From 5ccf9a58ae25169d2069b2c9df9b7848e87e5b02 Mon Sep 17 00:00:00 2001 From: Igor Beylin Date: Fri, 21 Aug 2026 09:26:28 -0400 Subject: [PATCH 1/5] chore(ci): collapse Dependabot pin refresh into one stack base Replace the overlapping #212/#213/#215/#216 siblings with a single bottom-of-stack commit: l9-ci-core pins to 0d28395, upload-artifact v7.0.1, and SPDX AND expressions on the license allow-list fallback so the observability layer can pass Dependency Review. Co-authored-by: Cursor --- .github/workflows/audit.yml | 2 +- .github/workflows/baseline-ratchet-caller.yml | 4 ++-- .github/workflows/l9-analysis.yml | 6 +++--- .github/workflows/supply-chain.yml | 6 +++--- 4 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml index 8524f2ae..e9b88706 100644 --- a/.github/workflows/audit.yml +++ b/.github/workflows/audit.yml @@ -34,7 +34,7 @@ jobs: - name: Upload reports if: always() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@v7.0.1 with: name: l9-audit-reports path: artifacts/ diff --git a/.github/workflows/baseline-ratchet-caller.yml b/.github/workflows/baseline-ratchet-caller.yml index 6771038d..946cad92 100644 --- a/.github/workflows/baseline-ratchet-caller.yml +++ b/.github/workflows/baseline-ratchet-caller.yml @@ -26,9 +26,9 @@ permissions: jobs: ratchet: name: Baseline Ratchet - uses: Quantum-L9/l9-ci-core/.github/workflows/baseline-ratchet.yml@d81a06ed821106a487df2e5ad06d93e347392af6 + uses: Quantum-L9/l9-ci-core/.github/workflows/baseline-ratchet.yml@0d28395428426853c44825c4645c23ee8ace23b1 with: - core-revision: d81a06ed821106a487df2e5ad06d93e347392af6 + core-revision: 0d28395428426853c44825c4645c23ee8ace23b1 sdk-revision: 0779fca8238011f8abea551895f96584676e9d17 python-version: "3.12" pytest-paths: tests diff --git a/.github/workflows/l9-analysis.yml b/.github/workflows/l9-analysis.yml index d166bd53..65c65ca8 100644 --- a/.github/workflows/l9-analysis.yml +++ b/.github/workflows/l9-analysis.yml @@ -95,7 +95,7 @@ jobs: - id: sdk name: Provision immutable SDK if: steps.gov.outputs.enabled == 'true' - uses: Quantum-L9/l9-ci-core/.github/actions/provision-sdk@f88116503430aa18992b70d8d31063e34ff97ef1 + uses: Quantum-L9/l9-ci-core/.github/actions/provision-sdk@0d28395428426853c44825c4645c23ee8ace23b1 - name: Normalize provider report if: steps.gov.outputs.enabled == 'true' @@ -156,7 +156,7 @@ jobs: - name: Upload analysis artifact set if: steps.gov.outputs.enabled == 'true' - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: ${{ steps.names.outputs.artifact-name }} path: | @@ -170,7 +170,7 @@ jobs: name: Publish analysis (Core) needs: analyze if: needs.analyze.outputs.enabled == 'true' - uses: Quantum-L9/l9-ci-core/.github/workflows/publish-analysis.yml@f88116503430aa18992b70d8d31063e34ff97ef1 + uses: Quantum-L9/l9-ci-core/.github/workflows/publish-analysis.yml@0d28395428426853c44825c4645c23ee8ace23b1 permissions: actions: read checks: write diff --git a/.github/workflows/supply-chain.yml b/.github/workflows/supply-chain.yml index e3db0a4f..1304b2ac 100644 --- a/.github/workflows/supply-chain.yml +++ b/.github/workflows/supply-chain.yml @@ -76,7 +76,7 @@ jobs: sarif_file: scorecard.sarif - name: Upload Scorecard Results as Artifact - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@v7.0.1 with: name: scorecard-results path: scorecard.sarif @@ -122,7 +122,7 @@ jobs: fail-on-severity: high # dependency-review-action rejects specifying both allow-licenses and # deny-licenses. Keep the allow-list (stricter); deny-list is implied. - allow-licenses: ${{ vars.ALLOWED_LICENSES || 'MIT, Apache-2.0, BSD-3-Clause, BSD-2-Clause, ISC' }} + allow-licenses: ${{ vars.ALLOWED_LICENSES || 'MIT, Apache-2.0, BSD-3-Clause, BSD-2-Clause, ISC, Apache-2.0 AND MIT, Apache-2.0 AND BSD-2-Clause' }} comment-summary-in-pr: on-failure # ──────────────────────────────────────────────────────────────────────── @@ -217,7 +217,7 @@ jobs: - name: Upload License Report if: always() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@v7.0.1 with: name: license-report path: | From d775e6ff482a49bdbf9a36b5ec5bbb33dd49a14a Mon Sep 17 00:00:00 2001 From: Igor Beylin Date: Fri, 21 Aug 2026 09:26:28 -0400 Subject: [PATCH 2/5] chore(deps): bump observability group on the pin-refresh base structlog 26.1.0 and prometheus-client 0.26.0 from #211. Lands on chore/stack-ci-pins so the SPDX AND allow-list is already present. Co-authored-by: Cursor --- poetry.lock | 18 +++++++++--------- pyproject.toml | 4 ++-- 2 files changed, 11 insertions(+), 11 deletions(-) diff --git a/poetry.lock b/poetry.lock index 90b51ea8..df21d7ba 100644 --- a/poetry.lock +++ b/poetry.lock @@ -1,4 +1,4 @@ -# This file is automatically @generated by Poetry 2.3.2 and should not be changed by hand. +# This file is automatically @generated by Poetry 2.4.1 and should not be changed by hand. [[package]] name = "annotated-doc" @@ -1398,14 +1398,14 @@ testing = ["coverage", "pytest", "pytest-benchmark"] [[package]] name = "prometheus-client" -version = "0.24.1" +version = "0.26.0" description = "Python client for the Prometheus monitoring system." optional = false python-versions = ">=3.9" groups = ["main"] files = [ - {file = "prometheus_client-0.24.1-py3-none-any.whl", hash = "sha256:150db128af71a5c2482b36e588fc8a6b95e498750da4b17065947c16070f4055"}, - {file = "prometheus_client-0.24.1.tar.gz", hash = "sha256:7e0ced7fbbd40f7b84962d5d2ab6f17ef88a72504dcf7c0b40737b43b2a461f9"}, + {file = "prometheus_client-0.26.0-py3-none-any.whl", hash = "sha256:fa93d06737aa02bacd05794768508bb97d2fbee28cb3bca04eaae92f0ca953d6"}, + {file = "prometheus_client-0.26.0.tar.gz", hash = "sha256:04a91bcf94e2cf74a44a1a874d651a2e853ed354b6e822f3b7487751465d5c2b"}, ] [package.extras] @@ -1985,14 +1985,14 @@ full = ["httpx (>=0.27.0,<0.29.0)", "httpx2 (>=2.0.0)", "itsdangerous", "jinja2" [[package]] name = "structlog" -version = "25.5.0" +version = "26.1.0" description = "Structured Logging for Python" optional = false -python-versions = ">=3.8" +python-versions = ">=3.10" groups = ["main"] files = [ - {file = "structlog-25.5.0-py3-none-any.whl", hash = "sha256:a8453e9b9e636ec59bd9e79bbd4a72f025981b3ba0f5837aebf48f02f37a7f9f"}, - {file = "structlog-25.5.0.tar.gz", hash = "sha256:098522a3bebed9153d4570c6d0288abf80a031dfdb2048d59a49e9dc2190fc98"}, + {file = "structlog-26.1.0-py3-none-any.whl", hash = "sha256:e081a26d6c373e6d201eca24eede26d8ffab07f88f477822e679183428d3d91e"}, + {file = "structlog-26.1.0.tar.gz", hash = "sha256:f63a716cbd1b1291cf7661de7794b455acfa4c43c5bcf1630e6ad5ddc1adb3b7"}, ] [[package]] @@ -2549,4 +2549,4 @@ dev = ["pytest", "setuptools"] [metadata] lock-version = "2.1" python-versions = "^3.12" -content-hash = "c13b08e33b20faf4025e3426314fa99d2072248154240eff2e3f90e430b47c2d" +content-hash = "a556f6b155b8192463ecadd9016fbd3e96c90e0e436f80b4ffb6fa67c71f0035" diff --git a/pyproject.toml b/pyproject.toml index bedb4c42..927bf5cf 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -19,8 +19,8 @@ python-multipart = ">=0.0.9,<0.0.32" redis = "^7.4.0" apscheduler = "^3.10.0" httpx = "^0.28.0" -structlog = "^25.5.0" -prometheus-client = "^0.24.1" +structlog = ">=25.5,<27.0" +prometheus-client = ">=0.24.1,<0.27.0" numpy = "^2.4.3" openai = "^1.0.0" asyncpg = "^0.31.0" From 32f1ced166c8eb51db9967f276ed42145869e1ce Mon Sep 17 00:00:00 2001 From: Igor Beylin Date: Fri, 21 Aug 2026 09:26:28 -0400 Subject: [PATCH 3/5] chore(ci): bump attest-build-provenance to v4.2.2 Independent docker-build.yml change from #214, stacked on the observability layer so the three PRs merge oldest-first without file fights. Co-authored-by: Cursor --- .github/workflows/docker-build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml index b3ed6b33..42229741 100644 --- a/.github/workflows/docker-build.yml +++ b/.github/workflows/docker-build.yml @@ -140,7 +140,7 @@ jobs: - name: Attest Build Provenance if: github.event_name != 'pull_request' - uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0.0 + uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 with: subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} subject-digest: ${{ steps.build.outputs.digest }} From e68b63d522f45eef10a4a4c3ae9d503f0bebac95 Mon Sep 17 00:00:00 2001 From: Igor Beylin Date: Fri, 21 Aug 2026 11:20:29 -0400 Subject: [PATCH 4/5] fix(ci): use compatible sdk-revision and keep SPDX AND licenses Baseline ratchet at l9-ci-core@0d28395 only lists b1a49141. Repo ALLOWED_LICENSES would drop Dual-license compounds from a fallback. Widen Docker/pip structlog to match Poetry 26.1.0. Co-authored-by: Cursor --- .github/workflows/baseline-ratchet-caller.yml | 2 +- .github/workflows/supply-chain.yml | 4 +++- requirements.txt | 2 +- 3 files changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/workflows/baseline-ratchet-caller.yml b/.github/workflows/baseline-ratchet-caller.yml index 946cad92..3e0bdf39 100644 --- a/.github/workflows/baseline-ratchet-caller.yml +++ b/.github/workflows/baseline-ratchet-caller.yml @@ -29,7 +29,7 @@ jobs: uses: Quantum-L9/l9-ci-core/.github/workflows/baseline-ratchet.yml@0d28395428426853c44825c4645c23ee8ace23b1 with: core-revision: 0d28395428426853c44825c4645c23ee8ace23b1 - sdk-revision: 0779fca8238011f8abea551895f96584676e9d17 + sdk-revision: b1a491414ed04bb18d665f8a8755de80947c8200 python-version: "3.12" pytest-paths: tests test-quarantine-ledger: .l9/baselines/test-quarantine.yml diff --git a/.github/workflows/supply-chain.yml b/.github/workflows/supply-chain.yml index 1304b2ac..84d6d3d5 100644 --- a/.github/workflows/supply-chain.yml +++ b/.github/workflows/supply-chain.yml @@ -122,7 +122,9 @@ jobs: fail-on-severity: high # dependency-review-action rejects specifying both allow-licenses and # deny-licenses. Keep the allow-list (stricter); deny-list is implied. - allow-licenses: ${{ vars.ALLOWED_LICENSES || 'MIT, Apache-2.0, BSD-3-Clause, BSD-2-Clause, ISC, Apache-2.0 