chore(dependabot): cap open pull requests per update block by hyperpolymath · Pull Request #216 · hyperpolymath/proven

hyperpolymath · 2026-09-12T14:38:41Z

Adds open-pull-requests-limit to Dependabot update blocks that had no cap, following the estate per-ecosystem cap doctrine (task #37). No other line in the file is touched.

Claude-Session: https://claude.ai/code/session_011eQ7hibx92N7fBDtwgReWk

Summary

Closes #

Type of change

🐛 Bug fix (non-breaking change that fixes an issue)
✨ New feature (non-breaking change that adds functionality)
💥 Breaking change (would change existing behaviour)
🕳️ Soundness fix (fixes a checker/proof false-negative)
📖 Documentation
🧹 Refactor / tech debt (behaviour-preserving)
⚡ Performance
🔧 Build / CI / tooling

How has this been verified?

Checklist

My commits are signed (git commit -S).
I ran the project's own checks/tests locally and they pass.
New files carry the correct SPDX-License-Identifier (code/config MPL-2.0,
prose CC-BY-SA-4.0); I did not relicense existing files.
Docs are updated, and no public claim now overstates what the code does.
I have not introduced a soundness hole (or I have flagged where I might have).

Notes for reviewers

Adds `open-pull-requests-limit` to Dependabot update blocks that had no cap, following the estate per-ecosystem cap doctrine (task #37). No other line in the file is touched. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011eQ7hibx92N7fBDtwgReWk

coderabbitai · 2026-09-12T14:38:58Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: aed6eebc-1992-42b1-a08c-658b253b9081

📥 Commits

Reviewing files that changed from the base of the PR and between b047620 and 156ae6e.

📒 Files selected for processing (1)

.github/dependabot.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (5)

GitHub Check: analyze (actions, none)
GitHub Check: verify-idris-build
GitHub Check: analyze (javascript-typescript, none)
GitHub Check: analyze (cpp, none)
GitHub Check: GitGuardian Security Checks

⚠️ CI failures not shown inline (6)

GitHub Actions: Secret Scanner / 0_scan _ rust-secrets.txt: chore(dependabot): cap open pull requests per update block

Conclusion: failure

View job details

##[group]Run TODAY="${RUST_TODAY:-$(date -u +%Y-%m-%d)}"
 �[36;1mTODAY="${RUST_TODAY:-$(date -u +%Y-%m-%d)}"�[0m
 �[36;1m�[0m
 �[36;1m# An unparseable cutoff would pick the warn branch forever, silently�[0m
 �[36;1m# disarming the widened scan. Refuse to run instead.�[0m
 �[36;1mrequire_date() {�[0m
 �[36;1m  case "$2" in�[0m
 �[36;1m    [0-9][0-9][0-9][0-9]-[0-1][0-9]-[0-3][0-9]) : ;;�[0m
 �[36;1m    *) echo "::error::rust-secrets: $1='$2' is not YYYY-MM-DD."�[0m

GitHub Actions: Secret Scanner / scan _ rust-secrets: chore(dependabot): cap open pull requests per update block

Conclusion: failure

View job details

##[group]Run TODAY="${RUST_TODAY:-$(date -u +%Y-%m-%d)}"
 �[36;1mTODAY="${RUST_TODAY:-$(date -u +%Y-%m-%d)}"�[0m
 �[36;1m�[0m
 �[36;1m# An unparseable cutoff would pick the warn branch forever, silently�[0m
 �[36;1m# disarming the widened scan. Refuse to run instead.�[0m
 �[36;1mrequire_date() {�[0m
 �[36;1m  case "$2" in�[0m
 �[36;1m    [0-9][0-9][0-9][0-9]-[0-1][0-9]-[0-3][0-9]) : ;;�[0m
 �[36;1m    *) echo "::error::rust-secrets: $1='$2' is not YYYY-MM-DD."�[0m

GitHub Actions: Secret Scanner / 1_scan _ gitleaks.txt: chore(dependabot): cap open pull requests per update block

