From 1dc0edbad1944052d338cfc37ea6fca8f5380b8b Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 4 Sep 2026 04:13:25 +0000 Subject: [PATCH 1/2] chore(deps): bump the github-actions-dependencies group across 1 directory with 2 updates Bumps the github-actions-dependencies group with 2 updates in the / directory: [github/codeql-action/init](https://github.com/github/codeql-action) and [github/codeql-action/analyze](https://github.com/github/codeql-action). Updates `github/codeql-action/init` from 4.37.8 to 4.37.9 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28...cdf488f595d80d6e07e03d4674febd5ab45fa938) Updates `github/codeql-action/analyze` from 4.37.8 to 4.37.9 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28...cdf488f595d80d6e07e03d4674febd5ab45fa938) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.37.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions-dependencies - dependency-name: github/codeql-action/analyze dependency-version: 4.37.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions-dependencies ... Signed-off-by: dependabot[bot] From 64ea4403482c417ab25547a0d12153d27a16644a Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 4 Sep 2026 05:13:07 +0000 Subject: [PATCH 2/2] Fix CI workflow container lint schema Co-authored-by: neilime <314088+neilime@users.noreply.github.com> --- .github/workflows/continuous-integration.yml | 40 ++++++++++++-------- 1 file changed, 25 insertions(+), 15 deletions(-) diff --git a/.github/workflows/continuous-integration.yml b/.github/workflows/continuous-integration.yml index ab43b43..06e3f5e 100644 --- a/.github/workflows/continuous-integration.yml +++ b/.github/workflows/continuous-integration.yml @@ -190,8 +190,6 @@ jobs: container-image: ${{ steps.parse.outputs.container-image }} container-env: ${{ steps.parse.outputs.container-env }} container-options: ${{ steps.parse.outputs.container-options }} - container-ports: ${{ steps.parse.outputs.container-ports }} - container-volumes: ${{ steps.parse.outputs.container-volumes }} container-username: ${{ steps.parse.outputs.container-username }} path-mapping: ${{ steps.parse.outputs.path-mapping }} steps: @@ -199,7 +197,7 @@ jobs: uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 env: CONTAINER_INPUT: ${{ inputs.container }} - CONTAINER_PASSWORD: ${{ secrets.container-password }} + CONTAINER_PASSWORD: ${{ secrets.container-password }} # zizmor: ignore[secrets-outside-env] reusable workflow validates private registry credentials before job container startup WORKING_DIRECTORY: ${{ inputs.working-directory }} with: script: | @@ -255,16 +253,28 @@ jobs: core.setOutput('container-env', JSON.stringify(container.env)); } - if (container.options) { - core.setOutput('container-options', container.options); - } - if (container.ports) { - core.setOutput('container-ports', JSON.stringify(container.ports)); + if (!Array.isArray(container.ports)) { + return core.setFailed('Container ports must be an array.'); + } + + container.options = [container.options, ...container.ports.map(port => `--publish ${port}`)] + .filter(Boolean) + .join(' '); } if (container.volumes) { - core.setOutput('container-volumes', JSON.stringify(container.volumes)); + if (!Array.isArray(container.volumes)) { + return core.setFailed('Container volumes must be an array.'); + } + + container.options = [container.options, ...container.volumes.map(volume => `--volume ${volume}`)] + .filter(Boolean) + .join(' '); + } + + if (container.options) { + core.setOutput('container-options', container.options); } if (container.credentials?.username) { @@ -318,12 +328,12 @@ jobs: contents: read packages: read container: &ci-container - image: ${{ needs.prepare.outputs.container-image || '' }} + image: ${{ needs.prepare.outputs.container-image || '' }} # zizmor: ignore[unpinned-images] reusable workflow intentionally accepts caller-provided container images env: ${{ fromJSON(needs.prepare.outputs.container-env || '{}') }} options: ${{ needs.prepare.outputs.container-options || ' ' }} - ports: ${{ fromJSON(needs.prepare.outputs.container-ports || '[]') }} - volumes: ${{ fromJSON(needs.prepare.outputs.container-volumes || '[]') }} - credentials: ${{ fromJSON(needs.prepare.outputs.container-username && format('{{"username":{0},"password":{1}}}',toJSON(needs.prepare.outputs.container-username),toJSON(secrets.container-password)) || '{}') }} + credentials: + username: ${{ needs.prepare.outputs.container-username || '' }} + password: ${{ secrets.container-password || '' }} # zizmor: ignore[secrets-outside-env] private registry container authentication is configured at the job container level outputs: working-directory: ${{ steps.working-directory.outputs.absolute-path }} build-env: ${{ steps.build-variables.outputs.env }} @@ -508,7 +518,7 @@ jobs: with: container: ${{ inputs.container != '' && 'true' || 'false' }} working-directory: ${{ needs.setup.outputs.working-directory }} - build-secrets: ${{ secrets.build-secrets }} + build-secrets: ${{ secrets.build-secrets }} # zizmor: ignore[secrets-outside-env] build secrets are intentionally forwarded to the build action build-commands: ${{ needs.setup.outputs.build-commands }} build-env: ${{ needs.setup.outputs.build-env }} build-artifact: ${{ needs.setup.outputs.build-artifact }} @@ -577,4 +587,4 @@ jobs: coverage: ${{ steps.prepare-test-options.outputs.coverage }} report-file: ${{ steps.prepare-test-options.outputs.report-file }} path-mapping: ${{ needs.prepare.outputs.path-mapping || '' }} - github-token: ${{ secrets.github-token || github.token }} + github-token: ${{ secrets.github-token || github.token }} # zizmor: ignore[secrets-outside-env] reusable workflow token override is intentional