AND MIT, Apache-2.0 AND BSD-2-Clause' }} + # Repo var ALLOWED_LICENSES is set and would drop SPDX AND compounds + # from a || fallback. Always append the two Dual-license strings. + allow-licenses: ${{ vars.ALLOWED_LICENSES || 'MIT, Apache-2.0, BSD-3-Clause, BSD-2-Clause, ISC' }}, Apache-2.0 AND MIT, Apache-2.0 AND BSD-2-Clause comment-summary-in-pr: on-failure # ──────────────────────────────────────────────────────────────────────── diff --git a/requirements.txt b/requirements.txt index c37526a5..c648bafe 100644 --- a/requirements.txt +++ b/requirements.txt @@ -13,7 +13,7 @@ python-multipart>=0.0.9,<1.0.0 redis>=7.4.0,<8.0.0 apscheduler>=3.10.0,<4.0.0 httpx>=0.28.0,<0.29.0 -structlog>=25.5.0,<26.0.0 +structlog>=25.5.0,<27.0.0 prometheus-client>=0.24.1,<1.0.0 numpy>=2.4.3,<3.0.0 openai>=1.0.0,<2.0.0 From ee82bedcdfb1daac76687167797de62bd0decbe7 Mon Sep 17 00:00:00 2001 From: Igor Beylin Date: Fri, 21 Aug 2026 11:22:29 -0400 Subject: [PATCH 5/5] fix(ci): allow Dual-license observability via purl, hash-pin artifacts SPDX AND strings in allow-licenses did not match package Dual licenses and broke MIT matching for upload-artifact. Allow structlog and prometheus-client by purl; pin upload-artifact to v7.0.1 by hash. Co-authored-by: Cursor --- .github/workflows/audit.yml | 2 +- .github/workflows/supply-chain.yml | 11 ++++++----- 2 files changed, 7 insertions(+), 6 deletions(-) diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml index e9b88706..75e0f912 100644 --- a/.github/workflows/audit.yml +++ b/.github/workflows/audit.yml @@ -34,7 +34,7 @@ jobs: - name: Upload reports if: always() - uses: actions/upload-artifact@v7.0.1 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: l9-audit-reports path: artifacts/ diff --git a/.github/workflows/supply-chain.yml b/.github/workflows/supply-chain.yml index 84d6d3d5..27251433 100644 --- a/.github/workflows/supply-chain.yml +++ b/.github/workflows/supply-chain.yml @@ -76,7 +76,7 @@ jobs: sarif_file: scorecard.sarif - name: Upload Scorecard Results as Artifact - uses: actions/upload-artifact@v7.0.1 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: scorecard-results path: scorecard.sarif @@ -122,9 +122,10 @@ jobs: fail-on-severity: high # dependency-review-action rejects specifying both allow-licenses and # deny-licenses. Keep the allow-list (stricter); deny-list is implied. - # Repo var ALLOWED_LICENSES is set and would drop SPDX AND compounds - # from a || fallback. Always append the two Dual-license strings. - allow-licenses: ${{ vars.ALLOWED_LICENSES || 'MIT, Apache-2.0, BSD-3-Clause, BSD-2-Clause, ISC' }}, Apache-2.0 AND MIT, Apache-2.0 AND BSD-2-Clause + # SPDX AND compounds in allow-licenses do not match package Dual + # licenses and also break MIT matching (upload-artifact 7.0.1). + allow-licenses: ${{ vars.ALLOWED_LICENSES || 'MIT, Apache-2.0, BSD-3-Clause, BSD-2-Clause, ISC' }} + allow-dependencies-licenses: pkg:pypi/structlog, pkg:pypi/prometheus-client comment-summary-in-pr: on-failure # ──────────────────────────────────────────────────────────────────────── @@ -219,7 +220,7 @@ jobs: - name: Upload License Report if: always() - uses: actions/upload-artifact@v7.0.1 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: license-report path: |