Repository navigation
ci(actions)(deps): bump aquasecurity/trivy-action from d2a0b60797ff03db6132bd4e2b293f9b37081297 to c03d123cb480c08c69b054af418ea5e69fe6e57e in the github-actions group - #637
Conversation
Bumps the github-actions group with 1 update: [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action). Updates `aquasecurity/trivy-action` from d2a0b60797ff03db6132bd4e2b293f9b37081297 to c03d123cb480c08c69b054af418ea5e69fe6e57e - [Release notes](https://github.com/aquasecurity/trivy-action/releases) - [Commits](aquasecurity/trivy-action@d2a0b60...c03d123) --- updated-dependencies: - dependency-name: aquasecurity/trivy-action dependency-version: c03d123cb480c08c69b054af418ea5e69fe6e57e dependency-type: direct:production dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
🔴 NSE Evidence Report — #637Status: FAIL · Branch: 🔗 Revision
Overall🔴 FAIL Required CI checks contain failures. Primary affected files:
🧪 Test Matrix
🔴 Affected Files
|
| Workflow | Job | Status | Details |
|---|---|---|---|
CI |
Heavy CI (${{ matrix.suite }}) |
⏭️ SKIPPED | logs |
CI |
Extended Validation (Tier 2) |
⏭️ SKIPPED | logs |
CI |
Aggregate CI Results |
⏭️ SKIPPED | logs |
CI |
Full Runtime Overall Verdict |
✅ SUCCESS | logs |
CI |
DB Fabric Certification (SQLite ↔ PostgreSQL) |
✅ SUCCESS | logs |
GitHub Advanced Security |
CodeQL |
✅ SUCCESS | logs |
GitHub Advanced Security |
Trivy |
✅ SUCCESS | logs |
Docs |
Deploy GitHub Pages |
⏭️ SKIPPED | logs |
GitHub Advanced Security |
osv-scanner |
✅ SUCCESS | logs |
Socket Security |
Socket Security: Pull Request Alerts |
✅ SUCCESS | logs |
Code scanning AI findings on PR #637 |
github-advanced-security |
❌ FAILURE | logs |
OSV Dependency Scan |
OSV Scanner / osv-scan |
✅ SUCCESS | logs |
JS Tests |
Frontend JS Unit Tests |
✅ SUCCESS | logs |
Tests (OS Matrix) |
Py Tests (macos-latest) |
✅ SUCCESS | logs |
CI |
MetaTrader 5 Wine Runtime |
✅ SUCCESS | logs |
CI |
Full NSE Runtime (postgres) |
✅ SUCCESS | logs |
CI |
Code Quality & Tests |
✅ SUCCESS | logs |
CI |
CI Integrity and Change Classification |
✅ SUCCESS | logs |
Tests (OS Matrix) |
Py Tests (windows-latest) |
✅ SUCCESS | logs |
CI |
Full NSE Runtime (sqlite) |
✅ SUCCESS | logs |
Dependency Lock & Migration Safety |
Migration safety (fail-loud + version postconditions) |
✅ SUCCESS | logs |
Dependency Lock & Migration Safety |
Dependency drift (lock vs pyproject) |
✅ SUCCESS | logs |
Lockfile Diff |
Dependency Manifest Diff |
✅ SUCCESS | logs |
Security |
CodeQL Analysis |
✅ SUCCESS | logs |
Security |
Trivy Vulnerability Scan |
✅ SUCCESS | logs |
Docs |
Validate documentation |
✅ SUCCESS | logs |
Socket Security |
Socket Security: Project Report |
✅ SUCCESS | logs |
🟢 Final Verdict — Merge? Yes
Every merge precondition observed is satisfied:
- 1 check(s) not green:
github-advanced-security— the base branch's required list could not be read, so GitHub's own mergeability answer is used instead. - Not observed: which checks the base branch requires, required-review count — could not be read.
- GitHub reports this PR is mergeable, which already accounts for the unreadable rules above.
NSE Evidence Report — generated by nse pr report. Statuses are deterministic: 🟢 PASS · 🟡 IN PROGRESS · 🟠 BLOCKED · 🔴 FAIL · ⚪ UNKNOWN. unknown = the evidence did not determine it. This comment is updated in place; it never duplicates.
…#638) Root cause: Dependabot bumps ranges in pyproject.toml but cannot run uv pip compile, so it opens PRs whose committed requirements.lock is stale. The required "Dependency drift (lock vs pyproject)" gate then fails on every dependency PR and blocks the merge queue (#633-#637). Two-part fix: 1. Regenerate requirements.lock + requirements.txt from the current pyproject.toml (uv 0.12.10, --python-version 3.11) so main is consistent again. Every PR that does not itself touch pyproject.toml (all npm/frontend and github-actions PRs) goes green because the gate compares the committed lock against a fresh compile. 2. Add .github/workflows/dependency-autoregen.yml: on any pyproject.toml change reaching main it regenerates and commits the artifacts in place (main can never stay drifted); on PRs that move pyproject.toml it pushes the regenerated artifacts onto the PR branch and re-requests the check suites. Idempotent - converges after one commit. Co-authored-by: Opselon <opselon@users.noreply.github.com>
Dependabot bumps pyproject.toml ranges but cannot run uv pip compile, so the compiled artifacts must ship in the same PR (see .github/dependabot.yml lockfile-safe contract). Regenerated with uv 0.12.10 --python-version 3.11.
1 participant
Bumps the github-actions group with 1 update: aquasecurity/trivy-action.
Updates
aquasecurity/trivy-actionfrom d2a0b60797ff03db6132bd4e2b293f9b37081297 to c03d123cb480c08c69b054af418ea5e69fe6e57eCommits
c03d123chore(deps): Update trivy to v0.75.0 (#588)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions