chore(deps): bump the github-actions group with 4 updates

[dependabot]

Bumps the github-actions group with 4 updates: dorny/paths-filter, github/codeql-action/init, github/codeql-action/analyze and fallow-rs/fallow.

Updates dorny/paths-filter from 4.0.1 to 4.0.2

Release notes

Sourced from dorny/paths-filter's releases.

v4.0.2

What's Changed

• fix warning message by @​cgundy in dorny/paths-filter#282
• chore: fix GitHub spelling in logs by @​squat in dorny/paths-filter#278
• fix: use rev-parse instead of branch --show-current for older git compat by @​saschabratton in dorny/paths-filter#303
• fix: work around git dubious ownership errors in container jobs by @​saschabratton in dorny/paths-filter#317
• docs: update changelog for v4.0.2 by @​saschabratton in dorny/paths-filter#318

New Contributors

• @​cgundy made their first contribution in dorny/paths-filter#282
• @​squat made their first contribution in dorny/paths-filter#278

Full Changelog: dorny/paths-filter@v4.0.1...v4.0.2

Changelog

Sourced from dorny/paths-filter's changelog.

Changelog

v4.0.2

• Work around git dubious ownership errors in container jobs
• Use rev-parse instead of branch --show-current for older git compat
• Fix warning message

v4.0.1

• Support merge queue

v4.0.0

• Update action runtime to node24

v3.0.3

• Add missing predicate-quantifier

v3.0.2

• Add config parameter for predicate quantifier

v3.0.1

• Compare base and ref when token is empty

v3.0.0

• Update to Node.js 20
• Update all dependencies

v2.11.1

• Update @​actions/core to v1.10.0 - Fixes warning about deprecated set-output
• Document need for pull-requests: read permission
• Updating to actions/checkout@v3

v2.11.0

• Set list-files input parameter as not required
• Update Node.js
• Fix incorrect handling of Unicode characters in exec()
• Use Octokit pagination
• Updates real world links

v2.10.2

• Fix getLocalRef() returns wrong ref

v2.10.1

• Improve robustness of change detection

v2.10.0

• Add ref input parameter
• Fix change detection in PR when pullRequest.changed_files is incorrect

v2.9.3

• Fix change detection when base is a tag

... (truncated)

Commits

• 7b450ff docs: update changelog for v4.0.2 (#318)
• 9280377 fix: work around git dubious ownership errors in container jobs (#317)
• f3ceefd fix: use rev-parse instead of branch --show-current for older git compat (#303)
• 61f87a1 chore: fix GitHub spelling in logs (#278)
• b82ff81 fix warning message (#282)
• See full diff in compare view

Updates github/codeql-action/init from 4.36.2 to 4.36.3

Release notes

Sourced from github/codeql-action/init's releases.

v4.36.3

No user facing changes.

Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.36.3 - 01 Jul 2026

No user facing changes.

4.36.2 - 04 Jun 2026

• Cache CodeQL CLI version information across Actions steps. #3943
• Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
• Update default CodeQL bundle version to 2.25.6. #3948

4.36.1 - 02 Jun 2026

No user facing changes.

4.36.0 - 22 May 2026

• Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894
• Add support for SHA-256 Git object IDs. #3893
• Update default CodeQL bundle version to 2.25.5. #3926

4.35.5 - 15 May 2026

• We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899
• For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #3791
• If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #3892
• Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #3880

4.35.4 - 07 May 2026

• Update default CodeQL bundle version to 2.25.4. #3881

4.35.3 - 01 May 2026

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. #3837
• Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. #3850
• Best-effort connection tests for private registries now use GET requests instead of HEAD for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. #3853
• Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. #3852
• Update default CodeQL bundle version to 2.25.3. #3865

4.35.2 - 15 Apr 2026

• The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #3795

... (truncated)

Commits

• 54f647b Merge pull request #3984 from github/update-v4.36.3-1f34ec164
• e78819e Trigger checks
• 2c9d3d6 Update changelog for v4.36.3
• 1f34ec1 Merge pull request #3983 from github/mbg/repo-props/ff-for-config-file-prop
• d5f0145 Log when repository property has a value but is ignored
• f27f563 Add test for when the FF is off
• 0025d0f Use FF
• f7fa18f Add FF for config file repo property
• 628fc3f Merge pull request #3979 from github/henrymercer/overlay-db-cleanup-size-tele...
• 9cfb67b Add clarifying comments
• Additional commits viewable in compare view

Updates github/codeql-action/analyze from 4.36.2 to 4.36.3

Release notes

Sourced from github/codeql-action/analyze's releases.

v4.36.3

No user facing changes.

