From 032e90c87625866f3c3ece3204fa3ea6b51fe612 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 30 Oct 2026 18:38:33 +0000 Subject: [PATCH 1/2] build(deps): bump the actions group with 2 updates Bumps the actions group with 2 updates: [github/codeql-action/init](https://github.com/github/codeql-action) and [github/codeql-action/analyze](https://github.com/github/codeql-action). Updates `github/codeql-action/init` from 4.39.0 to 4.39.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee...9b3254085494b55a0f7c4c2b3d2d52cc712ce370) Updates `github/codeql-action/analyze` from 4.39.0 to 4.39.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee...9b3254085494b55a0f7c4c2b3d2d52cc712ce370) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.39.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: github/codeql-action/analyze dependency-version: 4.39.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ... Signed-off-by: dependabot[bot] --- .github/workflows/codeql.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index f0e915b0..05e12a7a 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -30,12 +30,12 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: persist-credentials: false - - uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 + - uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 with: languages: ${{ matrix.language }} build-mode: none queries: security-extended - - uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 + - uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 with: category: /language:${{ matrix.language }} complete: From b314bb4100d8437a91692c0d7e42fcc7ba29394c Mon Sep 17 00:00:00 2001 From: David Refoua Date: Thu, 5 Nov 2026 04:16:58 +0330 Subject: [PATCH 2/2] Revalidate CodeQL workflow evidence for the pinned patch upgrade --- docs/FILE-COMPARISON.md | 2 +- docs/file-comparison-evidence.json | 2 +- docs/file-comparison.csv | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/FILE-COMPARISON.md b/docs/FILE-COMPARISON.md index 8182cb95..25a92433 100644 --- a/docs/FILE-COMPARISON.md +++ b/docs/FILE-COMPARISON.md @@ -3132,7 +3132,7 @@ Verdict: **parity-gap**. Revision: `5a6961ce6a477a4726b7baf8a84d12fde1cdf6ad`. O Verdict: **equivalent-behavior**. Revision: `5a6961ce6a477a4726b7baf8a84d12fde1cdf6ad`. Original-byte SHA-256: `fc3c298cf966d77f50b575614b4c26f24f1606459f07749a46880cd482f1cb53`. -- Target: `.github/workflows/codeql.yml:2 [UTF8-LF sha256=0ced3b7ee236102d9322f20ee0e4a37347aae41d791d48c38731f96daf4bdfba; anchor=name: "🛡️ Security · CodeQL"]`. +- Target: `.github/workflows/codeql.yml:2 [UTF8-LF sha256=fe91f6cfb9e6bfb6357d1e25dd41e80011991417c6914da478e39ab6c5d324c0; anchor=name: "🛡️ Security · CodeQL"]`. - Retained: Actual donor Actions and JavaScript matrix, no-build security-extended queries, pinned checkout/CodeQL actions, no persisted checkout credentials, PR/main/schedule/dispatch/merge-group triggers, cancellation, timeouts and fail-closed aggregate summary. - Omitted/replaced code: `Pealayer React/Vite names, packages:read permission and branded prose`. Disposition: **replaced**. Reason: Pakar analyzes embedded Web/scripts and Actions, not Pealayer React. Package read permission is unnecessary for these none-build scans; Rust/C++ coverage is explicitly not invented. - Test-code evidence: `tests/repository_governance_test.mjs:105 [UTF8-LF sha256=2c8393bbd1463ce367cff24d72110a96e53e664824d780f2e66a2c8f8930bda1; anchor=console.log('Repository governance]`. diff --git a/docs/file-comparison-evidence.json b/docs/file-comparison-evidence.json index 6299b9a2..ec73ba14 100644 --- a/docs/file-comparison-evidence.json +++ b/docs/file-comparison-evidence.json @@ -18217,7 +18217,7 @@ "targets": [ { "path": ".github/workflows/codeql.yml", - "sha256": "0ced3b7ee236102d9322f20ee0e4a37347aae41d791d48c38731f96daf4bdfba", + "sha256": "fe91f6cfb9e6bfb6357d1e25dd41e80011991417c6914da478e39ab6c5d324c0", "anchor": "name: \"🛡️ Security · CodeQL\"" } ], diff --git a/docs/file-comparison.csv b/docs/file-comparison.csv index 141a8d3e..0fb67f73 100644 --- a/docs/file-comparison.csv +++ b/docs/file-comparison.csv @@ -1599,7 +1599,7 @@ "Pealayer",".gitattributes","5a6961ce6a477a4726b7baf8a84d12fde1cdf6ad","547f59603028195ff9f8a87d04c4651551e8bd0d68f075257dfd549cd846b25b","donor-audit: specialist routing pending","https://github.com/atomicdeploy/PakarController/issues/3","pending-comparison","not-certified-by-this-comparison","","","Not yet determined; not an accepted exclusion","No approved reason to leave this file out. screened is not behavior-comparison proof.","","","Read and compare this exact donor; map every applicable behavior and justify each omission.","Not established by source/hash/test-code comparison; see issue #2" "Pealayer",".github/dependabot.yml","5a6961ce6a477a4726b7baf8a84d12fde1cdf6ad","fa4791635251ad7d5be26ce70d71a8e59aa7b814a4f09f2b5b749d8a49908225","repository-governance","https://github.com/atomicdeploy/PakarController/issues/3 | https://github.com/atomicdeploy/PakarController/issues/11","scoped-improvement","complete",".github/dependabot.yml:1 [UTF8-LF sha256=136887ba77b56544d0bcd367a31d2daaa7637ecdb8b997d63df6cb552d6f08e8; anchor=version: 2]","Actual donor weekly grouped github-actions and Cargo updates, with Cargo path adapted to the existing desktop workspace.","npm updates at /web_ui [not-applicable]","npm updates at /web_ui: Pakar has no /web_ui/package.json or Vite runtime. Embedded Web/tests use Node built-ins; Flutter's actual /mobile Pub dependency contract is covered instead.","tests/repository_governance_test.mjs:105 [UTF8-LF sha256=2c8393bbd1463ce367cff24d72110a96e53e664824d780f2e66a2c8f8930bda1; anchor=console.log('Repository governance]","Adds grouped Pub updates for the actual Android client and label routing while retaining weekly grouped Actions/Cargo updates.","","Not established by source/hash/test-code comparison; see issue #2" "Pealayer",".github/workflows/ci-cd.yml","5a6961ce6a477a4726b7baf8a84d12fde1cdf6ad","bba9a295ee7b59e318f76e0b6f6a80f0aec631e249f7d8c798f6c92c0bb7fd8c","github-coordination | repository-governance","https://github.com/atomicdeploy/PakarController/issues/3 | https://github.com/atomicdeploy/PakarController/issues/11","parity-gap","complete",".github/workflows/build.yml:2 [UTF8-LF sha256=2011a5c6db4cce2042b223c1724d4fc6481d140f7aaf68527bc0f8ccf79c363e; anchor=name: ""🚀 Build · Test · Release""] | tools/build-desktop.ps1:47 [UTF8-LF sha256=8ebd02ebcd5556bd70f97216faed6ea3c03ec8e92950514118e1b9901132e037; anchor=--test-threads=1] | tools/ci-checks.mjs:278 [UTF8-LF sha256=ccc3d394d143d99959677140fe0321c1a9826f6963de91433dd30e7a51c9ec8a; anchor=export function runChecks] | tools/prepare-release.mjs:18 [UTF8-LF sha256=820cefc9698d46f95cf39b4cd667494a05cd03d119a1c54f9892b2a35d8b824b; anchor=export function firmwareManifest]","Actual donor branch/PR/tag/dispatch/merge-group triggers, concurrency policy, pinned actions without checkout credentials, health-before-build jobs, timeouts, Rust cache reuse, locked tests/builds, packaging, curated notes, manifest/checksums/provenance and aggregate results adapted to current Windows/ESP/AVR/Android targets. | Release content is gated on all supported-target builds, created as an immutable draft prerelease, with the matched S3/AVR buffered pair and raw HTTPS update manifests. Explicit