chore(deps): bump actions/setup-node from 6 to 7 - #149
Open
dependabot[bot] wants to merge 1 commit into
Open
Conversation
dependabot
Bot
added
dependencies
Contributor
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
chittyregistry | d2c0e0b | Sep 10 2026, 01:35 AM |
|
@coderabbitai review |
Contributor
|
@dependabot recreate |
dependabot
Bot
force-pushed
the
dependabot/github_actions/actions/setup-node-7
branch
from
September 8, 2026 23:38
b264e9c to
f7e0abe
Compare
|
@coderabbitai review |
chitcommit
pushed a commit
that referenced
this pull request
Sep 8, 2026
Supersedes the previous correction commit on two points and adds one finding. - The failing `gates / dependency-audit` comes from chittycommand's reusable workflow, not a local gates.yml. It already exposes an `audit_omit_dev` input, and chittycommand sets it true for itself — so the fix here is a two-line `with:` block, not the org-level change I implied. - The dependabot backlog is two groups, not one: #123/#149 fail 7 distinct checks (major action bumps) and are real work; the rest are blocked only on the shared gate. - NEW: PR #188 has three delete-side conflicts, not one, and its doc edits are a blind 1Password→chittysecrets find/replace that renames a live Cloudflare tunnel and rewrites what a 2026-05-27 audit records as having happened. Recommend closing it unmerged. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013akT7HfdgZrsjhWv4KytnN
chitcommit
pushed a commit
that referenced
this pull request
Sep 10, 2026
Corrects my claim that #123/#149 'fail on merit'. They are not broken; they are the only PRs that trigger test-sync-daemon.yml, which has failed 10 of 10 runs since March 2026. Every one of those triggers was Dependabot editing the workflow file — the paths filter has never once fired on the code the workflow exists to test. Its first job runs a repo-wide 'npx tsc --noEmit' that fails on main with 80 errors across 15 files. It went unnoticed because ci.yml, which gates every PR, never typechecks at all. This is the 'check you pay for and never receive' pattern arriving without the usual tell: there is no continue-on-error to grep for. The job is not masked, it is scoped so narrowly it effectively never runs. Not a production incident — wrangler deploys src/universal-registry-worker.js and there is no build step, so the TypeScript never ships. Left unfixed: deciding between repairing the errors, narrowing tsconfig, or deleting an orphaned tree needs an owner's call on which of that code is still wanted. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013akT7HfdgZrsjhWv4KytnN
Contributor
|
@dependabot rebase |
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6 to 7. - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@v6...v7) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/github_actions/actions/setup-node-7
branch
from
September 10, 2026 01:34
f7e0abe to
d2c0e0b
Compare
Contributor
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@coderabbitai review |
chitcommit
added a commit
that referenced
this pull request
Sep 10, 2026
* docs(audit): record git-hygiene sweep — repo was cloned single-branch The clone carried `remote.origin.fetch = +refs/heads/main:...` and was shallow, so `git branch -r` showed 2 of the remote's 20 branches, no local branch had an upstream, `fetch --prune` could not see gone branches, and ancestry tests were unreliable. Every session in this clone was judging branch state against that partial view. Also records a silent failure in `~/.local/bin/git-wt`: `git wt --rm` printed "removed worktree + branch" while removing neither. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013akT7HfdgZrsjhWv4KytnN * docs(audit): correct the dependabot read, record the audit-gate blocker Two changes to the sweep report: 1. Retract "the stale dependabot PRs fail on merit" as a standing claim. It held when measured, but a repo-wide `gates / dependency-audit` failure has since appeared and now fails every open PR, including docs-only ones. The current red checks say nothing about the individual PRs. 2. Record the blocker itself: `npm audit --audit-level=high` fails against main's own tree. npm's proposed fix downgrades wrangler from ^4.120.0 to 4.15.2 — the advisory range flags everything >=4.16.0 — so `npm audit fix --force` would break the build to satisfy the scanner. The CVEs are in libheif via sharp, reached only through miniflare, a devDependency that never ships to the Worker. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013akT7HfdgZrsjhWv4KytnN * docs(audit): correct the gate's location and PR #188's real scope Supersedes the previous correction commit on two points and adds one finding. - The failing `gates / dependency-audit` comes from chittycommand's reusable workflow, not a local gates.yml. It already exposes an `audit_omit_dev` input, and chittycommand sets it true for itself — so the fix here is a two-line `with:` block, not the org-level change I implied. - The dependabot backlog is two groups, not one: #123/#149 fail 7 distinct checks (major action bumps) and are real work; the rest are blocked only on the shared gate. - NEW: PR #188 has three delete-side conflicts, not one, and its doc edits are a blind 1Password→chittysecrets find/replace that renames a live Cloudflare tunnel and rewrites what a 2026-05-27 audit records as having happened. Recommend closing it unmerged. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013akT7HfdgZrsjhWv4KytnN * docs(audit): the real finding — a CI check red for six months Corrects my claim that #123/#149 'fail on merit'. They are not broken; they are the only PRs that trigger test-sync-daemon.yml, which has failed 10 of 10 runs since March 2026. Every one of those triggers was Dependabot editing the workflow file — the paths filter has never once fired on the code the workflow exists to test. Its first job runs a repo-wide 'npx tsc --noEmit' that fails on main with 80 errors across 15 files. It went unnoticed because ci.yml, which gates every PR, never typechecks at all. This is the 'check you pay for and never receive' pattern arriving without the usual tell: there is no continue-on-error to grep for. The job is not masked, it is scoped so narrowly it effectively never runs. Not a production incident — wrangler deploys src/universal-registry-worker.js and there is no build step, so the TypeScript never ships. Left unfixed: deciding between repairing the errors, narrowing tsconfig, or deleting an orphaned tree needs an owner's call on which of that code is still wanted. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013akT7HfdgZrsjhWv4KytnN --------- Co-authored-by: NB <nb@chitty.cc> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
chitcommit
added a commit
that referenced
this pull request
Sep 10, 2026
The merged report still asserted at line 80 that #123/#149 'fail on merit'. Section 1 corrects that further down, but a reader hitting the earlier passage first would be sent to fix the wrong thing. Added a forward pointer there. Appends the outcome, which existed only in the session transcript: #192 came back CLEAN while every other PR stayed red (the gate discriminates), four PRs auto-merged once it landed, and #123/#149 then shed the shared gate while retaining exactly the six test-sync-daemon jobs — which is the proof the two failure classes were independent rather than one problem. Also records that the separated adversarial reviewer never ran, and that three PRs were merged without it. Claude-Session: https://claude.ai/code/session_013akT7HfdgZrsjhWv4KytnN Co-authored-by: NB <nb@chitty.cc> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps actions/setup-node from 6 to 7.
Release notes
Sourced from actions/setup-node's releases.
... (truncated)
Commits
8207627Migrate to ESM and upgrade dependencies (#1574)04be95cAdd cache-primary-key and cache-matched-key as outputs (#1577)7c2c68ddocs: Update caching recommendations to mitigate cache poisoning risks (#1567)6a61c03Merge pull request #1569 from jasongin/update-actions-cache-5.1.030eb73bResolve high-severity audit issues4e1a87aUpdate dist360237fStrict equality4f8aac5Bump@actions/cacheto 5.1.0, log cache write deniedf4a67bbOnly usemirrorTokeningetManifestif it's provided (#1548)0355742Remove dummy NODE_AUTH_TOKEN export (#1558)