[dependabot]

Bumps the actions group with 2 updates: hyperpolymath/gitbot-fleet/.github/workflows/fleet-report-back-reusable.yml and step-security/harden-runner.

Updates hyperpolymath/gitbot-fleet/.github/workflows/fleet-report-back-reusable.yml from 46d26a4b084c40847d9a2f2ef98305502b7320bc to 14892a53a0c2c38c7a6dd44964b796ef3044e626

Changelog

Sourced from hyperpolymath/gitbot-fleet/.github/workflows/fleet-report-back-reusable.yml's changelog.

Changelog

All notable changes to gitbot-fleet will be documented in this file.

This file is generated from conventional commits by the changelog-reusable.yml workflow (hyperpolymath/standards#206). Adopt the workflow in this repo's CI to keep this file in sync automatically — see templates/cliff.toml for the canonical config.

The format follows Keep a Changelog; this project aims to follow Semantic Versioning.

[Unreleased]

Added

• feat(sustainabot): migrate bot-integration from ReScript to AffineScr… (#199)
• feat(scripts): add fix-tracked-package-lock.sh for standards#67 enforcement (#170)
• feat(robot-repo-automaton): canonical RSR skeleton generator (rsr-template-repo#48) (#160)
• feat(rhodibot): add offline check CLI subcommand for CI gating (#150)
• feat(gsbot)!: faithful Rust/SPARK port — eliminate Python from the fleet (#145)

Fixed

• fix(examples): migrate SafeDOMExample.affine to current AffineScript grammar (closes #208) (#210)
• fix(sustainabot): parse-blocking OCaml-isms and HANDLE-keyword name (Refs #148) (#206)
• fix(licence): clear scaffold-placeholder leak (isolated; dirty repo) (#167)
• fix(ci): pin upload-artifact to valid SHA in fix-unpinned-actions.sh generator (Refs standards#48) (#163)
• fix(ci): bump a2ml/k9-validate-action pins to canonical (standards#85) (#162)
• fix(ci): sync hypatia-scan.yml to canonical (kill cd-scanner build drift) (#161)
• fix: resolve gitbot-fleet legacy hypatia findings at source; de-baseline (#152)
• fix(ci): adopt canonical hypatia-scan.yml (env.HOME/scanner-layout + Comment-step gate) (#151)
• fix(shared-context): clear pre-existing clippy -D warnings debt (item B) (#149)
• fix: stagger estate push to stop CI thundering-herd (#147)

Documentation

• docs(archive): session record for sustainabot #148 hand-port validation (#209)
• docs: promote stub .adoc to faithful AsciiDoc from canonical .md (Item 11 Group A) (#159)

CI

• ci: redistribute concurrency-cancel guard to read-only check workflows (#165)
• ci(hypatia-scan): restore hardened workflow (supersedes #129) (#142)

... (truncated)

Commits

• 14892a5 fix(ponsbot): accept the dirty stamp from a cargo-installed pons (#676)
• 6a3a227 fix(panicbot): carry unsuppressed test-code findings, as the direct lane does...
• b97e4e1 docs(cutover): record the 2026-11-13/14 rulings; D4 superseded (#675)
• 7fc2778 ci(report-back): pin panic-attack to 410a8f82, matching canon and Hypatia (#674)
• 31faf50 fix(finishingbot,glambot): accept estate canon, stop reporting retired or too...
• 912ff6d fix(panicbot,ponsbot): review follow-ups left open when #670 merged (#673)
• b079527 feat(panicbot): directives from the repo deed, deny-only = full suite minus d...
• 68e6523 feat(ponsbot): phase 0 of the scanner cutover (adapter, panicbot parity fixes...
• 62e5008 fix(report-back): every finding names a file so repo-level rules grade as sta...
• c32fc04 fix(cargo): drop semver build metadata from dependency requirements (#667)
• Additional commits viewable in compare view

Updates step-security/harden-runner from 2.22.3 to 2.22.4

Release notes

Sourced from step-security/harden-runner's releases.

v2.22.4

What's Changed

• Fixed a Linux agent memory leak that could cause runners to run out of memory during jobs with heavy process or network activity.
• The workaround for GitHub’s DNS resolver and outbound proxy experiment on GitHub-hosted Linux runners now defaults to enabled when feature flags can’t be fetched.
• Improved HTTP/2 TLS interception on Linux (enterprise tier).
• Added retries for failed monitoring API requests, improving reliability of monitoring initialization and raw-event uploads.

Full Changelog: step-security/harden-runner@v2.22.3...v2.22.4

Commits

• 1d88384 Merge pull request #716 from step-security/rc-48
• 26249c0 Merge pull request #712 from Prateek-stepsecurity/pn/monitor-retry
• b5a70cf Treat 409 from /monitor as terminal and add retry tests
• 0a48cce Retry /monitor call up to 3 times on failure
• 967c33e Merge pull request #715 from step-security/rc-47
• 4fa77e8 Merge pull request #714 from h0x0er/jatin/agent-v1.9.6-v0.18.1
• dd2b975 bump agent versions
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions