returns zero hits. ### Docs refresh - `898192e` — README: status flipped from "v0.1.0 initial public release" to "v1 — feature-complete on M1–M7" (the prerelease caveat stays since `package.json` is still `0.1.x`); 28 → 29 MCP tools across the mermaid diagram, table heading, and mcp-package row; new "Parse runtime — WASM default" section cross-linking ADR `0013-parse-runtime-wasm-default.md`; Repository Layout regenerated against `ls packages/` (now 17 packages — adds `cobol-proleap`, `frameworks`, `pack`, `policy`, `wiki`; drops `eval` and `gym` with a sibling-testbed note); 14 → 15 GA languages (COBOL via regex provider); requirements bumped to Node 22-or-24; tool table expanded to enumerate the cross-repo federation tools and `pack_codebase`. - `69eac8f` — ADR 0011 `Proposed → Accepted`; ADR 0013-m7 `Proposed → Accepted`; sibling-ADR cross-link banner on the duplicate-0013 collision (`0013-parse-runtime-wasm-default.md` and `0013-m7-default-flip-and-abstraction.md` both landed concurrently); ADR 0014 References block swapped from `.erpaval/specs/...` (gitignored, will rot once packet graduates) to durable code-path citations. - `edb362e` — CHANGELOG `[Unreleased]` entry summarizing this PR; AGENTS.md 28 → 29 tools and a divergence banner where it intentionally drops session-local coordinates that CLAUDE.md still carries; OBJECTIVES.md tool count + language count + sibling-testbed note. ## Validation - `pnpm install --frozen-lockfile` ✅ - `mise run check` (lint + typecheck + test + banned-strings + verdict) ✅ - `pnpm -F @opencodehub/cli test` — **236/236** pass (was 235; +1 from the new `[SKIP]` parsing case in `bench.test.ts`) - `pnpm -F @opencodehub/embedder test` — 79 pass / 0 fail / 1 skipped - `bash scripts/smoke-mcp.sh` — **PASS (29 tools listed)** - `node packages/cli/dist/index.js doctor` — `tree-sitter native binding: OK`, `duckdb native binding: OK`, `graph-db native binding: FAIL` (real opt-in build status — the `@ladybugdb/core` binding is not installed on this dev box, which is what `doctor` is supposed to surface; the false-WARN this PR fixes is gone) - `rg -n 'AC-[A-Z]-[0-9]' packages/ scripts/` — zero hits ## Test plan - [ ] CI green on `chore/v1-upstream-bug-sweep` - [ ] `codehub doctor` reports OK on tree-sitter + duckdb in CI matrix (Node 22 + Node 24) - [ ] `codehub scan /tmp/<fixture>` ingests into `<fixture>` not CWD (manual verification on a downstream repo) - [ ] `codehub bench` table now renders all 17 rows, none stuck on "skipped — script crashed" - [ ] License audit / banned-strings / commitlint stay green ## Out of scope - Bug #5 (testbed-only pytest-timeout). Listed for reference in UPSTREAM_BUGS.md; does not affect upstream.
theagenticguy
added a commit
that referenced
this pull request
May 29, 2026
…skip logs (#156) ## Summary Fixes a cluster of scanner/indexer robustness bugs surfaced by running `codehub analyze` on an external Python/uv project. Each was misreporting a ran-but-nonzero scanner as a hard skip, or emitting misleading/duplicate diagnostics. Grounded against osv-scanner v2 and bandit exit-code semantics. ## Issues fixed **1. osv-scanner "exit code 127" despite running fine** — osv v2 reserves exit `1–126` = vulns found, `127` = general error, `128` = no packages (per osv docs). The shared invoker treated only 0/1 as clean, so 127 surfaced as a bare error. Root trigger: the wrapper passed `--offline-vulnerabilities` by default, which on a repo with no synced DB makes osv walk the tree, then fail to load the offline DB → exit 127. → Added an osv-specific exit-code interpreter (127 → "general error, try `codehub db-sync`"; 128 → "no packages discovered"). Dropped offline-by-default; use the canonical `scan source --recursive .` form (matches `ci.yml`). **The `root: /` line is osv's own internal log — the adapter correctly roots at the repo dir (`cwd=projectPath`, arg `.`).** **2. bandit "exit code 2 + usage:"** — bandit exits 2 on argparse errors; `-f sarif` is invalid without the `bandit[sarif]` extra installed → usage banner. (The old "falls back to text" assumption was false.) → Detect exit-2 + `usage: bandit` and emit an actionable "install `bandit[sarif]`" advisory; suppress the misleading "stdout was not valid JSON" note. **3. Duplicate skip messages** — the runner routed `onWarn` to status `"skipped"` AND re-emitted the terminal note, so lines printed twice and ran-but-nonzero advisories were mislabeled "skipped". → Added a distinct `"warn"` status (scan ran, here's a note) and coalesced the terminal event so each note prints once. **4. scip-python "mise ERROR No version is set for shim"** — `runIndexer` threw on any non-zero exit; a mise/asdf shim with no pinned version resolves on PATH but exits non-zero before the real indexer runs, producing an alarming "indexer failed". → Detect the version-manager-shim failure pattern and return a graceful `skipped` (logged as the calmer "python skipped — …") with an actionable hint. A genuine traceback still throws. ## Out of scope (user-env, not codehub bugs) pip-audit "binary not found" is a graceful skip already (only bug was the duplicate print, fixed in #3). The dead-code ghost-community warning is correctly guarded and informational. ## Verification - `@opencodehub/scanners` — **88 tests pass** (+7: osv exit 1/127/128 + argv, bandit exit-2, runner de-dup + warn) - `@opencodehub/scip-ingest` — **66 tests pass** (+4: mise/asdf shim detection + genuine-crash still throws) ## Note for reviewer Dropping `--offline-vulnerabilities` is a deliberate posture change (osv does online lookups by default now) — flagging for sign-off.
