Skip to content

build(deps): bump the actions group with 9 updates - #2750

Merged
jonahgabriel merged 3 commits into
devfrom
dependabot/github_actions/actions-7190022a1c
Oct 14, 2026
Merged

build(deps): bump the actions group with 9 updates#2750
jonahgabriel merged 3 commits into
devfrom
dependabot/github_actions/actions-7190022a1c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 14, 2026

Copy link
Copy Markdown
Contributor

Bumps the actions group with 9 updates:

Package From To
OmniNode-ai/omnibase_core/.github/workflows/receipt-gate.yml 4e4f5e0404d364e296c5d37db6aa3ab9e07f8ffa b05c7d6f6336659d4965123bbc78a5d5b8822d70
OmniNode-ai/omnimarket/.github/workflows/route-runner-reusable.yml 0.4.303 0.4.310
OmniNode-ai/omnibase_core/.github/actions/validate-boundaries de3398d1fcf7a6f48451f680b74b1a6c6c383b8a b05c7d6f6336659d4965123bbc78a5d5b8822d70
github/codeql-action 4.38.2 4.38.3
OmniNode-ai/omnibase_core/.github/workflows/validate-docs.yml 13ceae69c246a33c9fc8fc4b33f83fb66b89edc6 b05c7d6f6336659d4965123bbc78a5d5b8822d70
OmniNode-ai/omniclaude/.github/workflows/hardcoded-model-config-reusable.yml 3b8addff365b1a53e04106284b9275b6d5fad3c6 ed4300f8a427ead7f099daf69cedc012907cdbd3
OmniNode-ai/omnibase_core/.github/workflows/imperative-contract-guard.yml 70f7ceda44af968ccf26264ecd429cfd27503971 b05c7d6f6336659d4965123bbc78a5d5b8822d70
trufflesecurity/trufflehog 3.97.9 3.99.2
bridgecrewio/checkov-action 12.3128.0 12.3132.0

Updates OmniNode-ai/omnibase_core/.github/workflows/receipt-gate.yml from 4e4f5e0404d364e296c5d37db6aa3ab9e07f8ffa to b05c7d6f6336659d4965123bbc78a5d5b8822d70

Changelog

Sourced from OmniNode-ai/omnibase_core/.github/workflows/receipt-gate.yml's changelog.

v0.47.43 (2026-10-13)

Release

  • Cut omnibase-core from dev at 0.47.43 by the scheduled release train.
  • 1 release-relevant commit(s) merged since v0.47.42.
  • Opened by the release train, which cuts only when the repo's declared lab-evidence premise holds for the exact candidate commit.

Included Since v0.47.42

  • feat: add a no-legacy-handler flip path to the canonical handler-shape ratchet (#1963)

v0.47.42 (2026-10-12)

Release

  • Cut omnibase-core from dev at 0.47.42 by the scheduled release train.
  • 3 release-relevant commit(s) merged since v0.47.41.
  • Opened by the release train, which cuts only when the repo's declared lab-evidence premise holds for the exact candidate commit.

Included Since v0.47.41

  • feat: a delegation request carries the lab host it was sent from, so the router can spend only that host's own key (#1958)
  • feat: retire the skip-token approvals registry; the receipt gate rejects every skip token (#1953)
  • feat: canonical-file-shape reads the allowlist-path a caller passes to omnibase_core's imperative contract guard (#1949)

v0.47.41 (2026-10-11)

Release

  • Cut omnibase-core from dev at 0.47.41 by the scheduled release train.
  • 5 release-relevant commit(s) merged since v0.47.39.
  • Opened by the release train, which cuts only when the repo's declared lab-evidence premise holds for the exact candidate commit.

Included Since v0.47.39

  • feat: move the imperative contract guard into omnibase_core with a shrink-only allowlist ratchet (#1946)
  • feat: move the no-bare-feature-flags hook from onex_change_control into omnibase_core (#1936)
  • feat: move the arch-handler-contract-compliance validator from onex_change_control into omnibase_core (#1941)
  • feat: move the cosmetic-lint hook from onex_change_control into omnibase_core (#1938)
  • fix: read every acceptance criteria section (#1937)

v0.47.39 (2026-10-10)

Release

  • Cut omnibase-core from dev at 0.47.39 by the scheduled release train.
  • 2 release-relevant commit(s) merged since v0.47.38.
  • Opened by the release train, which cuts only when the repo's declared lab-evidence premise holds for the exact candidate commit.

Included Since v0.47.38

  • feat: add binds_ac label and check type validators (#1935)
  • feat: move the no-hardcoded-topics hook from onex_change_control into omnibase_core (#1933)

v0.47.38 (2026-10-10)

Release

... (truncated)

Commits
  • b05c7d6 ci(OMN-20780): warn on a push to main through a main-target-guard pre-push ho...
  • 27417d9 chore(OMN-20074): delete the deploy gate reusable no caller uses (S9) (#1970)
  • ffda26d fix(OMN-14355): require only Evidence-Ticket in release resolve step (#1968)
  • 4178906 build(OMN-20074): drop the unused onex_change_control dev dependency (#1967)
  • d677b4e chore: release omnibase_core 0.47.43 (OMN-18595) (#1965)
  • 70f7ced feat(OMN-21075): admit the onboarding script as a VENDOR_DEFAULT file in the ...
  • e06f904 ci(OMN-20068): add named step for writer pin-only verdict tests (#1964)
  • db47fe8 feat(OMN-20298): add a no-legacy-handler flip path to the canonical handler-s...
  • 483fc46 ci(OMN-20068): wire the writer pin-only verdict tests as a pre-commit hook (#...
  • 1c58f98 ci(OMN-20068): admit pin-swap-only diffs in writer_pin_only (#1961)
  • Additional commits viewable in compare view

