build(deps): bump Quantum-L9/l9-ci-core/.github/workflows/publish-analysis.yml from f88116503430aa18992b70d8d31063e34ff97ef1 to 05db475deed8197b1e843006a76cd5610dad10c5

[dependabot]

Bumps Quantum-L9/l9-ci-core/.github/workflows/publish-analysis.yml from f88116503430aa18992b70d8d31063e34ff97ef1 to 05db475deed8197b1e843006a76cd5610dad10c5.

Commits

• 05db475 fix(preflight): repair broken invariant suite, coherent lint/type gate (#45)
• f4e4677 docs(governance): draft org-level required-status-checks ruleset
• c93f8fb ci: add ruff pre-commit hooks for local dev parity
• d5a3617 chore(license): apply Quantum AI Partners proprietary license
• 13edc9f feat: auto-regenerate semgrep identity maps from the live registry
• 1b026c1 fix: wire semgrep identity-map and policy so strict mode is enforceable
• a39f591 feat: add optional MYPY_EXCLUDE env var to Python lint-test preset
• d4225db fix: mkdir .mypy_cache before --install-types to avoid cold-cache failure
• d5e0f31 fix: unblock first-activation CI failures in Python/TypeScript presets
• 81970d3 feat: add TypeScript/JavaScript preset mirroring the locked Python preset
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies, type:dependency. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[cryptoxdog]

PR Remediation - Cycle 1

Codebase fixes: 0
CI pipeline signals: 3
Human decisions: 0
Commit: none

CI handoff files

• CI-001 -> issues/ci-pipeline/8dfd35dd3f69-l9-ci-core-sdk-revision-skew.md (blocking)
• CI-002 -> issues/ci-pipeline/b27a63fac9ec-node20-deprecated-action-pins.md (non-blocking, pre-existing)
• CI-003 -> issues/ci-pipeline/656125bb0029-ci-pr-pipeline-startup-failure.md (non-blocking, pre-existing)

Local codebase verification: 0/0 (no codebase changes required; PR diff is a Dependabot workflow-SHA bump only)
Threads: resolved 0, CI-routed open 0, human open 0 (no unresolved review threads exist on this PR)

Why this PR isn't yet green

The Publish analysis (Core) / publish check fails inside Quantum-L9/l9-ci-core's own reusable workflow (publish-analysis.yml@05db475deed8197b1e843006a76cd5610dad10c5, the exact ref this PR bumps to): that workflow's default sdk-revision input (0779fca8238011f8abea551895f96584676e9d17) is not listed in the .l9/sdk-compatibility.yaml allowlist bundled with the provision-sdk action commit (d2c2cd7f7251632825c53b8ed31570ba5d8add26) it itself pins. This is entirely internal to l9-ci-core — Website-Bot has no .l9/sdk-compatibility.yaml to add or edit (the action reads its own bundled copy, not the caller workspace), and l9-analysis.yml is a locked, do-not-edit preset file. See CI-001 for full evidence.

Two other pre-existing, non-blocking, repo-wide CI issues (Node 20 deprecated action pins; ci.yml's call to l9-ci-core's pr-pipeline.yml failing with startup_failure) were re-confirmed fresh on this branch and re-signaled per this PR (CI-002, CI-003), consistent with prior L9 PR Remediation runs on PRs #65, #62, #59, #58, #63, #64, #61.

Per the bounded workflow's stop condition ("only CI-pipeline blockers remain"), this run stopped after cycle 1 rather than spend the remaining cycles retrying a proven CI-pipeline root cause. No further safe action is available inside this repository for this PR; the fix must land in Quantum-L9/l9-ci-core.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[cryptoxdog]

CI-pipeline fix applied (outside the automated remediation loop, by operator authorization)

Root-caused and fixed the blocking CI-001 signal from the run above. l9-ci-core@05db475d (the exact commit this PR's Dependabot bump targeted) is a transiently-broken intermediate commit: it bumps publish-analysis.yml's sdk-revision default to 0779fca8 but leaves the provision-sdk/validate-bundle/render-publication/publish-check action pins on the older d2c2cd7f, whose bundled .l9/sdk-compatibility.yaml predates that revision entirely — hence the "sdk-revision is not listed" failure.

l9-ci-core's own history already fixes this two commits later (2989db3, which moves the default and all four action pins forward together as one coherent set). Verified the input/output contract is unchanged between the broken commit and current l9-ci-core main — bumping past the broken window is safe. Commit f8b22b5 moves this PR's pin to current l9-ci-core main (eb2481e). All checks are now green.