Version updated for https://github.com/systeminit/setup-swamp to version v0.1.1. This action is used across all versions by 1 repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. What’s Changed Hide the whoami information from the output

Version updated for https://github.com/theadamdanielsson/overllm to version v0.7.0. This action is used across all versions by ? repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. What’s Changed Recall improvements + one new rule, each validated on ~14k files of real code (framework-heavy and amateur) with no new false positives. Matured call detection — follow a model through composition. LangChain chain.invoke(...) and bound-model .invoke(...) are now detected (an LCEL | pipe, .with_structured_output(), or an alias that composes a known model). A prompt | parser chain (no model) or a dict | dict merge is not tracked — precise. langchain detection 385→492. kwargs-splat — create(**params) on the unambiguous chains. Embeddings — embeddings.create in a per-item loop → llm-in-loop. Module-constant prompts — a prompt/model held in a top-level constant used inside a function is resolved. New rule json-mode-missing-json — response_format=json_object with a static prompt lacking “json” is a provable OpenAI 400 (fires only when the absence is provable). 155 tests. Precision held: amateur-corpus findings byte-identical to 0.6.2.

Version updated for https://github.com/tmatens/compose-lint to version v0.13.0. This action is used across all versions by 1 repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. What’s Changed Added Validated profiles must declare immutable version tags. The profile ci-smoke gate (scripts/validate_profiles.py) now rejects a status: validated profile whose applies_to.tags includes a mutable rolling tag (latest, stable, edge, main, nightly, …): such a tag points to a different image over time, so a derivation done against it cannot be trusted to still apply to the image a consumer later pulls. Exploratory profiles are unaffected, and no existing catalog profile uses a mutable tag, so this guards against a future mistake without changing current data. Profile schema 1.3: app_tier_verified. An optional top-level block on a profile recording that the whole hardening was verified at the service level — the multi-container stack brought up with every dimension applied and a real service-level check passed — a stronger signal than the per-dimension workload, which exercises only one container. Fields: service, service_version, method, check, verified_date, result, and an optional over_hardening (applied + result) that proves the check catches a too-tight config (not a rubber stamp). Requires status: validated (schema) and result: pass (ci-smoke gate). Optional and additive — all 1.0–1.2 documents remain valid, and it never substitutes for the per-dimension validated_via evidence. ADR-017 §10. Fixed Profile-enrichment hints no longer collapse across services in text output. The fix-block dedup keyed on rule_id alone, so when two services were flagged by the same rule but enrichment gave them different image-specific guidance (e.g. postgres → cap_add: [CHOWN, DAC_OVERRIDE, SETGID, SETUID], caddy → cap_add: [NET_BIND_SERVICE]), the second service was rendered (see fix above) — pointing at the first service’s wrong-image recommendation. The dedup now keys on (rule_id, fix, references), so distinct hints each print in full while identical fixes still collapse. Changed Profile enrichment is now labeled experimental. The feature is already opt-in and off by default (profiles.enabled); this makes its provisional status explicit. When enrichment is active, compose-lint prints a one-line stderr reminder that fix recommendations are advisory, derived for a specific invocation, and not validated against your runtime — and the config docs mark the section experimental. No behavior change to the findings themselves. Clearer profile-enrichment caveat. The provenance tail not independently verified here is replaced with compose-lint can't see your runtime, confirm it fits your setup — it names the actual limit (a static linter reads the compose text, not the running container, and can’t confirm the recommendation matches your invocation) rather than a vague disclaimer. Added Profile schema 1.2 (ADR-017 §9): an optional derivation.run_config block recording the invocation a minimum was derived under — user, command, entrypoint, network, pid, devices, security_opt, mounts, and env (keys only, never values). A derived minimum is only valid for its invocation (postgres run with user: set skips the root→user drop and needs none of the startup caps a default-invocation profile lists), so a consumer can diff a target service against it and downgrade to a hint on divergence. Emitted by csd’s drop-test producer, not hand-authored. Additive — all 1.0/1.1 documents remain valid. Opt-in profile enrichment (ADR-017). Set profiles.enabled: true and point profiles.path at a catalog of container-sec-derive (csd) profiles you trust; findings from CL-0006/0007/0002/0011/0016 then gain image-specific fix guidance — e.g. the observed minimum cap_add for that image. Enrichment is advisory and additive only (it never creates, drops, or reclassifies a finding) and the hint is attributed and marked unverified. Off by default. Per ADR-017 §7, compose-lint ships no catalog of its own — the catalog is a user-configured external source, so the linter neither grows nor endorses profile data. Profile contribution path (ADR-017): scripts/validate_profiles.py (the ci-smoke gate — schema, validated/exploratory invariants, and workload-hash verification), a profile-validate CI job that runs it on catalog changes, and a contributor guide (docs/profiles.md).

