microsoft/semantic-kernel
1
0
Fork 0
mirror of https://github.com/microsoft/semantic-kernel.git synced 2026-10-12 11:19:56 +00:00
Code Issues Packages Projects Releases Wiki Activity
5,101 Commits 64 Branches 1,077 Tags
main
Commit Graph
14 Commits
Author SHA1 Message Date
Evan Mattsondependabot[bot]copilot-swe-agent[bot]rogerbarretoCopilot
 		ebc2ef9bb2 Consolidate Dependabot dependency updates (#14385) 
### Motivation and Context

Consolidates the currently open Dependabot updates into one reviewable
dependency PR while preserving each source update's intent across GitHub
Actions, .NET, Python, and JavaScript sample dependencies.

### Description

Updates pinned GitHub Actions, central NuGet package versions, Python
dependency constraints and uv lockfiles, and npm/Yarn lockfiles for the
affected samples. Overlapping lockfile updates were regenerated or
reconciled so that all compatible requested versions are retained
together on the latest `main`. The incompatible MCP 2.x and Python 3.10
`onnxruntime-genai` updates are excluded, the private-feed-only
`@humanfs/node` update is omitted, and the logging abstractions floor is
aligned with the updated Azure AI Projects dependency.

### Related Issue

Supersedes:
- https://github.com/microsoft/semantic-kernel/pull/14177
- https://github.com/microsoft/semantic-kernel/pull/14179
- https://github.com/microsoft/semantic-kernel/pull/14180
- https://github.com/microsoft/semantic-kernel/pull/14190
- https://github.com/microsoft/semantic-kernel/pull/14209
- https://github.com/microsoft/semantic-kernel/pull/14230
- https://github.com/microsoft/semantic-kernel/pull/14233
- https://github.com/microsoft/semantic-kernel/pull/14254
- https://github.com/microsoft/semantic-kernel/pull/14257
- https://github.com/microsoft/semantic-kernel/pull/14259
- https://github.com/microsoft/semantic-kernel/pull/14260
- https://github.com/microsoft/semantic-kernel/pull/14261
- https://github.com/microsoft/semantic-kernel/pull/14271
- https://github.com/microsoft/semantic-kernel/pull/14272
- https://github.com/microsoft/semantic-kernel/pull/14273
- https://github.com/microsoft/semantic-kernel/pull/14274
- https://github.com/microsoft/semantic-kernel/pull/14276
- https://github.com/microsoft/semantic-kernel/pull/14280
- https://github.com/microsoft/semantic-kernel/pull/14282
- https://github.com/microsoft/semantic-kernel/pull/14299
- https://github.com/microsoft/semantic-kernel/pull/14300
- https://github.com/microsoft/semantic-kernel/pull/14335
- https://github.com/microsoft/semantic-kernel/pull/14337
- https://github.com/microsoft/semantic-kernel/pull/14338
- https://github.com/microsoft/semantic-kernel/pull/14339
- https://github.com/microsoft/semantic-kernel/pull/14357
- https://github.com/microsoft/semantic-kernel/pull/14358
- https://github.com/microsoft/semantic-kernel/pull/14361
- https://github.com/microsoft/semantic-kernel/pull/14365
- https://github.com/microsoft/semantic-kernel/pull/14366
- https://github.com/microsoft/semantic-kernel/pull/14367
- https://github.com/microsoft/semantic-kernel/pull/14368
- https://github.com/microsoft/semantic-kernel/pull/14369

### Contribution Checklist

- [ ] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [ ] I didn't break anyone 😄

---------

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Co-authored-by: rogerbarreto <[email protected]>
Co-authored-by: Copilot <[email protected]>
Copilot-Session: d3c2550f-f129-4660-9461-af1288241064
 2026-09-07 09:46:40 +00:00
Dan Fiedlerandwestey 6eab62d273 Pin GitHub Actions to full-length commit SHAs (#14307) 
## Summary

This PR pins GitHub Actions to full-length commit SHAs for improved
security and reproducibility and adds a 7 day cooldown to Dependabot
configuration for GitHub Actions. This work is described in more detail
at https://aka.ms/action-pinning.

## Why?

Pinning actions to commit SHAs prevents supply-chain attacks where a tag
could be moved to point to malicious code. This is a recommended
security best practice per the [GitHub Actions security hardening
guide](https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#using-third-party-actions).

This change mitigates the risk of tag retargeting to malicious code as
seen in incidents like the [tj-actions/changed-files action
compromise](https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised)
or [codfish/semantic-release-action
compromise](https://www.stepsecurity.io/blog/supply-chain-compromise-codfish-semantic-release-action)
and improves the integrity and reproducibility of the CI/CD pipeline.

## What changed?

**Action pinning:** Third-party action references in
`.github/workflows/` that used mutable tag-based references (e.g.,
`actions/checkout@v4`) have been updated to full-length commit SHAs with
a version comment (e.g., `actions/checkout@<sha> # v4`) using the
[pinact](https://github.com/suzuki-shunsuke/pinact) tool. References
that were already pinned to a SHA, or that used immutable release tags,
were left unchanged.

**Dependabot configuration:** `.github/dependabot.yml` has been updated
to ensure a `github-actions` package-ecosystem section is present with a
`cooldown` configuration (`default-days: 7`). If the file did not exist,
it was created. If a `github-actions` section already existed, only the
`cooldown` block was added or its `default-days` value was increased to
7 if it was lower. The 7-day cooldown provides a window for the
community to detect and report compromised releases before they are
automatically proposed as updates, reducing exposure to supply-chain
attacks via newly published malicious versions.

## Is this safe to merge?

Yes. The pinned SHAs correspond to the same commits that the existing
tags pointed to. No behavioral changes in action execution are
introduced. You can verify the pinned SHA value using the GitHub REST
API (e.g., the commit hash for `actions/checkout@v7` can be found in the
`sha` property in the JSON response for `GET
https://api.github.com/repos/actions/checkout/commits/v7`).

## Additional Information

For more information, please see https://aka.ms/action-pinning

Co-authored-by: westey <[email protected]>
 2026-08-26 11:34:45 +00:00
Giles OdigweandCopilot d6f832e34a ci: harden Python test coverage workflow (#14026) 
## Summary

Improves the Python test coverage workflow with better input handling
and token management.

## Changes

- Added validation for the PR number file content before use in
environment setup
- Switched to using the built-in github.token instead of a PAT for
artifact download and PR comments
- Added actions: read permission to support artifact download with the
built-in token

## Notes

The workflow_run trigger provides a github.token scoped to the base
repository with the permissions declared in the workflow file. The
pull-requests: write permission allows posting comments on PRs,
including those opened from forks.

Co-authored-by: Copilot <[email protected]>
 2026-05-27 07:43:12 +00:00
dependabot[bot]andEvan Mattson 1211af3527 Bump MishaKav/pytest-coverage-comment from 1.1.54 to 1.1.57 (#13063) 
Bumps
[MishaKav/pytest-coverage-comment](https://github.com/mishakav/pytest-coverage-comment)
from 1.1.54 to 1.1.57.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/mishakav/pytest-coverage-comment/releases">MishaKav/pytest-coverage-comment's
releases</a>.</em></p>
<blockquote>
<h2>v1.1.57</h2>
<h2>What's Changed</h2>
<ul>
<li>Fix/issue 204 coverageHtml empty by <a
href="https://github.com/MishaKav"><code>@​MishaKav</code></a> in <a
href="https://redirect.github.com/MishaKav/pytest-coverage-comment/pull/218">MishaKav/pytest-coverage-comment#218</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MishaKav/pytest-coverage-comment/compare/v1...v1.1.57">https://github.com/MishaKav/pytest-coverage-comment/compare/v1...v1.1.57</a></p>
<h2>v1.1.56</h2>
<h2>What's Changed</h2>
<ul>
<li>Fix invalid syntax by <a
href="https://github.com/MishaKav"><code>@​MishaKav</code></a> in <a
href="https://redirect.github.com/MishaKav/pytest-coverage-comment/pull/215">MishaKav/pytest-coverage-comment#215</a>
Basicaly, it's patch for prev. release.
Sorry, guys</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MishaKav/pytest-coverage-comment/compare/v1...v1.1.56">https://github.com/MishaKav/pytest-coverage-comment/compare/v1...v1.1.56</a></p>
<h2>v1.1.55</h2>
<h2>What's Changed</h2>
<p>🔗 Link Removal Options</p>
<p>Added new options to reduce comment size for large coverage
reports:</p>
<ul>
<li>remove-links-to-files - Remove clickable file links</li>
<li>remove-links-to-lines - Remove clickable line number links</li>
</ul>
<p>📏 Auto Summary Truncation</p>
<p>Fixed &quot;GitHub Action Summary too big&quot; error (<a
href="https://redirect.github.com/mishakav/pytest-coverage-comment/issues/209">#209</a>)
- summaries exceeding 1MB are now automatically
truncated with intelligent break points.</p>
<p>📚 Documentation &amp; UX</p>
<ul>
<li>Enhanced README with collapsible sections and comprehensive
examples</li>
<li>Improved warning system suggests size optimization options</li>
<li>Aligned action.yml descriptions with README for consistency</li>
</ul>
<p>🛠️ Technical</p>
<ul>
<li>Updated dependencies (prettier, brace-expansion)</li>
<li>Better error handling for size limits</li>
<li>Fully backward compatible - no breaking changes</li>
</ul>
<p>Perfect for large codebases hitting GitHub's comment size limits!
🎯</p>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MishaKav/pytest-coverage-comment/compare/v1.1.54...v1.1.55">https://github.com/MishaKav/pytest-coverage-comment/compare/v1.1.54...v1.1.55</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/MishaKav/pytest-coverage-comment/blob/main/CHANGELOG.md">MishaKav/pytest-coverage-comment's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/MishaKav/pytest-coverage-comment/tree/v1.1.57">Pytest
Coverage Comment 1.1.57</a></h2>
<p><strong>Release Date:</strong> 2025-08-30</p>
<h4>Changes</h4>
<ul>
<li>fix coverageHtml output empty when using XML coverage files (<a
href="https://redirect.github.com/mishakav/pytest-coverage-comment/issues/204">#204</a>)</li>
<li>ensure proper HTML generation for both text and XML coverage file
types</li>
</ul>
<h2><a
href="https://github.com/MishaKav/pytest-coverage-comment/tree/v1.1.56">Pytest
Coverage Comment 1.1.56</a></h2>
<p><strong>Release Date:</strong> 2025-08-09</p>
<h4>Changes</h4>
<ul>
<li>fix GitHub Actions matrix syntax parsing error in action.yml (<a
href="https://redirect.github.com/mishakav/pytest-coverage-comment/issues/214">#214</a>)</li>
</ul>
<h2><a
href="https://github.com/MishaKav/pytest-coverage-comment/tree/v1.1.55">Pytest
Coverage Comment 1.1.55</a></h2>
<p><strong>Release Date:</strong> 2025-08-09</p>
<h4>Changes</h4>
<ul>
<li>fix GitHub Action Summary size limit error by implementing automatic
truncation for summaries exceeding 1MB (<a
href="https://redirect.github.com/mishakav/pytest-coverage-comment/issues/209">#209</a>)</li>
<li>add <code>remove-links-to-files</code> and
<code>remove-links-to-lines</code> options to reduce comment size by
removing clickable links</li>
<li>improve README with collapsible sections, better examples, and
comprehensive troubleshooting guide</li>
<li>align action.yml descriptions with README for consistency and
clarity</li>
<li>enhance comment size warning system with suggestions for new link
removal options</li>
<li>bump dev dependencies</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MishaKav/pytest-coverage-comment/commit/1bdbba85fb74a2fdc1ec66383acec1091610f82b"><code>1bdbba8</code></a>
Fix/issue 204 coverageHtml empty (<a
href="https://redirect.github.com/mishakav/pytest-coverage-comment/issues/218">#218</a>)</li>
<li><a
href="https://github.com/MishaKav/pytest-coverage-comment/commit/9638e4b1448019aba40c4aaaa1ade87a9f211aa1"><code>9638e4b</code></a>
Fix invalid syntax (<a
href="https://redirect.github.com/mishakav/pytest-coverage-comment/issues/215">#215</a>)</li>
<li><a
href="https://github.com/MishaKav/pytest-coverage-comment/commit/c69f3778ae57715f5f243d944e9dceacfadb3624"><code>c69f377</code></a>
add <code>remove-links-to-files</code> and
<code>remove-links-to-lines</code> + Readme redesign (<a
href="https://redirect.github.com/mishakav/pytest-coverage-comment/issues/213">#213</a>)</li>
<li><a
href="https://github.com/MishaKav/pytest-coverage-comment/commit/44f4ebe6ea5191edfbd6918896c70776b786add8"><code>44f4ebe</code></a>
Small grammar fix [skip ci] (<a
href="https://redirect.github.com/mishakav/pytest-coverage-comment/issues/212">#212</a>)</li>
<li><a
href="https://github.com/MishaKav/pytest-coverage-comment/commit/f977308f807b37827c1f2e412d951da62e1a34c2"><code>f977308</code></a>
