[workflow-audit] 6 unexplained change(s) on 2026-09-24

[github-actions]

6 unexplained commit(s) in the audit window (.github/workflows/ .config/tend.yaml .github/audit/ .vscode/) since 2026-09-23T12:43:01Z.

Renovate pin bumps, reproducible tend regenerations, clean merges, and
commits first pushed by an admin are classified and omitted — see the
run summary for what was skipped.
Everything below needs a human to account for it.

1c6b7b0 — fix(security-audit): lift the deciding lines above the truncation point

• Author: dormouse-bot 287024035+dormouse-bot@users.noreply.github.com (self-declared; not proof of origin)
• First pushed by: dormouse-bot (branch_creation)
• Date: 2026-09-23 13:17:37 +0000
• Refs: remotes/origin/fix/audit-lift-deciding-lines
• Files:
  • .github/workflows/security-audit.yaml
• View diff

340b980 — Keep provisioning obligations out of the FAIL IF list so the audit can decide (#748)

• Author: dormouse-bot ned.twigg+dormouse-bot@diffplug.com (self-declared; not proof of origin)
• First pushed by: nedtwigg (pr_merge)
• Date: 2026-09-23 09:58:07 -0700
• Refs: main,remotes/origin/alert-improve remotes/origin/browser-lifecycle,remotes/origin/browser-providers remotes/origin/browser-quick-wins,remotes/origin/browser-viewer-socket remotes/origin/fix/audit-lift-deciding-lines,remotes/origin/fix/dor-cmd-exit-code remotes/origin/main,remotes/origin/playwright-browser
• Files:
  • .github/audit/_preamble.md
  • .github/audit/hosted.md
• View diff

4b8b565 — chore: update tend workflows (0.3.1 → 0.3.2)

• Author: dormouse-bot 287024035+dormouse-bot@users.noreply.github.com (self-declared; not proof of origin)
• First pushed by: dormouse-bot (branch_creation)
• Date: 2026-09-24 11:49:22 +0000
• Refs: remotes/origin/tend/update-workflows
• Files:
  • .config/tend.yaml
  • .github/workflows/tend-ci-fix.yaml
  • .github/workflows/tend-mention-relay.yaml
  • .github/workflows/tend-mention.yaml
  • .github/workflows/tend-nightly.yaml
  • .github/workflows/tend-notifications.yaml
  • .github/workflows/tend-review-runs.yaml
  • .github/workflows/tend-review.yaml
  • .github/workflows/tend-triage.yaml
  • .github/workflows/tend-weekly.yaml
• View diff

573ea8b — Keep the lift from silencing the step, and cap only the findings

• Author: dormouse-bot 287024035+dormouse-bot@users.noreply.github.com (self-declared; not proof of origin)
• First pushed by: dormouse-bot (push)
• Date: 2026-09-23 13:33:37 +0000
• Refs: remotes/origin/fix/audit-lift-deciding-lines
• Files:
  • .github/workflows/security-audit.yaml
• View diff

b34037c — fix(security-audit): lift the deciding lines above the truncation point (#764)

• Author: dormouse-bot ned.twigg+dormouse-bot@diffplug.com (self-declared; not proof of origin)
• First pushed by: nedtwigg (pr_merge)
• Date: 2026-09-23 10:03:45 -0700
• Refs: main,remotes/origin/alert-improve remotes/origin/browser-lifecycle,remotes/origin/browser-providers remotes/origin/browser-quick-wins,remotes/origin/browser-viewer-socket remotes/origin/fix/dor-cmd-exit-code,remotes/origin/main remotes/origin/playwright-browser,remotes/origin/tend/update-workflows
• Files:
  • .github/workflows/security-audit.yaml
• View diff

d4ca2c0 — Return the CLI's exit code from dor.cmd on Windows

• Author: dormouse-bot 287024035+dormouse-bot@users.noreply.github.com (self-declared; not proof of origin)
• First pushed by: dormouse-bot (branch_creation)
• Date: 2026-09-24 11:57:36 +0000
• Refs: remotes/origin/fix/dor-cmd-exit-code
• Files:
  • .github/workflows/ci.yml
• View diff

[dormouse-bot]

All six commits map to four PRs: #748, #764, #779 and #780. Two are on main, both merged by nedtwigg through review. The other four exist only on PR branches, so the audit, which reads main, is not running any of them.

On main (2)

Commit	PR	Window files
340b980	#748, Keep provisioning obligations out of the FAIL IF list	.github/audit/_preamble.md, .github/audit/hosted.md
b34037c	#764, squash of the two branch commits below	.github/workflows/security-audit.yaml

Not on main (4)

Commit	PR	Window files
1c6b7b0, 573ea8b	#764 (merged as b34037c)	.github/workflows/security-audit.yaml
4b8b565	#779, open draft: tend workflows 0.3.1 → 0.3.2	.config/tend.yaml, nine .github/workflows/tend-*.yaml
d4ca2c0	#780, open draft: dor.cmd exit code on Windows	.github/workflows/ci.yml

Nothing here is unexplained. #779 and #780 still need maintainer review before their workflow edits land. This is the same shape as #763: the audit window counts commits on every branch, and git branch -r --contains tells PR-branch commits apart from main.