Skip to content

chore(ci): refresh mature CodeQL, CodSpeed and TruffleHog action pins #1653

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
unbraind merged 5 commits into from
Nov 2, 2026
Merged

chore(ci): refresh mature CodeQL, CodSpeed and TruffleHog action pins #1653

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
dbb6800
chore(ci): refresh mature CodeQL, CodSpeed and TruffleHog action pins
unbraind Nov 2, 2026
5c9ef7a
chore(changelog): close pm-ey1zh7 and regenerate after the action-pin…
unbraind Nov 2, 2026
f1ab2d0
chore(tracker): narrow pm-ey1zh7's verification claim to what the con…
unbraind Nov 2, 2026
3c9af96
chore(tracker): make pm-jd2zim's GH-1652 criterion safe under concurr…
unbraind Nov 2, 2026
4a9d19b
chore(tracker): keep pm-ey1zh7 and pm-jd2zim claims aligned with the …
unbraind Nov 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 32 additions & 0 deletions .agents/pm/chores/pm-ey1zh7.toon
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,32 @@
id: pm-ey1zh7
title: "Refresh mature GitHub Action pins: CodeQL 4.39.1, CodSpeed action 5.6.0 and TruffleHog 3.99.7"
description: "Adopt the five github-actions updates Dependabot proposed in GH PR #1651 once each upstream release cleared the seven-day age floor, and move the exact-pin workflow contracts with them."
type: Chore
status: closed
priority: 2
tags[3]: "area:ci",dependencies,supply-chain
created_at: "2026-11-02T09:29:42.682Z"
updated_at: "2026-11-02T10:30:25.507Z"
closed_at: "2026-11-02T09:33:53.521Z"
completed_at: "2026-11-02T09:33:53.521Z"
author: "harness:claude-code"
estimated_minutes: 45
acceptance_criteria: "Every workflow pins github/codeql-action init, analyze and upload-sarif to 9b3254085494b55a0f7c4c2b3d2d52cc712ce370 (v4.39.1), CodSpeedHQ/action to 78102a468f96d8e0ccb92d0ec49425753fc42062 (v5.6.0) and trufflesecurity/trufflehog to 31ce31ee1abbcc7dc8eee5764c17121c3044c8b2 (v3.99.7), each SHA verified against its dereferenced release tag; The executed TruffleHog version input matches the action pin (3.99.7); GH PR #1651 is closed with a comment that links this item and the implementing PR; tests/integration/ci-workflow-contract.spec.ts pins the exact new CodSpeed and TruffleHog SHAs and the TruffleHog version and passes (its CodeQL assertions only require some 40-character SHA pin and it does not read scorecard.yml, so the CodeQL refresh is verified by the tag-to-SHA check and actionlint, not by the spec), and the dependency-cooldown, workflow-permissions and actionlint gates pass"
parent: pm-ogzvx6
risk: low
confidence: high
resolution: "Pinned github/codeql-action init/analyze/upload-sarif to v4.39.1 (9b3254085494), CodSpeedHQ/action to v5.6.0 (78102a468f96) and trufflesecurity/trufflehog to v3.99.7 (31ce31ee1abb) with version input 3.99.7. Every SHA was checked against its dereferenced release tag. All three releases are older than seven days. tests/integration/ci-workflow-contract.spec.ts moved its exact CodSpeed and TruffleHog pins and the TruffleHog version (24 passed). Its CodeQL checks accept any 40-character SHA pin and scorecard.yml is not inspected, so the CodeQL refresh rests on the tag check and actionlint. The cooldown, workflow-permissions and actionlint gates pass. Dependabot GH PR #1651 is closed with a comment linking this item and PR #1653."
expected_result: "Workflows run the eligible CodeQL, CodSpeed and TruffleHog releases under exact SHA pins verified against their release tags, and the workflow contract spec enforces the exact CodSpeed and TruffleHog pins and the TruffleHog version (its CodeQL checks require only some SHA pin)"
actual_result: "Workflows pin the eligible CodeQL, CodSpeed and TruffleHog releases by verified SHA. The workflow contract spec enforces the exact CodSpeed and TruffleHog pins and the TruffleHog version, and requires only some SHA pin for CodeQL"
dependencies[1]{id,kind,created_at,author,source_kind,author_source}:
pm-8skz5z,related,"2026-11-02T09:31:47.070Z","harness:claude-code","cli:update:dep",detected
files[5]{path,scope}:
.github/workflows/codeql.yml,project
.github/workflows/codspeed.yml,project
.github/workflows/scorecard.yml,project
.github/workflows/security.yml,project
tests/integration/ci-workflow-contract.spec.ts,project
tests[1]{command,scope,timeout_seconds,provenance{author,created_at,source_kind,source_ref},note}:
pnpm exec vitest run tests/integration/ci-workflow-contract.spec.ts,project,300,"harness:claude-code","2026-11-02T09:33:52.761Z",local_mutation,chore/actions-refresh-and-triage-2026-11-02,exact action pins and TruffleHog version contract