truncate step summaries (<a
href="https://redirect.github.com/mishakav/pytest-coverage-comment/issues/210">#210</a>)</li>
<li>See full diff in <a
href="https://github.com/mishakav/pytest-coverage-comment/compare/v1.1.54...v1.1.57">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=MishaKav/pytest-coverage-comment&package-manager=github_actions&previous-version=1.1.54&new-version=1.1.57)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Evan Mattson <[email protected]>
 2025-09-11 04:06:13 +00:00
dependabot[bot] 52bb300ffe Bump actions/checkout from 4 to 5 (#12930) 
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to
5.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/checkout/releases">actions/checkout's
releases</a>.</em></p>
<blockquote>
<h2>v5.0.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Update actions checkout to use node 24 by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li>
<li>Prepare v5.0.0 release by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2238">actions/checkout#2238</a></li>
</ul>
<h2>⚠️ Minimum Compatible Runner Version</h2>
<p><strong>v2.327.1</strong><br />
<a
href="https://github.com/actions/runner/releases/tag/v2.327.1">Release
Notes</a></p>
<p>Make sure your runner is updated to this version or newer to use this
release.</p>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v4...v5.0.0">https://github.com/actions/checkout/compare/v4...v5.0.0</a></p>
<h2>v4.3.0</h2>
<h2>What's Changed</h2>
<ul>
<li>docs: update README.md by <a
href="https://github.com/motss"><code>@​motss</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li>
<li>Add internal repos for checking out multiple repositories by <a
href="https://github.com/mouismail"><code>@​mouismail</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li>
<li>Documentation update - add recommended permissions to Readme by <a
href="https://github.com/benwells"><code>@​benwells</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li>
<li>Adjust positioning of user email note and permissions heading by <a
href="https://github.com/joshmgross"><code>@​joshmgross</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li>
<li>Update README.md by <a
href="https://github.com/nebuk89"><code>@​nebuk89</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li>
<li>Update CODEOWNERS for actions by <a
href="https://github.com/TingluoHuang"><code>@​TingluoHuang</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li>
<li>Update package dependencies by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li>
<li>Prepare release v4.3.0 by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2237">actions/checkout#2237</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/motss"><code>@​motss</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li>
<li><a href="https://github.com/mouismail"><code>@​mouismail</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li>
<li><a href="https://github.com/benwells"><code>@​benwells</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li>
<li><a href="https://github.com/nebuk89"><code>@​nebuk89</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li>
<li><a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v4...v4.3.0">https://github.com/actions/checkout/compare/v4...v4.3.0</a></p>
<h2>v4.2.2</h2>
<h2>What's Changed</h2>
<ul>
<li><code>url-helper.ts</code> now leverages well-known environment
variables by <a href="https://github.com/jww3"><code>@​jww3</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li>
<li>Expand unit test coverage for <code>isGhes</code> by <a
href="https://github.com/jww3"><code>@​jww3</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v4.2.1...v4.2.2">https://github.com/actions/checkout/compare/v4.2.1...v4.2.2</a></p>
<h2>v4.2.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Check out other refs/* by commit if provided, fall back to ref by <a
href="https://github.com/orhantoy"><code>@​orhantoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/Jcambass"><code>@​Jcambass</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/checkout/pull/1919">actions/checkout#1919</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v4.2.0...v4.2.1">https://github.com/actions/checkout/compare/v4.2.0...v4.2.1</a></p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h2>V5.0.0</h2>
<ul>
<li>Update actions checkout to use node 24 by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li>
</ul>
<h2>V4.3.0</h2>
<ul>
<li>docs: update README.md by <a
href="https://github.com/motss"><code>@​motss</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li>
<li>Add internal repos for checking out multiple repositories by <a
href="https://github.com/mouismail"><code>@​mouismail</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li>
<li>Documentation update - add recommended permissions to Readme by <a
href="https://github.com/benwells"><code>@​benwells</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li>
<li>Adjust positioning of user email note and permissions heading by <a
href="https://github.com/joshmgross"><code>@​joshmgross</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li>
<li>Update README.md by <a
href="https://github.com/nebuk89"><code>@​nebuk89</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li>
<li>Update CODEOWNERS for actions by <a
href="https://github.com/TingluoHuang"><code>@​TingluoHuang</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li>
<li>Update package dependencies by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li>
</ul>
<h2>v4.2.2</h2>
<ul>
<li><code>url-helper.ts</code> now leverages well-known environment
variables by <a href="https://github.com/jww3"><code>@​jww3</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li>
