From 0161c2951280b8a75506374488060b5f6f0b4a50 Mon Sep 17 00:00:00 2001 From: John Osumi <931193+sumitake@users.noreply.github.com> Date: Mon, 31 Aug 2026 16:19:15 -0700 Subject: [PATCH] ci: stop Dependabot from splitting CodeQL init/analyze Dependabot treated github/codeql-action/init and /analyze as separate dependencies, so each PR loaded config 4.37.9 against analyzer 4.37.8. Group GitHub Actions updates, bump both pins together, and make the msgpack audit compare requirements.txt to pyproject.toml instead of a hardcoded version. --- .github/dependabot.yml | 4 ++++ .github/workflows/codeql.yml | 4 ++-- THIRD_PARTY_NOTICES.md | 2 +- docs/architecture-and-operations.md | 2 +- pyproject.toml | 2 +- requirements.txt | 2 +- scripts/validate_repository.py | 6 ++++-- 7 files changed, 14 insertions(+), 8 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index ae1c550..0a35b4f 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -7,6 +7,10 @@ updates: day: monday open-pull-requests-limit: 5 labels: ["dependencies", "github-actions"] + groups: + github-actions: + patterns: + - "*" - package-ecosystem: npm directory: / diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 486d81b..1bafba3 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -32,11 +32,11 @@ jobs: - name: Check out repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Initialize CodeQL - uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 + uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 with: languages: ${{ matrix.language }} queries: security-extended - name: Analyze - uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 + uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 with: category: /language:${{ matrix.language }} diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md index 2b06de7..52baef3 100644 --- a/THIRD_PARTY_NOTICES.md +++ b/THIRD_PARTY_NOTICES.md @@ -20,7 +20,7 @@ license: ## MessagePack for Python -The Python runtime depends on `msgpack` version `1.2.1`, distributed under the +The Python runtime depends on `msgpack` version `1.2.2`, distributed under the Apache License 2.0. Source and license: diff --git a/docs/architecture-and-operations.md b/docs/architecture-and-operations.md index 4f33770..20dab1f 100644 --- a/docs/architecture-and-operations.md +++ b/docs/architecture-and-operations.md @@ -230,7 +230,7 @@ A production monitor should distinguish: - Node.js: 20 and newer, continuously tested on 20, 22, and 24. - Python: 3.11 and newer, continuously tested on 3.11 through 3.14. - Microsoft dev-tunnels SDK: pinned to 1.3.50. -- MessagePack Python: pinned to 1.2.1. +- MessagePack Python: pinned to 1.2.2. - RPC protocol: observed version 5 only. The VS Code Remote RPC interface is private and can change without semantic diff --git a/pyproject.toml b/pyproject.toml index 3fcb56d..c615689 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -10,7 +10,7 @@ readme = "README.md" requires-python = ">=3.11" license = "MIT" authors = [{ name = "John Osumi" }] -dependencies = ["msgpack==1.2.1"] +dependencies = ["msgpack==1.2.2"] [project.scripts] remote-ssh-tunnel-rpc = "remote_ssh_tunnel.cli:main" diff --git a/requirements.txt b/requirements.txt index 5e4913b..9258cbe 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1 +1 @@ -msgpack==1.2.1 +msgpack==1.2.2 diff --git a/scripts/validate_repository.py b/scripts/validate_repository.py index c3b7109..7b665c4 100755 --- a/scripts/validate_repository.py +++ b/scripts/validate_repository.py @@ -151,8 +151,10 @@ def check_runtime_contract(errors: list[str]) -> None: errors.append("relay executable is not marked executable") requirement = (ROOT / "requirements.txt").read_text().strip() - if requirement != "msgpack==1.2.1": - errors.append("requirements.txt must pin the audited msgpack runtime") + pyproject = (ROOT / "pyproject.toml").read_text() + pinned = re.search(r'"((?:msgpack==)[0-9][0-9.]*)"', pyproject) + if pinned is None or requirement != pinned.group(1): + errors.append("requirements.txt must pin the same msgpack version as pyproject.toml") def check_plist(errors: list[str]) -> None: