Repository navigation
Conversation
dependabot
Bot
added
dependencies
dependabot
Bot
requested review from
dfoulks1,
potiuk and
ppkarwasz
as code owners
November 2, 2026 13:46
dependabot
Bot
force-pushed
the
dependabot/github_actions/dot-github/actions/for-dependabot-triggered-reviews/carabiner-dev/actions/install/download-and-verify-1.3.1
branch
from
November 2, 2026 17:54
9cda1f4 to
fc8cef0
Compare
potiuk
approved these changes
Nov 2, 2026
potiuk
left a comment
potiuk
left a comment
Member
There was a problem hiding this comment.
LGTM. The red verify is a gap in our verifier, not in the action: v1.3.1 now verifies
SLSA provenance per organization (policylabs, then carabiner-dev) by running the
bootstrapped ampel directly, and verify-action-build does not yet recognize that
multi-org verification shape. Fix in #1483; admin-merging this one.
Drafted-by: Claude Code (Opus 5.5); reviewed by potiuk before posting
potiuk
added a commit
that referenced
this pull request
Nov 2, 2026
carabiner-dev/actions install/download-and-verify v1.3.1 verifies SLSA provenance per organization (policylabs, then carabiner-dev) by running the ampel binary from its ampel-bootstrap step instead of calling ampel/verify, so the download was reported unverified (#1480). Count that shape as verification when the bootstrap step, its ampel-path output and a `verify --subject` run block are all present. Generated-by: Claude Opus 5
potiuk
approved these changes
Nov 2, 2026
…and-verify Bumps [carabiner-dev/actions/install/download-and-verify](https://github.com/carabiner-dev/actions) from 1.3.0 to 1.3.1. - [Release notes](https://github.com/carabiner-dev/actions/releases) - [Commits](carabiner-dev/actions@d41fe10...63d43b5) --- updated-dependencies: - dependency-name: carabiner-dev/actions/install/download-and-verify dependency-version: 1.3.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
potiuk
force-pushed
the
dependabot/github_actions/dot-github/actions/for-dependabot-triggered-reviews/carabiner-dev/actions/install/download-and-verify-1.3.1
branch
from
November 2, 2026 18:46
fc8cef0 to
ea1174e
Compare
potiuk
deleted the
dependabot/github_actions/dot-github/actions/for-dependabot-triggered-reviews/carabiner-dev/actions/install/download-and-verify-1.3.1
branch
November 2, 2026 18:50
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps carabiner-dev/actions/install/download-and-verify from 1.3.0 to 1.3.1.
Release notes
Sourced from carabiner-dev/actions/install/download-and-verify's releases.
Commits
63d43b5Cut patch release5896b93Merge pull request #158 from carabiner-dev/update-bnd-v0.4.7e1e5eaaUpdate bnd installer default to v0.4.71ebed6cMerge pull request #156 from carabiner-dev/update-unpack-v0.3.531403f9Update unpack installer default to v0.3.53939447Merge pull request #155 from carabiner-dev/update-ampel-v1.5.0a600d7dUpdate ampel installer default to v1.5.063b3d28Merge pull request #137 from deobieta/add-osps-compliance-workflow9b28e61feat: add OSPS Baseline compliance reusable workflow9f42878Merge pull request #154 from carabiner-dev/update-readme-pins-557810687a30