Updates OmniNode-ai/omnimarket/.github/workflows/route-runner-reusable.yml from 0.4.303 to 0.4.310

Release notes

Sourced from OmniNode-ai/omnimarket/.github/workflows/route-runner-reusable.yml's releases.

v0.4.310

What's Changed

Full Changelog: OmniNode-ai/omnimarket@v0.4.309...v0.4.310

... (truncated)

Commits
  • 5e67c93 ci(OMN-20910): the Hostile Reviewer reads its voters from the contract overla...
  • aceefca feat(OMN-20885): host the pr-title check-title decision as node_pr_title_chec...
  • 7edc88f fix(OMN-20074): parse hand-authored OCC companion evidence ids (#3738)
  • a9d39a8 feat(OMN-20915): add PR triage reads to the omnimarket GitHub transport (#3735)
  • 8edc4de feat(OMN-20912): PR authoring write effect with claim and quota guards (#3729)
  • c6c75a9 fix(OMN-20945): node_dod_verify refuses a contract YAML with a duplicate mapp...
  • 2515380 feat(OMN-20912): typed gateway reads for Actions, PR text and releases (#3728)
  • eb5b311 test(OMN-20938): record OCC supersession verdicts and diff the runner against...
  • 0fa6457 fix(OMN-20867): no tick-schedule window is lost to jitter, and a tick dead-le...
  • 82bf5c6 feat(OMN-20750): a green, armed PR gone DIRTY gets one conflict request from ...
  • Additional commits viewable in compare view

Updates OmniNode-ai/omnibase_core/.github/actions/validate-boundaries from de3398d1fcf7a6f48451f680b74b1a6c6c383b8a to b05c7d6f6336659d4965123bbc78a5d5b8822d70

Changelog

Sourced from OmniNode-ai/omnibase_core/.github/actions/validate-boundaries's changelog.

v0.47.43 (2026-10-13)

Release

  • Cut omnibase-core from dev at 0.47.43 by the scheduled release train.
  • 1 release-relevant commit(s) merged since v0.47.42.
  • Opened by the release train, which cuts only when the repo's declared lab-evidence premise holds for the exact candidate commit.

Included Since v0.47.42

  • feat: add a no-legacy-handler flip path to the canonical handler-shape ratchet (#1963)

v0.47.42 (2026-10-12)

Release

  • Cut omnibase-core from dev at 0.47.42 by the scheduled release train.
  • 3 release-relevant commit(s) merged since v0.47.41.
  • Opened by the release train, which cuts only when the repo's declared lab-evidence premise holds for the exact candidate commit.

Included Since v0.47.41

  • feat: a delegation request carries the lab host it was sent from, so the router can spend only that host's own key (#1958)
  • feat: retire the skip-token approvals registry; the receipt gate rejects every skip token (#1953)
  • feat: canonical-file-shape reads the allowlist-path a caller passes to omnibase_core's imperative contract guard (#1949)

v0.47.41 (2026-10-11)

Release

  • Cut omnibase-core from dev at 0.47.41 by the scheduled release train.
  • 5 release-relevant commit(s) merged since v0.47.39.
  • Opened by the release train, which cuts only when the repo's declared lab-evidence premise holds for the exact candidate commit.

Included Since v0.47.39

  • feat: move the imperative contract guard into omnibase_core with a shrink-only allowlist ratchet (#1946)
  • feat: move the no-bare-feature-flags hook from onex_change_control into omnibase_core (#1936)
  • feat: move the arch-handler-contract-compliance validator from onex_change_control into omnibase_core (#1941)
  • feat: move the cosmetic-lint hook from onex_change_control into omnibase_core (#1938)
  • fix: read every acceptance criteria section (#1937)

v0.47.39 (2026-10-10)

Release

  • Cut omnibase-core from dev at 0.47.39 by the scheduled release train.
  • 2 release-relevant commit(s) merged since v0.47.38.
  • Opened by the release train, which cuts only when the repo's declared lab-evidence premise holds for the exact candidate commit.

Included Since v0.47.38

  • feat: add binds_ac label and check type validators (#1935)
  • feat: move the no-hardcoded-topics hook from onex_change_control into omnibase_core (#1933)

v0.47.38 (2026-10-10)

Release

... (truncated)

Commits
  • b05c7d6 ci(OMN-20780): warn on a push to main through a main-target-guard pre-push ho...
  • 27417d9 chore(OMN-20074): delete the deploy gate reusable no caller uses (S9) (#1970)
  • ffda26d fix(OMN-14355): require only Evidence-Ticket in release resolve step (#1968)
  • 4178906 build(OMN-20074): drop the unused onex_change_control dev dependency (#1967)
  • d677b4e chore: release omnibase_core 0.47.43 (OMN-18595) (#1965)
  • 70f7ced feat(OMN-21075): admit the onboarding script as a VENDOR_DEFAULT file in the ...
  • e06f904 ci(OMN-20068): add named step for writer pin-only verdict tests (#1964)
  • db47fe8 feat(OMN-20298): add a no-legacy-handler flip path to the canonical handler-s...
  • 483fc46 ci(OMN-20068): wire the writer pin-only verdict tests as a pre-commit hook (#...
  • 1c58f98 ci(OMN-20068): admit pin-swap-only diffs in writer_pin_only (#1961)
  • Additional commits viewable in compare view

Updates github/codeql-action from 4.38.2 to 4.38.3

Release notes

Sourced from github/codeql-action's releases.

v4.38.3

  • Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
  • Update default CodeQL bundle version to 2.27.2. #4203
  • Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184
Changelog

Sourced from github/codeql-action's changelog.

