From fd5b2dd6b17afac5a88c1d12694852ea48828b8c Mon Sep 17 00:00:00 2001 From: Felix Geelhaar Date: Sun, 26 Jul 2026 13:53:19 +0200 Subject: [PATCH] chore(ci): bump the fleet nox pin to 1.19.0 nox shipped 1.17.1, 1.18.0 and 1.19.0 in two days, leaving the pin three releases behind. warden's own version-drift check refused a release push over it, correctly. Measured before moving, scanning every repo with a committed baseline under BOTH 1.17.0 and 1.19.0 and comparing net-new critical/high -- the exact condition the shared gate fails on. The control is the point: counting failures under the new version alone conflates "this bump breaks it" with "already broken". 25 repos identical, 0 regressions, 4 improved: axi-go 1 -> 0 SEC-147 gone (Nox-HQ/nox#361) nomi 11 -> 5 SEC-240 + SEC-435 gone lexora ERR -> 0 -format now honoured over config (Nox-HQ/nox#362) nexa ERR -> 0 same Three of those are fixes for issues filed against nox this morning. The lexora/nexa change is the most consequential: 1.17.0 let a repo-level `output.format` silently override the workflow's `-format json,sarif`, so no findings.json was written and the gate step -- guarded on that file -- skipped, which reads as a green check. 1.19.0 honours the flag. Also confirmed the OUTGOING sha against 1.17.0's published checksums.txt before touching it, so the field and method are verified rather than assumed. Incoming sha is 1.19.0's published linux_amd64 checksum. Claude-Session: https://claude.ai/code/session_01LMVPJFeTCEtUk2CSNBBBdK --- .github/workflows/go-ci.yml | 4 ++-- .github/workflows/js-ci.yml | 4 ++-- .github/workflows/nox-remediate.yml | 4 ++-- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/go-ci.yml b/.github/workflows/go-ci.yml index e82a1ad..455ac34 100644 --- a/.github/workflows/go-ci.yml +++ b/.github/workflows/go-ci.yml @@ -34,11 +34,11 @@ on: nox-version: description: "nox release version (no leading v)." type: string - default: "1.17.0" + default: "1.19.0" nox-sha256: description: "sha256 of nox__linux_amd64.tar.gz (verify on bump)." type: string - default: "1a7af79d12015e929925effdc428f034cc53f64be2a9099a6706c9e982a06e26" + default: "9d1029a686bd8df3477ef3034d65ab477631e7b2cdfee385e2b20295ffe834b8" nox-strict: description: "Fail on net-new critical/high even before a baseline exists. Default: gate only once a baseline is committed." type: boolean diff --git a/.github/workflows/js-ci.yml b/.github/workflows/js-ci.yml index 8c940c2..3d6ef40 100644 --- a/.github/workflows/js-ci.yml +++ b/.github/workflows/js-ci.yml @@ -36,10 +36,10 @@ on: default: "." nox-version: type: string - default: "1.17.0" + default: "1.19.0" nox-sha256: type: string - default: "1a7af79d12015e929925effdc428f034cc53f64be2a9099a6706c9e982a06e26" + default: "9d1029a686bd8df3477ef3034d65ab477631e7b2cdfee385e2b20295ffe834b8" nox-strict: description: "Fail on net-new critical/high even before a baseline exists." type: boolean diff --git a/.github/workflows/nox-remediate.yml b/.github/workflows/nox-remediate.yml index 02b422c..da4384a 100644 --- a/.github/workflows/nox-remediate.yml +++ b/.github/workflows/nox-remediate.yml @@ -25,11 +25,11 @@ on: nox-version: description: "nox release version (no leading v)." type: string - default: "1.17.0" + default: "1.19.0" nox-sha256: description: "sha256 of nox__linux_amd64.tar.gz (verify on bump)." type: string - default: "1a7af79d12015e929925effdc428f034cc53f64be2a9099a6706c9e982a06e26" + default: "9d1029a686bd8df3477ef3034d65ab477631e7b2cdfee385e2b20295ffe834b8" include-major: description: "Allow major-version action bumps (off by default; majors are surfaced but held)." type: boolean