Bump bjcorder/deterministic-deps from 6076e4b0edc592d8f09b8984bf504b8709eb6b4f to a03aa117d43235e11a2dee9310f8e3d42acba611

[dependabot]

Bumps bjcorder/deterministic-deps from 6076e4b0edc592d8f09b8984bf504b8709eb6b4f to a03aa117d43235e11a2dee9310f8e3d42acba611.

Changelog

Sourced from bjcorder/deterministic-deps's changelog.

Changelog

All notable changes to this project will be documented in this file.

Unreleased

• Future versions of deterministic-deps are licensed under AGPL-3.0-only. Previous MIT-licensed releases remain available under their original terms.

1.0.0 - 2026-05-03

• Published the v1 GitHub Action interface for advisory and enforce modes.
• Set package and action metadata for the stable Marketplace v1.0.0 release.
• Supported static dependency determinism checks for GitHub Actions, container files, Terraform/OpenTofu, Node.js, Python, Go, Rust, JVM, and Ruby.
• Added Markdown reports, SARIF reports for code scanning, count outputs, and optional patch output for conservative safe exact-line remediation suggestions.
• Added parser-backed checks for GitHub Actions workflows, Compose files, devcontainer JSON, Terraform/OpenTofu blocks, Node manifests and lockfiles, Python requirements/project files, Go modules, Rust manifests, Gemfiles, and Maven/Gradle files.
• Added .deterministic-deps.yml configuration with rule toggles, severity overrides, allowlists, include/exclude patterns, ecosystem options, and a machine-readable JSON Schema.
• Added diagnostics for malformed config, invalid config fields, and invalid direct action inputs with deterministic fallback behavior.
• Added opt-in remote validation for pinned GitHub commit refs with bounded timeout/retry behavior.
• Added GitHub Enterprise Server URL handling for opt-in remote validation through GitHub Actions GITHUB_API_URL and GITHUB_SERVER_URL environment variables.
• Added enriched SARIF metadata, rule documentation links, default severity metadata, and stable partial fingerprints for code scanning alerts.
• Added release validation workflows, including a manual v1 tag smoke workflow for validating a semantic version tag before moving the floating v1 tag.
• Added release-readiness audit and whitespace checks to CI and release validation.
• Added scanner guardrail coverage for many dependency files and deeply nested default excludes.
• Documented v1 limits: static analysis by default, no package registry resolution, no container digest existence checks, no broad autofix, and remote validation limited to GitHub commit refs.

0.1.0

• Initial TypeScript GitHub Action implementation.
• Added advisory and enforce modes.
• Added static rules for GitHub Actions, containers, Terraform/OpenTofu, Node.js, Python, Go, Rust, JVM, and Ruby.
• Added parser-backed YAML and JSON checks for GitHub Actions, Compose, and devcontainer image references.
• Added block-aware Terraform module and provider checks.
• Added ecosystem-specific config options for lockfile and hash policies.
• Added config validation diagnostics for invalid fields and malformed YAML.
• Added a fixture-based rule test matrix and golden report tests.
• Added Markdown and SARIF report generation.
• Added structured remediation suggestions, SARIF fixes, and optional patch output for safe exact-line replacements.
• Added a rule registry with code metadata for documented rule ids and default severities.
• Added open-source project documentation and CI scaffolding.

Commits

• a03aa11 docs: add contributor license agreement (#86)
• be0ec55 chore: relicense under AGPL-3.0-only (#84)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #112.