chore(deps): bump docker/setup-qemu-action from 3 to 4 - #21
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) from 3 to 4. - [Release notes](https://github.com/docker/setup-qemu-action/releases) - [Commits](docker/setup-qemu-action@v3...v4) --- updated-dependencies: - dependency-name: docker/setup-qemu-action dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
srpatcha
left a comment
srpatcha
left a comment
There was a problem hiding this comment.
Approving. Target verified against the upstream release list, and the two red
checks are pre-existing.
The failing checks are not this PR
Lint & Format and Quick Checks fail on all five open Dependabot PRs
identically, and on master. Reproduced locally against master:
$ ruff check eosim/
Found 324 errors.
$ ruff format --check eosim/
178 files would be reformatted, 15 files already formatted
So the lint gate has been red for some time and every PR inherits it. That is
worth someone's attention on its own — a permanently red required-adjacent check
trains people to ignore it, which is how a real failure gets waved through — but
it is not a reason to hold a version bump.
Verified
All five targets in this batch exist and are current:
docker/setup-qemu-action v4 latest v4.2.0
actions/checkout v7 latest v7.0.1
ossf/scorecard-action v2.4.4 latest v2.4.4
actions/download-artifact v8 latest v8.0.1
actions/github-script v9 latest v9.0.0
I check these rather than assume Dependabot picked a real tag — worth doing,
since a bump to a tag that does not exist fails at runtime with a confusing
error rather than at review.
EoSim is also one of the repositories whose ci.yml is correctly configured
(branches: [master, main, develop]), so unlike six of its siblings its CI
actually runs on pull requests. That is why these PRs have real check results at
all.
srpatcha
left a comment
srpatcha
left a comment
There was a problem hiding this comment.
Review — EoSim#21 "chore(deps): bump docker/setup-qemu-action from 3 to 4"
head: c1acb7f author: app/dependabot ci: fail (Lint & Format, Quick Checks — both pre-existing on master, not caused by this PR)
Verdict: The one-line bump itself is safe by inspection — release.yml:78 passes no inputs, and v4's only breaking change is the Node 24 runtime, which ubuntu-latest satisfies. What is not safe is the state this PR is sitting in: two checks are red, CI Summary is green anyway because it cannot fail, master requires no status checks at all, and the PR is already APPROVED + MERGEABLE. Findings 1 and 2 are pre-existing EoSim CI defects, not defects in this diff, but they are the reason this diff carries no evidence.
Findings
| # | Severity | File:line | Finding | Recommended fix |
|---|---|---|---|---|
| 1 | High | .github/workflows/ci.yml:263-278 | CI Summary is a gate that cannot fail. ci-summary declares needs: [lint, test, coverage, validate-platforms, simulator-smoke, docs, security, build] and if: always(), and its only step echoes ${{ needs.*.result }} into $GITHUB_STEP_SUMMARY. Nothing evaluates those results. On this PR lint failed, six downstream jobs were skipped, and CI Summary reported pass in 5s. Combined with finding 2 that green tick is the only aggregate signal a reviewer sees. Already covered by the §28.2 proposal of 2026-09-02 ("An aggregating gate job must fail on any non-success among its dependencies"); this is a fifth instance. |
Add a final step to ci-summary: fail if any needed result is not success or skipped-because-not-required. Smallest form: `if [ "${{ needs.lint.result }}" != "success" ] |
| 2 | High | Repo settings — master branch protection |
gh api repos/embeddedos-org/EoSim/branches/master/protection returns required_status_checks: null with required_approving_review_count: 1. Protection is configured, a human review is required, and no check is required. All five open dependabot PRs (#21-#25) report mergeStateStatus: UNSTABLE, reviewDecision: APPROVED, mergeable: MERGEABLE — each is one click from merging with a red pipeline. Already covered by the §28.3 proposal of 2026-09-03 and its addendum; EoSim is a fifth repository confirmed in the same state, and the first Tier-1 one. |
Repository setting, needs admin: require CI Summary once finding 1 makes it capable of failing. Requiring it before that fix would make things worse, not better — order matters. |
| 3 | High | .github/workflows/ci.yml:226 | pip install -e "." && pip-audit --strict 2>/dev/null || true. The || true discards the audit's exit status and 2>/dev/null discards its diagnostics, so the Security Scan check reports pass unconditionally — it did so on this PR in 21s. safety is installed at :224 and never invoked. Per .ai/reviewer.md, a security step that reports success without having meaningfully run is not rounded down. Pre-existing, not introduced here. |
Drop || true and 2>/dev/null. If a known-unfixable advisory is blocking, --ignore-vuln <ID> it explicitly so the exception is visible and dated, rather than suppressing every finding forever. Either invoke safety or stop installing it. |
| 4 | Medium | CI state — Lint & Format, Quick Checks | Both fail, on pre-existing ruff violations in EoSim's own source, not on anything in this diff. Lint & Format (run 33365422715): eosim/plugins/loader.py:4:1 I001, eosim/tests/runner.py:45,50 UP031, eosim/tests/scenarios.py:43,54,58 UP031. Quick Checks (run 33365422706) is the same class, wider: F401 in eosim/analysis/power.py:4, eosim/analysis/safety.py:4, eosim/api/websocket.py:4,17, eosim/artifacts/__init__.py:3; N806 in eosim/api/routes.py:93,114,136; UP031 across eosim/cli/main.py. master is red on lint and every EoSim PR inherits it. Because test, coverage, validate-platforms, simulator-smoke, docs and build all declare needs: lint, nothing downstream of lint has run on any of these PRs. |
Not this PR's job to fix, and it should not be asked to. Land a ruff check --fix / ruff format pass on master first; until then no EoSim PR can produce build or test evidence. |
| 5 | Low | .github/workflows/release.yml:78 | The changed action is only reachable from release.yml's docker job, which triggers on tag push. No PR workflow uses docker/setup-qemu-action, so this PR's own CI cannot exercise the bump even once lint is green. The first execution of setup-qemu-action@v4 in this repo will be a release. |
Note it in the merge decision. If you want evidence before a tag, dispatch release.yml manually against a throwaway pre-release tag, or add a workflow_dispatch build-only path. |
Not a finding, recorded as checked. v4's changes are Node 24 default runtime (requires Actions Runner ≥ 2.327.1 — ubuntu-latest hosted runners are well past this), ESM conversion, and dependency bumps. release.yml:78 invokes the action with no with: block, so no input was renamed or removed out from under it. docker/setup-buildx-action and the QEMU/binfmt contract between them are unchanged by this bump.
