deps: bump the actions group with 3 updates

[dependabot]

Bumps the actions group with 3 updates: actions/checkout, KineticCafe/actions-dco and zizmorcore/zizmor-action.

Updates actions/checkout from 6.0.1 to 6.0.2

Release notes

Sourced from actions/checkout's releases.

v6.0.2

What's Changed

• Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by @​TingluoHuang in actions/checkout#2355
• Fix tag handling: preserve annotations and explicit fetch-tags by @​ericsciple in actions/checkout#2356

Full Changelog: actions/checkout@v6.0.1...v6.0.2

Changelog

Sourced from actions/checkout's changelog.

Changelog

v6.0.2

• Fix tag handling: preserve annotations and explicit fetch-tags by @​ericsciple in actions/checkout#2356

v6.0.1

• Add worktree support for persist-credentials includeIf by @​ericsciple in actions/checkout#2327

v6.0.0

• Persist creds to a separate file by @​ericsciple in actions/checkout#2286
• Update README to include Node.js 24 support details and requirements by @​salmanmkc in actions/checkout#2248

v5.0.1

• Port v6 cleanup to v5 by @​ericsciple in actions/checkout#2301

v5.0.0

• Update actions checkout to use node 24 by @​salmanmkc in actions/checkout#2226

v4.3.1

• Port v6 cleanup to v4 by @​ericsciple in actions/checkout#2305

v4.3.0

• docs: update README.md by @​motss in actions/checkout#1971
• Add internal repos for checking out multiple repositories by @​mouismail in actions/checkout#1977
• Documentation update - add recommended permissions to Readme by @​benwells in actions/checkout#2043
• Adjust positioning of user email note and permissions heading by @​joshmgross in actions/checkout#2044
• Update README.md by @​nebuk89 in actions/checkout#2194
• Update CODEOWNERS for actions by @​TingluoHuang in actions/checkout#2224
• Update package dependencies by @​salmanmkc in actions/checkout#2236

v4.2.2

• url-helper.ts now leverages well-known environment variables by @​jww3 in actions/checkout#1941
• Expand unit test coverage for isGhes by @​jww3 in actions/checkout#1946

v4.2.1

• Check out other refs/* by commit if provided, fall back to ref by @​orhantoy in actions/checkout#1924

v4.2.0

• Add Ref and Commit outputs by @​lucacome in actions/checkout#1180
• Dependency updates by @​dependabot- actions/checkout#1777, actions/checkout#1872

v4.1.7

• Bump the minor-npm-dependencies group across 1 directory with 4 updates by @​dependabot in actions/checkout#1739
• Bump actions/checkout from 3 to 4 by @​dependabot in actions/checkout#1697
• Check out other refs/* by commit by @​orhantoy in actions/checkout#1774
• Pin actions/checkout's own workflows to a known, good, stable version. by @​jww3 in actions/checkout#1776

v4.1.6

• Check platform to set archive extension appropriately by @​cory-miller in actions/checkout#1732

... (truncated)

Commits

• de0fac2 Fix tag handling: preserve annotations and explicit fetch-tags (#2356)
• 064fe7f Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set (...
• See full diff in compare view

Updates KineticCafe/actions-dco from 2.0.0 to 2.1.1

Release notes

Sourced from KineticCafe/actions-dco's releases.

v2.1.1

What's Changed

• deps: bump actions/checkout from 5.0.0 to 6.0.0 by @​dependabot[bot] in KineticCafe/actions-dco#197
• deps: bump actions/setup-node from 6.0.0 to 6.1.0 in the actions group across 1 directory by @​dependabot[bot] in KineticCafe/actions-dco#200

Full Changelog: KineticCafe/actions-dco@v2.1.0...v2.1.1

v2.1.0

What's Changed

• deps: Bump pnpm/action-setup from 4.1.0 to 4.2.0 in the actions group by @​dependabot[bot] in KineticCafe/actions-dco#189
• deps: bump actions/upload-artifact from 4.6.2 to 5.0.0 by @​dependabot[bot] in KineticCafe/actions-dco#192
• deps: bump actions/setup-node from 5.0.0 to 6.0.0 by @​dependabot[bot] in KineticCafe/actions-dco#190
• deps: bump the bundler group with 2 updates by @​dependabot[bot] in KineticCafe/actions-dco#191
• deps: bump js-yaml from 4.1.0 to 4.1.1 by @​dependabot[bot] in KineticCafe/actions-dco#193
• fix: Escape the reason in the summary table by @​halostatue in KineticCafe/actions-dco#199

Full Changelog: KineticCafe/actions-dco@v2.0.0...v2.1.0

Changelog

Sourced from KineticCafe/actions-dco's changelog.

