[dependabot]

Bumps the actions group with 2 updates: Swatinem/rust-cache and hyperpolymath/cicd-squabbler/.github/actions/squabble.

Updates Swatinem/rust-cache from 2.9.2 to 2.9.3

Release notes

Sourced from Swatinem/rust-cache's releases.

v2.9.3

What's Changed

• Issue-375: stop cleanup timestamp pruning after the first entry by @​TethysSvensson in Swatinem/rust-cache#377
• fix: log rustup toolchain list failure as info instead of warning by @​SDAChess in Swatinem/rust-cache#394

New Contributors

• @​TethysSvensson made their first contribution in Swatinem/rust-cache#377
• @​SDAChess made their first contribution in Swatinem/rust-cache#394

Full Changelog: Swatinem/rust-cache@v2.9.2...v2.9.3

Changelog

Sourced from Swatinem/rust-cache's changelog.

2.9.3

• Fix timestamp based pruning
• Add missing awaits
• Do not emit warning on missing rustup

Commits

• d1527c8 2.9.3
• f0fca6f update dependencies and rebuild
• b49b17f add missing awaits
• 6a7bc3e Bump the dev-minor group across 1 directory with 2 updates (#383)
• 4ece996 Bump the actions group across 1 directory with 6 updates (#392)
• 8103aff Bump the prd-minor group across 1 directory with 2 updates (#389)
• 0e361f3 fix: log rustup toolchain list failure as info instead of warning (#393) (#394)
• f0d9c38 Merge pull request #380 from Swatinem/dependabot/github_actions/actions-8ff58...
• ccd9742 Bump the actions group with 2 updates
• 258712b fix: stop cleanup timestamp pruning after the first entry (#377)
• Additional commits viewable in compare view

Updates hyperpolymath/cicd-squabbler/.github/actions/squabble from 14f853fde902ab2d7631070d87a9dc9122e01013 to b625e05da04c0b72fe2ca19bd009841ff982f43d

Changelog

Sourced from hyperpolymath/cicd-squabbler/.github/actions/squabble's changelog.

== Changelog

All notable changes to this project will be documented in this file.

The format is based on https://keepachangelog.com/en/1.1.0/[Keep a Changelog], and this project adheres to https://semver.org/spec/v2.0.0.html[Semantic Versioning].

=== [Unreleased]

==== Added

• .github/actions/squabble — a composite action that installs the squabble v0.1.0 release binary for other workflows and, optionally, runs it. It refuses any download whose sha256 is not the pinned digest, or whose build attestation does not name this repository's release.yml, the v0.1.0 tag and its source commit, on a GitHub-hosted runner; nothing runs until both pass. tests/squabble_action_test.sh (27 cases, with planted tampered downloads and planted action.yml mutants) runs in the new squabble-action.yml workflow. Linux x86_64 only.
• squabble chains — read-only cross-repo CI dependency chains (Phase A of docs/proposals/squabble-modes-and-app-layer.adoc). Pure analysis in squabble-core::chains: cycles and dead upstreams (blocking), diamonds, pin skew and tag/branch pins (warnings), an upstreams-first landing order, and the longest chain (a max-plus longest path, hop-weighted for now). Sources mix freely: local checkouts, and gh:owner/repo read through GitHub GraphQL. --follow N probes upstreams; action repos are probed for existence only, and reusable-workflow upstreams contribute only the files actually called. New exit code 4 = blocking chain finding.
• squabble-forge crate — GitHub GraphQL via gh api graphql, batched with aliases, owner/name passed as variables. Every query is validated in tests against a committed schema snapshot (graphql/github-schema.graphql, refresh with just graphql-schema-refresh). Records rateLimit cost; an exhausted budget marks the remaining repos unavailable rather than guessing. Truncated or binary blobs and renamed repos are reported as notes.
• scripts/install-toolchain.sh no longer pipes a network response into a shell. rustup is bootstrapped from the official rustup-init binary whose published SHA-256 is fetched over TLS from the same origin and verified before execution; a tampered, malformed or missing digest is a refusal. Creusot is cloned at the commit its tag pointed to and the checkout is verified before ./INSTALL runs; a version with no pinned commit is refused instead of being cloned from a moving tag.
• docs/CREUSOT.adoc — the toolchain split into the four layers that actually gate a verdict (manager, toolchain, cargo creusot, Why3 + solver), and a measured account of an environment that reaches only some of them: the rustup wheel on PyPI installs from an allow-listed channel, every dist server still refuses (tls handshake eof), and rust-lang/rust publishes no binary assets, so GitHub cannot stand in for one. Records what the status of the obligations is in that environment — unchanged — rather than a skip.
• fetch: PinWorkflowActions, ReconcileActionsPolicy and

... (truncated)

Commits

• b625e05 Zero-job startup failures as first-class classes; chains resolves canonical u...
• be2128b refactor(fight,cli): carry verified_allowed through the policy facts
• 5f5aed4 test(zero-job): a startup_failure without a usable id is refused, not skipped
• df6fff3 fix: review findings — 404 ambiguity, blocking moves, no-silent-skip, overflo...
• 5aeb95a fix(creusot): prevent overflow in acceptance count sums
• 1116372 fix(forge): validate an API path before it reaches gh argv
• 905771e fix(install): bootstrap rustup from a digest-verified binary and pin Creusot ...
• 9105c7a docs(reports): record the zero-job diagnosis: the callee owner is not admitted
• 776ba99 docs(creusot): split the toolchain into its four gating layers, and record wh...
• 6a7e6ab Fix two review findings: suffixed run paths, and a prove step over nothing
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: ecbb173b-550b-41bf-ae1d-6c4f5562861e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-29T05:25:48.057626Z	dc04ff4	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.