Architecture conformance
Conforms. Infrastructure-tier change (master design §21, "Infrastructure — .github, website, docs, CI templates") to a Tier-1 Foundation repository. No source file, #include, link line or manifest entry, so §5.1 dependency direction is untouched. Findings 1-4 do bear on §17, which makes EoSim an adoption primitive whose "CI tests [share] the same application artifacts used on real hardware" — a CI pipeline whose aggregate gate cannot fail and whose lint stage blocks every downstream job is not producing the evidence §17 and §28 assume it does. That gap is already filed as the §28.2 and §28.3 proposals; no new proposal is warranted from this PR.
Proposed changes
Nothing to change in this diff. Order of operations for the repository:
ruff check --fix . && ruff format .onmaster, landed on its own, so lint goes green and the rest of the pipeline can run at all (finding 4).- Make
ci-summaryfail on any non-success dependency (finding 1) and remove the|| true/2>/dev/nullfrom the audit step (finding 3). - Only then require
CI Summaryin branch protection (finding 2). - Merge this bump once its pipeline has actually run.
Verification I ran
gh api repos/embeddedos-org/EoSim/branches/master/protection→required_status_checks: null,required_approving_review_count: 1.gh pr view 21..25 --json mergeStateStatus,reviewDecision,mergeable→UNSTABLE APPROVED MERGEABLEfor all five.gh run view --job 99405013134 --log-failedand--job 99405013285→ the ruff violations quoted in finding 4, and##[error]Process completed with exit code 1.- Read
.github/workflows/ci.yml,release.yml,scorecard.ymlandauto-assign.ymlfromorigin/master, not from the working tree — see "Not checked". - Confirmed by grep over
git ls-tree origin/master .github/workflows/that EoSim uses neitherpull_request_targetnorworkflow_runanywhere.
Not checked
- Nothing was executed. No workflow was run, dispatched or simulated.
docker/setup-qemu-action@v4has not been observed working in this repository by me or by CI; finding 5 is the reason. - The local EoSim checkout is dirty (179 modified tracked
.pycfiles) and two commits behindorigin/master, so the sync step correctly left it alone. Every file above was read fromorigin/masterviagit show. I did not stash, reset or check out anything. - I did not verify the Actions Runner version on any self-hosted runner; the Node 24 requirement is safe for
ubuntu-latesthosted runners and I did not check whether EoSim uses self-hosted runners anywhere. - I did not confirm that fixing lint would make
test/coverage/simulator-smokepass — they have not run, so their state is unknown, not green.
Automated architecture review of c1acb7f27951 — scheduled, model claude-opus-5, checked against the EmbeddedOS Master Design v2.0. Advisory only: this reviewer never approves, requests changes, or merges. Reply here to discuss or push back — a wrong finding is a bug worth reporting.
1 participant
Bumps docker/setup-qemu-action from 3 to 4.
Release notes
Sourced from docker/setup-qemu-action's releases.
... (truncated)
Commits
96fe6efMerge pull request #315 from docker/dependabot/npm_and_yarn/docker/actions-to...31f08d3[dependabot skip] chore: update generated content4e7017abuild(deps): bump@docker/actions-toolkitfrom 0.91.0 to 0.92.00eca235Merge pull request #314 from crazy-max/fix-yarn-preapprove-actions-toolkitea66a41chore: allow actions-toolkit to bypass yarn age gate451542bMerge pull request #308 from docker/dependabot/npm_and_yarn/undici-6.27.0532ae00[dependabot skip] chore: update generated contentb6f5af6build(deps): bump undici from 6.26.0 to 6.27.0cf96b86Merge pull request #304 from docker/dependabot/npm_and_yarn/tmp-0.2.7f0ba643[dependabot skip] chore: update generated contentDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)