Repository navigation
chore(deps): bump @holochain/tryorama from 0.19.0-dev.2 to 0.19.2 in the root-npm group across 1 directory - #45
Open
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ❌ Deployment failed View logs |
floss | e0ce3b2 | Aug 23 2026, 10:57 PM |
kalisam
added a commit
that referenced
this pull request
Aug 23, 2026
…check
Codex, P1, and correct. I documented this exact trap on python-ci.yml's trigger
and then reproduced it one file over.
`Compile check (wasm32)` and `Format` are meant to be required. GitHub leaves a
required check PENDING -- not passing -- when its workflow is skipped by path
filtering, so the `pull_request` paths filter would hang every PR that touches
no Rust.
Measured against the PRs actually open right now, rather than argued:
#43 26 files 0 rust-matching
#45 2 files 0
#49 2 files 0
#51 2 files 0
#53 2 files 0
#54 1 file 0
Six of seven. Every one of them would have sat pending forever the moment the
check was marked required.
Fixed the way Codex suggested, which is better than simply dropping the filter:
run on every pull request and skip the expensive work, rather than skipping the
workflow. A `changes` job diffs against the base ref and sets one output; `fmt`
and `wasm-check` always run and always report, but their toolchain setup, cargo
cache and actual cargo invocation are gated on it. A non-Rust PR gets a green
check in seconds with an explicit "No Rust changes" step saying why, and no
cache write.
The detector is plain git plus grep -- no third-party action, which matters in a
workflow whose other change this cycle was pinning a third-party action to a
SHA. Non-pull_request events (push, schedule, merge_group, workflow_dispatch)
always take the full path.
Regex verified against real paths: ARF/src/lib.rs, ARF/Cargo.toml,
ARF/Cargo.lock and .github/workflows/rust-ci.yml match; requirements-ci.txt,
docs/x.md and packages/y.py do not.
The held clippy/test/clippy-sarif jobs are untouched and still dispatch-only.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RRe5kvLPeiJetoM7xUHFNW
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/root-npm-328357c1b0
branch
from
August 23, 2026 22:56
bef6f46 to
e0ce3b2
Compare
kalisam
added a commit
to kalisam/FLOSS
that referenced
this pull request
Sep 11, 2026
…asm32 Auditing the seven dependabot PRs that the new CI produced turned up one that breaks the build and two configuration faults that caused it to be invisible. PR G-0-B#46 breaks the wasm32 build, and every check passed ------------------------------------------------------- It bumps `getrandom` 0.3 -> 0.4 across all four rose_forest zomes. Measured: origin/main cargo check --workspace --target wasm32-unknown-unknown OK PR G-0-B#46 same command FAILS error[E0425]: cannot find function `inner_u32` in module `backends` --> getrandom-0.3.4/src/lib.rs `getrandom` is not an ordinary dependency of the zomes. Each declares `getrandom = { version = "0.3", features = ["wasm_js"] }` purely to switch on the wasm backend of the getrandom that hdi/hdk already pull in -- a feature-enabling shim, which only works while it resolves to the SAME version hdi requires. `cargo tree` confirms hdi 0.7.1, hdk 0.6.1 and holochain_nonce 0.6.1 all still require 0.3.4. After the bump both 0.3.4 and 0.4.3 are in the graph, `wasm_js` applies only to 0.4.3, and 0.3.4 is left with no backend. So it is ignored alongside hdi/hdk: it moves when the Holochain line moves. Native `cargo check` passes on that PR, which is why it looks harmless. The gate could not see it -------------------------- Every check on G-0-B#46 was green: green set, CodeQL, semgrep, and `cargo fmt`. `cargo fmt` does not compile anything, and `clippy`/`test` are held behind workflow_dispatch, so no job in CI compiled the zomes at all. A dependency bump that breaks the WASM build would have merged on a full green board. Added a `wasm-check` job: `cargo check --workspace --target wasm32-unknown-unknown`. It is deliberately NOT part of the clippy/test hold -- those are held because the full Holochain build and test surface is not expected to pass yet, whereas this is a type-check against the target the zomes actually ship to, and it is verified passing on main today. Two pip groups were fighting over one file ------------------------------------------- The `/` and `/ARF` entries produced G-0-B#51 and G-0-B#49, and BOTH edit ARF/requirements.txt -- guaranteed conflict, with the loser needing a manual rebase for no reason. The root entry already reaches that file on its own. Consolidated to a single pip entry using `directories:` for `/`, `/ARF`, and `/ARF/pwnies`. One group, one PR per cycle across the whole Python surface -- which also makes the green-set gate mean something, since the CI set and the application set now move together or not at all. Status of the other six, all green-set passing and none touching a pinned surface: G-0-B#45 tryorama, G-0-B#48 GitHub-owned actions (it did NOT disturb the dtolnay/rust-toolchain SHA pin), G-0-B#49 and G-0-B#51 python, G-0-B#53 commons-gateway, G-0-B#54 esbuild. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RRe5kvLPeiJetoM7xUHFNW
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/root-npm-328357c1b0
branch
from
September 13, 2026 16:50
e0ce3b2 to
8be1b31
Compare
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
floss | 2557587 | Commit Preview URL Branch Preview URL |
Oct 28 2026, 01:09 PM |
Contributor
|
Important Review skippedBot user detected. To trigger a single review, invoke the
 |
Bumps the root-npm group with 1 update in the / directory: [@holochain/tryorama](https://github.com/holochain/tryorama). Updates `@holochain/tryorama` from 0.19.0-dev.2 to 0.19.2 - [Release notes](https://github.com/holochain/tryorama/releases) - [Changelog](https://github.com/holochain/tryorama/blob/main/CHANGELOG.md) - [Commits](https://github.com/holochain/tryorama/commits) --- updated-dependencies: - dependency-name: "@holochain/tryorama" dependency-version: 0.19.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: root-npm ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/root-npm-328357c1b0
branch
from
October 28, 2026 13:07
8be1b31 to
2557587
Compare
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the root-npm group with 1 update in the / directory: @holochain/tryorama.
Updates
@holochain/tryoramafrom 0.19.0-dev.2 to 0.19.2Release notes
Sourced from @holochain/tryorama's releases.
Changelog
Sourced from @holochain/tryorama's changelog.
Commits