KineticCafe/actions-dco Changelog

2.1.0 / 2025-12-17

• Upgraded dependencies.

• Added a possible workaround to #198[issue-198].

2.0.0 / 2025-10-17

• Upgraded dependencies and set runtime as Node v24.

1.3.8 / 2025-09-07

• Upgrade dependencies.

1.3.7 / 2025-08-23

• Bump version number as it was forgotten for 1.3.6.

1.3.6 / 2025-08-17

• Upgrade dependencies.

• Added debug logs to try to debug #169[issue-169].

• Change gitSignoffs to use String.prototype.matchAll() instead of Regexp.prototype.exec(), and to use named capture groups. While I don't expect this to fix #169[issue-169] based on the example data provided, it should result in improved pattern matching across multiple commits.

1.3.5 / 2025-08-01

• Upgrade dependencies.

1.3.4 / 2025-03-01

• Upgrade dependencies.

1.3.3 / 2025-02-18

• Upgrade dependencies, resolving a potential security issue.

1.3.2 / 2024-12-01

• Upgrade dependencies.

1.3.1 / 2024-11-01

• Upgrade dependencies.

... (truncated)

Commits

• 6e1652e chore: Update dependencies
• cd037df deps: bump actions/setup-node in the actions group across 1 directory
• 07b1ace chore: Update dist to try to fix a token issue
• b256b18 deps: bump actions/checkout from 5.0.0 to 6.0.0
• 76b7fc3 fix: Escape the reason in the summary table
• bc076f2 deps: Update dist/ after dependabot update
• 3899b64 deps: Add autofix capability to Dependabot PRs
• dc1cf81 deps: bump js-yaml from 4.1.0 to 4.1.1
• 28c71a1 deps: bump the bundler group with 2 updates
• 7fc90a9 deps: bump actions/setup-node from 5.0.0 to 6.0.0
• Additional commits viewable in compare view

Updates zizmorcore/zizmor-action from 0.3.0 to 0.4.1

Release notes

Sourced from zizmorcore/zizmor-action's releases.

v0.4.1

This version fixes an error in the 0.4.0 release that prevented non-relative use of the action.

What's Changed

• Fix version file path by @​woodruffw in zizmorcore/zizmor-action#83

Full Changelog: zizmorcore/zizmor-action@v0.4.0...v0.4.1

v0.4.0

This new version of zizmor-action brings two major changes:

• The new fail-on-no-inputs option can be used to control whether zizmor-action fails if no inputs were collected by zizmor. The default remains true, reflecting the pre-existing behavior.

• The action's use of the official zizmor Docker images is now fully hash-checked internally, preventing accidental or malicious modification to the images. This also means that subsequent releases of zizmor will induce a release of this action, rather than the action always picking up the latest version by default.

What's Changed

• docs: extended permissions required for internal repos by @​AntoineSebert in zizmorcore/zizmor-action#61
• docs: clarify description of "token" to indicate it is only used for online audits by @​rmuir in zizmorcore/zizmor-action#63
• Hash-check zizmor Docker images by @​woodruffw in zizmorcore/zizmor-action#68
• Add fail-on-no-inputs option by @​woodruffw in zizmorcore/zizmor-action#67

New Contributors

• @​AntoineSebert made their first contribution in zizmorcore/zizmor-action#61
• @​rmuir made their first contribution in zizmorcore/zizmor-action#63

Full Changelog: zizmorcore/zizmor-action@v0.3.0...v0.4.0

Commits

• 1356984 Fix version file path (#83)
• 72469cf Bump pins in README (#80)
• 3aa7e2f Add fail-on-no-inputs tests (#79)
• 92fc377 Sync zizmor versions (#78)
• 5aff8ef Add fail-on-no-inputs option (#67)
• 4d497b9 Sync zizmor versions (#75)
• 5fa0711 Fix sync-zizmor-versions (#69)
• c823f2c Hash-check zizmor Docker images (#68)
• 706c51b chore(deps): bump github/codeql-action in the github-actions group (#66)
• cb3d8e8 chore(deps): bump actions/checkout in the github-actions group (#65)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coveralls]

coverage: 89.035%. remained the same
when pulling b9dddff on dependabot/github_actions/actions-c8ebc60f0a
into 7de6c8d on main.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.