Repository navigation
chore(deps): Bump github/codeql-action from 4.35.1 to 4.35.2 - #84
Merged
don-petry merged 1 commit intoApr 18, 2026
Merged
Conversation
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.1 to 4.35.2. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@c10b806...95e58e9) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
![combsmith-dependabot-automrg[bot]](https://avatars.githubusercontent.com/u/258516906?s=60&v=4){kind=small}
don-petry
approved these changes
Apr 18, 2026
don-petry
left a comment
don-petry
left a comment
Contributor
There was a problem hiding this comment.
Automated review — APPROVED
Risk: LOW
Reviewed commit: d748a69fcbd89ad6b9f060548b35da8b064c1007
Cascade: triage → deep (see triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6 for models)
Summary
Dependabot patch bump of github/codeql-action from 4.35.1 to 4.35.2, touching only the codeql.yml workflow file. SHA pinning is correctly maintained. All substantive CI checks pass; the only failure is the dependabot-automerge bot workflow itself (not a code quality gate).
Findings
Info
.github/workflows/codeql.yml— Routine patch bump of github/codeql-action (4.35.1 → 4.35.2). Changes include TRAP cache deprecation notice, Python stdlib extraction optimization, and a bug fix for OIDC private registry validation. No security regressions expected..github/workflows/codeql.yml— Both init and analyze steps correctly updated to the same new full commit SHA (95e58e9a2cdfd71adc6e0353d5c52f41a045d225), consistent with the project's SHA-pinning practice.
Minor
- The
dependabot-automerge / dependabotcheck is FAILED, causing mergeStateStatus=UNSTABLE. This appears to be the auto-merge orchestration workflow failing internally, not a substantive code or security check. All other checks (Lint, Format, SonarCloud, AgentShield, dependency-audit) passed.
CI status
mergeStateStatus: UNSTABLE — the dependabot-automerge workflow failed internally, but all substantive code/security checks passed.
Reviewed by the don-petry PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6). Reply with @don-petry if you need a human.
don-petry
deleted the
dependabot/github_actions/github/codeql-action-4.35.2
branch
April 18, 2026 10:27
This was referenced Apr 19, 2026
don-petry
pushed a commit
that referenced
this pull request
Aug 3, 2026
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.1 to 4.35.2. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@c10b806...95e58e9) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
don-petry
pushed a commit
that referenced
this pull request
Aug 18, 2026
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.1 to 4.35.2. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@c10b806...95e58e9) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
don-petry
added a commit
that referenced
this pull request
Aug 19, 2026
…deation.yml-permissions (#371) * Add Claude Code GitHub Action (#5) * Add Claude Code GitHub Action for PR reviews * fix: address review feedback on Claude Code workflow - Restrict issue_comment trigger to PR comments only - Add author-association check (OWNER/MEMBER/COLLABORATOR) - Add pull_request_review_comment trigger - Add timeout-minutes to prevent runaway jobs Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use CLAUDE_CODE_OAUTH_TOKEN org secret Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add id-token: write permission for OAuth auth Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address remaining review comments - Pin claude-code-action to commit SHA for supply-chain safety - Add fork PR guard (secrets unavailable for fork PRs) - Scope pull_request trigger to main branch - Use >- folded scalar for if expression Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address OpenSSF Scorecard findings (#12) * fix: address OpenSSF Scorecard findings - Add SECURITY.md (#8) - Scope workflow token permissions (#9) - Add Dependabot configuration (#10) - Ensure SAST runs on all commits (#11) Closes #8, #9, #10, #11 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use correct CodeQL action commit SHA The previous SHA was invalid. Updated to the actual v3 commit SHA. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address PR review comments - Replace permissions: read-all with permissions: {} (deny-by-default) - Add actions: read to CodeQL workflow permissions - Add concrete security contact email to SECURITY.md Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use claude_code_oauth_token instead of anthropic_api_key The action has separate inputs for API keys vs OAuth tokens. CLAUDE_CODE_OAUTH_TOKEN is an OAuth token, not an API key. --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore(deps): Bump github/codeql-action from 3.35.1 to 4.35.1 (#15) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.35.1 to 4.35.1. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@5c8a8a6...c10b806) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> * chore(deps): Bump actions/checkout from 4.2.2 to 6.0.2 (#16) Bumps [actions/checkout](https://github.com/actions/checkout) from 4.2.2 to 6.0.2. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4.2.2...de0fac2) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> * chore(deps): Bump anthropics/claude-code-action from 1.0.80 to 1.0.81 (#13) Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.80 to 1.0.81. - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](anthropics/claude-code-action@094bd24...e7b588b) --- updated-dependencies: - dependency-name: anthropics/claude-code-action dependency-version: 1.0.81 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: enable Claude issue trigger per org CI standard (#30) Add issues:[labeled] event trigger and claude label support so Claude can work issues autonomously — reading the issue, creating a branch, implementing the fix, and opening a PR. Changes: - Add issues:[labeled] trigger to on: block - Add issue label condition to job if: guard - Upgrade contents permission to write (needed for branch creation) - Pin claude-code-action to v1.0.89 (6e2bd528) - Add label_trigger: "claude" input - Add dependabot skip condition on step - Add permission comment for contents: write Matches the standard defined in combsmith/.github#24. Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add checkout step to Claude workflow for issue-triggered mode (#31) The claude-code-action runs git fetch/checkout internally during branch setup but requires the repository to already be cloned on the runner. Without actions/checkout, issue-triggered runs fail with: fatal: not a git repository Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: split Claude workflow into interactive + issue automation jobs (#39) * feat: split Claude workflow into interactive + issue automation jobs Aligns with the org standard in petry-projects/.github. The claude-issue job runs in automation mode with tools to create PRs, self-review, check CI, and tag code owners when ready. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add concurrency guard and comment tools to claude-issue job - Add concurrency group keyed on issue number to prevent duplicate runs - Add gh pr comment and gh issue comment to allowedTools for review replies, thread resolution, and code owner tagging - Remove Bash(cat:*) since the Read tool already covers file reads Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: switch to org-level reusable Claude Code workflow (#40) * feat: add workflow to create code-quality repository ruleset Creates the required 'code-quality' branch ruleset with SonarCloud as a required status check on the default branch. This workflow runs on every push to main (idempotent) to ensure the ruleset stays in sync. Closes #28 Co-authored-by: don-petry <don-petry@users.noreply.github.com> * revert: remove workflow approach - cannot push workflow files * chore(workflows): adopt centralized stubs from petry-projects/.github (#52) Replace inline copies of standardized workflows with the canonical thin caller stubs from petry-projects/.github/standards/workflows/. Each stub delegates to a versioned reusable workflow at petry-projects/.github/.github/workflows/<name>-reusable.yml@v1, so future updates to the standard propagate automatically and drift is caught by the org-wide compliance audit. See combsmith/.github#87, #88, #89 for context. Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore(deps): Bump github/codeql-action from 4.35.1 to 4.35.2 (#84) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.1 to 4.35.2. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@c10b806...95e58e9) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix: correct reusable workflow path (remove duplicate .github/) (#114) fix: correct reusable workflow path (remove duplicate .github/ segment) Changed: petry-projects/.github/.github/workflows/... To: petry-projects/.github/workflows/... Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> * Revert "fix: correct reusable workflow path (remove duplicate .github/) (#114)" This reverts commit d49958d. * ci: add auto-rebase workflow and check_run trigger to claude.yml * add check_run trigger to claude.yml * add auto-rebase.yml workflow * chore(deps): Bump github/codeql-action from 4.35.2 to 4.35.3 (#122) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.2 to 4.35.3. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@95e58e9...e46ed2c) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> * chore(deps): Bump github/codeql-action from 4.35.3 to 4.35.4 (#138) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.3 to 4.35.4. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@e46ed2c...68bde55) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: dependabot-automerge-petry[bot] <270452309+dependabot-automerge-petry[bot]@users.noreply.github.com> * chore: delete stray codeql.yml workflow (#107) * chore: delete stray codeql.yml workflow The org now uses GitHub-managed CodeQL default setup. Per-repo workflow files are drift and run duplicate analysis alongside the default setup. This file contained no custom query packs, build modes, or path filters that would warrant an exception. Closes #66 Co-authored-by: don-petry <don-petry@users.noreply.github.com> * retrigger: bump workflows to run checks --------- Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com> * ci: remove drift codeql.yml — GitHub-managed default setup is active (#98) retrigger: bump workflows to run checks Co-authored-by: Claude <claude@anthropic.com> * chore(dev-lead): remove claude.yml — replaced by dev-lead.yml (#156) * fix(compliance): enable delete_branch_on_merge repository setting (#102) * fix(compliance): enable delete_branch_on_merge repository setting Apply the `delete_branch_on_merge` repository setting required by org standards (standards/github-settings.md#merge-settings). This is a repository-level setting applied via the GitHub API: gh api -X PATCH repos/petry-projects/ContentTwin \ -f delete_branch_on_merge=true # confirmed: true Closes #62 Co-authored-by: don-petry <don-petry@users.noreply.github.com> * retrigger: bump workflows to run checks --------- Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com> * fix: update code-quality ruleset to full required check list (#100) * fix: update code-quality ruleset to full required check list Add all required status checks to scripts/setup-rulesets.sh: - SonarCloud, Analyze (actions), Lint, Format - agent-shield / AgentShield, dependency-audit / Detect ecosystems Explicitly excludes claude-code / claude (see comment) to avoid deadlocking workflow-modifying PRs. Also enables strict_required_status_checks_policy to match the live ruleset. Closes #81 Co-authored-by: don-petry <don-petry@users.noreply.github.com> * retrigger: bump workflows to run checks --------- Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com> * fix(compliance): enable delete_branch_on_merge repository setting (#95) * fix(compliance): enable delete_branch_on_merge repository setting The repository setting `delete_branch_on_merge` must be enabled per org standards (standards/github-settings.md#repository-settings--standard-defaults). Applied via GitHub API: gh api -X PATCH repos/petry-projects/ContentTwin -f delete_branch_on_merge=true This is a repository-level setting, not a file change. The next weekly compliance audit will verify the fix and auto-close this finding. Closes #62 Co-authored-by: don-petry <don-petry@users.noreply.github.com> * retrigger: bump workflows to run checks --------- Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com> * fix: pin dependabot-automerge reusable workflow to SHA (#90) * fix: pin dependabot-automerge reusable workflow to SHA Pins petry-projects/.github reusable workflow from @v1 to commit SHA ee22b427cbce9ecadcf2b436acb57c3adf0cb63d (v1) to satisfy the action-pinning policy. Closes #58. Co-authored-by: don-petry <don-petry@users.noreply.github.com> * retrigger: bump workflows to run checks --------- Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com> * feat: implement issue #146 — Compliance: secret_scanning_non_provider_patterns (#170) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #134 — Compliance: check-suite-auto-trigger-347564 (#167) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #147 — Compliance: dependabot_security_updates (#166) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #132 — Compliance: non-stub-dependabot-rebase.yml (#165) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #143 — Compliance: non-stub-dependabot-automerge.yml (#164) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #133 — Compliance: check-suite-auto-trigger-1236702 (#172) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #142 — Compliance: codeowners-org-leads-not-first (#163) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #174 — [Fleet Monitor] petry-projects/ContentTwin — dev-lead.yml (#175) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #131 — Compliance: codeowners-no-catchall (#162) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #144 — Compliance: non-stub-pr-review-mention.yml (#177) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * rollout: deploy pr-review-mention standard