4.38.3 - 08 Oct 2026

  • Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
  • Update default CodeQL bundle version to 2.27.2. #4203
  • Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184
Commits
  • 24c5418 Merge pull request #4214 from github/update-v4.38.3-e0b52dbdc
  • 69e87c5 Add changelog note for #4184
  • 23b6828 Update changelog for v4.38.3
  • e0b52db Merge pull request #4210 from github/henrymercer/pin-python-for-older-clis-in-ci
  • 6b99698 Pin Python 3.13.15 for older CLI versions in multi-language check
  • 63d3d63 Merge pull request #4203 from github/update-bundle/codeql-bundle-v2.27.2
  • 7377a10 Add changelog note
  • c1a30cd Update default bundle to codeql-bundle-v2.27.2
  • d208ec7 Merge pull request #4200 from github/mbg/esm/migrate-pr-checks
  • a71b0c6 Replace __dirname in sync.ts
  • Additional commits viewable in compare view

Updates OmniNode-ai/omnibase_core/.github/workflows/validate-docs.yml from 13ceae69c246a33c9fc8fc4b33f83fb66b89edc6 to b05c7d6f6336659d4965123bbc78a5d5b8822d70

Changelog

Sourced from OmniNode-ai/omnibase_core/.github/workflows/validate-docs.yml's changelog.

v0.47.43 (2026-10-13)

Release

  • Cut omnibase-core from dev at 0.47.43 by the scheduled release train.
  • 1 release-relevant commit(s) merged since v0.47.42.
  • Opened by the release train, which cuts only when the repo's declared lab-evidence premise holds for the exact candidate commit.

Included Since v0.47.42

  • feat: add a no-legacy-handler flip path to the canonical handler-shape ratchet (#1963)

v0.47.42 (2026-10-12)

Release

  • Cut omnibase-core from dev at 0.47.42 by the scheduled release train.
  • 3 release-relevant commit(s) merged since v0.47.41.
  • Opened by the release train, which cuts only when the repo's declared lab-evidence premise holds for the exact candidate commit.

Included Since v0.47.41

  • feat: a delegation request carries the lab host it was sent from, so the router can spend only that host's own key (#1958)
  • feat: retire the skip-token approvals registry; the receipt gate rejects every skip token (#1953)
  • feat: canonical-file-shape reads the allowlist-path a caller passes to omnibase_core's imperative contract guard (#1949)

v0.47.41 (2026-10-11)

Release

  • Cut omnibase-core from dev at 0.47.41 by the scheduled release train.
  • 5 release-relevant commit(s) merged since v0.47.39.
  • Opened by the release train, which cuts only when the repo's declared lab-evidence premise holds for the exact candidate commit.

Included Since v0.47.39

  • feat: move the imperative contract guard into omnibase_core with a shrink-only allowlist ratchet (#1946)
  • feat: move the no-bare-feature-flags hook from onex_change_control into omnibase_core (#1936)
  • feat: move the arch-handler-contract-compliance validator from onex_change_control into omnibase_core (#1941)
  • feat: move the cosmetic-lint hook from onex_change_control into omnibase_core (#1938)
  • fix: read every acceptance criteria section (#1937)

v0.47.39 (2026-10-10)

Release

  • Cut omnibase-core from dev at 0.47.39 by the scheduled release train.
  • 2 release-relevant commit(s) merged since v0.47.38.
  • Opened by the release train, which cuts only when the repo's declared lab-evidence premise holds for the exact candidate commit.

Included Since v0.47.38

  • feat: add binds_ac label and check type validators (#1935)
  • feat: move the no-hardcoded-topics hook from onex_change_control into omnibase_core (#1933)

v0.47.38 (2026-10-10)

Release

... (truncated)

Commits
  • b05c7d6 ci(OMN-20780): warn on a push to main through a main-target-guard pre-push ho...
  • 27417d9 chore(OMN-20074): delete the deploy gate reusable no caller uses (S9) (#1970)
  • ffda26d fix(OMN-14355): require only Evidence-Ticket in release resolve step (#1968)
  • 4178906 build(OMN-20074): drop the unused onex_change_control dev dependency (#1967)
  • d677b4e chore: release omnibase_core 0.47.43 (OMN-18595) (#1965)
  • 70f7ced feat(OMN-21075): admit the onboarding script as a VENDOR_DEFAULT file in the ...
  • e06f904 ci(OMN-20068): add named step for writer pin-only verdict tests (#1964)
  • db47fe8 feat(OMN-20298): add a no-legacy-handler flip path to the canonical handler-s...
  • 483fc46 ci(OMN-20068): wire the writer pin-only verdict tests as a pre-commit hook (#...
  • 1c58f98 ci(OMN-20068): admit pin-swap-only diffs in writer_pin_only (#1961)
  • Additional commits viewable in compare view

