[dependabot]

Summary

Update the GitHub Action's installed CLI from 0.2.0 to 0.6.0, including Zod 4.6.7, and rebuild the shipped bundle so its embedded supported version matches the runtime manifest.

Changes

• Update the runtime package pin and locked dependency graph.
• Use the published CLI release's resolved Inquirer and canvas versions instead of incidental newer transitive releases. Preserve all optional platform packages and satisfy the published dependency constraints without adding overrides.
• Rebuild dist/index.cjs; its only generated change is the embedded CLI version.
• Review consumed CLI options, JSON results, exit codes, SARIF handling, runtime launchers, and package provenance. Existing adapters remain necessary and compatible.

Testing

• Frozen action and runtime installations passed.
• Action validation passed: 175 tests, type checking, metadata, documentation, and reproducible distribution checks.
• Installed CLI integration and packaged Linux smoke tests passed, including actual sandbox enforcement, virtualenv and MCP launcher inheritance, JSON/severity/SARIF results, provider request attribution, and cleanup, without external model calls. The integration suite used an isolated temporary directory after an existing enclosing Git marker affected the first local fixture run.
• Action and runtime dependency audits report zero vulnerabilities.
• Independent review verified the final three-file diff, dependency constraints and integrity metadata, release manifest hashes, and SBOM.
• Fresh hosted checks are verified on the final PR head before merging.

Risk and rollout

The Action now installs the published 0.6.0 CLI and its native dependencies. Existing action inputs, output contracts, credential isolation, interpreter selection, and cleanup behavior are preserved. No new wrapper settings or CLI surface are introduced. The existing real CLI integration and hosted smoke checks cover runtime compatibility.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-10-23T19:16:53.471530Z	eec07ce	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[mldangelo-oai]

Reviewed the runtime manifest, locked dependency graph, generated bundle, release provenance, and consumed CLI contracts. Local Action validation, installed CLI integration, packaged Linux smoke tests, and dependency audits passed. Both hosted Action CI runs and all required platform checks passed on this commit. Windows shard 3 initially timed out in two existing package-install fixtures; its unchanged-commit retry passed all 1,177 tests. No test expectations or runtime protections were weakened.