chore(deps): bump the github-actions group across 1 directory with 3 updates

[dependabot]

Bumps the github-actions group with 3 updates in the / directory: step-security/harden-runner, chainguard-dev/actions/kind-diag and fgrosse/go-coverage-report.

Updates step-security/harden-runner from 2.21.1 to 2.22.0

Release notes

Sourced from step-security/harden-runner's releases.

v2.22.0

What's Changed

• Linux ARM64 support for community tier
• GHES support for self-hosted VMs (enterprise tier)
• MacOS and Windows runner deny list support for block policy (enterprise tier).

Full Changelog: step-security/harden-runner@v2.21.1...v2.22.0

Commits

• 351661c Merge pull request #701 from step-security/rc-44
• 1dc7f2e Merge pull request #702 from h0x0er/jatin/ghes-changes-up
• af5ca38 simplified ghes config creation
• 9a6d710 fix2
• 74c65ea fix
• ceac816 resovled comments
• 2439321 refactoring for codebuild
• e28e09b Revert "job summary fixes for ghes"
• e38f7a0 job summary fixes for ghes
• 468d34b fixed insights url for ghes scenario
• Additional commits viewable in compare view

Updates chainguard-dev/actions/kind-diag from 1.6.37 to 1.6.40

Release notes

Sourced from chainguard-dev/actions/kind-diag's releases.

v1.6.40

What's Changed

• fix(setup-eksctl): match archive checksum exactly by @​shimmerjs in chainguard-dev/actions#1066

New Contributors

• @​shimmerjs made their first contribution in chainguard-dev/actions#1066

Full Changelog: chainguard-dev/actions@v1.6.39...v1.6.40

v1.6.39

What's Changed

• fix(release): stop persisting checkout credentials by @​stevebeattie in chainguard-dev/actions#1065

Full Changelog: chainguard-dev/actions@v1.6.38...v1.6.39

v1.6.38

What's Changed

• build(deps): bump reviewdog/action-actionlint from 1.73.4 to 1.74.0 by @​dependabot[bot] in chainguard-dev/actions#1044
• build(deps): bump the actions group across 1 directory with 3 updates by @​dependabot[bot] in chainguard-dev/actions#1043
• ci: add stale workflow for inactive issues and PRs by @​cpanato in chainguard-dev/actions#1047
• otel-export: move to TypeScript 7 and bump deps to latest by @​cpanato in chainguard-dev/actions#1046
• build(deps): bump reviewdog/action-actionlint from 1.74.0 to 1.77.0 by @​dependabot[bot] in chainguard-dev/actions#1050
• build(deps-dev): bump @​types/node from 25.9.8 to 26.6.3 in /otel-export by @​dependabot[bot] in chainguard-dev/actions#1048
• docs: pin README examples, flag apko-build deprecation, drop stale TODOs by @​cpanato in chainguard-dev/actions#1051
• build(deps): bump the actions group across 8 directories with 8 updates by @​dependabot[bot] in chainguard-dev/actions#1049
• ci: suppress zizmor superfluous-actions on create-pull-request by @​cpanato in chainguard-dev/actions#1056
• release-notes: don't persist checkout credentials by @​cpanato in chainguard-dev/actions#1055
• setup-kind: validate registry-authority before writing GITHUB_ENV by @​cpanato in chainguard-dev/actions#1054
• ci: suppress zizmor github-env on fixed PATH/ENV writes by @​cpanato in chainguard-dev/actions#1053
• ci: suppress zizmor self-repository on local action refs by @​cpanato in chainguard-dev/actions#1052
• hugo2confluence: fix gomarkdown OOB read, require Go 1.27 by @​cpanato in chainguard-dev/actions#1058
• githubapp-token: install @​octokit/app from a lockfile by @​cpanato in chainguard-dev/actions#1057
• release-notes: set up the stable Go release instead of 1.25 by @​cpanato in chainguard-dev/actions#1059
• build(deps): bump @​octokit/app from 16.1.2 to 16.1.4 in /githubapp-token by @​dependabot[bot] in chainguard-dev/actions#1060
• fix(git-tag): push with the token input via a credential helper by @​stevebeattie in chainguard-dev/actions#1062

Full Changelog: chainguard-dev/actions@v1.6.37...v1.6.38

Commits

• 84b1be4 fix(setup-eksctl): match archive checksum exactly (#1066)
• ec1df73 fix(release): stop persisting checkout credentials (#1065)
• 0a46f70 fix(git-tag): push with the token input via a credential helper (#1062)
• afed75b build(deps): bump @​octokit/app from 16.1.2 to 16.1.4 in /githubapp-token (#1060)
• 4eb623e release-notes: set up the stable Go release instead of 1.25 (#1059)
• 24c9d6b githubapp-token: install @​octokit/app from a lockfile (#1057)
• 65926d1 hugo2confluence: fix gomarkdown OOB read, require Go 1.27 (#1058)
• de02a2b ci: suppress zizmor self-repository on local action refs (#1052)
• d2cfb82 ci: suppress zizmor github-env on fixed PATH/ENV writes (#1053)
• ee8d9ae setup-kind: validate registry-authority before writing GITHUB_ENV (#1054)
• Additional commits viewable in compare view

Updates fgrosse/go-coverage-report from 1.4.0 to 1.5.0

Release notes

Sourced from fgrosse/go-coverage-report's releases.

v1.5.0

• If the base commit of the pull request has no usable baseline run (e.g. because it failed, is still running or its artifact expired), the action now uses the nearest commit in the first-parent history of the base commit with a usable run instead of the latest run on the target branch. The runs of each commit are filtered client-side, since the filtered workflow runs API can return stale results, and further candidates are tried if a coverage artifact cannot be downloaded or does not fgrosse/go-coverage-report#113
• Add baseline-search-depth and baseline-max-downloads inputs to configure how far the action searches for a baseline fgrosse/go-coverage-report#113
• fgrosse/go-coverage-report#13
• Behavior change: By default, the baseline coverage is now taken from the latest successful run for the base commit of the pull request (new baseline-sha input, defaults to github.event.pull_request.base.sha) instead of the latest successful run on the target branch. If there is no such run, the action falls back to the latest successful run on the target branch and emits a warning. Set baseline-sha to ""fgrosse/go-coverage-report#110
• Add baseline-run-idfgrosse/go-coverage-report#110
• Improve diagnostics when no baseline coverage is available: warnings and the pull request comment now distinguish between no successful baseline run being found and the coverage artifact of the selected run not being downloadable, and the fgrosse/go-coverage-report#110
• Show a caution callout at the top of the pull request comment if the report does not compare against the base commit fgrosse/go-coverage-report#110
• Name the baseline commit and run in the details section of the report via the new -baseline-commit, -baseline-run-id and -baseline-run-urlfgrosse/go-coverage-report#110
• Simplify the details section of the report: rename it to "Coverage details" and drop its headings to avoid mixing many fgrosse/go-coverage-report#110

Changelog

Sourced from fgrosse/go-coverage-report's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

Nothing yet

[v1.5.0] - 2026-10-02

• If the base commit of the pull request has no usable baseline run (e.g. because it failed, is still running or its artifact expired), the action now uses the nearest commit in the first-parent history of the base commit with a usable run instead of the latest run on the target branch. The runs of each commit are filtered client-side, since the filtered workflow runs API can return stale results, and further candidates are tried if a coverage artifact cannot be downloaded or does not fgrosse/go-coverage-report#113
• Add baseline-search-depth and baseline-max-downloads inputs to configure how far the action searches for a baseline fgrosse/go-coverage-report#113
• fgrosse/go-coverage-report#13
• Behavior change: By default, the baseline coverage is now taken from the latest successful run for the base commit of the pull request (new baseline-sha input, defaults to github.event.pull_request.base.sha) instead of the latest successful run on the target branch. If there is no such run, the action falls back to the latest successful run on the target branch and emits a warning. Set baseline-sha to ""fgrosse/go-coverage-report#110
• Add baseline-run-idfgrosse/go-coverage-report#110
• Improve diagnostics when no baseline coverage is available: warnings and the pull request comment now distinguish between no successful baseline run being found and the coverage artifact of the selected run not being downloadable, and the fgrosse/go-coverage-report#110
• Show a caution callout at the top of the pull request comment if the report does not compare against the base commit fgrosse/go-coverage-report#110
• Name the baseline commit and run in the details section of the report via the new -baseline-commit, -baseline-run-id and -baseline-run-urlfgrosse/go-coverage-report#110
• Simplify the details section of the report: rename it to "Coverage details" and drop its headings to avoid mixing many fgrosse/go-coverage-report#110

[v1.4.0] - 2026-09-20

• Also report packages whose coverage changed without any of their files being changed, e.g. when running integration tests with go test -coverpkgfgrosse/go-coverage-report#102
• fgrosse/go-coverage-report#103
• Fix the excludefgrosse/go-coverage-report#104

[v1.3.1] - 2026-07-20

• fgrosse/go-coverage-report#82
• Fix the ::endgroup::fgrosse/go-coverage-report#89

[v1.3.0] - 2026-03-11

• Add event-name and target-branch inputs to support workflows triggered by events other than pushfgrosse/go-coverage-report#58
• fgrosse/go-coverage-report#72
• fgrosse/go-coverage-report#71
• Add --excludefgrosse/go-coverage-report#59
• Add structured outputs (total_coverage, coverage_delta, coverage_trend, total_statements, covered_statements, missed_statementsfgrosse/go-coverage-report#64

[v1.2.0] - 2024-08-28

... (truncated)

Commits

• c4bf7e7 Release v1.5.0
• 2d3d0a9 action: fall back to the nearest ancestor of the base commit (#113)
• 7752bdc action: select the baseline by the PR base commit and explain it in the repor...
• 6093ed4 Bump github/codeql-action from 4.38.0 to 4.38.1 (#112)
• b1b031a go-coverage-report: drop package name limitation (#111)
• See full diff in compare view

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 30.25%. Comparing base (64b3dae) to head (2951afe).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4250   +/-   ##
=======================================
  Coverage   30.25%   30.25%           
=======================================
  Files         478      478           
  Lines       23169    23169           
=======================================
  Hits         7010     7010           
  Misses      16159    16159           

Flag	Coverage Δ
unit-tests	30.25% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[khrm]

/lgtm

[jkhelil]

@dependabot rebase

[jkhelil]

/approve

[tekton-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jkhelil

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [jkhelil]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[jkhelil]

/lgtm