workflow (#211) * rollout: deploy pr-review-mention standard workflow * chore: apply manual instructions [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * fix: correct pr-auto-review reusable workflow reference (#219) * fix: correct pr-auto-review reusable workflow reference * chore: apply manual instructions [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * deploy: add pr-review.yml workflow (#222) Co-authored-by: Claude Code Bot <noreply@anthropic.com> * feat: implement issue #205 — Compliance: gitignore_secrets_block (#230) * feat: implement issue #205 — Compliance: gitignore_secrets_block * chore: apply manual instructions [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * fix(reviews): address review comments [skip ci-relay] * fix(reviews): address review comments [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #286 — Compliance: check-suite-prefs-unreadable (#291) * feat: implement issue #286 — Compliance: check-suite-prefs-unreadable * chore: apply manual instructions [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * chore: sync 6 org-standard workflow stub(s) from petry-projects/.github (#293) * chore: sync 6 org-standard workflow stub(s) from petry-projects/.github * chore: sync 6 org-standard workflow stub(s) from petry-projects/.github * chore: sync 6 org-standard workflow stub(s) from petry-projects/.github * chore: sync 6 org-standard workflow stub(s) from petry-projects/.github * chore: sync 6 org-standard workflow stub(s) from petry-projects/.github * chore: sync 6 org-standard workflow stub(s) from petry-projects/.github * fix(ci): auto-fix for SonarCloud Code Analysis [skip ci-relay] * fix(reviews): address review comments [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * ci: inline NOSONAR(S7637) markers on first-party caller stubs (#549 canonical migration) (#308) * ci: inline NOSONAR(S7637) marker on add-to-project.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on agent-shield.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on auto-rebase.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on dependabot-automerge.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on dependabot-rebase.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on dependency-audit.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on dev-lead.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on pr-auto-review.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on pr-review-mention.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on pr-review.yml channel ref (#549) * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github (#327) * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: dev-lead update (review-changes) [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * fix: re-pin agent_ref inputs to v-form (missed by #657 uses:-only re-pin) (#328) fix: re-pin agent_ref to v-form for add-to-project.yml [#657] * feat: implement issue #342 — Compliance: dev-lead-stub-agent-ref (#349) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * chore: insert org secrets baseline in .gitignore (#366) * chore: insert org secrets baseline in .gitignore * fix(reviews): address review comments [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #346 — Compliance: stub-surface-drift-feature-ideation.yml-permissions * chore: dev-lead update (review-changes) [skip ci-relay] * fix(bot): address bot feedback [skip ci-relay] * fix(bot): address bot feedback [skip ci-relay] * fix: restore secrets-baseline END sentinel and add-to-project trailing newline Reverts two accidental truncation hunks unrelated to issue #346, per the automated review: .gitignore's org-managed secrets-baseline closing sentinel must not be edited, and the add-to-project.yml stub newline removal was pointless drift. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: dependabot-automerge-petry[bot] <270452309+dependabot-automerge-petry[bot]@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps github/codeql-action from 4.35.1 to 4.35.2.
Release notes
Sourced from github/codeql-action's releases.
Changelog
Sourced from github/codeql-action's changelog.
... (truncated)
Commits
95e58e9Merge pull request #3824 from github/update-v4.35.2-d2e135a736f31bfeUpdate changelog for v4.35.2d2e135aMerge pull request #3823 from github/update-bundle/codeql-bundle-v2.25.260abb65Add changelog note5a0a562Update default bundle to codeql-bundle-v2.25.26521697Merge pull request #3820 from github/dependabot/github_actions/dot-github/wor...3c45af2Merge pull request #3821 from github/dependabot/npm_and_yarn/npm-minor-345b93...f1c3393Rebuild1024fc4Rebuild9dd4cfeBump the npm-minor group across 1 directory with 6 updatesDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)