Repository navigation
Conversation
Combine reviewed dependency and Actions updates, align CodeQL and Fumadocs peers, harden immutable action pin validation, and verify both Pi SDK peer versions. Keep scanner severity and score gates and require completed Cisco deep scanning instead of accepting missing coverage.
This was referenced Oct 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Exact-head CI result (2026-09-30)
Head
57f2e5ca7b9c1aca9f78329dcb8a287395d09542passed all 12 CI jobs, including Node 22/24, both Pi peer versions, three operating systems, the normal Turbopack production export, CodeQL, packaged consumers, and MCP end-to-end tests. The remote tree was verified to match the locally validated tree.Retained-coverage scanner also passed: score 81/100, critical 0, high 0, medium 5, low 9, info 5. Cisco skill scanning completed with the balanced policy and static_analyzer, bytecode, pipeline analyzers; the explicit fail-closed coverage check passed. No targets were skipped. The remaining Cisco skill finding is informational: missing license metadata in the skill frontmatter. Optional Cisco MCP deep scanning remains unavailable and is not claimed as covered.
Version caveat: the reviewed new action pins
plugin-scanner 3.0.110pluscisco-ai-skill-scanner 2.0.12; the historical failing action resolvedplugin-scanner 2.0.1116pluscisco-ai-skill-scanner 2.0.14. These are different analyzer baselines. The historical logs do not expose the two high rule IDs/locations, so this PR does not claim to have proven those exact historical findings fixed. The exact rule-level historical comparison has not been established; keep this version difference visible during review rather than interpreting the green result as proof of historical-finding remediation.Residual native findings remain visible and unsuppressed: missing Claude marketplace strict metadata; four medium approval/sandbox-documentation matches (including generated duplicates); plugin-local documentation/license metadata and prerelease-semver warnings. No release versions, scanner thresholds, or suppression baselines were changed to clear these warnings.
Summary
Consolidates the reviewed dependency/Actions maintenance queue into one tested draft. This does not close the original PRs, merge, publish packages, or deploy the website.
Scanner coverage is preserved, not bypassed
The green historical run for #167 skipped Cisco deep scanning (
UNAVAILABLE), whereas the older scanner ran it. Therefore its 80/100 and zero-high result is not evidence that the original two high findings were fixed.This draft explicitly installs Cisco through the upstream hash-locked PyPI path, enables balanced skill scanning, retains
min_score: 80andfail_on_severity: high, and fails closed when the JSON report shows absent/skipped/failed/timed-out deep-scan coverage. Online analyzers/submission are disabled. Full JSON findings are printed even when the gate fails so remaining findings can be inspected rather than suppressed. Historical text logs did not include enough rule/location detail to attribute the two highs; the new exact-head scan is required.Verified upstream pins
Checked the official release tags against the exact commits on 2026-09-30; all comparisons were identical:
Local validation
/taskflowgit diff --checkpassedLocal caveats: cloud sandbox HOME needed a writable path outside
/tmp(some fixtures use/tmpas their workspace grant). The default Turbopack build was killed with exit 137 locally; the alternate webpack build passed. The exact-head remote checks listed above subsequently passed, including the default Turbopack export.