Updates OmniNode-ai/omniclaude/.github/workflows/hardcoded-model-config-reusable.yml from 3b8addf to ed4300f

Changelog

Sourced from OmniNode-ai/omniclaude/.github/workflows/hardcoded-model-config-reusable.yml's changelog.

v0.27.0 (2026-10-01)

Features

  • feat(OMN-20285): the status line PR segment is an optional bounded local extension; the launcher resolves the enabled onex plugin (#2460)
  • feat(OMN-20031): the Bash capture stamps goal_id on the one event that opens a goal (#2451)
  • feat(OMN-17099): onboarding containers run the developer's model and key; phase 5 stops reading as proof the key was used (#2449)
  • feat(OMN-20150): developers bring their own model key; it is settled before anything installs (#2448)
  • feat(OMN-20150): one command takes a Mac from bare to lab-ready (#2442)
  • feat(OMN-16913): a change under plugins/onex needs a plugin version bump; bump onex to 2.4.0 (#2435)
  • feat(OMN-20010): subagent hook lineage carries the sidecar model, description and workflow phase (#2405)
  • feat(OMN-19965): the delegate plugin ships exactly one skill and documents its permission rule (#2408)
  • feat(OMN-19513): every Claude Code hook journals a lineage-carrying hook.event; SessionEnd hooks survive headless cancellation (#2371)
  • feat(OMN-19551): hooks journal the full prompt, tool input, tool result and assistant reply through the redaction contract (#2343)
  • feat(OMN-19513): all-hooks capture contract and mock seam: 33 hook types, lineage, subagent spans (#2370)
  • feat(OMN-13856): PreToolUse hook refuses an agent-posted Linear comment with no actor line (#2353)
  • feat(OMN-19479): gh user shim caches the harness PR-link lookup; statusline refreshes every 900 s under one lock (#2349)
  • feat(OMN-19607): a PR merge fast-forwards the matching canonical clones, and a launchd timer catches merges made elsewhere (#2346)
  • feat(OMN-19399): opt-in open-pull-request fence for the unattended worktree prune (#2328)
  • feat(OMN-19246): every overlay-configured skill resolves ONEX_SKILL_OVERLAY_ROOTS (#2318)
  • feat(OMN-18874): refuse a path-scoped restore over uncommitted work (#2316)
  • feat(OMN-18530): the hook inventory gate reports a gate-shaped script declared nowhere (#2295)
  • feat(OMN-18946): give a hook refusal a durable, aggregated home (#2293)
  • feat(OMN-18948): the session-start surface prints the sixth dropped-work key (#2291)
  • feat(OMN-18961): the session-start goal surface announces a pending tick re-fire (#2289)
  • feat(OMN-18954): the session-start goal surface prints the four dropped-work counts and the cause behind a stale goal (#2288)
  • feat(OMN-18798): allow the ruled publish-loop merge, refuse branch creation, fix the mask test (#2277)
  • feat(OMN-18798): refuse force pushes and ledger-path checkouts in the shared clone (#2276)
  • feat(OMN-18798): refuse tree-moving git commands in the shared registry clone (#2274)

Bug Fixes

  • fix(OMN-20110): a journalled hook emit returns at once and is reported as journalled, not NOT recorded (#2470)
  • fix(OMN-19626): route hook ledger callers through packaged writer (#2463)
  • fix(OMN-20110): the hook capture finds a workflow agent's sidecar without listing every run (#2461)
  • fix(OMN-17427): rename local to 'expanded' in hook_refusal_lane (#2457)
  • fix(OMN-20262): lane identity reads ONEX_LANE and the pr-close refusal prints an absolute CLI path (#2454)
  • fix(OMN-20201): 105 orchestrator contracts declare runtime_profiles [main] and leave the runtime-profiles allowlist (#2450)
  • fix(OMN-19381): a hook refusal row names the lane from the payload sidecar, lane env, CLAIM or worktree path (#2452)
  • fix(OMN-20184): runtime profiles run inside CI Summary, the canonical-inference growth check fails closed, and the delegation smoke test runs (#2447)
  • fix(OMN-17427): the ticket-creation gate admits only a no-project create and the ticket skills create in Backlog (#2441)
  • fix(OMN-20110): a workflow agent's hook emit no longer globs every project directory (#2436)
  • fix(OMN-17427): pr_body_stamp_guard admits dropping a stamp when the one that stays names a merged companion (#2422)
  • fix(OMN-17427): narrow three guard matchers that refused valid commands (#2421)
  • fix(OMN-20109): hook alarms resolve their Slack credential and fail loud when they cannot deliver (#2420)
  • fix(OMN-20110): hook emits are O(1), bounded and fail loud with one operator alarm per episode (#2417)
  • fix(OMN-19852): the shared-tree git guard reads the command's own effective directory (assigned variables, subshell and brace groups, --work-tree) (#2411)
  • fix(OMN-19513): activate hook.event capture, the dev-lane produce grant is live so the lane contract stops holding it back (#2410)
  • fix(OMN-19913): a broker-refused event class pays the dead-letter threshold once, not once per record (#2396)
  • fix(OMN-19820): the plugin hooks.json description names no private repository, internal knowledge-base prose, lab configuration or person (#2376)
  • fix(OMN-16986): plugin_deploy_readback resolves the enabled onex plugin instead of a hardcoded default (#2365)
  • fix(OMN-19696): claim release refuses a live claim held by a different lane under a shared run id (#2364)

... (truncated)

Commits
  • ed4300f perf(OMN-17427): speed up the three slowest pre-commit hooks (#2743)
  • a643806 fix(OMN-20074): map flat unit test changes to tests/unit/ in detect_test_path...
  • c220999 chore(deps): bump omnibase_infra to 0.38.72 (#2744)
  • 9fd83b1 ci(OMN-20780): warn on a push to main through a main-target-guard pre-push ho...
  • 89997e4 ci(OMN-17427): pin omninode-intelligence to 3fcbf795 (8192-token retry) (#2740)
  • f9d7f75 chore(deps): bump omnibase_core to 0.47.43 (#2741)
  • 0f169f1 chore(ci): bump omnibase_core pin to d677b4e78219 [bot] [OMN-9050] (#2742)
  • 72c80bd feat(OMN-17427): private-repo-runner-placement reads a dated variables snapsh...
  • bf988a0 chore(deps, OMN-13902): refresh omninode sibling locks [bot] (#2731)
  • f1ae4c6 chore(OMN-20710): post-merge plugin version bump (#2736)
  • Additional commits viewable in compare view

Updates OmniNode-ai/omnibase_core/.github/workflows/imperative-contract-guard.yml from 70f7ceda44af968ccf26264ecd429cfd27503971 to b05c7d6f6336659d4965123bbc78a5d5b8822d70

Changelog

Sourced from OmniNode-ai/omnibase_core/.github/workflows/imperative-contract-guard.yml's changelog.

v0.47.43 (2026-10-13)

Release

  • Cut omnibase-core from dev at 0.47.43 by the scheduled release train.
  • 1 release-relevant commit(s) merged since v0.47.42.
  • Opened by the release train, which cuts only when the repo's declared lab-evidence premise holds for the exact candidate commit.

Included Since v0.47.42

  • feat: add a no-legacy-handler flip path to the canonical handler-shape ratchet (#1963)

v0.47.42 (2026-10-12)

Release

  • Cut omnibase-core from dev at 0.47.42 by the scheduled release train.
  • 3 release-relevant commit(s) merged since v0.47.41.
  • Opened by the release train, which cuts only when the repo's declared lab-evidence premise holds for the exact candidate commit.

Included Since v0.47.41

  • feat: a delegation request carries the lab host it was sent from, so the router can spend only that host's own key (#1958)
  • feat: retire the skip-token approvals registry; the receipt gate rejects every skip token (#1953)
  • feat: canonical-file-shape reads the allowlist-path a caller passes to omnibase_core's imperative contract guard (#1949)

v0.47.41 (2026-10-11)

Release

  • Cut omnibase-core from dev at 0.47.41 by the scheduled release train.
  • 5 release-relevant commit(s) merged since v0.47.39.
  • Opened by the release train, which cuts only when the repo's declared lab-evidence premise holds for the exact candidate commit.

Included Since v0.47.39

  • feat: move the imperative contract guard into omnibase_core with a shrink-only allowlist ratchet (#1946)
  • feat: move the no-bare-feature-flags hook from onex_change_control into omnibase_core (#1936)
  • feat: move the arch-handler-contract-compliance validator from onex_change_control into omnibase_core (#1941)
  • feat: move the cosmetic-lint hook from onex_change_control into omnibase_core (#1938)
  • fix: read every acceptance criteria section (#1937)

v0.47.39 (2026-10-10)

Release

  • Cut omnibase-core from dev at 0.47.39 by the scheduled release train.
  • 2 release-relevant commit(s) merged since v0.47.38.
  • Opened by the release train, which cuts only when the repo's declared lab-evidence premise holds for the exact candidate commit.

Included Since v0.47.38

  • feat: add binds_ac label and check type validators (#1935)
  • feat: move the no-hardcoded-topics hook from onex_change_control into omnibase_core (#1933)

v0.47.38 (2026-10-10)

Release

... (truncated)

Commits
  • b05c7d6 ci(OMN-20780): warn on a push to main through a main-target-guard pre-push ho...
  • 27417d9 chore(OMN-20074): delete the deploy gate reusable no caller uses (S9) (#1970)
  • ffda26d fix(OMN-14355): require only Evidence-Ticket in release resolve step (#1968)
  • 4178906 build(OMN-20074): drop the unused onex_change_control dev dependency (#1967)
  • d677b4e chore: release omnibase_core 0.47.43 (OMN-18595) (#1965)
  • See full diff in compare view

Updates trufflesecurity/trufflehog from 3.97.9 to 3.99.2

Release notes

Sourced from trufflesecurity/trufflehog's releases.

