chore(deps): refresh dependencies and stabilize CI checks

[steipete]

Refresh the dependencies and workflow actions that pass ClawScan's local gates. Go updates jsonschema/v6 6.0.2 → 6.0.3 and x/text 0.14.0 → 0.41.0. The leaderboard now requires Gradio 6.26 and Hugging Face Hub 1.29. The npm promotion workflow uses npm 11.19.1 instead of 11.15.0. The npm wrapper itself has no package dependencies, and this repository does not maintain a changelog.

Update 16 Actions dependencies across 13 workflows, including checkout/setup-go/setup-node, artifact upload/download, Pages, Docker, CodeQL, dependency review, and stale. All 53 external action references resolve to verified release commits; actionlint and create-github-app-token were already current. Major upgrades retain the existing workflow inputs and permission boundaries.

The separate CI-fix commit makes five tests reliable on macOS and machines with Docker installed: budget fixtures use canonical temporary paths, target assertions preserve the input directory spelling, and unit tests use synthetic judges instead of invoking external tools. It also migrates publishing to the supported hf CLI, keeps credentials in the environment rather than argv, adds three publisher regression tests to CI, and fixes the checksum command's shellcheck warning. No release, merge, dataset upload, or runtime image publication was performed.

The baseline CI, Docs, CodeQL, and runtime workflows were green. The old Security Signals publisher failure is not fully resolved here: both June submissions use a dataset name rejected by the validator, and correcting only that name exposes a larger problem—the validator ignores the recorded revision and compares historical predictions with the current case set. A live probe found 3,365 unknown IDs, 3,334 missing IDs, and two unsupported labels. The partial metadata change was removed. Historical revision handling needs a separate change; validation has not been weakened and historical predictions remain untouched.

Held upgrades:

Dependency	Candidate	Reason
npm	12.0.2	npm pack --json returns an object rather than the array the builder expects; the package smoke failed. Latest npm 11 passes.
SkillSpector	8f37cfa1 → ed787e95	Requires the repository's runtime benchmark comparison, beyond install/help checks.
Cisco scanner	2.0.12 → 2.0.13	Runtime benchmark comparison not available in this wave.
Snyk agent scan	0.5.12 → 0.6.0	Runtime benchmark comparison not available in this wave.
Claude Code runtime	2.1.193 → 2.1.250	Runtime judge benchmark comparison not available in this wave.
Codex runtime	0.142.3 → 0.150.1	Runtime judge benchmark comparison not available in this wave.
Socket CLI	1.1.129 → 1.1.160	Runtime benchmark comparison not available in this wave.

The Docker base/toolchain choices are unchanged with the held runtime stack. AIG 0.2.1 and AgentVerus 0.8.1 were already current. No open Dependabot or Renovate PR is superseded.

Local proof: go test -count=1 ./... passed 619 tests/subtests across nine packages, with one expected filesystem-dependent skip; go vet ./..., module verification, gofmt, actionlint, and shellcheck passed. All 24 Node tests passed (5 wrapper, 10 package-builder, 6 runtime-push, 3 publisher). The built CLI printed help and completed a static scan. npm 11.19.1 passed six-platform build/pack/install/run smoke; six local release archives and seven docs pages built. Python installed 48 compatible packages, built the 12-component Gradio app, loaded two leaderboard rows, and validated the 3,368-case fixture. Five publisher behavior-contract checks passed, including upload failure propagation, with synthetic credentials and no network upload.

The full Go suite also passed with the exact CI toolchain, Go 1.26.1: 619 passes, one expected filesystem-dependent skip, nine passing packages.

Codex autoreview caught and corrected an annotated-tag-object pin for CodeQL. All 53 action references were reverified against peeled release commits; the full follow-up review reported no actionable findings.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 28, 2026, 1:13 AM ET / 05:13 UTC.

ClawSweeper review

What this changes

The branch refreshes Go, Python, npm, and GitHub Actions dependencies; stabilizes tests; adds publisher coverage; and switches Security Signals publishing to the hf CLI.

Merge readiness

⚠️ Ready for maintainer review - 3 items remain

Keep this PR open for normal merge review: it is a coherent, current maintenance bundle and current main is its verified base rather than an implementation of its changes.

Priority: P3
Reviewed head: 11033b352f1a505fe9d5a399f58be9f7306fd52e

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused maintenance patch with substantial stated validation; the remaining uncertainty is limited to protected operational workflows.
Proof confidence	🐚 platinum hermit (4/6)	Sufficient (live_output): The PR body provides detailed after-fix validation across the CLI, packaging, release, Python, and publisher paths; no credentialed upload was performed, which is appropriate for the supplied proof.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (live_output): The PR body provides detailed after-fix validation across the CLI, packaging, release, Python, and publisher paths; no credentialed upload was performed, which is appropriate for the supplied proof.
Evidence reviewed	6 items	Verified PR-owned scope: The verified merge-base-to-head diff is a 24-file maintenance bundle with 143 additions and 80 deletions; it is not present in the base current-main revision. Publisher keeps credentials out of argv: Publish mode still requires HF_TOKEN, verifies the hf executable, and invokes hf upload without placing the token in process arguments. Workflow permissions and immutable action pins: The publishing workflow retains its existing environment-secret boundary and uses full commit SHAs for the upgraded checkout, setup, and artifact actions.
Findings	None	None.
Security	None	None.

