ci: bump github/codeql-action from 3 to 4 - #12
Closed
dependabot[bot] wants to merge 307 commits into
Closed
Conversation
- Canonical ntfy/mac-banner bodies derived from status letter;
agent-supplied `message` field ignored end-to-end.
- MCP tool `dc` schema locked to `{status}` only. `message`, `tool`,
`cwd`, `sessionKey`, `repo` removed. Server-side drop + stderr
`[mcp-fwd] ignored-message-len=N` for compliance monitoring.
MCPRuntime.version 6 → 7 forces mcp.py rewrite on next launch.
- Rules snippet v3: imperative "non-optional, system-level" framing;
"Never require the user to ask for it"; send only the letter, no
other fields. Old v2 blocks auto-replaced via existing sentinel.
- Copilot CLI: add `~/.copilot/copilot-instructions.md` alongside
the existing `~/.copilot/AGENTS.md`. RulesInstaller.Agent.rulesPaths
is now `[URL]`; install/uninstall/status/backup iterate. No
migration — both paths carry the sentinel block.
- Cursor setup-console note: paste snippet into Settings → Rules →
User Rules for every-project coverage (file isn't writable as of
April 2026).
- Sparkle appcast.xml + CHANGELOG updated for 1.7.0; MARKETING_VERSION
0.8.0 → 1.7.0, CURRENT_PROJECT_VERSION 1 → 170.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- Rules snippet v3 → v4. New framing: "Your turn is NOT complete until you have called dc(status='d'). This applies to EVERY user turn without exception — simple chat replies, refusals, and errors included. No opt-out. No waiting to be asked." - MCPRuntime version 7 → 8 forces mcp.py redeploy with matching tool description so agents that ignore global rules still see the "REQUIRED for every turn" wording in the tool schema itself. - `s` (start) is now explicitly optional on trivial turns; `d` stays mandatory across the board. - MARKETING_VERSION 1.7.0 → 1.7.1, CURRENT_PROJECT_VERSION 170 → 171. - Appcast + CHANGELOG updated. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…ggles, onboarding, Cursor paste fix - Remove hook transport (HookInstaller/HookRuntime/HookRoundTripTest); MCP is the single path for all 7 agents - Rename modes: Full → Screen On (.screenOn case); Screen-Off → Screen Off; migrate persisted value - Tracking refactor: replace WatchTarget single-select with Set<String> watchedAgentIds and per-agent menu toggles - Cursor fix: inline User-Rules Copy-snippet + Open-Cursor callout in Setup Install step - First-run Onboarding window (3 pages: mode pick, configure agents, iPhone push) - Rename 'Agents & Channels' → 'Configure Agents' across menu bar, settings, window title - Move logo.png + logo-doomcoder.png → assets/; update README + .gitignore - README rewritten for v1.8 naming and MCP-only architecture - CHANGELOG: v1.8.0 entry - Project: register OnboardingView.swift in pbxproj (with unique UUIDs) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- agent-setup.md: drop hook references, add Cursor User-Rules paste note - troubleshooting.md: rewrite around MCP-only, per-agent Track toggles, Cursor paste fix - iphone-notifications.md: rewrite around ntfy-only (Reminders + iMessage channels removed in v1.8) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…n API Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
v1.8.1 polish: the old Explain → Install → Verify flow made users sit through two separate handshake waits (Install polled 30s inline, Verify fired a second round-trip self-test). Collapsed to Explain → Install & Verify. The install step now runs a single streaming log through: - preflight warnings - write MCP config - write rules snippet (+ Cursor User Rules callout) - self-test (30s): DoomCoder ↔ its own mcp.py ↔ dc.sock - handshake (60s): wait for the real agent to load config - first tool call (60s): wait for the rules snippet to fire Each phase updates a 'Waiting for X' strip above the log so users know exactly what DoomCoder is waiting for. The explain step gains a Mac ↔ Socket ↔ Agent diagram and a 'What's happening?' disclosure with plain-English explainer — users no longer have to guess what MCP means. Also: Cursor's Copy snippet button now fires a top-of-sheet toast so the paste action is impossible to miss. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- Raise staleTimeout 30min → 2h - Reaper no longer forces state=.done; emits .info event instead - New interactive 'End session' notification action (UNNotificationCategory) - New AgentStatusManager.endSession(id:) method - Real events reset inactivity ping cooldown per session Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- Onboarding: add 'How DoomCoder works' welcome page with Mac↔Socket↔Agent diagram - CHANGELOG: stamp v1.8.1 release date 2026-04-17 - Bump MARKETING_VERSION 1.7.1 → 1.8.1, CURRENT_PROJECT_VERSION 171 → 181 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- Install flow: no 120s handshake wait; agent-dependent checks moved to Doctor - Rules snippet v5: single dc(d) per turn, dc(w) before asking; legacy s/e absorbed - Tracking banner after setup + observable install badge (no stale warn) - New In-Mac channel (timeSensitive banner + looping sound, 5/7/10s) - Menu bar: native Toggle rows, renamed About, removed stale icons/chips - Doctor: per-agent last-dc timestamp + inline Self-test button - Honesty: 'zero tokens' copy replaced with '~50 tokens per dc call' - Version: 1.8.1 -> 1.8.2 (build 181 -> 182) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- Snippet v6: shorter, kinder text; 'one d per reply' is the only rule, w marked optional. Drops 'REQUIRED/EXACTLY ONCE' that Cursor was treating as a per-tool-iteration protocol. - Agent-level debounce in AgentStatusManager.deliver(): drop dc(d) within 30s, dc(w) within 15s, and dc(w) when HID idle < 30s (user already at Mac = no need to ping). - MCP tool schema pruned to enum ['w','d']; s/e accepted silently for back-compat. - Scope reduced to Cursor / Claude Code / Copilot CLI. Install Anywhere pane stays as the generic non-listed-client pane. - In-Mac channel now reliable: NotificationManager.setup() called eagerly at app launch instead of lazily on first banner. - Configure sidebar: green check when agent ever completed setup, independent of tracking state or live handshake. - MCPRuntime.version 8->9; RulesInstaller.snippetVersion 5->6. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Remove all agent tracking, MCP runtime, hooks, notification channels, and related UI. Doom Coder is now a single-purpose menu bar utility: two sleep modes (Screen On / Screen Off), session timer, ⌥ Space global toggle, Launch at Login, Settings, Check for Updates (Sparkle), About, Quit. Deleted subsystems: - Agent tracking (event bus, sessions, status, tracking UI) - MCP runtime / installer / round-trip test - Rules installer / Onboarding / Doctor - Socket server, iPhone relay, In-Mac channel - NotificationManager, Log, LegacyDefaults migrator - Ref/ hook docs and stale guide/ documents Kept: - SleepManager (IOPMAssertion + ProcessInfo activity) - MenuBarView, SettingsView, AboutView, DoomCoderApp - Sparkle auto-update Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- Rewrite MenuBarWindowView with flat sections: master toggle, mode selector (Screen On/Off button pair), Configure Agents, Track Agents, footer (Settings·About·Updates·Quit). No DisclosureGroups / ScrollView / segmented Picker — all crash hazards in menuBarExtra(.window) on macOS 26. - New TrackingStore: per-agent notify opt-out (UserDefaults, defaults ON). Dispatcher now guards on TrackingStore.isEnabled before firing. - Rewrite TrackAgentsView (replaces popover): list every TrackedAgent with toggle + live-session state + install badge. Full-row clickable. - NotificationDispatcher: async/await permission flow (fixes Swift 6 strict-concurrency errors on UNUserNotificationCenter); cached permissionStatus; openSystemSettings() deep-link for denied state; sendTest(channel:) for channel test buttons. - NtfyTopic: move storage from Keychain to UserDefaults (topic is not a secret). One-time migrateFromKeychainIfNeeded() copies legacy entry and deletes the keychain item. - Delete dead DoomCoder/MenuBarView.swift and its 3 pbxproj references. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Hooks pipeline overhaul: - Stable dc-hook binary at ~/Library/Application Support/DoomCoder/dc-hook - Full event coverage: Claude (25), Cursor (20), VS Code (9), Copilot CLI (6) - Raw event timeline replaces state machine (no deriveState) - Claude/VS Code dedup via env-var detection in dc-hook - Session ID fix: getppid() for stable parent PID + conversation_id for Cursor - macOS notification delegate for foreground banner display - ntfy ChannelTester uses getOrCreate() instead of nil-returning .current - Notification dedupe window 30s → 5s - Expanded demo replay for all 4 agents Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The command string passed to agent hook configs was unquoted, so the space in '~/Library/Application Support/DoomCoder/dc-hook' split the path into two arguments. Both cmdFor() and the verification parser now handle quoted paths correctly. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Added: - Logs tab with event history, per-agent filtering, payload viewer, export - Health monitoring: green/grey dots, event counts, last-event timestamps - Dynamic prerequisites with live checks and Recheck button - Hook validation (60s periodic) with warning badge and Repair button - Auto-detect nudge for unconfigured agents - Live activity strip in menu bar for active sessions - Notification permission status with recovery flow - ntfy enhancements: Copy Subscribe URL, QR code for phone setup - EventStore schema migration: payload column, notifications table - Payload passthrough and notification history logging Fixed: - "3 of 1" counter bug — installedAndEnabledCount() checks both states - Track subtitle with contextual wording - Agent-scoped uninstall — stripDcHookEntries uses agent token - Agent-scoped uninstall verification — verifyUninstalled checks per-agent Changed: - Verify labels renamed to Test Helper / Run Demo / Watch Live - Configurable retention replaces hardcoded 7-day purge Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- Remove auto-fuse coupling between SleepManager and AgentTrackingManager - Simplify SleepManager.toggle() (no more manual-off cooldown) - Delete forceScreenOn/releaseAgentFuse/isFusedByAgents from SleepManager - Remove bind(sleepManager:) from AgentTrackingManager - Remove auto-fuse toggle from SettingsView - Rewrite MenuBarWindowView with two clear sections: 1. Keep Awake: toggle, mode chips, session timer chips 2. Agent Tracking: live sessions strip, configure/track buttons - Add spring animations (withAnimation, not .animation() modifiers) - Add .contentTransition(.numericText()) for live counters - Remove redundant DoomCoder branding from menu body - Expose session timer UI (was hidden since old version) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…mbol effects - Remove 'Keep Awake' header; inline elapsed time next to toggle - Icon-only footer with tooltips saves vertical space - Base window height 330→260 px; fixes fullscreen clipping - Spring-animated accordion with inset card style - SF Symbol animations: bolt bounce, antenna pulse, content transitions - Fix Updates button: KVO/Combine publisher replaces one-shot poll - Update About tagline for agent tracking - Bump version to 1.8.7 (187) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Reverts the file-name portion of the earlier DoomCoder->DoomCode rebrand so the Xcode projects, shared package/module, schemes, entitlements, @main type, directories, and build artifacts are named DoomCoder again. User-facing brand stays 'Doom Coder' (with the space); bundle ids (com.doomcoder.app), the Application Support/DoomCoder dir, and provisioning profile names are unchanged and now match the project again. Release artifact is DoomCoder-X.Y.Z.zip, consistent with the historical appcast. iOS project regenerated via xcodegen. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The iOS->Mac round-trip was slow because the iPhone relied on APNs-throttled silent pushes (priority 5, "a few per hour") and a 30s foreground poll to learn about the Mac's MacStatus ack. The Mac-> iOS direction felt instant because the iOS app already has a high- priority CKQuerySubscription on NotificationLog (priority 10). The optimistic-UI 45s timeout then fired while the ack was still in flight, snapping the iPhone's controls back to the stale MacStatus -- the perceived "revert". Three structural fixes: 1. High-priority push channels mirror what Mac->iOS already has. The iOS app now subscribes to MacStatus updates (private DB, firesOnRecordUpdate) and the Mac subscribes to CompanionStatus (private DB, firesOnRecordCreation+Update). Both run at apns-priority 10. The iPhone learns about a MacStatus ack within ~1-2s instead of 5-30s. 2. Conflict recovery on the iOS engine no longer races the in-flight send. A 300ms re-queue delay (matching the Mac's engineRecoveryKickDelay) prevents a serverRecordChanged on the presence heartbeat from spinning through maxPresenceConflictRetries and silently dropping the iPhone's presence for ~720s. The CompanionStatus base record now also persists to disk via a new PresenceServerRecordCache (per-zone scoped) so a fresh engine state on forceFetchAll / accountChange / resetLocalSyncState treats the next publish as UPDATE rather than INSERT -- no more CKError 14/2004 storm. 3. The optimistic-UI timeout is now a "Mac is alive AND state matches" gate, not a hard 45s deadline. The timeout was bumped to 90s (still inside the 30-min command expiresAt) and on fire it checks the live MacStatus: if the Mac is reaching CloudKit (lastSeen < 120s) AND its published state already matches the optimistic selection, treat as success -- no revert. The syncFromMac snap-back is also gated on freshness (<10s) so a stale status never clobbers an in-flight optimistic value. Telemetry noise reduction: * Per-record signposts + logger.debug lines are now #if DEBUG. A 200-record backlog drain used to emit 400 signposts + 400 logger lines + 400 NotificationCenter posts in <2s. * eventRecordedNotification is also #if DEBUG. The Diagnostics view re-render is the only consumer and it's a debug-only UI. * The iOS fetched/applied events are coalesced into one event per batch with a per-type tally. * The SyncDiagnostics view's notification subscription is throttled to 4Hz (250ms). Other: * Foreground fetch poll 30s -> 10s (safety net under the new push path). * Ack-poll cadence 2.5s -> 1.0s for snappier reconcile. * Presence send jittered 0-50ms so a heartbeat can't coalesce into the same CKModifyRecordsOperation as a ControlCommand and pull it into a retry on a presence conflict. * Mac suppresses the alert-banner from the new high-priority ControlCommand push (was already in the working tree as a prerequisite for Phase 2.2). Tests: added SyncRoundTripTests in DoomCoderCore asserting that applied without a prior localEdit leaves latency nil, latencies are non-negative, and the round-trip pair produces finite latencies. All 48 tests in the package pass (the pre-existing ringBufferCapsAt200 race is a separate issue acknowledged in the test's own comment).
CI's SwiftLint job (lint runs over the whole repo on every push/PR) was failing on 21 error-level violations, turning main red and blocking both Dependabot PRs. Mac and iOS builds were already green. Fixes: - EventStore: rename 12x `let T` (SQLITE_TRANSIENT) -> `transient` (identifier_name) - AddDeviceSheet: rename `HapticsTap()` -> `hapticsTap()` (identifier_name) - ConfigureSettingsPane / DataAndPrivacyView: wrap 4 long UI strings (line_length) - AgentInstallerV2 / CloudKitPusherDelegate: targeted disable on 2 structured OSLog lines (single-line for grep-able diagnostics) - dc-hook: targeted disable on the 16-member pbsi_comm C-ABI tuple (large_tuple, arity is fixed by MAXCOMLEN and cannot change) Verified clean with `swiftlint lint` locally (0 errors). Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Bumps [actions/checkout](https://github.com/actions/checkout) from 5 to 6. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v5...v6) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 2.3.2 to 3.0.0. - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](softprops/action-gh-release@v2.3.2...v3.0.0) --- updated-dependencies: - dependency-name: softprops/action-gh-release dependency-version: 3.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* ci(release): autostash before rebase in appcast push loop The "Commit version bump and appcast.xml" step committed our specific files, then ran `git pull --rebase` against main. The archive/notarize/dmg steps that run earlier can leave stray unstaged changes in tracked files (e.g. Xcode rewriting a pbxproj), so the rebase aborted with "you have unstaged changes" and only recovered via the hard-reset fallback on a later attempt — noisy, and it wasted an attempt every release. Adding --autostash shelves any build-time working-tree changes for the rebase and restores them after. We never commit them, and the push only sends committed history, so a noisy stash pop is harmless. Attempt 1 now succeeds cleanly. The hard-reset fallback is kept as a backstop. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * docs(releasing): sync with actual workflows + add troubleshooting RELEASING.md had drifted from the workflows and described setup that doesn't match reality, which masked the exact failures that just blocked a release. - macOS secrets: correct the list to what release.yml actually reads. Add the missing MAC_PROVISIONING_PROFILE and NOTARIZE_* keys, fix SPARKLE_ED_PRIVATE_KEY -> SPARKLE_PRIVATE_KEY, and drop APPLE_ID / APPLE_APP_PASSWORD (unused — the workflow notarizes with an App Store Connect API key, not an Apple ID). - iOS signing: the workflow uses manual App Store profiles from IOS_PROVISIONING_PROFILE_APP / _NS, not -allowProvisioningUpdates auto-mint. Document both secrets and correct the first-time-setup steps. - APPLE_TEAM_ID is read as a secret, not a repository variable — fix the docs. - Add a "tag name has to be exact" warning (v2.7.1, never v.2.7.1 — a stray dot matches no trigger and silently runs nothing). - Add a Troubleshooting section covering the three real failure modes: tag didn't trigger, profile missing a capability after an entitlement was added, and appcast not reaching users. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * ci(release): push appcast as admin via RELEASE_PAT under branch protection main is now protected by a branch ruleset (require PR + CI). The default GITHUB_TOKEN (github-actions[bot]) can't push to a protected branch on a user-owned repo, which would block the release's appcast/version-bump push. Set the checkout token to `secrets.RELEASE_PAT || secrets.GITHUB_TOKEN`. With a fine-grained PAT (owned by a repo admin, Contents: write) stored as RELEASE_PAT, the persisted credential pushes as that admin and bypasses the ruleset. Without it, falls back to GITHUB_TOKEN so unprotected forks still work. ACTION REQUIRED before the next release: add the RELEASE_PAT secret, or the appcast push (and thus the whole release) will fail against protected main.
Removed the short version section from the Code of Conduct.
* chore(oss): add contribution automation + reframe README sleep line Set up the "recommended" contribution-management bundle so incoming issues and PRs get routed and triaged with less manual work: - CODEOWNERS: auto-requests @katipally review on every PR. - labeler: auto-tags PRs by area (docs / ci / mac / ios / core). - greetings: welcomes first-time issue and PR authors. - stale: nudges then closes issues/PRs quiet for 60+14 days, exempting pinned / security / help wanted / good first issue. - release-drafter: keeps a draft changelog of the next release from merged PRs (drafts only; release.yml still publishes on a v* tag). Also reframe the README "Mac falls asleep" line: the run doesn't lose progress out of nowhere, it stalls because sleep drops the network and suspends the agent process. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * feat(mac): surface the open/close shortcut across the app The Option+Space (rebindable) shortcut to open/close the panel was only visible in Settings. Surface it where users actually look, using the live GlobalHotkey.shared.current.descriptionForUI so it always reflects the current binding (not a hardcoded key): - Menu bar dropdown: the "Open Doom Coder" item shows the shortcut. - Menu bar icon tooltip: adds a "<shortcut> to open or close" line. - Panel header: a small shortcut pill next to the title, with a hover tip. - About window: an "Open / close shortcut" row. Verified with a Debug build (BUILD SUCCEEDED) and SwiftLint clean. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * feat(mac): first-launch welcome window + v2.7.2 Add a short, plain-language onboarding window shown once on a fresh install: how to open Doom Coder (⌥ Space), a one-tap notifications opt-in, and an optional Accessibility note. Hosted as its own NSWindow so it reliably appears on first launch (the SwiftUI window-opener bridge isn't mounted until the floating panel is first shown). Upgraders are detected via existing What's New flags and skip onboarding. README: restyle the macOS download as a clickable tile, label macOS as the app vs iOS as the companion, surface ⌥ Space up top, add per-platform latest-version badges, and cache the downloads badge. Bump version to 2.7.2 (macOS-only release). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * docs(readme): cache all dynamic badges to survive shields.io outages Add cacheSeconds=3600 to the Release, CI, and Stars badges (Downloads and the per-platform version badges already had it). Dynamic GitHub/ iTunes badges occasionally render shields.io's 'Unable to select next GitHub token from pool' error during their API rate-limit windows; caching makes shields serve the last-good value instead. Static /badge/ shields (license, macOS, iOS, Swift) make no API call and are left as-is. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * ci(release-drafter): run only on push to main The release-drafter action reads its config from the default branch, so a PR that introduces .github/release-drafter.yml (as this branch does) fails the check because main doesn't have the config yet. The config is drafting-only with no autolabeler, so it has nothing to do on a pull_request regardless. Drop the pull_request trigger — drafting runs as PRs merge into main, which is the documented intent — and the false PR failure goes away. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Reorder so the notarized DMG/ZIP are published as a GitHub Release BEFORE the version-bump/appcast commit is pushed back to main. The deliverable users download must never depend on a protected-branch push succeeding — if that push fails, the release is already live and the only stale artifact is the Sparkle feed, which is recoverable. Also clarifies the failure message: the release is published; only appcast.xml on main is stale. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
ci(release): make releases survive main branch protection
The macOS 'release' and 'latest' badges were dynamic shields.io GitHub endpoints, which intermittently render 'Unable to select next GitHub token from pool' during shields' API rate-limit windows — so the README appeared not to update after a release. Make them static badges with the literal version baked in, and have the release bot rewrite that version in the same commit that pushes the version bump + appcast.xml. Now the README always matches the published release with zero external-API dependency. iOS keeps its dynamic App Store badge (separate pipeline). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
ci(release): auto-bump README version badges + make them static
CodeQL: parallel analysis of (1) Swift — the app + DoomCoderCore, built
under the CodeQL tracer mirroring the existing CI build, and (2) Actions
— the workflow files, which catches script-injection / unsafe ${{ }}
interpolation / over-broad tokens (the class of bug the old
release-drafter pull_request_target trigger was). Default high-confidence
query suite to stay actionable, weekly scheduled re-scan, least-privilege
permissions.
Dependency Review: on each PR, fails if it introduces a dependency with a
known moderate+ advisory or a strong-copyleft license. Supply-chain
complement to CodeQL; PR-only so it never blocks a release.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
ci(security): CodeQL (Swift + Actions) + Dependency Review
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3 to 4. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@v3...v4) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
Contributor
Author
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
dependabot
Bot
deleted the
dependabot/github_actions/github/codeql-action-4
branch
August 4, 2026 15:39
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps github/codeql-action from 3 to 4.
Release notes
Sourced from github/codeql-action's releases.
... (truncated)
Changelog
Sourced from github/codeql-action's changelog.
... (truncated)
Commits
0ad7c1fRebuild25c25b5Update changelog and version after v4.36.187557b9Merge pull request #3940 from github/update-v4.36.1-2a1689ed49431011Update changelog for v4.36.12a1689eMerge pull request #3939 from github/henrymercer/skip-overlay-revert-when-exp...d40e417Only do initial wait when not running tests5245323Disable missing diff-ranges fallback when overlay enabled manually948a63aAdd FF to force JGit-based Git backendDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)