theagenticguy
added a commit
that referenced
this pull request
Jun 14, 2026
…uce a symbol-free graph (#204) ## Why The WASM-resolver bug fixed in #201 shipped **invisibly for ~5 days**. Root cause of the *invisibility* (separate from the resolver itself): a globally-broken parser degrades silently — every file returns empty captures, `analyze` builds a File/Directory-only skeleton graph, prints a node count, and **exits 0**. Nothing distinguished "the parser is dead" from "this repo has no symbols." This PR closes that failure class and the adjacent gaps the investigation surfaced. ## The five fixes **#1 — Zero-symbol guard (run-level backstop).** `ParseOutput` now carries `treeSitterFileCount` + `treeSitterSymbolCount`; the orchestrator trips a `zeroSymbolGuardTripped` flag via the exported pure predicate `shouldTripZeroSymbolGuard` (≥5 tree-sitter files **and** 0 symbols), pushes a loud warning, and `analyze` maps it to a distinct **advisory exit code 3**. Configs-only / cobol-only / unsupported-language repos report 0 tree-sitter files and never trip; external `CodeElement` import stubs are excluded so an import-only repo can't mask a break. **#2 — Distinguish global parser death from per-file failure.** New `WasmRuntimeUnavailableError` (with `name` set so it survives Piscina's structured-clone across the worker boundary). `ensureWasmRuntime` now **throws** it when the vendored grammar dir is missing / `web-tree-sitter.wasm` won't init — a deployment breakage — instead of the old ambiguous soft `undefined` that collapsed into N identical per-file warnings. `openWasmParser` + `parseOne` rethrow; the parse phase aborts the run with an actionable message. Per-file errors (syntax, timeout, one missing grammar) still warn-and-skip. The "web-tree-sitter package genuinely absent" path stays a no-throw hand-off to #1. **#3 — Resolver drift-guard test.** Extended the `asset-resolver` drift guard to cover **all 5 shipped asset trees** (added `vendor/wasms` + `java` to plugin-assets / ci-templates / config). A future fixed-offset regression in any resolver now fails a test instead of shipping silently — codifies the audit that this session ran by hand. **#4 — tsup rm-before-copy.** `copyTree` now `rm`s each leaf dest before `cp`, so an incremental/watch rebuild can't accumulate renamed/deleted asset dirs in `dist/` (the stale `opencodehub-*` skill dirs from the rename PR). Safe against the nested-dest hazard — each `onSuccess` dest is a distinct leaf. **#5 — Verifier asserts a real symbol.** `verify-global-install.sh` now requires `codehub query 'Greet'` to return a `Function/Class/Method` row from `greeter.go` (a uniquely-cased Go func), replacing the weak "any hit on `export default`" gate — which **passed on the 0-symbol skeleton** because the stderr header alone satisfied "non-empty". ## Verification Against the built bundle: - **Happy path** → exit 0, 16 nodes / 24 edges, symbols extracted. - **`vendor/wasms` hidden** → run **ABORTS (exit 1)** with `Phase 'parse' failed: web-tree-sitter runtime failed to initialize; vendored grammar directory not found at <dir> (reinstall … or re-vendor …)`. **No skeleton graph persisted.** (Before this PR: silent exit 0 with a 5-node skeleton — the exact bug that hid #201.) The two parser fixes compose: #2 hard-aborts the runtime-death case before anything is written; #1's exit-3 guard is the backstop for the residual soft case (package genuinely absent → no throw but 0 symbols). Tests: ingestion **594/594**, cli **316 pass / 0 fail / 11 platform-skip**; typecheck + repo lint + banned-strings clean. New tests: `wasm-runtime.test.ts` (global-probe), `parse-worker.test.ts` (sentinel rethrow vs per-file warning), `orchestrator.test.ts` (predicate table + healthy-run no-trip), extended `asset-resolver.test.ts` drift guard. ## Notes - Adds advisory **exit code 3** to `analyze` (graph built, but zero code symbols). Documented in an `index.ts` comment; the happy path stays exit 0. - Pushing a warning does not affect `graphHash` (hash is over graph nodes/edges only) — the byte-identical-hash determinism test stays green. - Stacks cleanly on the merged resolver fix (#201) and the prefix rename (#203); no overlap. --------- Co-authored-by: T <t@example.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps ossf/scorecard-action from 2.4.0 to 2.4.3.
Release notes
Sourced from ossf/scorecard-action's releases.
Commits
4eaacf0bump docker to ghcr v2.4.3 (#1587)42e3a01🌱 Bump the github-actions group with 3 updates (#1585)88c07ac🌱 Bump github.com/sigstore/cosign/v2 from 2.5.2 to 2.6.0 (#1579)6c690f2Bump github.com/ossf/scorecard/v5 from v5.2.1 to v5.3.0 (#1586)92083b5📖 Fix recommended command to test the image in development (#1583)7975ea6🌱 Bump the docker-images group across 1 directory with 2 updates (#1...0d1a743🌱 Bump github.com/spf13/cobra from 1.9.1 to 1.10.1 (#1575)46e6e0c🌱 Bump the github-actions group with 2 updates (#1580)c3f1350🌱 Improve printing options (#1584)43e475b🌱 Bump golang.org/x/net from 0.42.0 to 0.44.0 (#1578)