Update github actions

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	minor	v6.0.2 → v6.1.0
actions/create-github-app-token	action	minor	v3.1.1 → v3.2.0
actions/setup-node	action	minor	v6.4.0 → v6.5.0
github/codeql-action	action	patch	v4.37.7 → v4.37.9
jdx/mise-action	action	minor	v4.2.5 → v4.3.0
open-telemetry/shared-workflows	workflow	minor	v0.7.0 → v0.12.0
python	uses-with	minor	3.11 → 3.14

---

Release Notes

actions/checkout (actions/checkout)

v6.1.0

Compare Source

v6.0.3

Compare Source

• Fix checkout init for SHA-256 repositories by @​yaananth in #​2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in #​2414

actions/create-github-app-token (actions/create-github-app-token)

v3.2.0

Compare Source

Features

• add support for enterprise-level GitHub Apps (#​263) (952a2a7)
• support full repository names in repositories input (#​372) (85eb8dd)

Bug Fixes

• deps: bump @​actions/core from 3.0.0 to 3.0.1 in the production-dependencies group (#​364) (43e5c34)
• validate private-key input (#​376) (f24bbd8)

actions/setup-node (actions/setup-node)

v6.5.0

Compare Source

What's Changed

• Update @​actions/cache to 5.1.0 and add security overrides for undici and fast-xml-parser by @​HarithaVattikuti in #​1579

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

github/codeql-action (github/codeql-action)

v4.37.9

Compare Source

• Update default CodeQL bundle version to 2.26.4. #​4106

v4.37.8

Compare Source

No user facing changes.

jdx/mise-action (jdx/mise-action)

v4.3.0: : Install age-filtered mise releases

Compare Source

A small release that adds an opt-in way to hold back from installing brand-new mise releases.

Added

minimum_release_age input (#​604 by @​jdx)

When version is omitted, you can now set minimum_release_age to install the newest stable, non-draft mise release that is older than a given cutoff — a simple way to avoid picking up a mise release the moment it ships (closes #​603).

- uses: jdx/mise-action@v4
  with:
    minimum_release_age: 7d

It accepts relative durations (24h, 7d, 6mo, 1y) as well as absolute ISO dates and timestamps. Age-filtered versions are resolved from the GitHub Releases API (the CDN only serves the latest binary) and downloaded by their exact version. If mise is already present on disk, an age-filtered run updates it to the resolved version rather than keeping the existing binary. An explicit version always takes precedence over minimum_release_age, and invalid dates fail fast.

Full Changelog: jdx/mise-action@v4.2.5...v4.3.0

open-telemetry/shared-workflows (open-telemetry/shared-workflows)

v0.12.0

Compare Source

What's Changed

• Use typed dashboard result and state contracts by @​trask in #​303
• Normalize pull request data before dashboard evaluation by @​trask in #​304
• Add opentelemetry-ebpf-profiler to PR dashboard by @​florianl in #​318
• Allow callers to skip Scorecard publication by @​trask in #​317
• Extract pure classification policy by @​trask in #​313
• Isolate classification execution and cache orchestration by @​trask in #​314
• End reviewer handoff on actionable feedback by @​trask in #​310
• Create dashboard status comments for draft pull requests by @​trask in #​321

New Contributors

• @​florianl made their first contribution in #​318

Full Changelog: open-telemetry/shared-workflows@v0.11.0...v0.12.0

v0.11.0

Compare Source

What's Changed

• Promote pull request dashboard to v0.10.0 by @​otelbot-shared-workflows[bot] in #​284
• Default releases to minor version bumps by @​trask in #​283
• Add a manual sweep that repairs stale author reminders by @​trask in #​281
• Load dashboard code from the reusable workflow commit by @​trask in #​285
• Restore dashboard workflow Git context by @​trask in #​287
• Extract PR dashboard discussion lifecycle by @​trask in #​293
• Extract PR dashboard routing snapshot by @​trask in #​294
• Extract dashboard routing into a single decision by @​trask in #​296
• Extract PR dashboard reviewer state by @​trask in #​297
• Extract pull request activity timeline by @​trask in #​298
• Separate PR evaluation from dashboard operations by @​trask in #​299
• Extract dashboard state update transaction by @​trask in #​300
• Defer dashboard comment updates for locked pull requests by @​trask in #​291
• Remove CNCF-hosted runner option from Scorecard and Zizmor docs by @​trask in #​309
• Add Scorecard file mode and Harden Runner options by @​trask in #​306

Full Changelog: open-telemetry/shared-workflows@v0.10.0...v0.11.0

v0.10.0

Compare Source

What's Changed

• Promote pull request dashboard to v0.9.0 by @​otelbot-shared-workflows[bot] in #​275
• Shorten the author reminder comment by @​trask in #​276
• Restore GitHub-hosted runners by @​trask in #​278
• Show time spent in draft on PR dashboard by @​trask in #​272
• Make Netlify queue mode updates repeatable by @​trask in #​277
• Make Netlify queue worker retries safe by @​trask in #​279
• Stop a stalled gate from failing the repository run by @​trask in #​280

