Fix CI workflow maintenance failures

Author: pboling

.github/workflows/caboose.yml

@@ -85,7 +85,7 @@ jobs:
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
         with:
           egress-policy: audit
 
@@ -104,8 +104,8 @@ jobs:
       # We need to do this first to get appraisal installed.
       # NOTE: This does not use the primary Gemfile at all.
       - name: Install Root Appraisal
-        run: bundle > /dev/null 2>&1
+        run: bundle
       - name: Appraisal for ${{ matrix.appraisal }}
-        run: bundle exec appraisal ${{ matrix.appraisal }} bundle > /dev/null 2>&1
+        run: bundle exec appraisal ${{ matrix.appraisal }} bundle
       - name: Tests for ${{ matrix.ruby }} via ${{ matrix.exec_cmd }}
         run: bundle exec appraisal ${{ matrix.appraisal }} bundle exec ${{ matrix.exec_cmd }}

.github/workflows/coverage.yml

@@ -101,7 +101,7 @@ jobs:
         if: ${{ !env.ACT }}
         uses: qltysh/qlty-action/coverage@a19242102d17e497f437d7466aa01b528537e899 # v2.2.0
         with:
-          token: ${{secrets.QLTY_COVERAGE_TOKEN}}
+          oidc: true
           files: coverage/lcov.info
           format: lcov
           skip-errors: false

.github/workflows/macos.yml

@@ -65,7 +65,7 @@ jobs:
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
         with:
           egress-policy: audit
 

.github/workflows/scorecard-analysis.yml

@@ -27,7 +27,7 @@ jobs:
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
         with:
           egress-policy: audit
 

.github/workflows/windows.yml

@@ -47,7 +47,7 @@ jobs:
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
         with:
           egress-policy: audit
 

CHANGELOG.md

@@ -28,6 +28,7 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Fixed
 
+- Updated CI workflow maintenance: QLTY uploads now use OIDC, harden-runner is pinned to v2.19.4, and Caboose dependency installation logs are visible on failure.
 - Replaced stale platform CI `rake magic` commands with portable spec commands.
 - Pinned `multi_xml` below 0.9 for TruffleRuby compatibility.
 - Marked EOL TruffleRuby 22.3, 23.0, and 23.1 CI as experimental because they can crash inside the interpreter during Bundler setup.

REEK

@@ -1,2 +0,0 @@
-./reek: 1: ./reek:: not found
-./reek: 2: ./reek:: not found

docs/OAuth2.html

@@ -6,7 +6,7 @@
 <title>
   Class: OAuth2::AccessToken
 
-    &mdash; Documentation by YARD 0.9.43
+    &mdash; Documentation by YARD 0.9.44
 
 </title>
 
@@ -3072,9 +3072,9 @@ <h3 class="signature " id="to_hash-instance_method">
 </div>
 
       <div id="footer">
-  Generated on Wed May 20 17:27:20 2026 by
+  Generated on Wed Jun  3 19:00:56 2026 by
   <a href="https://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
-  0.9.43 (ruby-4.0.4).
+  0.9.44 (ruby-4.0.4).
 </div>
 
     </div>