chore(deps): Bump the github-actions-dependencies group with 4 updates

[dependabot]

Bumps the github-actions-dependencies group with 4 updates: github/codeql-action, codecov/codecov-action, python-semantic-release/python-semantic-release and pypa/gh-action-pypi-publish.

Updates github/codeql-action from 3.27.5 to 3.27.6

Release notes

Sourced from github/codeql-action's releases.

v3.27.6

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

Note that the only difference between v2 and v3 of the CodeQL Action is the node version they support, with v3 running on node 20 while we continue to release v2 to support running on node 16. For example 3.22.11 was the first v3 release and is functionally identical to 2.22.11. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.

3.27.6 - 03 Dec 2024

• Update default CodeQL bundle version to 2.19.4. #2626

See the full CHANGELOG.md for more information.

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

Note that the only difference between v2 and v3 of the CodeQL Action is the node version they support, with v3 running on node 20 while we continue to release v2 to support running on node 16. For example 3.22.11 was the first v3 release and is functionally identical to 2.22.11. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.

[UNRELEASED]

• We are rolling out a change in December 2024 that will extract the CodeQL bundle directly to the toolcache to improve performance. #2631
• Update default CodeQL bundle version to 2.20.0. #2636

3.27.6 - 03 Dec 2024

• Update default CodeQL bundle version to 2.19.4. #2626

3.27.5 - 19 Nov 2024

No user facing changes.

3.27.4 - 14 Nov 2024

No user facing changes.

3.27.3 - 12 Nov 2024

No user facing changes.

3.27.2 - 12 Nov 2024

• Fixed an issue where setting up the CodeQL tools would sometimes fail with the message "Invalid value 'undefined' for header 'authorization'". #2590

3.27.1 - 08 Nov 2024

• The CodeQL Action now downloads bundles compressed using Zstandard on GitHub Enterprise Server when using Linux or macOS runners. This speeds up the installation of the CodeQL tools. This feature is already available to GitHub.com users. #2573
• Update default CodeQL bundle version to 2.19.3. #2576

3.27.0 - 22 Oct 2024

• Bump the minimum CodeQL bundle version to 2.14.6. #2549
• Fix an issue where the upload-sarif Action would fail with "upload-sarif post-action step failed: Input required and not supplied: token" when called in a composite Action that had a different set of inputs to the ones expected by the upload-sarif Action. #2557
• Update default CodeQL bundle version to 2.19.2. #2552

3.26.13 - 14 Oct 2024

No user facing changes.

3.26.12 - 07 Oct 2024

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.14.5 and earlier. These versions of CodeQL were discontinued on 24 September 2024 alongside GitHub Enterprise Server 3.10, and will be unsupported by CodeQL Action versions 3.27.0 and later and versions 2.27.0 and later. #2520

... (truncated)

Commits

• aa57810 Merge pull request #2628 from github/update-v3.27.6-af49565b8
• 34e77b7 Update changelog for v3.27.6
• af49565 Merge pull request #2620 from github/cklin/DiffThunkRange-fix
• 5659f01 Merge pull request #2626 from github/update-bundle/codeql-bundle-v2.19.4
• 5333ff3 Add changelog note
• e4fb28d Update default bundle to codeql-bundle-v2.19.4
• 3d3d628 Merge pull request #2617 from github/update-supported-enterprise-server-versions
• 2eea97e Fix DiffThunkRange access
• f8e782a Merge pull request #2618 from github/mergeback/v3.27.5-to-main-f09c1c0a
• 49b7c97 Update checked-in dependencies
• Additional commits viewable in compare view

Updates codecov/codecov-action from 5.0.7 to 5.1.1

Release notes

Sourced from codecov/codecov-action's releases.

v5.1.1

What's Changed

• chore(release): wrapper-0.0.30 by @​codecov-releaser-app in codecov/codecov-action#1715

Full Changelog: codecov/codecov-action@v5.1.0...v5.1.1

v5.1.0

What's Changed

• build(deps): bump github/codeql-action from 3.27.4 to 3.27.5 by @​dependabot in codecov/codecov-action#1701
• fix: hide unnecessary error on shasum by @​thomasrockhu-codecov in codecov/codecov-action#1692
• chore(release): wrapper-0.0.29 by @​codecov-releaser-app in codecov/codecov-action#1713
• chore(release): 5.1.0 by @​thomasrockhu-codecov in codecov/codecov-action#1714