How this fits together

ClawScan’s workflows test, package, release, and publish the Go security-scanning CLI. The Security Signals publisher turns validated submissions into JSONL and uploads it to a Hugging Face dataset when its credential is available.

flowchart LR
  A[Source changes] --> B[CI workflows]
  B --> C[CLI and package checks]
  C --> D[Release and npm publishing]
  E[Accepted submissions] --> F[Results publisher]
  F --> G[Hugging Face dataset]

Loading

Before merge

• Resolve merge risk (P1) - Major action upgrades and the changed hf invocation affect release and dataset-publishing paths that normal pull-request checks cannot fully exercise.
• Resolve merge risk (P1) - The repository-required autoreview helper could not start because this review environment has no usable temporary directory; its independent review signal is unavailable.
• Complete next step (P2) - No discrete repair is identified; the remaining work is normal protected-workflow validation rather than an automated code change.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Automation surface	13 workflow files updated; 53 action references refreshed	The branch spans CI, release, npm, Pages, benchmark, and Security Signals automation.
Publisher coverage	55 new test lines; 1 CI test command added	The new publisher contract test is included in the normal test workflow.

Merge-risk options

Maintainer options:

1. Validate through protected workflow gates (recommended)
   Require the exact-head CI checks to complete, then use the next authorized release and dataset-publish dispatches to validate the upgraded action and hf paths.
2. Accept staged operational validation
   Merge the pinned updates with the understanding that protected release and credentialed publisher paths are only exercised by their authorized workflows.

Technical review

Best possible solution:

Merge after required checks complete, then validate the release-only and credentialed publishing paths through their next authorized workflow dispatches while preserving immutable action pins and environment-only credentials.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a dependency and automation maintenance pull request, not a report of broken existing behavior.

Is this the best way to solve the issue?

Yes: the patch preserves the workflow permission boundaries and moves the publisher credential out of command arguments; protected workflow runs remain the appropriate final validation boundary.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against f3ac276393cd.

Labels

Label changes:

• add P3: This is routine dependency and CI maintenance without a demonstrated production outage.
• add merge-risk: 🚨 automation: The branch changes versioned workflow actions and the command used for Security Signals dataset publication.
• add proof: sufficient: Contributor real behavior proof is sufficient. The PR body provides detailed after-fix validation across the CLI, packaging, release, Python, and publisher paths; no credentialed upload was performed, which is appropriate for the supplied proof.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The PR body provides detailed after-fix validation across the CLI, packaging, release, Python, and publisher paths; no credentialed upload was performed, which is appropriate for the supplied proof.

Label justifications:

• P3: This is routine dependency and CI maintenance without a demonstrated production outage.
• merge-risk: 🚨 automation: The branch changes versioned workflow actions and the command used for Security Signals dataset publication.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The PR body provides detailed after-fix validation across the CLI, packaging, release, Python, and publisher paths; no credentialed upload was performed, which is appropriate for the supplied proof.
• proof: sufficient: Contributor real behavior proof is sufficient. The PR body provides detailed after-fix validation across the CLI, packaging, release, Python, and publisher paths; no credentialed upload was performed, which is appropriate for the supplied proof.

Evidence

What I checked:

• Verified PR-owned scope: The verified merge-base-to-head diff is a 24-file maintenance bundle with 143 additions and 80 deletions; it is not present in the base current-main revision. (.github/workflows/ci.yml:75, 11033b352f1a)
• Publisher keeps credentials out of argv: Publish mode still requires HF_TOKEN, verifies the hf executable, and invokes hf upload without placing the token in process arguments. (scripts/publish-security-signals-results.sh:115, 11033b352f1a)
• Workflow permissions and immutable action pins: The publishing workflow retains its existing environment-secret boundary and uses full commit SHAs for the upgraded checkout, setup, and artifact actions. (.github/workflows/publish-security-signals-results.yml:13, 11033b352f1a)
• Feature history: The original Security Signals publisher and npm release workflow appear to date to Patrick Erichsen’s commits 2c59920 and f178c86; Jesse Merhi later updated the npm workflow in e63bacb. (scripts/publish-security-signals-results.sh:124, 2c599204336a)
• Contributor-supplied behavior proof: The PR body reports after-fix full Go-suite, CLI static-scan, npm package/release, Python app, and publisher-contract runs; the publisher test covers the environment-only credential invocation. (scripts/publish-security-signals-results.test.mjs:31, 11033b352f1a)
• Structured-review infrastructure limitation: The repository-required autoreview helper was invoked for the branch but could not create a usable temporary directory, so no helper verdict is claimed. (.agents/skills/autoreview/SKILL.md:1)

Likely related people:

• Patrick Erichsen: Introduced the original Security Signals publisher and npm release workflow in the current history. (role: original workflow and publisher author; confidence: high; commits: 2c599204336a, f178c861b898; files: scripts/publish-security-signals-results.sh, .github/workflows/npm-release.yml)
• Jesse Merhi: Recently changed the npm release workflow while adding install-policy support. (role: recent adjacent workflow contributor; confidence: medium; commits: e63bacb73e8e; files: .github/workflows/npm-release.yml)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Let the exact-head CI and runtime-image checks complete before merge.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.