[dependabot]

Bumps the github-actions group with 3 updates in the / directory: sylvainsf/causinator9000, securego/gosec and mheap/require-checklist-action.

Updates sylvainsf/causinator9000 from 2.1.0 to 2.2.0

Release notes

Sourced from sylvainsf/causinator9000's releases.

v2.2.0

Full Changelog: sylvainsf/causinator9000@v2.1.0...v2.2.0

Commits

• ba057ac fix: skip closed PRs, require concurrency group for auto-issue\n\nTwo fixes f...
• 4330260 fix: assign Copilot after issue creation, not during\n\nThe --assignee flag o...
• See full diff in compare view

Updates securego/gosec from 2.25.0 to 2.26.1

Release notes

Sourced from securego/gosec's releases.

v2.26.1

Changelog

• 4a3bd8af174872c778439083ded7adbf3747e770 Update cosign to v3.0.6 (#1659)

Commits

• 4a3bd8a Update cosign to v3.0.6 (#1659)
• 553d8a5 Sync taint rule docs and add missing CWE mappings for G113/G307 (#1658)
• bf0ccd3 Update all dependencies (#1657)
• 4ead098 Add G710 rule for open redirect via taint analysis (#1654)
• 8ff985f Fix formatting
• a1aad0c Update the default models use by autofix and phase out the older models
• 74bdf7f Format and clean-up the README
• 74dc989 Add HTTP file-serving function to the skins of pathtraversal analyzer (#1647)
• 7020111 Skip flaging the TLS min version for go 1.18+ (#1646)
• d5869fc chore(deps): bump go.opentelemetry.io/otel from 1.39.0 to 1.41.0 (#1645)
• Additional commits viewable in compare view

Updates mheap/require-checklist-action from 2.5.0 to 2.6.1

Release notes

Sourced from mheap/require-checklist-action's releases.

v2.6.1

What's Changed

• Update convert-action to get node24 by @​mheap in mheap/require-checklist-action#58

Full Changelog: mheap/require-checklist-action@v2.5.0...v2.6.1

v2.6.0

• No changes. Regenerating to get node 24 support

Full Changelog: mheap/require-checklist-action@v2.5.0...v2.6.0

Commits

• 9c8100a Automatic compilation
• 74de6f6 Update convert-action to get node24 (#58)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ✅ 0 package(s) with unknown licenses.
• ⚠️ 1 packages with OpenSSF Scorecard issues.

See the Details below.

OpenSSF Scorecard

Package	Version	Score	Details
actions/mheap/require-checklist-action	9c8100a52aa9726d4648e61aa92415f6c843c990	⚠️ 3.5	Details Check Score Reason Code-Review ⚠️ 3 Found 7/23 approved changesets -- score normalized to 3 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Maintained ⚠️ 1 1 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 1 Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Security-Policy ⚠️ 0 security policy file not detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Pinned-Dependencies 🟢 5 dependency not pinned by hash detected -- score normalized to 5 Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0

Scanned Files

• .github/workflows/require-pr-checklist.yaml

[github-actions]

Unit Tests

    2 files  ±0    415 suites  ±0   6m 57s ⏱️ -4s
4 904 tests ±0  4 902 ✅ ±0  2 💤 ±0  0 ❌ ±0 
5 818 runs  ±0  5 816 ✅ ±0  2 💤 ±0  0 ❌ ±0 

Results for commit 392b770. ± Comparison against base commit f1bcb28.

♻️ This comment has been updated with latest results.

[Copilot]

Pull request overview

This Dependabot PR updates pinned commit SHAs for three GitHub Actions used in the repository’s CI/workflow automation (PR checklist enforcement, CodeQL custom GoSec scan, and c9k CI failure reporting).

Changes:

• Bump mheap/require-checklist-action from v2.5.0 to v2.6.1 in the PR checklist workflow.
• Bump securego/gosec from v2.25.0 to v2.26.1 in the CodeQL workflow’s custom GoSec job.
• Bump sylvainsf/causinator9000 from v2.1.0 to v2.2.0 in both c9k reporting workflows.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
.github/workflows/require-pr-checklist.yaml	Updates the action used to enforce PR checklist completion.
.github/workflows/codeql.yml	Updates the GoSec action used for SARIF generation/upload in CodeQL.
.github/workflows/c9k-nightly.yml	Updates the causinator9000 action used for scheduled CI failure reporting.
.github/workflows/c9k-failure-report.yml	Updates the causinator9000 action used for scheduled CI failure reporting with auto-issue enabled.

Comments suppressed due to low confidence (1)

.github/workflows/c9k-failure-report.yml:28

• causinator9000 v2.2.0 release notes indicate auto-issue mode now requires a GitHub Actions concurrency group. This workflow enables auto-issue: "true" but does not define concurrency, which may cause the action to fail or create duplicate issues. Define a stable concurrency.group for this workflow/job (and set an appropriate cancel-in-progress value) when using auto-issue.

        uses: sylvainsf/causinator9000@ba057ac66a8eee6b0f293012ff567afdd49ea6c7 # v2.2.0
        with:
          repo: ${{ github.repository }}
          hours: "48"
          auto-issue: "true"

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 51.47%. Comparing base (e22e1d9) to head (65087d4).

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #11786   +/-   ##
=======================================
  Coverage   51.46%   51.47%           
=======================================
  Files         699      699           
  Lines       44130    44130           
=======================================
+ Hits        22712    22714    +2     
+ Misses      19254    19253    -1     
+ Partials     2164     2163    -1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[sk593]

@dependabot recreate

[radius-functional-tests]

Radius functional test overview

🔍 Go to test action run

Click here to see the test run details

Name	Value
Repository	radius-project/radius
Commit ref	65087d4
Unique ID	func58dc44b9c7
Image tag	pr-func58dc44b9c7

• gotestsum 1.13.0
• KinD: v0.29.0
• Dapr: 1.14.4
• Azure KeyVault CSI driver: 1.4.2
• Azure Workload identity webhook: 1.3.0
• Bicep recipe location ghcr.io/radius-project/dev/test/testrecipes/test-bicep-recipes/<name>:pr-func58dc44b9c7
• Terraform recipe location http://tf-module-server.radius-test-tf-module-server.svc.cluster.local/<name>.zip (in cluster)
• applications-rp test image location: ghcr.io/radius-project/dev/applications-rp:pr-func58dc44b9c7
• dynamic-rp test image location: ghcr.io/radius-project/dev/dynamic-rp:pr-func58dc44b9c7
• controller test image location: ghcr.io/radius-project/dev/controller:pr-func58dc44b9c7
• ucp test image location: ghcr.io/radius-project/dev/ucpd:pr-func58dc44b9c7
• deployment-engine test image location: ghcr.io/radius-project/deployment-engine:latest

Test Status

⌛ Building Radius and pushing container images for functional tests...
✅ Container images build succeeded
⌛ Publishing Bicep Recipes for functional tests...
✅ Recipe publishing succeeded
⌛ Starting corerp-cloud functional tests...
⌛ Starting ucp-cloud functional tests...
✅ ucp-cloud functional tests succeeded
✅ corerp-cloud functional tests succeeded

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.