legacy packaging is preserved but the overflowing ESP8266 image is not promised as a release output. Untrusted PRs do not execute publishing code with a write token. | Actual donor serial native test execution, isolated test configuration and RUST_BACKTRACE=1 restored. Runtime harness flags are separated from compile jobs; immediate panic output remains available even if a later test aborts before its summary.","LIBMPV_WINDOWS_RELEASES_API_URL, MPV_DLL_PATH, Windows GNU libmpv linking, Linux/macOS mpv dependencies and standalone pealayer-downloader [not-applicable] | macOS Intel/Apple silicon and Linux native platform matrix/packages [pending] | UPX checksum-locked packing and packed native package smoke/resource checks [pending] | branch-tag and archive suffix creation, softprops update-existing release [replaced]","LIBMPV_WINDOWS_RELEASES_API_URL, MPV_DLL_PATH, Windows GNU libmpv linking, Linux/macOS mpv dependencies and standalone pealayer-downloader: Pakar deliberately excludes the media runtime and standalone media utility. Copying this setup would introduce forbidden mpv and unrelated package dependencies. | macOS Intel/Apple silicon and Linux native platform matrix/packages: Current accepted native target is Windows; firmware and Android use Linux runners. Full donor reread includes the new scripts/run-ci-rust-tests.sh macOS sampling helper and 15-minute native test step. Linux/macOS native matrix and diagnostic sampling remain useful pending work; they require actual Pakar platform coverage, not donor's unrelated acceptance. | UPX checksum-locked packing and packed native package smoke/resource checks: Existing Windows wrappers preserve donor resource/donor/cache gates and CLI runtime tests, but Pakar has no accepted compressed native package probe. Do not call a source or CLI test full packed GUI runtime acceptance. | branch-tag and archive suffix creation, softprops update-existing release: User requests stable names without random/time suffixes. Version releases keep stable package names; release enumeration must succeed and an existing release is not overwritten.","tests/build_storage_test.ps1:17 [UTF8-LF sha256=6bfae8dbd4e71ee19a6d760fe69898d3f057354877c3182dff73ee9240f1dbbd; anchor=Actual donor serial test contract] | tests/repository_governance_test.mjs:105 [UTF8-LF sha256=2c8393bbd1463ce367cff24d72110a96e53e664824d780f2e66a2c8f8930bda1; anchor=console.log('Repository governance]","","The historical 8849ab8 menu failure was subsequently fixed; 5d02b07 Build 38141677102 and CodeQL 38141677110 pass. This is not production/deployment proof. Validate the unexecuted draft publisher, useful additional native targets, donor macOS diagnostics and optional compressed package/runtime verification.","Not established by source/hash/test-code comparison; see issue #2" -"Pealayer",".github/workflows/codeql.yml","5a6961ce6a477a4726b7baf8a84d12fde1cdf6ad","fc3c298cf966d77f50b575614b4c26f24f1606459f07749a46880cd482f1cb53","github-coordination | repository-governance","https://github.com/atomicdeploy/PakarController/issues/3 | https://github.com/atomicdeploy/PakarController/issues/11","equivalent-behavior","complete",".github/workflows/codeql.yml:2 [UTF8-LF sha256=0ced3b7ee236102d9322f20ee0e4a37347aae41d791d48c38731f96daf4bdfba; anchor=name: ""🛡️ Security · CodeQL""]","Actual donor Actions and JavaScript matrix, no-build security-extended queries, pinned checkout/CodeQL actions, no persisted checkout credentials, PR/main/schedule/dispatch/merge-group triggers, cancellation, timeouts and fail-closed aggregate summary.","Pealayer React/Vite names, packages:read permission and branded prose [replaced]","Pealayer