Repository navigation
chore(ci): bump actions/checkout from 4.2.2 to 7.0.1 - #6
Closed
dependabot[bot] wants to merge 1 commit into
Closed
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [actions/checkout](https://github.com/actions/checkout) from 4.2.2 to 7.0.1. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@11bd719...3d3c42e) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Owner
|
Closing this: the Dependabot configuration is being removed, and this repository now tracks Action version bumps manually during maintenance. The currently pinned versions stay as validated (the workflow passes today). |
Author
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
dependabot
Bot
deleted the
dependabot/github_actions/actions/checkout-7.0.1
branch
September 30, 2026 03:16
ChongCyrus
added a commit
that referenced
this pull request
Sep 30, 2026
决定依据（用同一套扫描器实测）：含 dependabot = 100 分，去掉 = 95 分，再去掉 SECURITY.md = 91，再去掉 lockfile = 86——阈值是 80 且不得有 critical/high，故低危项不是必需的。 本仓库零运行时依赖，依赖面只有两个 Action；为它们维护每周开 PR 的机器人换来的是维护者每次做决定，不划算。 改为 scripts/check-action-versions.mjs（npm run check:actions）：读工作流里所有 uses: owner/repo@<sha> # vX.Y.Z，用 GitHub API 比对上游最新 release，落后的打印可直接替换的整行并以 1 退出；例行检查与每次发布时跑一次。 两个 Dependabot PR（#5/#6）已按决定关闭，当前 pin 保持已验证版本不动。docs/AUDIT-CHECKLIST.md §9.1 记录此结论，避免以后又为凑分加回去。
ChongCyrus
added a commit
that referenced
this pull request
Oct 9, 2026
…rts, files, installer, tests
P0-2 of vibe-math-unify: make the preset a first-class member of this bundle, following the wiring
manual in vibe-math-vmu/docs/10-packs.md section 6 and the measured checklist in the design recon
(design/01). No product behaviour was added: the plugin entry point stays inert (see the previous
commit). No version bump (that stays a release step).
Wiring, site by site:
1. scripts/build-preset-rows.mjs - VERSIONS += 'vmu', ORDER += { vmu: 25 }.
2. cordis.patch.yml - REGENERATED by that script (never hand-edited): 1991 lines now, and
`--check` reports "up to date". The new declaration is `- id: preset-vibe-math-vmu` with
`id: vibe-math-vmu`, and the composition's plugin row was rewritten by the existing TRANSFORM
to the installed package subpath `dsh-vibe-math/vibe-math-vmu/vibe-math-vmu.js`.
Verified BEFORE regenerating that all six TRANSFORMS still match exactly once for vmu (each one
throws otherwise): #3 matches the new `name: './vibe-math-vmu.js'` row, #6 matches the copied
`# -- Vibe Math V5` section marker (so that marker must not be renamed without generalising the
regex - recorded as a follow-up), #1/#2/#5 match the frozen 0.1.x text inherited from the copy.
3. package.json - exports += "./vibe-math-vmu/vibe-math-vmu.js"; files[] += 20 entries (runtime
files plus docs/00..14). Version deliberately NOT bumped. Mojibake entries that already exist in
files[] were neither copied nor "fixed" (out of scope; noted in the recon).
4. installer.js - PRESETS += a vibe-math-vmu entry (agent.cordis.yml, preset.yml,
vibe-math-vmu.js, math-computation.js, math-engines.js, docs/00..14) so the legacy directory
line (DSH <= 0.1.6) installs the same set.
5. tests/audit-preset-rows.test.mjs - VERSIONS += 'vmu', IDS += { vmu: '25' }, the declaration-row
regex widened from `(v\d+r?)` to `(v\d+r?|vmu)`, and the preset-declaration count assertion
changed from the hardcoded 5 to VERSIONS.length.
6. tests/audit-preset-mechanism.test.mjs - "all five preset dirs" / "exactly five preset
directories" -> six (the legacy-directory branch now writes six).
7. tests/audit-math-computation-parity.mjs - PRESETS += 'vibe-math-vmu', and the copy-count
assertion changed from the hardcoded 5 to PRESETS.length (vmu reuses the shared math modules
byte-identically, per the recon verdict S14).