Changelog

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.36.3 - 01 Jul 2026

No user facing changes.

4.36.2 - 04 Jun 2026

• Cache CodeQL CLI version information across Actions steps. #3943
• Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
• Update default CodeQL bundle version to 2.25.6. #3948

4.36.1 - 02 Jun 2026

No user facing changes.

4.36.0 - 22 May 2026

• Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894
• Add support for SHA-256 Git object IDs. #3893
• Update default CodeQL bundle version to 2.25.5. #3926

4.35.5 - 15 May 2026

• We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899
• For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #3791
• If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #3892
• Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #3880

4.35.4 - 07 May 2026

• Update default CodeQL bundle version to 2.25.4. #3881

4.35.3 - 01 May 2026

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. #3837
• Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. #3850
• Best-effort connection tests for private registries now use GET requests instead of HEAD for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. #3853
• Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. #3852
• Update default CodeQL bundle version to 2.25.3. #3865

4.35.2 - 15 Apr 2026

• The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #3795

... (truncated)

Commits

• 54f647b Merge pull request #3984 from github/update-v4.36.3-1f34ec164
• e78819e Trigger checks
• 2c9d3d6 Update changelog for v4.36.3
• 1f34ec1 Merge pull request #3983 from github/mbg/repo-props/ff-for-config-file-prop
• d5f0145 Log when repository property has a value but is ignored
• f27f563 Add test for when the FF is off
• 0025d0f Use FF
• f7fa18f Add FF for config file repo property
• 628fc3f Merge pull request #3979 from github/henrymercer/overlay-db-cleanup-size-tele...
• 9cfb67b Add clarifying comments
• Additional commits viewable in compare view

Updates fallow-rs/fallow from 2.103.0 to 3.0.0

Release notes

Sourced from fallow-rs/fallow's releases.

v3.0.0: new brand, styling audit, rule packs, and architecture guard

Fallow 3.0

Your code-health gate now reviews your styles. Same PR, same JSON, no new tool.

Fallow 3.0 is a major release for one reason: fallow audit, the gate that already reviews your TypeScript and JavaScript, now reviews your CSS and CSS-in-JS in the same PR, in the same JSON stream, with no separate tool and no extra config. That is the change that crossed the version to 3.0.

Alongside it: policy-as-code with rule packs, a pre-edit architecture guard, better PR and MR reporting, and a new brand mark.

No breaking changes. CLI flags, configuration, and JSON output contracts are all unchanged. The major bump marks the platform milestone (styling in audit), not a breaking API change. GitHub Action users on @v2 should move to @v3 to keep receiving releases.

npm install -g fallow@3.0.0
# or
npx fallow@3.0.0

Styling analysis, now inside fallow audit

Run fallow audit on your next PR and styling feedback lands next to your JS and TS findings, in the same JSON. No new command, no new config, no second tool. Findings are verdict-neutral by default: they report, they do not fail the gate. What you get:

• Design-system drift and near-duplicate theme tokens
• Duplicate CSS blocks and selector-complexity hotspots
• Dead styling surface and broken references
• Raw one-off values that bypass your tokens

The deep pass scans the project-wide styling surface, then narrows cross-file results back to the anchors the PR touched. A two-file change gets styling feedback scoped to those two files, not a repo-wide dump.

Two new findings, css-token-drift and raw-style-value, flag introduced raw values on design-system axes: colors, font sizes, line heights, radii, and shadows. They are low-confidence and verify-first, so they stay off the gate until you opt in:

// gate on drift once you trust it
"rules": { "css-token-drift": "error" }

Dialing it back:

• --no-css (or audit.css: false) disables styling analysis entirely.
• --no-css-deep (or audit.cssDeep: false) keeps the local styling checks and skips only the project-wide reachability pass.