Full Changelog: codecov/codecov-action@v5.0.7...v5.1.0

Changelog

Sourced from codecov/codecov-action's changelog.

v5.1.1

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.1.0..v5.1.1

v5.1.0

What's Changed

• fix: hide unnecessary error on shasum by @​thomasrockhu-codecov in codecov/codecov-action#1692
• build(deps): bump github/codeql-action from 3.27.4 to 3.27.5 by @​app/dependabot in codecov/codecov-action#1701
• chore(release): wrapper-0.0.29 by @​app/codecov-releaser-app in codecov/codecov-action#1713

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.0.7..v5.1.0

v5.0.7

What's Changed

• fix: use HEAD_REPO by @​thomasrockhu-codecov in codecov/codecov-action#1690

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.0.6..v5.0.7

v5.0.6

What's Changed

• fix: update CODECOV_TOKEN and fix tokenless by @​thomasrockhu-codecov in codecov/codecov-action#1688

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.0.5..v5.0.6

v5.0.5

What's Changed

• chore(release): wrapper-0.0.27 by @​app/codecov-releaser-app in codecov/codecov-action#1685

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.0.4..v5.0.5

v5.0.4

What's Changed

• chore(deps): bump wrapper to 0.0.26 by @​thomasrockhu-codecov in codecov/codecov-action#1681
• fix: strip out a trailing /n from input tokens by @​thomasrockhu-codecov in codecov/codecov-action#1679
• fix: add action version by @​thomasrockhu-codecov in codecov/codecov-action#1678

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.0.3..v5.0.4

v5.0.3

What's Changed

• fix: update OIDC audience by @​thomasrockhu-codecov in codecov/codecov-action#1675
• fix: use double-quotes for OIDC by @​thomasrockhu-codecov in codecov/codecov-action#1669
• fix: prevent always setting tokenless to be true by @​thomasrockhu-codecov in codecov/codecov-action#1673

... (truncated)

Commits

• 7f8b4b4 chore(release): wrapper-0.0.30 (#1715)
• c2fcb21 chore(release): 5.1.0 (#1714)
• 0192401 chore(release): wrapper-0.0.29 (#1713)
• cda5e55 fix: hide unnecessary error on shasum (#1692)
• 2ed5abc build(deps): bump github/codeql-action from 3.27.4 to 3.27.5 (#1701)
• See full diff in compare view

Updates python-semantic-release/python-semantic-release from 9.15.0 to 9.15.1

Release notes

Sourced from python-semantic-release/python-semantic-release's releases.

v9.15.1 (2024-12-03)

Bug Fixes

• changelog-md: Fix commit sort of breaking descriptions section (75b342e)

• parser-angular: Ensure issues are sorted by numeric value rather than text sorted (3858add)

• parser-emoji: Ensure issues are sorted by numeric value rather than text sorted (7b8d2d9)

---

Detailed Changes: v9.15.0...v9.15.1

Changelog

Sourced from python-semantic-release/python-semantic-release's changelog.

CHANGELOG

v9.15.1 (2024-12-03)

Bug Fixes

• changelog-md: Fix commit sort of breaking descriptions section (75b342e)

• parser-angular: Ensure issues are sorted by numeric value rather than text sorted (3858add)

• parser-emoji: Ensure issues are sorted by numeric value rather than text sorted (7b8d2d9)

v9.15.0 (2024-12-02)

Bug Fixes

• cmd-version: Ensure release utilizes a timezone aware datetime (ca817ed)

• default-changelog: Alphabetically sort commit descriptions in version type sections (bdaaf5a)

Features

• commit-parser: Enable parsers to flag commit to be ignored for changelog (#1108, 0cc668c)

This adds an attribute to the ParsedCommit object that allows custom parsers to set to false if it is desired to ignore the commit completely from entry into the changelog.

Resolves: #778

• test(parser-custom): add test w/ parser that toggles if a parsed commit is included in changelog

• default-changelog: Add a separate formatted breaking changes section (#1110, 4fde30e)

Resolves: #244

• test(fixtures): update repo changelog generator to add breaking descriptions

• test(default-changelog): add unit tests to demonstrate breaking change descriptions

... (truncated)

Commits

• a323379 9.15.1
• 7ae2b73 style(parsers): fix lint error & formatting
• 75b342e fix(changelog-md): fix commit sort of breaking descriptions section
• 7b8d2d9 fix(parser-emoji): ensure issues are sorted by numeric value rather than text...
• 3858add fix(parser-angular): ensure issues are sorted by numeric value rather than te...
• 290334d test(parsers): ensure issue sort by numeric value instead of alphanumeric
• 18c6c65 ci(deps): bump psr/publish-action & action-junit-report actions (#1113)
• See full diff in compare view