Evidence (this session, all green after the two test-hardcoding fixes):
- node scripts/build-preset-rows.mjs -> wrote cordis.patch.yml (1991 lines); --check -> up to date;
- audit-preset-rows: PRESET DECLARATIONS 51 passed / 0 failed, ALL GREEN;
- audit-math-computation-parity: 118 passed / 0 failed, self-probe 8/8 as required;
- audit-preset-mechanism: 21 passed / 0 failed; audit-installer-compat: 77 / 0;
audit-installer-policy: 99 / 0; audit-package-membership: 9 / 0;
- run-tests --counts unchanged: {"total":107,"suites":45,"probes":62};
- GATE_SCOPE=quick exit 0: TOTAL 24 PASS 24 FAIL 0.
Next: a full non-incremental sweep (GATE_RELEASE=1) as the final evidence for this step, then the
first real capability increment in the documented order (settings schema, store, bus, prompts).
ChongCyrus
added a commit
that referenced
this pull request
Oct 9, 2026
…eralise two generator transforms The previous two commits made the vmu preset real but left it narrating v5r, because P0-1 copied the known-good v5r composition as the starting point. That is not acceptable in a shipped artifact: a user installing vmu must not be told they installed the fifth-generation institute. This commit removes every trace of it, and makes the generator able to accept the corrected wording. Changed (vibe-math-vmu/agent.cordis.yml, now 206 lines, down from 460): - the introductory comment block now describes vmu as a framework (capabilities + hooks; every policy in settings, middleware or a pack) and states the zero-mechanism default, pointing at docs/; - the section header is now `# -- Vibe Math Unify --` and the plugin-row comment describes the vmu framework instead of the v5r institute; - the persona `prefix: |-` body (132 lines of v5r institutional prompt) is replaced by a 15-line vmu-appropriate prefix that also teaches the intended usage (prefer settings or a declarative rule over new code). The prompt pipeline (docs/06) still owns persona text from P1 on; this is the honest interim, not a placeholder that ships someone else's narrative; - the legacy `text: |-` body (134 lines, kept in the source because TRANSFORM #2 requires it as an anchor and removes it from the generated output) is replaced by 3 vmu lines. The anchor line itself is untouched, so the transform still matches exactly once. Changed (scripts/build-preset-rows.mjs): - TRANSFORM #4's find pattern is generalised from `\(\.\/vibe-math-v\d+r?\.js\)` to `(?:a preset-local plugin|this package's plugin) \(\.\/vibe-math-(?:v\d+r?|vmu)\.js\)` so the corrected comment is still matched and rewritten to the package subpath; - TRANSFORM #6's find pattern is generalised from `(?=# -- Vibe Math V\d )` to `(?=# -- Vibe Math (?:V\d|Unify) )` so the `present` row is still injected at the vmu section header. Both must still match exactly once for every preset (the generator throws otherwise) - verified by regenerating all six presets. Evidence (this session): - `node scripts/build-preset-rows.mjs` -> "up to date" (no drift) and all six transforms matched; - the vmu composition is now v5r-free: `v5r|V5R|FIFTH|vibe_v5_` count = 0; - inside the generated vmu declaration, the only remaining occurrence is the legitimate mention of the planned `v5r-pack` in the preset description (that pack is the documented first integration pack); - tests/audit-preset-rows.test.mjs ALL GREEN; tests/audit-preset-mechanism.test.mjs ALL GREEN; tests/audit-package-membership.mjs 9 passed / 0 failed; - run-tests --counts unchanged: {"total":107,"suites":45,"probes":62}. The full non-incremental gate was green immediately before this change (TOTAL 107 PASS 107 FAIL 0), which is what closed P0-2; a further full sweep is scheduled as part of the next capability increment.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps actions/checkout from 4.2.2 to 7.0.1.
Release notes
Sourced from actions/checkout's releases.
... (truncated)
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
3d3c42eprep v7.0.1 release (#2531)2880268escape values passed to --unset (#2530)12cd223trim only ascii whitespace for branch (#2521)62661c4skip running unsafe pr check if input is default (#2518)e8d4307Bump the minor-actions-dependencies group with 2 updates (#2499)631c942eslint 9 (#2474)4f1f4aeBump actions/upload-artifact from 4 to 7 (#2476)ba09753Bump actions/checkout from 6 to 7 (#2488)b9e0990Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)e8cb398Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)