v3.99.2

What's Changed

Full Changelog: trufflesecurity/trufflehog@v3.99.1...v3.99.2

v3.99.1

What's Changed

Full Changelog: trufflesecurity/trufflehog@v3.99.0...v3.99.1

v3.99.0

What's Changed

Full Changelog: trufflesecurity/trufflehog@v3.98.1...v3.99.0

v3.98.1

What's Changed

New Contributors

Full Changelog: trufflesecurity/trufflehog@v3.98.0...v3.98.1

v3.98.0

What's Changed

@dependabot
build(deps): bump the actions group with 9 updates
3033859 
Bumps the actions group with 9 updates:

| Package | From | To |
| --- | --- | --- |
| [OmniNode-ai/omnibase_core/.github/workflows/receipt-gate.yml](https://github.com/omninode-ai/omnibase_core) | `4e4f5e0404d364e296c5d37db6aa3ab9e07f8ffa` | `b05c7d6f6336659d4965123bbc78a5d5b8822d70` |
| [OmniNode-ai/omnimarket/.github/workflows/route-runner-reusable.yml](https://github.com/omninode-ai/omnimarket) | `0.4.303` | `0.4.310` |
| [OmniNode-ai/omnibase_core/.github/actions/validate-boundaries](https://github.com/omninode-ai/omnibase_core) | `de3398d1fcf7a6f48451f680b74b1a6c6c383b8a` | `b05c7d6f6336659d4965123bbc78a5d5b8822d70` |
| [github/codeql-action](https://github.com/github/codeql-action) | `4.38.2` | `4.38.3` |
| [OmniNode-ai/omnibase_core/.github/workflows/validate-docs.yml](https://github.com/omninode-ai/omnibase_core) | `13ceae69c246a33c9fc8fc4b33f83fb66b89edc6` | `b05c7d6f6336659d4965123bbc78a5d5b8822d70` |
| [OmniNode-ai/omniclaude/.github/workflows/hardcoded-model-config-reusable.yml](https://github.com/omninode-ai/omniclaude) | `3b8addff365b1a53e04106284b9275b6d5fad3c6` | `ed4300f8a427ead7f099daf69cedc012907cdbd3` |
| [OmniNode-ai/omnibase_core/.github/workflows/imperative-contract-guard.yml](https://github.com/omninode-ai/omnibase_core) | `70f7ceda44af968ccf26264ecd429cfd27503971` | `b05c7d6f6336659d4965123bbc78a5d5b8822d70` |
| [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) | `3.97.9` | `3.99.2` |
| [bridgecrewio/checkov-action](https://github.com/bridgecrewio/checkov-action) | `12.3128.0` | `12.3132.0` |


Updates `OmniNode-ai/omnibase_core/.github/workflows/receipt-gate.yml` from 4e4f5e0404d364e296c5d37db6aa3ab9e07f8ffa to b05c7d6f6336659d4965123bbc78a5d5b8822d70
- [Release notes](https://github.com/omninode-ai/omnibase_core/releases)
- [Changelog](https://github.com/OmniNode-ai/omnibase_core/blob/dev/CHANGELOG.md)
- [Commits](OmniNode-ai/omnibase_core@4e4f5e0...b05c7d6)

Updates `OmniNode-ai/omnimarket/.github/workflows/route-runner-reusable.yml` from 0.4.303 to 0.4.310
- [Release notes](https://github.com/omninode-ai/omnimarket/releases)
- [Changelog](https://github.com/OmniNode-ai/omnimarket/blob/dev/CHANGELOG.md)
- [Commits](OmniNode-ai/omnimarket@01a0d1b...5e67c93)

Updates `OmniNode-ai/omnibase_core/.github/actions/validate-boundaries` from de3398d1fcf7a6f48451f680b74b1a6c6c383b8a to b05c7d6f6336659d4965123bbc78a5d5b8822d70
- [Release notes](https://github.com/omninode-ai/omnibase_core/releases)
- [Changelog](https://github.com/OmniNode-ai/omnibase_core/blob/dev/CHANGELOG.md)
- [Commits](OmniNode-ai/omnibase_core@de3398d...b05c7d6)

Updates `github/codeql-action` from 4.38.2 to 4.38.3
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@v4.38.2...v4.38.3)

Updates `OmniNode-ai/omnibase_core/.github/workflows/validate-docs.yml` from 13ceae69c246a33c9fc8fc4b33f83fb66b89edc6 to b05c7d6f6336659d4965123bbc78a5d5b8822d70
- [Release notes](https://github.com/omninode-ai/omnibase_core/releases)
- [Changelog](https://github.com/OmniNode-ai/omnibase_core/blob/dev/CHANGELOG.md)
- [Commits](OmniNode-ai/omnibase_core@13ceae6...b05c7d6)

Updates `OmniNode-ai/omniclaude/.github/workflows/hardcoded-model-config-reusable.yml` from 3b8addf to ed4300f
- [Release notes](https://github.com/omninode-ai/omniclaude/releases)
- [Changelog](https://github.com/OmniNode-ai/omniclaude/blob/dev/CHANGELOG.md)
- [Commits](3b8addf...ed4300f)

Updates `OmniNode-ai/omnibase_core/.github/workflows/imperative-contract-guard.yml` from 70f7ceda44af968ccf26264ecd429cfd27503971 to b05c7d6f6336659d4965123bbc78a5d5b8822d70
- [Release notes](https://github.com/omninode-ai/omnibase_core/releases)
- [Changelog](https://github.com/OmniNode-ai/omnibase_core/blob/dev/CHANGELOG.md)
- [Commits](OmniNode-ai/omnibase_core@70f7ced...b05c7d6)

Updates `trufflesecurity/trufflehog` from 3.97.9 to 3.99.2
- [Release notes](https://github.com/trufflesecurity/trufflehog/releases)
- [Commits](trufflesecurity/trufflehog@4dd8831...e76dff8)