Styling actions are report-only (auto_fixable: false). Agents surface the finding and let you verify and edit by hand, rather than rewriting your styles for you.

Custom rules: policy as code

Encode your architecture in declarative rule packs, enforce them in the same gate, and let agents check the rules before writing a line.

• Authoring. fallow rule-pack init | list | test | schema scaffolds, inspects, and validates policy packs. init drops in a starter or architecture-oriented pack and can wire it straight into your config. list shows loaded packs with their sources, severities, matchers, and messages (human or JSON). test and schema validate a pack before you ship it.
• V2 matchers. Scope rules to boundary zones, ban direct exports with banned-export, and use a trailing /* banned-import specifier for subpath-only deep-import bans. Everything reports under one stable policy-violation family, so existing suppressions and CI keep working untouched.
• A guard that runs before the edit. fallow guard <files> tells you which rules govern a file before a line is written: its boundary zone, allowed import zones, forbidden call patterns, rule-pack rules, effective severities, and suppression tokens. It works on files that do not exist yet, and it is exposed as the read-only MCP guard tool, so an agent can ask "what rules apply here?" and stay inside the lines from the first draft.

... (truncated)

Changelog

Sourced from fallow-rs/fallow's changelog.

Changelog

All notable changes to fallow are documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

[3.0.0] - 2026-07-04

Added

• Rule-pack authoring commands for repo-wide policy linting. fallow rule-pack now exposes init, list, test, and schema as one command family. init can scaffold starter and architecture-oriented packs, wire them into the local config when possible, and print a manual snippet otherwise. list shows the loaded packs, source files, effective severities, matcher patterns, and rule messages in human or JSON form, giving teams a clearer path to project-specific guardrails without hand-authoring every file from scratch.

• Pre-edit architecture guard reports for agents and humans. fallow guard reports the boundary zone, allowed import zones, forbidden call patterns, rule-pack policy rules, effective severities, suppression tokens, and notes for one or more files before code is written. It is config-only, works for files that do not exist yet, and is also exposed as the read-only MCP guard tool so agents can ask which repo-wide rules apply before editing.

• Rule-pack V2 matchers for architecture policy. Rule-pack rules can now be scoped to boundary zones, ban direct exports via banned-export, and use a trailing /* banned-import specifier for subpath-only deep-import bans. These all continue to report as policy-violation, so existing suppressions and CI integrations keep one stable issue family.

• Richer PR and MR reporting for GitHub Actions and GitLab CI. The bundled CI integrations now render sticky summary comments from typed Rust output, with a gate table, an attention banner, top fixes, and sidecar artifacts for full drilldown. Clean runs no longer create a new sticky comment; if an older Fallow comment already exists, the integration updates it so stale warnings disappear. GitHub Actions also posts a native Fallow Check Run from the same decision artifact when checks: write is available, while workflow annotations and job summaries prefer the typed sidecars before falling back to the legacy jq summaries. Inline GitHub review comments and GitLab MR discussions skip clean zero-comment envelopes, so dead-code-only jobs no longer leave "0 inline findings" timeline noise.

• fallow audit now includes styling findings by default. Audit now runs CSS and CSS-in-JS analytics in the normal PR gate and emits verdict-neutral styling findings for design-system drift, duplicate CSS blocks, selector complexity, dead styling surface, broken references,

... (truncated)

Commits

• 630722b chore: release v3.0.0
• 348caa5 feat(core): add rule-pack v2 matchers
• 7989267 feat(cli): add pre-edit architecture guard reports
• 691c3f9 feat: add v3 styling analysis integration
• 2c67798 feat(cli): add rule-pack authoring commands
• d4e8a86 fix(brand): update GitHub Pages favicon to the f-wing mark
• 80dd2c3 feat(brand): new fallow f-wing logo (#1733)
• 0dac94e feat(action): post PR output as the branded Fallow app (#1737)
• 606685c chore: fix vscode guard dist check
• ac7df1b refactor(architecture): finish engine and registry split
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions