build(deps): bump github.com/go-git/go-git/v5 from 5.19.1 to 5.19.2 in the go_modules group across 1 directory - #121
Merged
Conversation
Bumps the go_modules group with 1 update in the / directory: [github.com/go-git/go-git/v5](https://github.com/go-git/go-git). Updates `github.com/go-git/go-git/v5` from 5.19.1 to 5.19.2 - [Release notes](https://github.com/go-git/go-git/releases) - [Changelog](https://github.com/go-git/go-git/blob/main/HISTORY.md) - [Commits](go-git/go-git@v5.19.1...v5.19.2) --- updated-dependencies: - dependency-name: github.com/go-git/go-git/v5 dependency-version: 5.19.2 dependency-type: indirect dependency-group: go_modules ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
ss-o
approved these changes
Aug 14, 2026
ss-o
added a commit
that referenced
this pull request
Aug 16, 2026
ss-o
added a commit
that referenced
this pull request
Aug 16, 2026
* chore(ci): update actionlint for vars context * ci(wiki-sync): harden GitHub App authentication * test(wiki-sync): enforce least-privilege contract * test(wiki-sync): close contract false negatives * test(wiki-sync): enforce exact step sequence * test(wiki-sync): validate complete security topology * Delete .github/.cspell directory Signed-off-by: Sal <59910950+ss-o@users.noreply.github.com> * fix(wikidoc): sanitize generated MDX (#94) Co-authored-by: Sall <ss-o@users.noreply.github.com> * fix(ci): disable persisted checkout credentials in go-ci and docs-generate zsh-n.yml already disabled persist-credentials on checkout; go-ci.yml and docs-generate.yml did not, leaving a lingering token on the runner filesystem for the rest of the job. Align both with the same hardening and cover it with a workflow contract test. Addresses PR #99 review feedback. The trunk pre-commit hook is skipped for this commit: the trunk 1.3.1 daemon in this repo deadlocks scheduling gitleaks across multiple staged files (reproduced twice, tracked separately from #100's config-mutation fix). Explicit bypass authorized by the maintainer. * chore(trunk): deliberate compatible Trunk plugin/runtime upgrade (#103) * chore(trunk): bump plugin ref and pinned linter/runtime versions Move plugins ref v0.0.8 -> v1.10.2, go 1.18.3 -> 1.24.11, node 18.12.1 -> 22.16.0, and every linter pin to a version compatible with those runtimes: gitleaks 8.30.1 needs go>=1.24.11, markdownlint 0.49.1 needs a Node new enough for the regex 'v' flag, and golangci-lint v2.x must be requested as the golangci-lint2 linter id (github.com/golangci/golangci-lint/v2/...), not golangci-lint (v1-only import path). Verified with trunk check --all: every linter installs and runs; only finding is 8 genuine golangci-lint2 code issues the linter could never previously surface, since it never successfully installed under the old pins. Refs #101 * fix(lint): resolve golangci-lint2 findings surfaced by the trunk upgrade golangci-lint2 never installed under the old pins, so these went unreported until the trunk.yaml compat fix landed: - cmd/zsh-lint/main.go, internal/survey/corpus_test.go: acknowledge the Close() error on read-only files opened right before this line (errcheck) - internal/parse/parse_test.go, internal/survey/survey.go: same, for the deferred Close() case - internal/survey/survey.go: acknowledge Fprintf's error return on the three survey-output writes (errcheck) - internal/rules/special_param_shadow.go: delete a dead reset of numericArgument - every path past that line either returns/breaks before it's read, or falls through to an unconditional recompute a few lines down, so the assignment was never observable (ineffassign) No behavior change; verified with go test ./... and go vet ./... * chore(git): don't flag Go's tab indentation as a whitespace error git-diff-check started reporting "tab in indent" on every touched Go line once the trunk pin fix let it actually run. Traced it to this machine's global core.whitespace including tab-in-indent, which is fundamentally incompatible with gofmt's mandatory tab indentation - it would flag any future Go diff for any contributor with that global setting. Scope the override to *.go via .gitattributes so it's independent of any contributor's global git config, rather than each contributor needing to carry