chore(ci): compatible pin refresh + observability + attest - #220
Merged
Conversation
Replace the overlapping #212/#213/#215/#216 siblings with a single bottom-of-stack commit: l9-ci-core pins to 0d28395, upload-artifact v7.0.1, and SPDX AND expressions on the license allow-list fallback so the observability layer can pass Dependency Review. Co-authored-by: Cursor <cursoragent@cursor.com>
structlog 26.1.0 and prometheus-client 0.26.0 from #211. Lands on chore/stack-ci-pins so the SPDX AND allow-list is already present. Co-authored-by: Cursor <cursoragent@cursor.com>
Independent docker-build.yml change from #214, stacked on the observability layer so the three PRs merge oldest-first without file fights. Co-authored-by: Cursor <cursoragent@cursor.com>
Baseline ratchet at l9-ci-core@0d28395 only lists b1a49141. Repo ALLOWED_LICENSES would drop Dual-license compounds from a fallback. Widen Docker/pip structlog to match Poetry 26.1.0. Co-authored-by: Cursor <cursoragent@cursor.com>
This was referenced Aug 21, 2026
|
✅ PR reviewable size is within recommended limits |
2 tasks
L9 Audit Harness Report
Step Results
Architecture Audit Findings
See Spec Coverage
See Next StepsAll checks passed. Safe to merge. |
Dependency ReviewThe following issues were found:
License Issuespoetry.lock
.github/workflows/supply-chain.yml
requirements.txt
Allowed Licenses: MIT, Apache-2.0, BSD-3-Clause, BSD-2-Clause, ISC, Apache-2.0 AND MIT, Apache-2.0 AND BSD-2-Clause OpenSSF Scorecard
Scanned Files
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
SPDX AND strings in allow-licenses did not match package Dual licenses and broke MIT matching for upload-artifact. Allow structlog and prometheus-client by purl; pin upload-artifact to v7.0.1 by hash. Co-authored-by: Cursor <cursoragent@cursor.com>
|
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Replacement for the broken 3-stack (#217–#219). One PR against
mainso Baseline Ratchet actually runs.l9-ci-corecallers to0d28395428426853c44825c4645c23ee8ace23b1sdk-revisionis the compatible defaultb1a491414ed04bb18d665f8a8755de80947c8200(not0779fca, which ratchet rejects)upload-artifactv7.0.1 (hash-pinned inl9-analysis.yml)attest-build-provenancev4.2.2 (4d101475d8b20a2381f78447822ac1eab6504dd8)structlog26.1.0 +prometheus-client0.26.0 in Poetry andrequirements.txt(<27.0.0) so Docker/pip can installALLOWED_LICENSESis set (that var currently omitsApache-2.0 AND MIT/Apache-2.0 AND BSD-2-Clause)Closes #217 #218 #219 after this URL exists (comments + close follow).
Does not change
engine/handlers.py.query_idis already onorigin/main; Lint and Test is green there.Test plan
sdk-revisionlisted in.l9/sdk-compatibility.yamlat l9-ci-core@0d28395)mergeStateStatus=CLEANviastack_safe_merge.py --runMade with Cursor