<li>Expand unit test coverage for <code>isGhes</code> by <a
href="https://github.com/jww3"><code>@​jww3</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li>
</ul>
<h2>v4.2.1</h2>
<ul>
<li>Check out other refs/* by commit if provided, fall back to ref by <a
href="https://github.com/orhantoy"><code>@​orhantoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li>
</ul>
<h2>v4.2.0</h2>
<ul>
<li>Add Ref and Commit outputs by <a
href="https://github.com/lucacome"><code>@​lucacome</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1180">actions/checkout#1180</a></li>
<li>Dependency updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>- <a
href="https://redirect.github.com/actions/checkout/pull/1777">actions/checkout#1777</a>,
<a
href="https://redirect.github.com/actions/checkout/pull/1872">actions/checkout#1872</a></li>
</ul>
<h2>v4.1.7</h2>
<ul>
<li>Bump the minor-npm-dependencies group across 1 directory with 4
updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1739">actions/checkout#1739</a></li>
<li>Bump actions/checkout from 3 to 4 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1697">actions/checkout#1697</a></li>
<li>Check out other refs/* by commit by <a
href="https://github.com/orhantoy"><code>@​orhantoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1774">actions/checkout#1774</a></li>
<li>Pin actions/checkout's own workflows to a known, good, stable
version. by <a href="https://github.com/jww3"><code>@​jww3</code></a> in
<a
href="https://redirect.github.com/actions/checkout/pull/1776">actions/checkout#1776</a></li>
</ul>
<h2>v4.1.6</h2>
<ul>
<li>Check platform to set archive extension appropriately by <a
href="https://github.com/cory-miller"><code>@​cory-miller</code></a> in
<a
href="https://redirect.github.com/actions/checkout/pull/1732">actions/checkout#1732</a></li>
</ul>
<h2>v4.1.5</h2>
<ul>
<li>Update NPM dependencies by <a
href="https://github.com/cory-miller"><code>@​cory-miller</code></a> in
<a
href="https://redirect.github.com/actions/checkout/pull/1703">actions/checkout#1703</a></li>
<li>Bump github/codeql-action from 2 to 3 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1694">actions/checkout#1694</a></li>
<li>Bump actions/setup-node from 1 to 4 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1696">actions/checkout#1696</a></li>
<li>Bump actions/upload-artifact from 2 to 4 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1695">actions/checkout#1695</a></li>
<li>README: Suggest <code>user.email</code> to be
<code>41898282+github-actions[bot]@users.noreply.github.com</code> by <a
href="https://github.com/cory-miller"><code>@​cory-miller</code></a> in
<a
href="https://redirect.github.com/actions/checkout/pull/1707">actions/checkout#1707</a></li>
</ul>
<h2>v4.1.4</h2>
<ul>
<li>Disable <code>extensions.worktreeConfig</code> when disabling
<code>sparse-checkout</code> by <a
href="https://github.com/jww3"><code>@​jww3</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1692">actions/checkout#1692</a></li>
<li>Add dependabot config by <a
href="https://github.com/cory-miller"><code>@​cory-miller</code></a> in
<a
href="https://redirect.github.com/actions/checkout/pull/1688">actions/checkout#1688</a></li>
<li>Bump the minor-actions-dependencies group with 2 updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1693">actions/checkout#1693</a></li>
<li>Bump word-wrap from 1.2.3 to 1.2.5 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1643">actions/checkout#1643</a></li>
</ul>
<h2>v4.1.3</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/checkout/commit/08c6903cd8c0fde910a37f88322edcfb5dd907a8"><code>08c6903</code></a>
Prepare v5.0.0 release (<a
href="https://redirect.github.com/actions/checkout/issues/2238">#2238</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/9f265659d3bb64ab1440b03b12f4d47a24320917"><code>9f26565</code></a>
Update actions checkout to use node 24 (<a
href="https://redirect.github.com/actions/checkout/issues/2226">#2226</a>)</li>
<li>See full diff in <a
href="https://github.com/actions/checkout/compare/v4...v5">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/checkout&package-manager=github_actions&previous-version=4&new-version=5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2025-09-03 17:05:22 +00:00
dependabot[bot] 0b8d9e2b0d Bump MishaKav/pytest-coverage-comment from 1.1.54 to 1.1.56 (#12932) 
Bumps
[MishaKav/pytest-coverage-comment](https://github.com/mishakav/pytest-coverage-comment)
from 1.1.54 to 1.1.56.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/mishakav/pytest-coverage-comment/releases">MishaKav/pytest-coverage-comment's
releases</a>.</em></p>
<blockquote>
<h2>v1.1.56</h2>
<h2>What's Changed</h2>
<ul>
<li>Fix invalid syntax by <a
href="https://github.com/MishaKav"><code>@​MishaKav</code></a> in <a
href="https://redirect.github.com/MishaKav/pytest-coverage-comment/pull/215">MishaKav/pytest-coverage-comment#215</a>
Basicaly, it's patch for prev. release.
Sorry, guys</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MishaKav/pytest-coverage-comment/compare/v1...v1.1.56">https://github.com/MishaKav/pytest-coverage-comment/compare/v1...v1.1.56</a></p>
<h2>v1.1.55</h2>
<h2>What's Changed</h2>
<p>🔗 Link Removal Options</p>
<p>Added new options to reduce comment size for large coverage
reports:</p>
<ul>
<li>remove-links-to-files - Remove clickable file links</li>
<li>remove-links-to-lines - Remove clickable line number links</li>
</ul>
<p>📏 Auto Summary Truncation</p>
<p>Fixed &quot;GitHub Action Summary too big&quot; error (<a
href="https://redirect.github.com/mishakav/pytest-coverage-comment/issues/209">#209</a>)
- summaries exceeding 1MB are now automatically
truncated with intelligent break points.</p>
