From 1a697d4157232d7914ccb3f94b7c0f870822410f Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 10 Sep 2026 19:06:48 +0000 Subject: [PATCH 1/4] build(deps): bump github/codeql-action/init from 4.37.3 to 4.37.9 Bumps [github/codeql-action/init](https://github.com/github/codeql-action) from 4.37.3 to 4.37.9. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81...cdf488f595d80d6e07e03d4674febd5ab45fa938) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.37.9 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- .github/workflows/codeql.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 0162b66..a389770 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -56,7 +56,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Initialize CodeQL - uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4 + uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} From bdaf535a99c96e9127fe03a2127e127d9ed34fbe Mon Sep 17 00:00:00 2001 From: thrr87 <193831865+thrr87@users.noreply.github.com> Date: Thu, 10 Sep 2026 21:27:51 +0200 Subject: [PATCH 2/4] ci: update CodeQL steps together and group future updates --- .github/dependabot.yml | 4 ++++ .github/workflows/codeql.yml | 4 ++-- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 9a350e5..0a63a95 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -5,3 +5,7 @@ updates: schedule: interval: monthly open-pull-requests-limit: 5 + groups: + codeql: + patterns: + - github/codeql-action/* diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index a389770..e42570c 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -56,7 +56,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Initialize CodeQL - uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4 + uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} @@ -67,6 +67,6 @@ jobs: run: swift build --arch arm64 - name: Analyze - uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4 + uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 with: category: /language:${{ matrix.language }} From 0f23a8cb23829d853516c8118598dbec55122a26 Mon Sep 17 00:00:00 2001 From: thrr87 <193831865+thrr87@users.noreply.github.com> Date: Thu, 10 Sep 2026 21:32:19 +0200 Subject: [PATCH 3/4] ci: include verified upload-artifact v7 update --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 5240447..31550b9 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -97,7 +97,7 @@ jobs: - name: Upload dry-run artifacts if: inputs.dry_run - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: Codex-Limits-${{ inputs.version }} path: | From bba097dd7bed2a9db243de5965c45f064d3a3b09 Mon Sep 17 00:00:00 2001 From: thrr87 <193831865+thrr87@users.noreply.github.com> Date: Thu, 10 Sep 2026 21:50:07 +0200 Subject: [PATCH 4/4] test: wait for Grok descendants to be reaped after cancellation --- Tests/CodexLimitsTests/GrokBillingClientTests.swift | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/Tests/CodexLimitsTests/GrokBillingClientTests.swift b/Tests/CodexLimitsTests/GrokBillingClientTests.swift index ac5b64b..03fdf2a 100644 --- a/Tests/CodexLimitsTests/GrokBillingClientTests.swift +++ b/Tests/CodexLimitsTests/GrokBillingClientTests.swift @@ -180,8 +180,8 @@ final class GrokBillingClientTests: XCTestCase { let executable = try script(in: directory, body: """ /bin/sleep 60 & child=$! - printf '%s %s\\n' "$$" "$child" > '\(record.path)' trap 'kill "$child" 2>/dev/null; wait "$child" 2>/dev/null; exit 0' TERM + printf '%s %s\\n' "$$" "$child" > '\(record.path)' wait "$child" """) let started = Date() @@ -206,8 +206,15 @@ final class GrokBillingClientTests: XCTestCase { let pids = try String(contentsOf: record).split(whereSeparator: \.isWhitespace).compactMap { Int32($0) } XCTAssertEqual(pids.count, 2) for pid in pids { - XCTAssertEqual(kill(pid, 0), -1) - XCTAssertEqual(errno, ESRCH) + // The kernel can reap a killed descendant after its parent exits. + let deadline = ProcessInfo.processInfo.systemUptime + 1 + while kill(pid, 0) == 0, ProcessInfo.processInfo.systemUptime < deadline { + try await Task.sleep(for: .milliseconds(10)) + } + let result = kill(pid, 0) + let processError = errno + XCTAssertEqual(result, -1) + XCTAssertEqual(processError, ESRCH) } } }