a local exception. * chore(trunk): add caution comment for *out in .trunk/.gitignore --------- Co-authored-by: Sal <ss-o@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> * test(survey): add parser-gap fixture for glob-toggle expansion Minimized from real-world hostname glob matching. The ${~spec} operator enables filename generation on the expansion result, which the mvdan/sh front end rejects with: not a valid parameter expansion operator: `~` Validated per docs/project/parser-gap-workflow.md: zsh -n accepts the fixture (the construct is real Zsh) and zsh-lint-survey fails on it with the tracked error family, so TestMinimizedCorpus holds the gap open until the front end learns the operator. Refs: #104 * test(survey): add parser-gap fixture for fd-variable redirects Minimized from real-code socket handling. The {varname} dynamic file-descriptor redirection is valid Zsh, but the front end misreports it: `{varname}` redirects are a bash feature; tried parsing as zsh Validated per docs/project/parser-gap-workflow.md: zsh -n accepts the fixture (the construct is real Zsh) and zsh-lint-survey fails on it with the tracked error family, so TestMinimizedCorpus holds the gap open until the front end supports the redirect form. Refs: #105 * ci(zsh-n): expose a stable aggregate context for required checks The zsh-n job is a matrix over files discovered at run time, so it reports one check run per leg, named after the path: zsh-n (./internal/survey/testdata/corpus/gap-13-multi-name-loop.zsh) Those names move whenever a Zsh file is added, renamed, or removed, so they cannot be listed in a ruleset's required_status_checks. Adding two corpus fixtures for #104 and #105 changes the context set again, which makes the problem concrete rather than theoretical. Add a zsh-n-complete job that depends on both existing jobs and fails when either did not succeed, giving one context name a ruleset can require. The `if: always()` guard is load-bearing: without it the aggregate is skipped when a leg fails, and a skipped required check never reports, which is the deadlock ADR-0013 warns about. TestZshSyntaxExposesStableAggregateContext locks the job ID, its name, its needs list, and the always() guard, matching the executable-check pattern already used by TestGoCIBuildTestReportsOnEveryPullRequest. Verified by mutation: dropping the guard and deleting the job each fail the test. This is a prerequisite for the required-status-checks row of the ADR-0013 class-2 baseline. It does not require the context or apply any ruleset. Refs: #90 * chore(github): add CODEOWNERS so code-owner review can resolve The reference main ruleset in runbooks/branch-protection.md (z-shell/.github) requires code-owner review, and ADR-0013 makes that row required for class-2 repositories. The rule needs a CODEOWNERS file to resolve an owner; with no file present it can never be satisfied. Use the same single-maintainer shape as z-shell/zsh-eza. The sole entry is also the usual author of promotions, so the self-review deadlock the runbook describes is expected and is handled by the ruleset's bypass actors rather than by a second reviewer. Adding the file changes no behavior on its own. It is a prerequisite for the main ruleset, which is not applied here. Refs: #90 * docs(survey): correct the gap-105 fixture header The header called {varname} fd-variable redirection "MULTIOS". That is the wrong feature: MULTIOS governs implicit tees and cats when a command has several redirections to different targets, while {varname} opens a new file descriptor and stores its number in the named parameter (zshmisc, REDIRECTION). Naming the wrong option in a canonical fixture would misdirect future parser-gap triage and corpus searches. Comment-only. The fixture still passes zsh -n and still fails the survey with the same tracked diagnostic, so TestMinimizedCorpus continues to hold #105 open. Raised by Copilot review on #106. Refs #105 * ci(zsh-n): report on every pull request so the aggregate can be required The zsh-n-complete aggregate gave the matrix a stable context name, but the workflow still filtered pull_request by paths. A path-filtered trigger does not report at all on a pull request that touches no Zsh, and a