<p>📚 Documentation &amp; UX</p>
<ul>
<li>Enhanced README with collapsible sections and comprehensive
examples</li>
<li>Improved warning system suggests size optimization options</li>
<li>Aligned action.yml descriptions with README for consistency</li>
</ul>
<p>🛠️ Technical</p>
<ul>
<li>Updated dependencies (prettier, brace-expansion)</li>
<li>Better error handling for size limits</li>
<li>Fully backward compatible - no breaking changes</li>
</ul>
<p>Perfect for large codebases hitting GitHub's comment size limits!
🎯</p>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MishaKav/pytest-coverage-comment/compare/v1.1.54...v1.1.55">https://github.com/MishaKav/pytest-coverage-comment/compare/v1.1.54...v1.1.55</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/MishaKav/pytest-coverage-comment/blob/main/CHANGELOG.md">MishaKav/pytest-coverage-comment's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/MishaKav/pytest-coverage-comment/tree/v1.1.56">Pytest
Coverage Comment 1.1.56</a></h2>
<p><strong>Release Date:</strong> 2025-08-09</p>
<h4>Changes</h4>
<ul>
<li>fix GitHub Actions matrix syntax parsing error in action.yml (<a
href="https://redirect.github.com/mishakav/pytest-coverage-comment/issues/214">#214</a>)</li>
</ul>
<h2><a
href="https://github.com/MishaKav/pytest-coverage-comment/tree/v1.1.55">Pytest
Coverage Comment 1.1.55</a></h2>
<p><strong>Release Date:</strong> 2025-08-09</p>
<h4>Changes</h4>
<ul>
<li>fix GitHub Action Summary size limit error by implementing automatic
truncation for summaries exceeding 1MB (<a
href="https://redirect.github.com/mishakav/pytest-coverage-comment/issues/209">#209</a>)</li>
<li>add <code>remove-links-to-files</code> and
<code>remove-links-to-lines</code> options to reduce comment size by
removing clickable links</li>
<li>improve README with collapsible sections, better examples, and
comprehensive troubleshooting guide</li>
<li>align action.yml descriptions with README for consistency and
clarity</li>
<li>enhance comment size warning system with suggestions for new link
removal options</li>
<li>bump dev dependencies</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MishaKav/pytest-coverage-comment/commit/9638e4b1448019aba40c4aaaa1ade87a9f211aa1"><code>9638e4b</code></a>
Fix invalid syntax (<a
href="https://redirect.github.com/mishakav/pytest-coverage-comment/issues/215">#215</a>)</li>
<li><a
href="https://github.com/MishaKav/pytest-coverage-comment/commit/c69f3778ae57715f5f243d944e9dceacfadb3624"><code>c69f377</code></a>
add <code>remove-links-to-files</code> and
<code>remove-links-to-lines</code> + Readme redesign (<a
href="https://redirect.github.com/mishakav/pytest-coverage-comment/issues/213">#213</a>)</li>
<li><a
href="https://github.com/MishaKav/pytest-coverage-comment/commit/44f4ebe6ea5191edfbd6918896c70776b786add8"><code>44f4ebe</code></a>
Small grammar fix [skip ci] (<a
href="https://redirect.github.com/mishakav/pytest-coverage-comment/issues/212">#212</a>)</li>
<li><a
href="https://github.com/MishaKav/pytest-coverage-comment/commit/f977308f807b37827c1f2e412d951da62e1a34c2"><code>f977308</code></a>
truncate step summaries (<a
href="https://redirect.github.com/mishakav/pytest-coverage-comment/issues/210">#210</a>)</li>
<li>See full diff in <a
href="https://github.com/mishakav/pytest-coverage-comment/compare/v1.1.54...v1.1.56">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=MishaKav/pytest-coverage-comment&package-manager=github_actions&previous-version=1.1.54&new-version=1.1.56)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2025-09-03 16:54:58 +00:00
dependabot[bot]andRoger Barreto 9d692c1fd6 Bump MishaKav/pytest-coverage-comment from 1.1.53 to 1.1.54 (#11896) 
Bumps
[MishaKav/pytest-coverage-comment](https://github.com/mishakav/pytest-coverage-comment)
from 1.1.53 to 1.1.54.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/mishakav/pytest-coverage-comment/releases">MishaKav/pytest-coverage-comment's
releases</a>.</em></p>
<blockquote>
<h2>v1.1.54</h2>
<h2>What's Changed</h2>
<ul>
<li>Improvements by <a
href="https://github.com/MishaKav"><code>@​MishaKav</code></a> in <a
href="https://redirect.github.com/MishaKav/pytest-coverage-comment/pull/206">MishaKav/pytest-coverage-comment#206</a></li>
</ul>
<ul>
<li>add support for new format for <code>pytest-coverage-path</code>,
basically it add support for output of <code>pytest-cov &gt;=
6.0.0</code></li>
<li>bump dev dependencies</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MishaKav/pytest-coverage-comment/compare/v1.1.53...v1.1.54">https://github.com/MishaKav/pytest-coverage-comment/compare/v1.1.53...v1.1.54</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/MishaKav/pytest-coverage-comment/blob/main/CHANGELOG.md">MishaKav/pytest-coverage-comment's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/MishaKav/pytest-coverage-comment/tree/v1.1.54">Pytest
Coverage Comment 1.1.54</a></h2>
<p><strong>Release Date:</strong> 2025-04-30</p>
<h4>Changes</h4>
<ul>
<li>add support for new format for <code>pytest-coverage-path</code>,
basically it add support for output of <code>pytest-cov &gt;=
6.0.0</code></li>
<li>bump dev dependencies</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MishaKav/pytest-coverage-comment/commit/13d3c18e21895566c746187c9ea74736372e5e91"><code>13d3c18</code></a>
Improvements (<a
href="https://redirect.github.com/mishakav/pytest-coverage-comment/issues/206">#206</a>)</li>
<li>See full diff in <a
href="https://github.com/mishakav/pytest-coverage-comment/compare/v1.1.53...v1.1.54">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=MishaKav/pytest-coverage-comment&package-manager=github_actions&previous-version=1.1.53&new-version=1.1.54)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

You can trigger a rebase of this PR by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

> **Note**
> Automatic rebases have been disabled on this pull request as it has
been open for over 30 days.

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Roger Barreto <[email protected]>
 2025-08-06 03:24:45 +00:00
dependabot[bot] 55417dc2b4 Bump actions/download-artifact from 4 to 5 (#12869) 
Bumps
[actions/download-artifact](https://github.com/actions/download-artifact)
from 4 to 5.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/download-artifact/releases">actions/download-artifact's
releases</a>.</em></p>
<blockquote>
<h2>v5.0.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Update README.md by <a
href="https://github.com/nebuk89"><code>@​nebuk89</code></a> in <a
href="https://redirect.github.com/actions/download-artifact/pull/407">actions/download-artifact#407</a></li>
<li>BREAKING fix: inconsistent path behavior for single artifact
downloads by ID by <a
href="https://github.com/GrantBirki"><code>@​GrantBirki</code></a> in <a
href="https://redirect.github.com/actions/download-artifact/pull/416">actions/download-artifact#416</a></li>
</ul>
<h2>v5.0.0</h2>
<h3>🚨 Breaking Change</h3>
<p>This release fixes an inconsistency in path behavior for single
artifact downloads by ID. <strong>If you're downloading single artifacts
by ID, the output path may change.</strong></p>
<h4>What Changed</h4>
<p>Previously, <strong>single artifact downloads</strong> behaved
differently depending on how you specified the artifact:</p>
<ul>
<li><strong>By name</strong>: <code>name: my-artifact</code> → extracted
to <code>path/</code> (direct)</li>
<li><strong>By ID</strong>: <code>artifact-ids: 12345</code> → extracted
to <code>path/my-artifact/</code> (nested)</li>
</ul>
<p>Now both methods are consistent:</p>
<ul>
<li><strong>By name</strong>: <code>name: my-artifact</code> → extracted
to <code>path/</code> (unchanged)</li>
<li><strong>By ID</strong>: <code>artifact-ids: 12345</code> → extracted
to <code>path/</code> (fixed - now direct)</li>
</ul>
<h4>Migration Guide</h4>
<h5>✅ No Action Needed If:</h5>
<ul>
<li>You download artifacts by <strong>name</strong></li>
<li>You download <strong>multiple</strong> artifacts by ID</li>
<li>You already use <code>merge-multiple: true</code> as a
workaround</li>
</ul>
<h5>⚠️ Action Required If:</h5>
<p>You download <strong>single artifacts by ID</strong> and your
workflows expect the nested directory structure.</p>
<p><strong>Before v5 (nested structure):</strong></p>
<pre lang="yaml"><code>- uses: actions/download-artifact@v4
  with:
    artifact-ids: 12345
    path: dist
# Files were in: dist/my-artifact/
</code></pre>
<blockquote>
<p>Where <code>my-artifact</code> is the name of the artifact you
previously uploaded</p>
</blockquote>
<p><strong>To maintain old behavior (if needed):</strong></p>
<pre lang="yaml"><code>&lt;/tr&gt;&lt;/table&gt; 
</code></pre>
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/download-artifact/commit/634f93cb2916e3fdff6788551b99b062d0335ce0"><code>634f93c</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/download-artifact/issues/416">#416</a>
from actions/single-artifact-id-download-path</li>
<li><a
href="https://github.com/actions/download-artifact/commit/b19ff4302770b82aa4694b63703b547756dacce6"><code>b19ff43</code></a>
refactor: resolve download path correctly in artifact download tests
(mainly ...</li>
<li><a
href="https://github.com/actions/download-artifact/commit/e262cbee4ab8c473c61c59a81ad8e9dc760e90db"><code>e262cbe</code></a>
bundle dist</li>
<li><a
href="https://github.com/actions/download-artifact/commit/bff23f9308ceb2f06d673043ea6311519be6a87b"><code>bff23f9</code></a>
update docs</li>
<li><a
href="https://github.com/actions/download-artifact/commit/fff8c148a8fdd56aa81fcb019f0b5f6c65700c4d"><code>fff8c14</code></a>
fix download path logic when downloading a single artifact by id</li>
<li><a
href="https://github.com/actions/download-artifact/commit/448e3f862ab3ef47aa50ff917776823c9946035b"><code>448e3f8</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/download-artifact/issues/407">#407</a>
from actions/nebuk89-patch-1</li>
<li><a
href="https://github.com/actions/download-artifact/commit/47225c44b359a5155efdbbbc352041b3e249fb1b"><code>47225c4</code></a>
Update README.md</li>
<li>See full diff in <a
href="https://github.com/actions/download-artifact/compare/v4...v5">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/download-artifact&package-manager=github_actions&previous-version=4&new-version=5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2025-08-06 03:18:19 +00:00
Tao Chen 4027c5eb6a Python: Fix Python test coverage report workflow (#12261) 
### Motivation and Context

<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
  1. Why is this change required?
  2. What problem does it solve?
  3. What scenario does it contribute to?
  4. If it fixes an open issue, please link to the issue here.
-->
Our Python test coverage workflow has been failing due to a breaking in
the text format of the test coverage output:
https://github.com/MishaKav/pytest-coverage-comment/issues/202.

### Description

<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
This PR fixes the issue by switching to xml.

### Contribution Checklist

<!-- Before submitting this PR, please make sure: -->

- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄
 2025-05-26 02:49:53 +00:00
Evan Mattson ff498b4ca9 Python: Updates (#11371) 
### Motivation and Context

Some code cleanup. 

<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
  1. Why is this change required?
  2. What problem does it solve?
  3. What scenario does it contribute to?
  4. If it fixes an open issue, please link to the issue here.
-->

### Description

Some code cleanup. 

<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->

### Contribution Checklist

<!-- Before submitting this PR, please make sure: -->

- [X] The code builds clean without any errors or warnings
- [X] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [X] All unit tests pass, and I have added new tests where possible
- [X] I didn't break anyone 😄
 2025-04-04 13:32:26 +00:00
Eduard van Valkenburg 12a4d40957 Python: add write token to report (#9980) 
### Motivation and Context

<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
  1. Why is this change required?
  2. What problem does it solve?
  3. What scenario does it contribute to?
  4. If it fixes an open issue, please link to the issue here.
-->
The coverage report write job did not have the right permissions yet.

### Description

<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->

### Contribution Checklist

<!-- Before submitting this PR, please make sure: -->

- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄
 2024-12-16 09:04:04 +00:00
Tao ChenandEvan Mattson adb49f3cb9 Python: Fix set-env not allow in workflow (#9973) 
### Motivation and Context

<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
  1. Why is this change required?
  2. What problem does it solve?
  3. What scenario does it contribute to?
  4. If it fixes an open issue, please link to the issue here.
-->
`set-env` command is disabled in our workflow.

![image](https://github.com/user-attachments/assets/a6813291-e58f-4691-ae05-efd35c04ec15)

### Description

<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
Use `$GITHUB_ENV` instead.

### Contribution Checklist

<!-- Before submitting this PR, please make sure: -->

- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄

Co-authored-by: Evan Mattson <[email protected]>
 2024-12-13 23:50:23 +00:00
Tao Chen fbbd444992 Python: Add PR number to test coverage workflow (#9964) 
### Motivation and Context

<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
  1. Why is this change required?
  2. What problem does it solve?
  3. What scenario does it contribute to?
  4. If it fixes an open issue, please link to the issue here.
-->
The test coverage workflow needs the PR number to post comments to PRs.
However, the `workflow_run` context doesn't contain the PR number thus
we need to save it.

### Description

<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
Save the PR number in a file and upload it as artifact for the second
workflow to use.

### Contribution Checklist

<!-- Before submitting this PR, please make sure: -->

- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄
 2024-12-13 19:15:04 +00:00
Tao Chen ed58607ca9 Python: Secure Python test coverage workflow (#9961) 
### Motivation and Context

<!-- Thank you for your contribution to the semantic-kernel repo!
Please help reviewers and future users, providing the following
information:
  1. Why is this change required?
  2. What problem does it solve?
  3. What scenario does it contribute to?
  4. If it fixes an open issue, please link to the issue here.
-->
The Python test coverage workflow needs to post comments of coverage
results on PRs, which requires the proper permissions. By default, PRs
from forks don't have the required permissions if the workflow is
triggered by the `pull_request` event.

However, one can use the `pull_request_target` event as the trigger and
check out the code from the PR for test coverage. This approach posts
various security risks as it gives the code from the PR full access to
the repository secrets.

### Description

<!-- Describe your changes, the overall approach, the underlying design.
These notes will help understanding how your code works. Thanks! -->
It's recommended to use a two-stage approach for this kind of scenarios:
https://securitylab.github.com/resources/github-actions-preventing-pwn-requests/

In this PR, 
1. a new workflow is created named `python-test-coverage-report`. This
workflow is given the proper permissions to post the coverage report in
the PR comments by using the `workflow_run` trigger. This trigger
ensures the workflow is run on the context of the default branch.
2. the existing workflow `python-test-coverage` is updated such that it
only runs the unit tests and doesn't have the permissions to post the
coverage report in the PR comments.

### Contribution Checklist

<!-- Before submitting this PR, please make sure: -->

- [x] The code builds clean without any errors or warnings
- [x] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [x] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄
 2024-12-12 21:19:46 +00:00