close_reason: "Shipped in PR #1653: all five action pins refreshed under verified SHAs with their workflow contracts"
body: "Release ages verified on 2026-11-02 via the GitHub releases API: codeql-action v4.39.1 2026-10-21T15:48Z, CodSpeedHQ/action v5.6.0 2026-10-22T13:18Z, trufflehog v3.99.7 2026-10-24T06:04Z. Each proposed SHA equals the commit its tag dereferences to. Dependabot's own branch cannot pass because tests/integration/ci-workflow-contract.spec.ts pins the exact CodSpeed and TruffleHog SHAs and the TruffleHog version input, so the refresh lands with the contract update in a maintainer PR, as for pm-8skz5z."
7 changes: 5 additions & 2 deletions .agents/pm/chores/pm-t3jxjj.toon
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ status: open
priority: 3
tags[3]: dependencies,sentry,telemetry
created_at: "2026-09-27T21:20:34.332Z"
updated_at: "2026-11-01T05:46:43.327Z"
updated_at: "2026-11-02T09:30:12.233Z"
author: "harness:codex"
estimated_minutes: 240
acceptance_criteria: "Revalidate the exact upstream publication timestamp and seven-day cooldown before choosing an eligible Sentry 11 version; Demonstrate Node 22/24/26 installed-consumer compatibility, telemetry delivery and expected-error classification with positive and negative controls; Pass static, exact coverage and release gates and document rollback to the prior supported major without losing queued telemetry"
Expand All @@ -18,7 +18,7 @@ dependencies[3]{id,kind,created_at,author,source_kind,author_source}:
pm-u9qqip,discovered_from,"2026-09-27T21:20:34.332Z","harness:codex","cli:create:dep",detected
pm-u9d0,implements,"2026-09-28T05:51:10.872Z","harness:codex","cli:update:dep",detected
pm-2csj4k,related,"2026-11-01T05:46:42.755Z","harness:claude-code","cli:update:dep",detected
comments[16]:
comments[17]:
- created_at: "2026-09-27T21:20:34.332Z"
author: "harness:codex"
text: "Duplicate check: all-status searches for Sentry 11 major migration and Sentry 11.0.0 found historical closed 10.x refresh and telemetry items but no major-upgrade owner. Registry metadata: @sentry/node latest 11.0.0, released 2026-09-23T12:38:30.858Z; engine range includes supported Node >=22.18.0. This item is open and unclaimed until the seven-day release-age policy allows adoption."
Expand Down Expand Up @@ -68,6 +68,9 @@ comments[16]:
- created_at: "2026-11-01T05:46:34.899Z"
author: "harness:claude-code"
text: "2026-11-01 registry measurement: eligible Sentry 11.9.0 (published 2026-10-23) replaces the OpenTelemetry SDK packages with @sentry/bundler-plugins (pulls the Sentry CLI package 'sentry' 0.45, 15.5 MB, plus oxc-parser native bindings), @sentry/server-utils (22.0 MB unpacked) and @sentry/server-runtime-injection (6.9 MB). The bundled runtime closure is capped at 25 MB unpacked by scripts/release/package-artifact-budget.json, so adopting @sentry/node 11 as-is would exceed the runtime budget several times over, on top of the enableLogs compile break recorded above. Adoption needs a lighter integration (for example a core-only transport) or an explicit budget decision, not a version bump. Upside recorded for the decision: Sentry 11 drops the OpenTelemetry 2.x packages whose <1.10.0 peer caps cause Bun's install warnings; pm-2csj4k removes those warnings now by pinning the tested peers, independent of this migration."
- created_at: "2026-11-02T09:30:12.232Z"
author: "harness:claude-code"
text: "Dependabot GH PR #1650 (@sentry/node 10.76.2 to 11.9.0, opened 2026-11-02) is closed under this item, following GH PRs #1403, #1448, #1503 and #1600. Verified 2026-11-02: 11.9.0 (published 2026-10-23, past the age floor) still fails the TypeScript build with TS2353 at src/core/sentry/instrument.ts:490, because enableLogs is absent from NodeOptions. It still depends on @sentry/bundler-plugins, @sentry/server-runtime-injection and @sentry/server-utils, the footprint recorded here against the runtime bundle budget. Nothing about this item's adoption blockers changed. Dependabot will re-propose on the next 11.x release."
notes[1]{created_at,author,text,edited_at}:
"2026-09-28T05:51:10.872Z","harness:codex","Readiness repair 2026-09-28: the complete active census found this as the sole item lacking acceptance criteria, estimate, risk, confidence and expected result. The 240-minute estimate covers compatibility investigation and verification, not a promised delivery date. Earliest adoption remains seven complete days after the recorded upstream release (2026-09-30T12:38:30.858Z), with live registry revalidation before dependency changes.","2026-09-28T07:22:06.053Z"
files[4]{path,scope}:
Expand Down
Loading
Loading