Conclusion: failure

View job details

##[group]Run set -euo pipefail
 �[36;1mset -euo pipefail�[0m
 �[36;1m�[0m
 �[36;1m# A repo-local baseline wins outright — it is expected to `[extend]`�[0m
 �[36;1m# the estate one, so "wins" still means "inherits". This mirrors what�[0m
 �[36;1m# the AsciiDoc pass below already did, which was inconsistent with�[0m
 �[36;1m# this step until now.�[0m
 �[36;1mCONFIG=".gitleaks-estate.toml"�[0m
 �[36;1mif [ -f .gitleaks.toml ]; then�[0m
 �[36;1m  CONFIG=".gitleaks.toml"�[0m
 �[36;1m  echo "Using repository .gitleaks.toml (extending the estate baseline)."�[0m
 �[36;1melse�[0m
 �[36;1m  echo "Using estate baseline allowlist."�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1m"$RUNNER_TEMP/gitleaks" detect \�[0m
 �[36;1m  --source . \�[0m
 �[36;1m  --no-git \�[0m
 �[36;1m  --redact \�[0m
 �[36;1m  --no-banner \�[0m
 �[36;1m  --verbose \�[0m
 �[36;1m  --config "$CONFIG" \�[0m
 �[36;1m  --exit-code 1�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 Using estate baseline allowlist.
 Finding:     ...ted : detectFormat "�[1;3;mREDACTED�[0m = StripeKey
 ***REDACTED_SECRET_ASSIGNMENT***
 RuleID:      stripe-access-token
 Entropy:     4.201841
 File:        src/Proven/SafeAPIKey/Proofs.idr
 Line:        41
 Fingerprint: src/Proven/SafeAPIKey/Proofs.idr:stripe-access-***REDACTED_SECRET_ASSIGNMENT***
 Finding:     ...ted : detectFormat "�[1;3;mREDACTED�[0m = StripeKey
 ***REDACTED_SECRET_ASSIGNMENT***
 RuleID:      stripe-access-token
 Entropy:     4.011365
 File:        src/Proven/SafeAPIKey/Proofs.idr
 Line:        46
 Fingerprint: src/Proven/SafeAPIKey/Proofs.idr:stripe-access-***REDACTED_SECRET_ASSIGNMENT***
 Finding:     let validJwt = "�[1;3;mREDACTED�[0m"
 ***REDACTED_SECRET_ASSIGNMENT***
 RuleID:      jwt
 Entropy:     5.444070
 File:        tests/unit/SafeJWTUnit.idr
 Line:        37
 Fingerprint: tests/unit/SafeJWTUnit.idr:jwt:37
 �[90m2:38PM�[0m �[32mINF�[0m scan completed in 1.05s
 �[90m2:38PM�[0m �[31mWRN�[0m leaks found: 3
 ##[error]Process completed with exit code 1.

GitHub Actions: Secret Scanner / scan _ gitleaks: chore(dependabot): cap open pull requests per update block

Conclusion: failure

View job details

##[group]Run set -euo pipefail
 �[36;1mset -euo pipefail�[0m
 �[36;1m�[0m
 �[36;1m# A repo-local baseline wins outright — it is expected to `[extend]`�[0m
 �[36;1m# the estate one, so "wins" still means "inherits". This mirrors what�[0m
 �[36;1m# the AsciiDoc pass below already did, which was inconsistent with�[0m
 �[36;1m# this step until now.�[0m
 �[36;1mCONFIG=".gitleaks-estate.toml"�[0m
 �[36;1mif [ -f .gitleaks.toml ]; then�[0m
 �[36;1m  CONFIG=".gitleaks.toml"�[0m
 �[36;1m  echo "Using repository .gitleaks.toml (extending the estate baseline)."�[0m
 �[36;1melse�[0m
 �[36;1m  echo "Using estate baseline allowlist."�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1m"$RUNNER_TEMP/gitleaks" detect \�[0m
 �[36;1m  --source . \�[0m
 �[36;1m  --no-git \�[0m
 �[36;1m  --redact \�[0m
 �[36;1m  --no-banner \�[0m
 �[36;1m  --verbose \�[0m
 �[36;1m  --config "$CONFIG" \�[0m
 �[36;1m  --exit-code 1�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 Using estate baseline allowlist.
 Finding:     ...ted : detectFormat "�[1;3;mREDACTED�[0m = StripeKey
 ***REDACTED_SECRET_ASSIGNMENT***
 RuleID:      stripe-access-token
 Entropy:     4.201841
 File:        src/Proven/SafeAPIKey/Proofs.idr
 Line:        41
 Fingerprint: src/Proven/SafeAPIKey/Proofs.idr:stripe-access-***REDACTED_SECRET_ASSIGNMENT***
 Finding:     ...ted : detectFormat "�[1;3;mREDACTED�[0m = StripeKey
 ***REDACTED_SECRET_ASSIGNMENT***
 RuleID:      stripe-access-token
 Entropy:     4.011365
 File:        src/Proven/SafeAPIKey/Proofs.idr
 Line:        46
 Fingerprint: src/Proven/SafeAPIKey/Proofs.idr:stripe-access-***REDACTED_SECRET_ASSIGNMENT***
 Finding:     let validJwt = "�[1;3;mREDACTED�[0m"
 ***REDACTED_SECRET_ASSIGNMENT***
 RuleID:      jwt
 Entropy:     5.444070
 File:        tests/unit/SafeJWTUnit.idr
 Line:        37
 Fingerprint: tests/unit/SafeJWTUnit.idr:jwt:37
 �[90m2:38PM�[0m �[32mINF�[0m scan completed in 1.05s
 �[90m2:38PM�[0m �[31mWRN�[0m leaks found: 3
 ##[error]Process completed with exit code 1.