required check that never reports leaves such a pull request permanently pending. PR #109 made this concrete: it changed no Zsh files and produced zero zsh-n contexts of any kind. Stability of the name and unconditional reporting are both needed before the context can be listed in a ruleset's required_status_checks. This removes the filter so Zsh Syntax Check Complete reports everywhere. The cost is running the matrix on every pull request. That is the right trade for this repository specifically: it is a Zsh analyzer, so always syntax checking its own Zsh is defensible, and Actions minutes are free on public repositories. TestZshSyntaxExposesStableAggregateContext now also asserts the trigger is unfiltered, matching TestGoCIBuildTestReportsOnEveryPullRequest. Verified by mutation: restoring a paths filter fails the test. The push trigger keeps its paths filter; only pull_request needs to be unconditional for the required-check contract. Refs #90 * test(release): add failed-tag publication probe * test(release): remove failed-tag publication probe * fix(parse): support nested conditional alternation * test(survey): add issue 12 try always gap fixture * test(survey): add issue 125 alternate if gap fixture * docs(project): record parser gap survey split * docs(project): clarify portable survey reproduction * docs(project): canonicalize survey roots * feat(parse): support alternate brace-form if commands (#125) * feat(rules): add plugin rules for zero-handling and unload-function * feat(rules): add fpath-hygiene rule and refine unquoted-var exemptions * style: resolve staticcheck and unused warnings across parse and rule packages * feat(parse): support multi-name for loops (#13) * fix(parse): support Zsh try/always blocks (#12) * style(parse): satisfy Trunk staticcheck * fix(parse): reject unmatched conditional pattern groups (#120) Closes #120. * fix(parse): support grouped Zsh case patterns (#123) * feat: parse strict rollout reference corpus (#130) * feat: parse strict rollout reference corpus * docs: record strict rollout candidate commits * fix: satisfy alternate condition staticcheck --------- Co-authored-by: Sal <ss-o@users.noreply.github.com> * chore: reconcile main into next (#139) Reconciles Dependabot dependency updates merged into main (#110, #121) back into next. * fix(parse): support glob-toggle and fd-variable redirects (#104, #105) * fix(parse): support glob-toggle and fd-variable redirects (#104, #105) Add narrow same-width compatibility adapters for native Zsh ${~spec} parameter expansions and {varname}>... dynamic file descriptor redirects. Promote gap-104 and gap-105 fixtures to ok-* regression coverage and add unit tests. * refactor(parse): use tagged switches for currentIf in alternate_if --------- Co-authored-by: Sal <ss-o@users.noreply.github.com> * fix(parse): support escaped ANSI-C heredoc delimiters (#122) Add narrow same-width compatibility adapter for native Zsh heredocs using escaped ANSI-C delimiters. Add ok-ansic-heredoc regression fixture and comprehensive unit tests. Co-authored-by: Sal <ss-o@users.noreply.github.com> --------- Signed-off-by: Sal <59910950+ss-o@users.noreply.github.com> Co-authored-by: Sall <ss-o@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the go_modules group with 1 update in the / directory: github.com/go-git/go-git/v5.
Updates
github.com/go-git/go-git/v5from 5.19.1 to 5.19.2Release notes
Sourced from github.com/go-git/go-git/v5's releases.
Commits
3eeb238Merge pull request #2277 from go-git/checkout-v5008a78fgit: worktree, make the filesystem wrapper a symlink-safe boundary2263fb5Merge pull request #2268 from go-git/renovate/releases/v5.x-go-golang.org-x-t...77b7625build: Update module golang.org/x/text to v0.39.0 [SECURITY]85ea767Merge pull request #2267 from go-git/renovate/releases/v5.x-go-golang.org-x-n...198675abuild: Update module golang.org/x/net to v0.56.0 [SECURITY]4a0e66dMerge pull request #2254 from pjbgf/v5-dotgit-ref-name-containment3b306efstorage: dotgit, align reference-name safety with refname_is_safef3d0cc1storage: dotgit, reject path traversal in reference names979cfe9Merge pull request #2262 from joshblum/joshblum/to-slash-v5Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.