React/Vite names, packages:read permission and branded prose: Pakar analyzes embedded Web/scripts and Actions, not Pealayer React. Package read permission is unnecessary for these none-build scans; Rust/C++ coverage is explicitly not invented.","tests/repository_governance_test.mjs:105 [UTF8-LF sha256=2c8393bbd1463ce367cff24d72110a96e53e664824d780f2e66a2c8f8930bda1; anchor=console.log('Repository governance]","","","Not established by source/hash/test-code comparison; see issue #2" +"Pealayer",".github/workflows/codeql.yml","5a6961ce6a477a4726b7baf8a84d12fde1cdf6ad","fc3c298cf966d77f50b575614b4c26f24f1606459f07749a46880cd482f1cb53","github-coordination | repository-governance","https://github.com/atomicdeploy/PakarController/issues/3 | https://github.com/atomicdeploy/PakarController/issues/11","equivalent-behavior","complete",".github/workflows/codeql.yml:2 [UTF8-LF sha256=fe91f6cfb9e6bfb6357d1e25dd41e80011991417c6914da478e39ab6c5d324c0; anchor=name: ""🛡️ Security · CodeQL""]","Actual donor Actions and JavaScript matrix, no-build security-extended queries, pinned checkout/CodeQL actions, no persisted checkout credentials, PR/main/schedule/dispatch/merge-group triggers, cancellation, timeouts and fail-closed aggregate summary.","Pealayer React/Vite names, packages:read permission and branded prose [replaced]","Pealayer React/Vite names, packages:read permission and branded prose: Pakar analyzes embedded Web/scripts and Actions, not Pealayer React. Package read permission is unnecessary for these none-build scans; Rust/C++ coverage is explicitly not invented.","tests/repository_governance_test.mjs:105 [UTF8-LF sha256=2c8393bbd1463ce367cff24d72110a96e53e664824d780f2e66a2c8f8930bda1; anchor=console.log('Repository governance]","","","Not established by source/hash/test-code comparison; see issue #2" "Pealayer",".gitignore","5a6961ce6a477a4726b7baf8a84d12fde1cdf6ad","65880959cad401160df570618e66f8cca68139ca38fbaf50e70475640b2d495c","donor-audit: specialist routing pending","https://github.com/atomicdeploy/PakarController/issues/3","pending-comparison","not-certified-by-this-comparison","","","Not yet determined; not an accepted exclusion","No approved reason to leave this file out. screened is not behavior-comparison proof.","","","Read and compare this exact donor; map every applicable behavior and justify each omission.","Not established by source/hash/test-code comparison; see issue #2" "Pealayer","AGENTS.md","5a6961ce6a477a4726b7baf8a84d12fde1cdf6ad","8419c4724104029c8f5730a54b0471a4f41169b40af5be5e96652db2cd5f6070","donor-audit: specialist routing pending","https://github.com/atomicdeploy/PakarController/issues/3","pending-comparison","not-certified-by-this-comparison","","","Not yet determined; not an accepted exclusion","No approved reason to leave this file out. screened is not behavior-comparison proof.","","","Read and compare this exact donor; map every applicable behavior and justify each omission.","Not established by source/hash/test-code comparison; see issue #2" "Pealayer","assets/fonts/Hack-LICENSE.txt","5a6961ce6a477a4726b7baf8a84d12fde1cdf6ad","47c0cccbeec7e8614548cc485588b28149e7874188df5f41b36efebcee285c87","localization","https://github.com/atomicdeploy/PakarController/issues/3 | https://github.com/atomicdeploy/PakarController/issues/4","pending-comparison","not-certified-by-this-comparison","","","Not yet determined; not an accepted exclusion","No approved reason to leave this file out. screened is not behavior-comparison proof.","","","Read and compare this exact donor; map every applicable behavior and justify each omission.","Not established by source/hash/test-code comparison; see issue #2"