GitHub Actions: Secret Scanner / 2_scan _ shell-secrets.txt: chore(dependabot): cap open pull requests per update block

Conclusion: failure

View job details

##[group]Run # Patterns: an `export FOO=` or `FOO=` with a quoted literal of meaningful length.
 �[36;1m# Patterns: an `export FOO=` or `FOO=` with a quoted literal of meaningful length.�[0m
 �[36;1m# Restricted to *_TOKEN / *_KEY / *_SECRET / PASSWORD to keep false-positives low.�[0m
 �[36;1mPATTERNS=(�[0m
 �[36;1m  '(export[[:space:]]+)?[A-Z_]*TOKEN[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{20,}["'"'"']'�[0m
 �[36;1m  '(export[[:space:]]+)?[A-Z_]*API_KEY[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{20,}["'"'"']'�[0m
 �[36;1m  '(export[[:space:]]+)?[A-Z_]*SECRET[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{16,}["'"'"']'�[0m
 �[36;1m  '(export[[:space:]]+)?***"'"'"'][^"'"'"']{6,}["'"'"']'�[0m
 �[36;1m)�[0m
 �[36;1m�[0m
 �[36;1m# Inline pragma patterns — suppress a hit when found on the same or�[0m
 �[36;1m# immediately preceding line.�[0m
 �[36;1mPRAGMA_RE='(scanner-allow:[[:space:]]*shell-secrets|hypatia:[[:space:]]*allow[[:space:]]+security_errors/secret_detected)'�[0m
 �[36;1m�[0m
 �[36;1m# Param-expansion RHS pattern — assignments whose value is a variable�[0m
 �[36;1m# reference rather than a literal are never real secrets.�[0m
 �[36;1m# Matches: ="$VAR"  ="${VAR}"  ="${VAR:-…}"  ="${VAR:?…}"  ='${VAR}'  =$VAR�[0m
 �[36;1mPARAM_EXPANSION_RE='=['"'"'"'"'"']?\$\{?[A-Za-z_][A-Za-z0-9_]*(:[?-][^}]*)?\}?['"'"'"'"'"']?[[:space:]]*(#.*)?$'�[0m
 �[36;1m�[0m
 �[36;1m# Load per-repo ignore globs from .shell-secrets-ignore if present.�[0m
 �[36;1mIGNORE_GLOBS=()�[0m
 �[36;1mif [[ -f .shell-secrets-ignore ]]; then�[0m
 �[36;1m  while IFS= read -r line || [[ -n "$line" ]]; do�[0m
 �[36;1m    # Skip blank lines and comments�[0m
 �[36;1m    [[ -z "$line" || "$line" == \#* ]] && continue�[0m
 �[36;1m    IGNORE_GLOBS+=("$line")�[0m
 �[36;1m  done < .shell-secrets-ignore�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1m# is_ignored <filepath> — returns 0 (true) if path matches any ignore glob.�[0m
 �[36;1mis_ignored() {�[0m
 �[36;1m  local path="$1"�[0m
 �[36;1m  for glob in "${IGNORE_GLOBS[@]}"; do�[0m
 �[36;1m    #...

GitHub Actions: Secret Scanner / scan _ shell-secrets: chore(dependabot): cap open pull requests per update block

