[dependabot]

Bumps the github-actions group with 2 updates: sebastienrousseau/pipelines/.github/workflows/node-ci.yml and sebastienrousseau/pipelines/.github/workflows/security.yml.

Updates sebastienrousseau/pipelines/.github/workflows/node-ci.yml from 980375f1d96368885ff65cc4c7f1ff355a5a4095 to 83114142d0a14e9c6302a9ba9e716a0cc53e4e01

Changelog

Sourced from sebastienrousseau/pipelines/.github/workflows/node-ci.yml's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog.

[0.0.3] - 2026-10-26

Fixed

• rust-ci.yml and docs.yml now build on the toolchain the caller asks for. dtolnay/rust-toolchain only runs rustup default, and a caller's rust-toolchain.toml beats that, so a repo pinning stable there ran its MSRV and nightly jobs on stable while they reported green (staticdatagen's msrv job built with 1.99.0 while asking for 1.88.0). Every job that installs inputs.rust-version now exports RUSTUP_TOOLCHAIN, which beats the file, and fails unless rustc in use is the requested version. tests/validate.sh checks that every such install is pinned and verified.
• release.yml: the checkout stays clean so cargo publish can run (#7).
• node-ci.yml: test arguments reach pnpm's test script after a -- separator (#5).
• security.yml: dependency review uses moderate, the value the action accepts, instead of medium (8b4bfb5).
• rust-ci.yml coverage: package exclusion passes --exclude with --workspace, and tarpaulin arguments are a bash array, so globs and word splitting no longer break them (738590a, 1301362, 99a39f7).

Added

• rust-ci.yml: a coverage-exclude-packages input that leaves packages out of coverage (2d0f335, renamed in ee4d1cf).
• security.yml: an allow-ghsas input for the dependency-review job (4777ab1).
• release.yml: SBOMs for Python and Node are uploaded instead of discarded (#8), cross linkers are installed for the Linux targets (#9), and Rust crates publish through crates.io trusted publishing (#10).
• node-ci.yml: callers can opt into the packageManager field for pnpm (#12).

Changed

• Callers whose rust-toolchain.toml pins stable now get real nightly rustdoc builds from docs.yml (its default rust-version is nightly), as the input always promised.
• rust-ci.yml: the audit job installs a prebuilt cargo-audit instead of compiling it on every run (#11).
• python-ci.yml: ruff and mypy versions are pinned (#6).
• This repository's own Validate workflow runs on every pull request, not only on workflow changes: it is a required check, so a docs-only PR

... (truncated)

Commits

• 8311414 Merge pull request #16 from sebastienrousseau/feat/v0.0.3
• fb7c789 ci: run Validate on every pull request
• b31a772 chore: date the 0.0.3 release
• e558096 Merge pull request #15 from sebastienrousseau/feat/v0.0.3
• b09826d ci: move Scorecard to scorecard-action 2.5.0
• 4af8fad Merge pull request #14 from sebastienrousseau/feat/v0.0.3
• e0f6576 Merge main into feat/v0.0.3
• 2591bea test: look for mutable tags on uses: lines only
• 022dfee ci: pin staticcheck, govulncheck and actionlint
• 46d04ee docs(changelog): record what landed since v0.0.2
• Additional commits viewable in compare view

Updates sebastienrousseau/pipelines/.github/workflows/security.yml from 980375f1d96368885ff65cc4c7f1ff355a5a4095 to 83114142d0a14e9c6302a9ba9e716a0cc53e4e01

Changelog

Sourced from sebastienrousseau/pipelines/.github/workflows/security.yml's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog.

[0.0.3] - 2026-10-26

Fixed

• rust-ci.yml and docs.yml now build on the toolchain the caller asks for. dtolnay/rust-toolchain only runs rustup default, and a caller's rust-toolchain.toml beats that, so a repo pinning stable there ran its MSRV and nightly jobs on stable while they reported green (staticdatagen's msrv job built with 1.99.0 while asking for 1.88.0). Every job that installs inputs.rust-version now exports RUSTUP_TOOLCHAIN, which beats the file, and fails unless rustc in use is the requested version. tests/validate.sh checks that every such install is pinned and verified.
• release.yml: the checkout stays clean so cargo publish can run (#7).
• node-ci.yml: test arguments reach pnpm's test script after a -- separator (#5).
• security.yml: dependency review uses moderate, the value the action accepts, instead of medium (8b4bfb5).
• rust-ci.yml coverage: package exclusion passes --exclude with --workspace, and tarpaulin arguments are a bash array, so globs and word splitting no longer break them (738590a, 1301362, 99a39f7).

Added

• rust-ci.yml: a coverage-exclude-packages input that leaves packages out of coverage (2d0f335, renamed in ee4d1cf).
• security.yml: an allow-ghsas input for the dependency-review job (4777ab1).
• release.yml: SBOMs for Python and Node are uploaded instead of discarded (#8), cross linkers are installed for the Linux targets (#9), and Rust crates publish through crates.io trusted publishing (#10).
• node-ci.yml: callers can opt into the packageManager field for pnpm (#12).

Changed

• Callers whose rust-toolchain.toml pins stable now get real nightly rustdoc builds from docs.yml (its default rust-version is nightly), as the input always promised.
• rust-ci.yml: the audit job installs a prebuilt cargo-audit instead of compiling it on every run (#11).
• python-ci.yml: ruff and mypy versions are pinned (#6).
• This repository's own Validate workflow runs on every pull request, not only on workflow changes: it is a required check, so a docs-only PR

... (truncated)

Commits

• 8311414 Merge pull request #16 from sebastienrousseau/feat/v0.0.3
• fb7c789 ci: run Validate on every pull request
• b31a772 chore: date the 0.0.3 release
• e558096 Merge pull request #15 from sebastienrousseau/feat/v0.0.3
• b09826d ci: move Scorecard to scorecard-action 2.5.0
• 4af8fad Merge pull request #14 from sebastienrousseau/feat/v0.0.3
• e0f6576 Merge main into feat/v0.0.3
• 2591bea test: look for mutable tags on uses: lines only
• 022dfee ci: pin staticcheck, govulncheck and actionlint
• 46d04ee docs(changelog): record what landed since v0.0.2
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: github-actions. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[sebastienrousseau]

Folded into #215 (feat/v0.0.10).