ci: bump github/codeql-action from 4 to 4.37.4 in the all-ci-actions group across 1 directory - #95
Closed
dependabot[bot] wants to merge 1 commit into
Closed
Conversation
dependabot
Bot
added
dependencies
deftio
added a commit
that referenced
this pull request
Aug 4, 2026
commit 635acf05d86320b74be87224f686585330ceb0cd
Author: deftio <deftio@deftio.com>
Date: Mon Aug 3 22:25:58 2026 -0700
v2.1.5 release
commit 43a7cf04f1468ebe958ea586ee9b3949dc4028d6
Author: deftio <deftio@deftio.com>
Date: Mon Aug 3 22:15:48 2026 -0700
2.1.5 js artifacts build and ci cleaned up
commit 13c8a5dfbfe8e0c657968c6dce644f8b313852ea
Author: deftio <deftio@deftio.com>
Date: Mon Aug 3 19:05:23 2026 -0700
tools: derive the squash subject from the CHANGELOG, confirm it separately
The merge subject came from the branch name, so a release landed on main
described by whatever the branch happened to be called -- v2.1.4 was a
CommonJS packaging fix and would have read "dependabot deps".
release.js now:
- derives a subject from the CHANGELOG section for the version being
released, preferring the first column-0 prose sentence. Indented lines are
skipped because they are wrapped list items, and HTML comments because
drift-lint pragmas are HTML comments and were being picked up as summaries.
- accepts --squash-msg="..." as an override, in both the argv form and the
npm_config form, since `npm run release --squash-msg=x` (no --) is what
people type and npm swallows it into the environment.
- falls back to the branch name only when the CHANGELOG yields nothing.
- confirms the subject in its own step ([a]ccept/[e]dit/[q]uit) before the
separate y/n on actually merging, so wording is settled apart from the
decision to release.
- writes subject + full CHANGELOG section to .git/SQUASH_MSG and commits with
-F, so main's history carries the changelog and the body is not mangled by
shell quoting.
- prints the derived subject and body size during --dry-run.
publish.yml sets nullglob: an unmatched glob is passed through literally in
bash and gh would fail on the nonexistent filename, so a build that stopped
emitting one asset family would break the release rather than degrade it.
CHANGELOG dated and given a summary paragraph, which is both the release
notes body and the source of the derived subject.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
commit ebf181b955bd0781b61d95086816d8e24ef2278c
Author: deftio <deftio@deftio.com>
Date: Mon Aug 3 17:41:47 2026 -0700
tools: start-release leaves a green branch; guard repo URLs
start-release bumped the version but did not rebuild dist, so every
test:bundles banner assertion failed until the developer happened to run a
build -- 58 failures on a branch where nothing had been written yet. It now
rebuilds and includes dist in the "start vX.Y.Z" commit.
Added a drift-lint rule for bitwrench repo URLs that do not point at
github.com/deftio. A fabricated owner (github.com/nicktackes/bitwrench) sat
in the embedded C headers and the Rust Cargo.toml from 2026-03 until v2.1.0
removed it. Verified it never reached npm (0 hits in the 2.0.32, 2.1.0 and
2.1.4 tarballs) and it is absent from main -- but nothing would have caught
it, and the embedded registries render these URLs on the package page.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
commit 71a267ee41cdbbd84b503ccd4586440556ced773
Author: deftio <deftio@deftio.com>
Date: Mon Aug 3 14:50:16 2026 -0700
chore: hygiene pass + document the data-bw-action removal
Docs:
- CHANGELOG gains a v2.1.5 note recording that data-bw-action/data-bw-id
were removed in v2.1.0 without being called out. Includes the before/after
migration: markup annotation -> bw_act_* class tokens, which BCCL emits
automatically (makeButton({action:'save'}) -> bw_act_save).
- Brief matching notes in agents.md and llms.txt. All three are wrapped in
drift-lint ignore pragmas, since a migration note has to name the retired
attribute to be useful.
- Preserved dev/boilerroom-field-report.md, production feedback from a
~5,500 LOC bwserve app, which otherwise only existed on a stray remote
branch.
Infra:
- codeql-action pinned back to @v4 from @v4.37.3. The exact-patch pin made
dependabot open a PR on every patch release (#95 arrived within a day).
- publish.yml release assets now include dist/*.cjs, *.cjs.map, *.gz and
*.d.ts. The glob was dist/*.js, so the v2.1.4 release attached 76 assets
and zero CommonJS bundles -- the very thing that release existed to fix.
- publish.yml prefers the curated CHANGELOG section for release notes,
falling back to --generate-notes when the section is missing.
- release.js no longer runs test:cli separately; it is part of npm test
as of v2.1.4.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
commit c8f12e2dba306cf09c9bbf827889d34ca5a84738
Author: deftio <deftio@deftio.com>
Date: Mon Aug 3 14:45:16 2026 -0700
start v2.1.5: embedded release
Bumps the all-ci-actions group with 1 update in the / directory: [github/codeql-action](https://github.com/github/codeql-action). Updates `github/codeql-action` from 4 to 4.37.4 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@v4...v4.37.4) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.37.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-ci-actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/github_actions/all-ci-actions-83bd6e4a5a
branch
from
August 4, 2026 05:54
845ca18 to
e676a53
Compare
Owner
|
Closing: codeql-action is intentionally pinned to the floating @v4 tag, which is GitHub's recommendation and receives patches automatically at run time. An exact pin generates a PR on every patch release with no benefit. Added an ignore rule for github/codeql-action in dependabot.yml so this stops recurring. |
Contributor
Author
|
This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests. To ignore these dependencies, configure ignore rules in dependabot.yml |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the all-ci-actions group with 1 update in the / directory: github/codeql-action.
Updates
github/codeql-actionfrom 4 to 4.37.4Release notes
Sourced from github/codeql-action's releases.
... (truncated)
Changelog
Sourced from github/codeql-action's changelog.
Commits
18420e3Merge pull request #4043 from github/mbg/ts/changelog7e8d897Merge pull request #4046 from github/mbg/repo-prop/code-quality2d4c474Log!analysisKindSupportedcase98c05a1Fix argument validation inrollback-changelog.ts8289a49Ignore repository property for unsupported analysis kinds2a8731cMoveconfig-filecomputation after determining theanalysisKinds3434fbbMerge pull request #4044 from github/mbg/ff/promote-toolcache3013ac0PromoteAllowToolcacheInputfeature74b15aaInstall JS deps if needed inpost-release-mergebackworkflowf00f809Fix checking keys rather than values