Full Changelog: open-telemetry/shared-workflows@v0.9.0...v0.10.0

v0.9.0

Compare Source

What's Changed

• Queue pull request dashboard updates in Netlify by @​trask in #​271

Full Changelog: open-telemetry/shared-workflows@v0.8.0...v0.9.0

v0.8.0

Compare Source

What's Changed

• Fix PR dashboard promotion permissions by @​trask in #​250
• Promote pull request dashboard to v0.7.0 by @​otelbot-shared-workflows[bot] in #​252
• Add otel-python repos to pull request dashboard by @​emdneto in #​249
• Add semantic-conventions-conformance to PR dashboard by @​lmolkova in #​257
• Request Copilot's first review when the automatic one never arrives by @​trask in #​253
• Stop a gate that never reports from holding a pull request forever by @​trask in #​255
• Keep re-requested approvals in reviewer queue by @​trask in #​262
• Keep conflicted PR routing actionable without gate failures by @​trask in #​265
• Migrate workflows to CNCF runners with caller opt-in by @​trask in #​269

New Contributors

• @​otelbot-shared-workflows[bot] made their first contribution in #​252
• @​emdneto made their first contribution in #​249
• @​lmolkova made their first contribution in #​257

Full Changelog: open-telemetry/shared-workflows@v0.7.0...v0.8.0

actions/python-versions (python)

v3.14.7: 3.14.7

Compare Source

Python 3.14.7

v3.14.6: 3.14.6

Compare Source

Python 3.14.6

v3.14.5: 3.14.5

Compare Source

Python 3.14.5

v3.14.4: 3.14.4

Compare Source

Python 3.14.4

v3.14.3: 3.14.3

Compare Source

Python 3.14.3

v3.14.2: 3.14.2

Compare Source

Python 3.14.2

v3.14.1: 3.14.1

Compare Source

Python 3.14.1

v3.14.0: 3.14.0

Compare Source

Python 3.14.0

v3.13.15: 3.13.15

Compare Source

Python 3.13.15

v3.13.14: 3.13.14

Compare Source

Python 3.13.14

v3.13.13: 3.13.13

Compare Source

Python 3.13.13

v3.13.12: 3.13.12

Compare Source

Python 3.13.12

v3.13.11: 3.13.11

Compare Source

Python 3.13.11

v3.13.10: 3.13.10

Compare Source

Python 3.13.10

v3.13.9: 3.13.9

Compare Source

Python 3.13.9

v3.13.8: 3.13.8

Compare Source

Python 3.13.8

v3.13.7: 3.13.7

Compare Source

Python 3.13.7

v3.13.6: 3.13.6

Compare Source

Python 3.13.6

v3.13.5: 3.13.5

Compare Source

Python 3.13.5

v3.13.4: 3.13.4

Compare Source

Python 3.13.4

v3.13.3: 3.13.3

Compare Source

Python 3.13.3

v3.13.2: 3.13.2

Compare Source

Python 3.13.2

v3.13.1: 3.13.1

Compare Source

Python 3.13.1

v3.13.0: 3.13.0

Compare Source

Python 3.13.0

v3.12.14: 3.12.14

Compare Source

Python 3.12.14

v3.12.13: 3.12.13

Compare Source

Python 3.12.13

v3.12.12: 3.12.12

Compare Source

Python 3.12.12

v3.12.11: 3.12.11

Compare Source

Python 3.12.11

v3.12.10: 3.12.10

Compare Source

Python 3.12.10

v3.12.9: 3.12.9

Compare Source

Python 3.12.9

v3.12.8: 3.12.8

Compare Source

Python 3.12.8

v3.12.7: 3.12.7

Compare Source

Python 3.12.7

v3.12.6: 3.12.6

Compare Source

Python 3.12.6

v3.12.5: 3.12.5

Compare Source

Python 3.12.5

v3.12.4: 3.12.4

Compare Source

Python 3.12.4

v3.12.3: 3.12.3

Compare Source

Python 3.12.3

v3.12.2: 3.12.2

Compare Source

Python 3.12.2

v3.12.1: 3.12.1

Compare Source

Python 3.12.1

v3.12.0: 3.12.0

Compare Source

Python 3.12.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 07:59 AM, only on Tuesday (* 0-7 * * 2)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[Copilot]

Pull request overview

Updates pinned GitHub Actions and reusable shared workflows used by this repository’s CI/security automation, and refreshes the Python toolchain version used by workflow-run scripts.

Changes:

• Bump open-telemetry/shared-workflows reusable workflow references from v0.7.0 to v0.12.0 (pinned by commit SHA).
• Update several GitHub Actions pins (e.g., actions/checkout, actions/setup-node, actions/create-github-app-token, github/codeql-action).
• Update workflow Python version from 3.11 to 3.14 for release-notes/script jobs.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
.github/workflows/zizmor.yml	Bumps shared zizmor reusable workflow pin to v0.12.0.
.github/workflows/sonatype-guide-dependency-audit-daily.yml	Bumps shared failure-notification reusable workflow pin to v0.12.0.
.github/workflows/reusable-lint.yml	Updates jdx/mise-action pin to v4.3.0.
.github/workflows/ossf-scorecard.yml	Bumps shared scorecard + failure-notification workflow pins to v0.12.0.
.github/workflows/issue-management-stale-action.yml	Bumps shared failure-notification workflow pin to v0.12.0.
.github/workflows/fossa.yml	Bumps shared failure-notification workflow pin to v0.12.0.
.github/workflows/draft-release-notes.yml	Updates checkout, setup-node, create-github-app-token, and sets Python to 3.14.
.github/workflows/dependency-submission.yml	Bumps shared failure-notification workflow pin to v0.12.0.
.github/workflows/codeql.yml	Updates CodeQL action pins and bumps shared failure-notification workflow pin to v0.12.0.
.github/workflows/build-daily.yml	Bumps shared failure-notification workflow pin to v0.12.0.
.github/workflows/build-common.yml	Sets Python to 3.14 for workflow-run Python scripts.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.