Updates `bridgecrewio/checkov-action` from 12.3128.0 to 12.3132.0
- [Release notes](https://github.com/bridgecrewio/checkov-action/releases)
- [Commits](bridgecrewio/checkov-action@cc0e17d...d0dd2e9)

---
updated-dependencies:
- dependency-name: OmniNode-ai/omnibase_core/.github/workflows/receipt-gate.yml
  dependency-version: b05c7d6f6336659d4965123bbc78a5d5b8822d70
  dependency-type: direct:production
  dependency-group: actions
- dependency-name: OmniNode-ai/omnimarket/.github/workflows/route-runner-reusable.yml
  dependency-version: 0.4.310
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: OmniNode-ai/omnibase_core/.github/actions/validate-boundaries
  dependency-version: b05c7d6f6336659d4965123bbc78a5d5b8822d70
  dependency-type: direct:production
  dependency-group: actions
- dependency-name: github/codeql-action
  dependency-version: 4.38.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: OmniNode-ai/omnibase_core/.github/workflows/validate-docs.yml
  dependency-version: b05c7d6f6336659d4965123bbc78a5d5b8822d70
  dependency-type: direct:production
  dependency-group: actions
- dependency-name: OmniNode-ai/omniclaude/.github/workflows/hardcoded-model-config-reusable.yml
  dependency-version: ed4300f
  dependency-type: direct:production
  dependency-group: actions
- dependency-name: OmniNode-ai/omnibase_core/.github/workflows/imperative-contract-guard.yml
  dependency-version: b05c7d6f6336659d4965123bbc78a5d5b8822d70
  dependency-type: direct:production
  dependency-group: actions
- dependency-name: trufflesecurity/trufflehog
  dependency-version: 3.99.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: bridgecrewio/checkov-action
  dependency-version: 12.3132.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 14, 2026
@github-actions

github-actions Bot commented Oct 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

✅ Hostile Reviewer — PASSED

Blocking findings (critical/error): 0
Total findings: 9
Models succeeded: correctness,security-contracts

Findings

Severity Location Finding
warning .github/workflows/security-scan.yml:1 ai-reviewer:correctness:security TruffleHog pin moved to a commit that may not be a released tag | The diff updates trufflesecurity/trufflehog from 4dd8831c5f12599465d4d45c3c447b4018a34c85 (v3.97.1) to e76dff8a7e57d6df0c60ad8cbf5d5cba505a8fc9 (v3.99.2). The comment claims v3.99.2, but the pin is a raw commit SHA. If that SHA is a pre-release or dev commit rather than the actual v3.99.2 tag, the scanner version in CI will not match the documented version, and the exclude-detectors comment (which references upstream PR 5188) may be based on
warning .github/workflows/security-scan.yml:1 ai-reviewer:correctness:security Checkov pin moved to a commit that may not be a released tag | The diff updates bridgecrewio/checkov-action from cc0e17d456ef1713bbfd963ebac19dc776775cb2 (v12.3121.0) to d0dd2e9434b4428060edba72d050c135273bd677 (v12.3132.0). Same concern as TruffleHog: the comment asserts a specific version, but the pin is a raw SHA. If the SHA does not correspond to the v12.3132.0 release tag, the IaC scanner version in CI will silently diverge from the documented version, and any new check IDs or false-positive behavior i
warning .github/workflows/security-scan.yml, .github/workflows/ci.yml:1 ai-reviewer:correctness:security CodeQL action bumped to v4.38.3 across four workflow files | github/codeql-action is bumped from v4.38.2 to v4.38.3 in ci.yml, security-scan.yml (init, autobuild, analyze, upload-sarif). The v4.38.2 to v4.38.3 delta is a patch release, but CodeQL patch releases can change query results, add new alerts, or alter SARIF output format. The diff does not include any test or verification that the new version does not introduce new findings that would break the CI gate (e.g., new security-and-quality queries produ
warning .github/workflows/ci.yml, .github/workflows/docs-validate.yml:1 ai-reviewer:correctness:security omnibase_core reusable workflow and action pins moved to same commit | Both the validate-boundaries action and the validate-docs reusable workflow in omnibase_core are moved from different SHAs to the same new SHA b05c7d6f6336659d4965123bbc78a5d5b8822d70. This implies a single omnibase_core release that updated both. The diff does not document what changed in that commit. If the boundary-parity check logic changed, the CI gate behavior for boundary validation may have shifted, and the docs validation may no
warning .github/workflows/ci.yml:1 ai-reviewer:correctness:security omnimarket route-runner-reusable workflow pin bumped without changelog | The route-runner-reusable.yml pin in ci.yml moves from 01a0d1b3e7d7ba1a09012f9af245ba29afa000b5 to 5e67c9348a434e2b60b19b6f4b103f0ad4409945. This is a reusable workflow that orchestrates runner routing. A change in routing logic could alter which runners execute jobs, potentially moving sensitive jobs to less-trusted runners or changing concurrency behavior. The diff provides no context for what changed. | Evidence: uses: OmniNode-ai/o
warning .github/workflows/hardcoded-model-config.yml:1 ai-reviewer:correctness:security omniclaude hardcoded-model-config reusable workflow pin bumped | The hardcoded-model-config-reusable.yml pin moves from 3b8addf to ed4300f. This workflow checks for hardcoded model configurations. A change in detection logic could cause false positives or false negatives in the model config audit. The diff does not document the behavioral change. | Evidence: uses: OmniNode-ai/omniclaude/.github/workflows/hardcoded-model-config-reusable.yml@ed
info .github/workflows/security-scan.yml, .github/workflows/ci.yml, .github/workflows/docs-validate.yml, .github/workflows/hardcoded-model-config.yml:1 ai-reviewer:correctness:completeness No changelog or release notes referenced for any pin bump | The diff bumps seven external action/workflow pins across four workflow files. None of the bumps include a reference to the upstream PR, release notes, or commit message that justifies the change. This makes it impossible for a reviewer to assess the risk of each bump without manually inspecting the upstream repository. For security scanners (TruffleHog, Checkov, CodeQL), the absence of a changelog reference is a gap in the supply-chain review proc
error .github/workflows/ci.yml, .github/workflows/security-scan.yml:1 ai-reviewer:security-contracts:security Unpinned GitHub Actions tag reference | The diff changes the uses: reference for github/codeql-action/upload-sarif (and the other codeql actions) from @v4.38.2 to @v4.38.3. Both references are tags, not commit SHAs. A tag reference can be moved or reassigned by the action owner, allowing an attacker who compromises the tag to inject malicious code into the CI pipeline. The secure form requires a full 40-character commit SHA. | Evidence: uses: github/codeql-action/upload-sarif@v4.38.3 | Fix: Replace
warning .github/workflows/security-scan.yml:1 ai-reviewer:security-contracts:security TruffleHog version jump without changelog review | TruffleHog is bumped from v3.97.1 to v3.99.2, a minor version jump spanning multiple releases. The comment notes a known false-positive issue with the Lob detector in v3.95.9+ and references an upstream PR (5188) that has not been released. The diff does not document whether the v3.99.2 release resolved the Lob detector issue or introduced new detector behaviors that could alter scan results or performance. A jump of this magnitude in a security-critical to

