ci: bump getplumber/plumber from 0.3.86 to 0.4.60

[dependabot]

Bumps getplumber/plumber from 0.3.86 to 0.4.60.

Release notes

Sourced from getplumber/plumber's releases.

v0.4.60

0.4.60 (2026-09-11)

✨ Features

• platform: decode policy min_points and the push response's global score into a verdict (83dbfba)
• platform: evaluate resolved policies as first-class runs with no local fallback (1fedc61)
• platform: in platform mode the resolved policies drive the log, the push and the exit code (8f4b6ba)
• platform: local gates, thresholds and the degraded exit are inert in platform mode (551eac6)
• platform: per-policy artifacts, badge and MR comment from the platform verdict (5ef59c2), closes #467
• platform: per-policy log sections and the platform verdict block (13d0da9)

🐛 Bug Fixes

• platform: a --no-controls run is not platform mode in the summary (65ae90c)
• platform: carry each run's not-evaluable marks in its policy report entry (d16571b)
• platform: decode the gate strictly, only the global score tolerantly (ef0733a)
• platform: honest verdict line, collection diagnostics and header in platform mode (db8aedf)
• platform: inventory runs keep their guards in platform mode, pin the run-level dismissal mark (ee6de90)
• platform: platform-mode artifacts carry only the policies' verdicts (b8c3411)
• platform: tolerant gate decode and validated global letter (9c292fe)
• platform: track the two image controls independently in pbom verdicts (2928548)

📚 Documentation

• platform: platform mode evaluates only the platform's policies and takes its verdict (8ff0c69)
• platform: replace em dashes and restore template backticks (f73aa78)

✅ Tests

• platform: cover outputControlEntries's multi-policy accumulation (7e7fe68)
• platform: cover the post-action and pbom summaries through the cmd path (7e334ba)
• platform: cover the report's un-applied policy entry and min_points (93b6185)
• platform: cover the union's not-evaluable swap and the degraded sections (e10cc50), closes #220
• platform: pin the notEvaluable key removal in platform-mode json reports (6cc5dd0)

👷 CI/CD

• release: pin v0.4.59 refs [skip ci] (8da00d4)

v0.4.59

0.4.59 (2026-09-10)

✨ Features

... (truncated)

Changelog

Sourced from getplumber/plumber's changelog.

0.4.62 (2026-09-12)

🐛 Bug Fixes

• gitremote: eat every userinfo @ up to the last one before the path (d370cbd)
• platform: a served empty include list is complete attribution, not unknown (754ab69)
• platform: use the includes the resolve endpoint serves (dc10a57)

✅ Tests

• platform: pin the no-attribution branch of the includes served line (9b18a79)
• platform: pin the wire-level decode of resolve response includes (4e2837d)

👷 CI/CD

• release: pin v0.4.61 refs [skip ci] (cc366ec)

0.4.61 (2026-09-12)

✨ Features

• configuration: export nullable on schema fields so an editor knows when unset is meaningful (6ce3630)
• platform: require --platform-allow-http before sending credentials to a plain-http platform (fe0537c)
• scoring: withhold the score when no control was evaluated (230a389)

🐛 Bug Fixes

• cmd: keep the degraded-collection message ahead of the withheld score (d594e7f)
• scoring: count a finding once per identity so the job and the platform score the same input (ed43bb5)
• utils: strip userinfo from the parsed git remote so a token clone still matches the analyzed project (b571f61)

📚 Documentation

• plans: cli batch 2, platform decision rows 41, 45, 46, 51, 52 (4148d57)

✅ Tests

• cmd: assert the withheld-score gate line when controls exist but none was evaluated (7ecdabc)
• cmd: pin the plain-http refusal on the GitHub analysis path (894a527)

👷 CI/CD

... (truncated)

Commits

• f84005b chore(release): 0.4.60 [skip ci]
• e10cc50 test(platform): cover the union's not-evaluable swap and the degraded sections
• d16571b fix(platform): carry each run's not-evaluable marks in its policy report entry
• 7e7fe68 test(platform): cover outputControlEntries's multi-policy accumulation
• 93b6185 test(platform): cover the report's un-applied policy entry and min_points
• 65ae90c fix(platform): a --no-controls run is not platform mode in the summary
• 7e334ba test(platform): cover the post-action and pbom summaries through the cmd path
• 2928548 fix(platform): track the two image controls independently in pbom verdicts
• ef0733a fix(platform): decode the gate strictly, only the global score tolerantly
• f73aa78 docs(platform): replace em dashes and restore template backticks
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!