Repository navigation
chore(deps): bump clap from 4.6.0 to 4.6.1 in /bots/finishingbot - #81
Merged
hyperpolymath merged 1 commit intoApr 26, 2026
Merged
Conversation
Bumps [clap](https://github.com/clap-rs/clap) from 4.6.0 to 4.6.1. - [Release notes](https://github.com/clap-rs/clap/releases) - [Changelog](https://github.com/clap-rs/clap/blob/master/CHANGELOG.md) - [Commits](clap-rs/clap@clap_complete-v4.6.0...clap_complete-v4.6.1) --- updated-dependencies: - dependency-name: clap dependency-version: 4.6.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
hyperpolymath
approved these changes
Apr 26, 2026
This was referenced Oct 31, 2026
hyperpolymath
added a commit
that referenced
this pull request
Oct 31, 2026
## Scope Migrate only the existing Secret Scanner caller to published cicd-suite commit 4404c3c0474e17753fe7689f3485c02890aac113. Keep all three required contexts, existing triggers, full-history scanning (`fast-pr: false`), contents-read permissions and no inherited secrets. Preserve the standards lock record for the other callers. The new suite record includes checkout at the immutable SHA used in the pinned reusable; identity was checked with the GitHub repository API. ## Evidence and hold The first consumer canary unified-dataset-vocab PR #81 merged as 4921ac0d161d5619c3186b2e916ed3f6e2c8c89f; its PR run 41198606402 and main run 41199623322 passed real controls, full scanning and all three SHA-bound contexts. This PR must independently demonstrate actual jobs, setup, detector controls and scanner contexts at its own head, and must not merge on corpus-only evidence. Lock regeneration and deeper closure safeguards are the separate fleet PR #631, still open. Coordinate its reviewed receipts/closure audit with this change before merge; neither `gh actions-lock --verify-local` nor a green dangling-edge check proves source-derived closure. Here the existing-lock comparison fixtures pass; authoritative CLI regeneration/provenance checks and the local gawk gate were not run because their binaries are unavailable in the sandbox. Review the observed GitHub runner behaviour and CI evidence; stop on zero-job runs, missing contexts or incomplete closure. Do not bypass policy. Rollback: revert this PR, restoring caller and lock together, and verify actual jobs and all required checks; the previous scanner had zero-job startup failures, so rollback alone does not prove recovery. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> <!-- coderabbit-ai-generated:v1 --> ## Summary by CodeRabbit * **Chores** * Updated the automated secret-scanning workflow to use a pinned scanner version with read-only repository access. * **Tests** * Added automated checks for workflow lock-map coverage and lock regeneration, and included them in the end-to-end workflow. * Added coverage for missing workflow and dependency records, invalid references, and changes to reviewed dependencies. * **Documentation** * Added a report summarizing workflow lock-map coverage and review findings. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Arena Agent <297053741+arena-agent@users.noreply.github.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps clap from 4.6.0 to 4.6.1.
Release notes
Sourced from clap's releases.
Changelog
Sourced from clap's changelog.
Commits
1420275chore: Released2c817ddocs: Update changelogf88c94eMerge pull request #6341 from epage/sepacbb822fix(complete): Reduce risk of conflict with actual subcommandsa49fadbrefactor(complete): Pull out subcommand separatorddc008bMerge pull request #6332 from epage/update497dc50chore: Update compatible dependenciesdca2326Merge pull request #6331 from clap-rs/renovate/j178-prek-action-2.x54bdaa3chore(deps): Update j178/prek-action action to v2f0d30d9chore: ReleaseDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)