Gate semantics (pilot phase)

Verdict Meaning Blocks merge?
passed No critical/error findings No
blocked CRITICAL or ERROR findings found Yes
degraded Reviewer ran but every model failed mid-run No (pilot)
infra_error cli_review failed to run at all (install/crash) after 2 attempts Yes
unavailable_fork_isolation Fork PR — the LAN-only model is unreachable and the fleet is off limits Yes

Powered by omniintelligence.review_pairing.cli_review — node-based adversarial review via HandlerLlmCliSubprocess (OMN-8524)

jonahgabriel and others added 2 commits October 14, 2026 12:58
@jonahgabriel
chore(deps): correct version comments in security-scan.yml
881556d 
Dependabot bumped trufflehog to v3.99.2 and checkov-action to v12.3132.0, but trailing comments still read v3.97.1 and v12.3121.0. This commit updates those three comments to v3.99.2 and v12.3132.0 pinned 2026-10-14. No pin SHA changed. CI on the Dependabot head failed at actions/create-github-app-token because Dependabot-triggered runs receive no Actions secrets (ONEXBOT_APP_ID empty) in Pre-commit Suite (OMN-19612) and Hostile Reviewer; a commit from a non-Dependabot actor lets the next run receive them.
@jonahgabriel
fix(deps): revert receipt-gate and guard pins to base values
dad941f 
Revert omnibase_core receipt-gate.yml from b05c7d6f6336659d4965123bbc78a5d5b8822d70 to 4e4f5e0404d364e296c5d37db6aa3ab9e07f8ffa and imperative-contract-guard.yml from b05c7d6f6336659d4965123bbc78a5d5b8822d70 to 70f7ceda44af968ccf26264ecd429cfd27503971.

Dependabot PR omniclaude#2750 bumped these pins. Both pins are locked by tests: tests/ci/test_repo_evidence_caller_workflow.py and tests/ci/test_repo_evidence_occ_comparison_off_omn20975.py require receipt-gate at 4e4f5e04; tests/ci/test_imperative_contract_guard_caller_omn21006.py requires the guard pin to equal the pre-commit canonical-file-shape rev and ci.yml CANONICAL_FILE_SHAPE_CORE (70f7ceda).

Six tests failed in Tests (Split 1/2), Pre-commit Suite and Refusal Surface. This commit reverts those two pins to their base values in call-repo-evidence-gate.yml and imperative-contract-guard.yml; the other seven bumps stay. The three test files pass locally (22 passed).
@jonahgabriel
jonahgabriel added this pull request to the merge queue Oct 14, 2026
Merged via the queue into dev with commit cc59bc1 Oct 14, 2026
150 checks passed
@jonahgabriel
jonahgabriel deleted the dependabot/github_actions/actions-7190022a1c branch October 14, 2026 18:30
jonahgabriel added a commit that referenced this pull request Oct 14, 2026
@jonahgabriel
Merge dev into dispatch head for OMN-16632
ebfbb6b 
Merge dev cc59bc1 into dispatch head 73d4ab8 after merge-queue ejection at 2026-10-14T18:55:25Z. The base commit is build(deps): bump the actions group with 9 updates (#2750). The merge had no conflicts and preserves all three existing dod_evidence entries in contracts/OMN-16632.yaml. The supplied CI context reports green checks on the dispatch head and contains no failed merge-group job names or logs.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@jonahgabriel