Version updated for https://github.com/vibgrate/cli to version v2026.704.3. This action is used across all versions by 0 repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. What’s Changed Vibgrate CLI 2026.704.3 Released 2026-07-04 Routine maintenance update for the CLI. What changed Changed Maintenance release with internal improvements and dependency updates. Benchmarks Two-arm benchmark of this release against 2026.704.1, interleaved on one runner against the pinned corpus (157 metrics compared).

Version updated for https://github.com/hahwul/hwaro to version v0.17.0. This action is used across all versions by 10 repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. What’s Changed v0.17.0 Added [outputs] config: extra per-page/section output formats (json, txt, xml, csv) from user templates/page.<fmt>.jinja / section.<fmt>.jinja, overridable per page via a front-matter outputs key (cascades), exposed as {{ alternate_output_tags }}, cache-aware under --cache Markdown render hooks: templates/hooks/render-{link,image,heading,codeblock}.html override element rendering (Hugo/Zola-style), no-op when absent; existing @//shortcode/srcset/anchor resolvers still run. See Render Hooks Fenced code block options after the language ({linenos=true, hl_lines="2-4 7", linenostart=5}) plus [highlight] line_numbers; mode = "server" bakes the result at build time, mode = "client" emits data-* attributes Opt-in inline markup behind [markdown] flags (off by default): ins (++), mark (==), sub (~), sup (^) Generalized {#id .class key=val} attribute blocks on headings and inline images ([markdown] attributes) First-class menu system (Hugo-style): [[menus.<name>]], per-language overrides, front-matter registration; exposed via site.menus/get_menu() with an active_path filter; doctor validates undefined parents and menu names hwaro init --wizard and hwaro new (no <path>) open interactive terminal wizards; archetypes gain a {{ description }} placeholder Scaffold design tokens (“Hwaro Ember” :root with light-dark() pairs, fluid type/space scales) and a header theme switcher (auto → light → dark, persisted, flash-free) across every styled scaffold just scaffold-previews: regenerate docs scaffold screenshots headlessly Changed hwaro init initializes immediately with defaults; --wizard opens the interactive flow (removed -y/--yes) Terminal output: the remaining commands (list/stats/validate/check-links/deploy/export/import/unused-assets/convert/platform/agents-md) adopt the ember language and shared glyph set; machine surfaces (--json, serve ready line, --version, exit codes) are byte-for-byte unchanged Scaffold design pass across docs/blog/book (~1,600 lines of duplicated dark CSS deleted) Removed The blog-dark, docs-dark, and book-dark scaffolds — scaffolds follow the OS scheme and ship a manual switcher; pin one permanently with :root { color-scheme: dark; } in css/style.css Fixed macOS release binaries shipped as portable .tar.gz archives with bundled OpenSSL, dropping the hardcoded Homebrew openssl@3 dependency Shortcodes: Jinja control tags ({% if %}, {% set %}) in block bodies no longer desync the nesting scan; mixed positional + named args no longer drop the positional value PWA service worker: offline→root navigation fallback restored across all three cache strategies llms-full.txt honors in_search_index = false Internal @/ links with a query string or anchor no longer double-escape & hwaro serve: authors front-matter edits update the taxonomy incrementally; equal-weight sections keep a stable prev/next order --cache: deleting a page regenerates the sitemap/feeds/search index even when no surviving page re-rendered Parallel builds surface sitemap/feed/search failures instead of exiting 0; closed section-list and shortcode-init fiber-safety gaps under -Dpreview_mt AMP: <img> with > inside a quoted attribute value converts without corrupting the markup Performance Flat N-page sites avoid an O(N²) render cost — section-page arrays and SEO/OG/canonical/JSON-LD strings are built only when the template’s static closure can reach them Parallel render workers read prewarmed Crinja caches lock-free (-Dpreview_mt); taxonomy generation reuses the running Builder instead of a second O(N) Crinja pass Markdown skips footnote/definition-list passes when the markers are absent; builds no longer run the markdown pipeline twice (dropped the legacy hook pre-pass) JS minification is no longer O(n²) on non-ASCII files (128KB CJK bundle: 59.5s → 9.6ms); HTML minifier compiles protected-tag patterns once at startup --cache: touched-but-identical files re-hashed once, page-bundle assets no longer recopied, lock-free hit/miss counters; serve incremental rebuilds render the affected set in parallel 404 page reuses render-phase template vars; --stream builds per-worker engines once per run; load_data() memoized per file mtime Full Changelog: https://github.com/hahwul/hwaro/compare/v0.16.0...v0.17.0

Version updated for https://github.com/hashgraph-online/ai-plugin-scanner-action to version v1.2.380. This action is used across all versions by 18 repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. What’s Changed Published automatically from https://github.com/hashgraph-online/hol-guard/tree/90c7ce1e7c3346d7c1d85d79ff61f8fd56adad8b with plugin-scanner 2.0.980. Full Changelog: https://github.com/hashgraph-online/ai-plugin-scanner-action/compare/v1.2.379...v1.2.380

Version updated for https://github.com/hashgraph-online/hol-codex-plugin-scanner-action to version v1.2.380. This action is used across all versions by 11 repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. What’s Changed Full Changelog: https://github.com/hashgraph-online/hol-codex-plugin-scanner-action/compare/v1...v1.2.380

Version updated for https://github.com/holon-run/holon to version v0.26.0. This action is used across all versions by 0 repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. What’s Changed Runtime line Holon v0.26.0 is part of the Rust runtime line. The Rust runtime is now the main holon binary. This release introduces the Agent Template package and registry line: local and remote template sources, GitHub repository discovery, daemon sync and diagnostics APIs, web GUI template browsing, and template skill preinstallation. It also adds GitHub Actions-style skill uses shorthand, improves the web GUI skills/file experience, and fixes template/skill install edge cases plus several runtime and provider issues.

Version updated for https://github.com/Htunn/offsec-ai to version v2.5.9. This action is used across all versions by 0 repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. What’s Changed fix: define OUTPUT_ARGS before use; -o was silently dropped (v2.5.9) (889e688) chore: replace all example.com targets with simpleportchecker.com (676106d) fix: –format not -f for ai-owasp-scan; use simpleportchecker target (v2.5.8) (504b6e8) fix: skip –timeout for ai-owasp-scan which does not support it (v2.5.7) (67a28cd) chore: use Gemini public endpoint in ai-owasp-scan job (6a13857) fix: use case statement for format flag routing; no more grep substring match (v2.5.6) (1a8ac41) fix: per-command format flag; base64 report-json; bump to v2.5.5 (813d327) chore: update offsec-ai-action.yml to use v2.5.4 (c9ebc12) fix: switch action to GEMINI_API_KEY; remove secrets expression from action.yml (9bbe4cc) fix: pin offsec-ai-action.yml to v2.5.3 (secrets expression fix) (c4a71c5)

Version updated for https://github.com/invarnhq/cibuild to version v2.3.0. This action is used across all versions by 0 repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. What’s Changed Release v2.3.0