Updates pypa/gh-action-pypi-publish from 1.12.2 to 1.12.3

Release notes

Sourced from pypa/gh-action-pypi-publish's releases.

v1.12.3

✨ What's Improved

With the updates by @​woodruffw💰 and @​webknjaz💰 via #309 and #313, it is now possible to publish distribution packages that include core metadata v2.4, like those built using maturin. This is done by bumping Twine to v6.0.1 and pkginfo to v1.12.0.

📝 Docs

We've made an attempt to clarify the runtime and workflow shape that are expected to be supported for calling this action in: https://github.com/marketplace/actions/pypi-publish#Non-goals.

[!TIP] Please, let us know in the release discussion if anything still remains unclear. TL;DR always call pypi-publish once per job; don't invoke it in reusable workflows; physically move building the dists into separate jobs having restricted permissions and storing the dists as GitHub Actions artifacts; when using self-hosted runners, make sure to still use pypi-publish on a GitHub-provided infra with runs-on: ubuntu-latest, while building and testing may remain self-hosted; don't perform any other actions in the publishing job; don't call pypi-publish from composite actions.

🛠️ Internal Updates

@​br3ndonland💰 improved the container image generation automation to include Git SHA in #301. And @​woodruffw💰 added the workflow_ref context to Trusted Publishing debug logging in #305, helping us diagnose misconfigurations faster. #313 also extends the smoke test in the CI to check against the maturin-made dists. Additionally, jeepney and secretstorage transitive deps have been added to the pip constraint-based lock file, as Dependabot seems to have missed those earlier.

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.12.2...v1.12.3

🧔‍♂️ Release Manager: @​webknjaz 🇺🇦

🙏 Special Thanks to @​samuelcolvin💰 for nudging me to cut this release sooner and for sponsoring me via @​pydantic💰!

🔌 Shameless Plug: The other day I've made this 🦋 Bluesky 🇺🇦 FOSS Maintainers Starter Pack subscribe to read news from people like me :)

💬 Discuss on Bluesky 🦋, on Mastodon 🐘 and on GitHub.

Commits

• 67339c7 📦 Only keep lower bounds @ input requirements
• cbd6d01 📝Fix a typo in "privileges" @ README
• 7252a9a 📝 Outline unsupported scenarios in README
• a536fa9 📌📦 Include jeepney & secretstorage pins
• 43caae4 💅📦 Split transitive dep constraints
• f371c3d Merge pull request #313 from webknjaz/maintenance/metadata-2.4
• 138a121 📌📦 Pin pkginfo to v1.12 @ runtime deps
• ff2b051 🧪 Add a Maturin-based package to CI
• 0a0a6ae 🧪 Allow CI to register multiple distributions
• e7723a4 Merge pull request #309 from trail-of-forks/ww/bumptwine
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Summary by Sourcery

CI:

• Update GitHub Actions dependencies including github/codeql-action, codecov/codecov-action, python-semantic-release, and pypa/gh-action-pypi-publish to their latest versions.

[sourcery-ai]

Reviewer's Guide by Sourcery

This pull request updates four GitHub Actions dependencies to their latest versions. The changes are minor version or patch updates that include bug fixes and improvements to the actions.

No diagrams generated as the changes look simple and do not need a visual representation.

File-Level Changes

Change	Details	Files
Update CodeQL action to version 3.27.6	Update default CodeQL bundle version to 2.19.4	.github/workflows/codeql.yml .github/workflows/scorecard.yml
Update Codecov action to version 5.1.1	Fix unnecessary error on shasum Update wrapper to version 0.0.30	.github/workflows/continuous-integration.yml
Update Python Semantic Release action to version 9.15.1	Fix commit sort of breaking descriptions section Fix issue sorting in Angular and Emoji parsers	.github/workflows/semantic-release.yml
Update PyPI publish action to version 1.12.3	Add support for core metadata v2.4 distribution packages Improve container image generation automation Add workflow_ref context to Trusted Publishing debug logging	.github/workflows/semantic-release.yml

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time. You can also use
  this command to specify where the summary should be inserted.

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

We have skipped reviewing this pull request. It seems to have been created by a bot (hey, dependabot[bot]!). We assume it knows what it's doing!