Conclusion: failure

View job details

##[group]Run # Patterns: an `export FOO=` or `FOO=` with a quoted literal of meaningful length.
 �[36;1m# Patterns: an `export FOO=` or `FOO=` with a quoted literal of meaningful length.�[0m
 �[36;1m# Restricted to *_TOKEN / *_KEY / *_SECRET / PASSWORD to keep false-positives low.�[0m
 �[36;1mPATTERNS=(�[0m
 �[36;1m  '(export[[:space:]]+)?[A-Z_]*TOKEN[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{20,}["'"'"']'�[0m
 �[36;1m  '(export[[:space:]]+)?[A-Z_]*API_KEY[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{20,}["'"'"']'�[0m
 �[36;1m  '(export[[:space:]]+)?[A-Z_]*SECRET[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{16,}["'"'"']'�[0m
 �[36;1m  '(export[[:space:]]+)?***"'"'"'][^"'"'"']{6,}["'"'"']'�[0m
 �[36;1m)�[0m
 �[36;1m�[0m
 �[36;1m# Inline pragma patterns — suppress a hit when found on the same or�[0m
 �[36;1m# immediately preceding line.�[0m
 �[36;1mPRAGMA_RE='(scanner-allow:[[:space:]]*shell-secrets|hypatia:[[:space:]]*allow[[:space:]]+security_errors/secret_detected)'�[0m
 �[36;1m�[0m
 �[36;1m# Param-expansion RHS pattern — assignments whose value is a variable�[0m
 �[36;1m# reference rather than a literal are never real secrets.�[0m
 �[36;1m# Matches: ="$VAR"  ="${VAR}"  ="${VAR:-…}"  ="${VAR:?…}"  ='${VAR}'  =$VAR�[0m
 �[36;1mPARAM_EXPANSION_RE='=['"'"'"'"'"']?\$\{?[A-Za-z_][A-Za-z0-9_]*(:[?-][^}]*)?\}?['"'"'"'"'"']?[[:space:]]*(#.*)?$'�[0m
 �[36;1m�[0m
 �[36;1m# Load per-repo ignore globs from .shell-secrets-ignore if present.�[0m
 �[36;1mIGNORE_GLOBS=()�[0m
 �[36;1mif [[ -f .shell-secrets-ignore ]]; then�[0m
 �[36;1m  while IFS= read -r line || [[ -n "$line" ]]; do�[0m
 �[36;1m    # Skip blank lines and comments�[0m
 �[36;1m    [[ -z "$line" || "$line" == \#* ]] && continue�[0m
 �[36;1m    IGNORE_GLOBS+=("$line")�[0m
 �[36;1m  done < .shell-secrets-ignore�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1m# is_ignored <filepath> — returns 0 (true) if path matches any ignore glob.�[0m
 �[36;1mis_ignored() {�[0m
 �[36;1m  local path="$1"�[0m
 �[36;1m  for glob in "${IGNORE_GLOBS[@]}"; do�[0m
 �[36;1m    #...

🔇 Additional comments (1)

.github/dependabot.yml (1)

12-12: LGTM!

Also applies to: 17-17, 22-22

📝 Summary

Summary by CodeRabbit

Chores
- Automated update activity is now capped for GitHub Actions.
- Automated pull requests for Rust dependency updates are disabled in the configured Rust components.

Walkthrough

The Dependabot configuration now limits GitHub Actions updates to two open pull requests. It disables Cargo update pull requests for the Rust and Rust fuzz directories.

Changes

Dependabot pull request limits

Layer / File(s)	Summary
Configure update limits `.github/dependabot.yml`	The GitHub Actions entry allows two open pull requests. The Cargo entries for `/bindings/rust` and `/bindings/rust/fuzz` allow none.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 156ae

This configuration change only caps GitHub Actions updates and disables Cargo pull requests for the two Rust directories.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description clearly explains that the change adds `open-pull-requests-limit` to Dependabot update blocks. It matches the changeset and objective.
Title check	✅ Passed	The title clearly and concisely summarises the Dependabot change by capping open pull requests per update block.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🛠️ Fix failing CI checks

Create stacked PR
Commit on current branch

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{A rabbit checks the update queue
Two action hops are allowed through
Cargo rests in Rusty lairs
No new pulls disturb its cares
The config stays neat and true}

_{Comment @coderabbitai help to get the list of available commands.}

sonarqubecloud · 2026-09-12T14:39:26Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

coderabbitai · 2026-09-13T21:13:25Z

✅ Coding Agent task started: View task and status

The task will inspect the CI failures, validate its fix, and commit the fix to this branch automatically.

Note: Fixing CI failures is a beta feature and may encounter errors. Expect some limitations and changes as we gather feedback and continue to improve it.

⏭️ 1 check(s) skipped — already failing on `main` (not caused by this PR)

GitHub Actions: Secret Scanner / 0_scan _ rust-secrets.txt

coderabbitai Bot approved these changes Sep 12, 2026

View reviewed changes

hyperpolymath merged commit b6bd74e into main Sep 13, 2026
19 of 21 checks passed

hyperpolymath deleted the chore/dependabot-pr-caps-2026-09-08 branch September 13, 2026 21:13

Navigation Menu

Uh oh!

chore(dependabot): cap open pull requests per update block - #216

chore(dependabot): cap open pull requests per update block#216
hyperpolymath merged 1 commit into
mainfrom
chore/dependabot-pr-caps-2026-09-08

hyperpolymath commented Sep 12, 2026

Uh oh!

coderabbitai Bot commented Sep 12, 2026 •

edited

Loading

Summary by CodeRabbit

Walkthrough

Changes

Uh oh!

sonarqubecloud Bot commented Sep 12, 2026

Uh oh!

coderabbitai Bot commented Sep 13, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

hyperpolymath commented Sep 12, 2026

Summary

Type of change

How has this been verified?

Checklist

Notes for reviewers

Uh oh!

coderabbitai Bot commented Sep 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Walkthrough

Changes

Uh oh!

sonarqubecloud Bot commented Sep 12, 2026

Quality Gate passed

Uh oh!

coderabbitai Bot commented Sep 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

coderabbitai Bot commented Sep 12, 2026 •

edited

Loading

coderabbitai Bot commented Sep 13, 2026 •

edited

Loading