chore: bump hypothesis from 6.165.3 to 6.165.10 - #179
Merged
Conversation
Bumps [hypothesis](https://github.com/HypothesisWorks/hypothesis) from 6.165.3 to 6.165.10. - [Release notes](https://github.com/HypothesisWorks/hypothesis/releases) - [Commits](HypothesisWorks/hypothesis@v6.165.3...v6.165.10) --- updated-dependencies: - dependency-name: hypothesis dependency-version: 6.165.10 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Contributor
7 tasks
bagowix
added a commit
that referenced
this pull request
Aug 23, 2026
## Summary Every open Dependabot bump PR (#179–#185) is red on the required `Coverage` check, and nothing is wrong in any of the diffs — all other checks pass, and the `pytest --cov` step inside that very job passes at 100%. Only the Codecov upload fails. The cause is that a workflow run triggered by Dependabot resolves `secrets.*` against the **Dependabot** secret store (Settings → Secrets → Dependabot), never against Actions secrets. `CODECOV_TOKEN` therefore has to be maintained in two places, and a drift between them is invisible until Codecov rejects the upload — at which point every open bump PR turns red at once. Two failure modes seen back to back on the same run: | Attempt | Token | Codecov | |---|---|---| | 2026-08-21 | absent (`INPUT_TOKEN:` empty) | `{"message":"Token required because branch is protected"}` | | 2026-08-23 | present (`Token length: 36`) | `{"message":"Repository not found"}` | The first row also rules out the obvious alternative: dropping the token and relying on a tokenless upload does not work while `main` is protected. The coverage gate is `fail_under = 100` in `pyproject.toml`, which `pytest` enforces in that same job before the upload runs — and in all five `quality` matrix jobs besides. Codecov only mirrors it (`.github/codecov.yml`). So a rejected upload on a bot PR is a reporting outage, not a coverage regression, and it must not hold up a routine bump. `fail_ci_if_error` becomes `${{ github.actor != 'dependabot[bot]' }}` on both upload steps; human PRs and pushes to `main` still fail hard when Codecov rejects a report. `github.actor` and not `github.triggering_actor`: the former stays `dependabot[bot]` when a maintainer re-runs the job by hand, the latter becomes the maintainer. This is the safety net, not the fix — the Dependabot-store `CODECOV_TOKEN` still has to be set to the repository upload token from `app.codecov.io/gh/bagowix/interlock/config/general` for bump PRs to report coverage at all. What changes here is that the next drift costs a missing report instead of a blocked merge queue. ## Checklist - [x] Tests added or updated (suite stays at 100% coverage) — CI-only change, no production code touched; the suite still passes at 100% - [x] `uv run ruff format --check` and `uv run ruff check` pass - [x] `uv run mypy`, `uv run pyright` and `uv run pyrefly check` pass - [x] Docs updated (`docs/`) for user-facing changes — none needed, nothing in the published surface changes - [x] `CHANGELOG.md` `[Unreleased]` updated - [x] Commits follow Conventional Commits - [x] `uv run zizmor .github/workflows/` passes ## Related issues None. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ### Fixed - Dependabot pull requests no longer fail CI when Codecov rejects coverage or test-results uploads. ### Changed - Codecov upload failures remain fatal for human pull requests and pushes to `main`. - The existing 100% coverage gate remains enforced by `pytest`. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps hypothesis from 6.165.3 to 6.165.10.
Commits
6384deeBump hypothesis version to 6.165.10 and update changelogc7ca59dMerge pull request #4864 from dgutson/claude-stateful-and-example3fc38f1claude: teach /hypothesis about stateful tests and@example16f24b7Merge pull request #4862 from Zac-HD/claude/upstream-regex-issues-fkke9q48ce446Bump hypothesis version to 6.165.9 and update changelogd559a69Merge pull request #4860 from Liam-DeVoe/optimize-single-branch-one-of3a19d89fix context flag restoration2408c99drop unecessary empty check3f94912Clarify re.ASCII wording in changelog entry9d0a9a8Fix from_regex handling of negative classes, re.ASCII, and zero-min repeatsDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)