deps(actions): bump KineticCafe/actions-dco from 3.1.0 to 3.2.0 in the actions-all group across 1 directory

[dependabot]

Bumps the actions-all group with 1 update in the / directory: KineticCafe/actions-dco.

Updates KineticCafe/actions-dco from 3.1.0 to 3.2.0

Release notes

Sourced from KineticCafe/actions-dco's releases.

v3.2.0: Prefer Default Branch Configuration

• Added a test case to detect regression of #216 or similar parsing errors.
• Modified the error handling of JSON response decoding to include a more meaningful error.
• Added support for reading .github/dco-check.toml or .dco-check.toml from the repo root on the default branch. If present, this takes precedence over any inline configuration (config:) key. This prevents a PR from "accidentally" changing the DCO check policy. See the configuration documentation for details.
• Added a configuration report to the output logs so that transient configurations are still reported for review.

What's Changed

• deps: bump the actions group with 2 updates by @​dependabot[bot] in KineticCafe/actions-dco#214
• deps: bump actions/dependency-review-action from 4.9.0 to 5.0.0 by @​dependabot[bot] in KineticCafe/actions-dco#215
• chore: Default branch configuration by @​halostatue in KineticCafe/actions-dco#218
• feat: Support default branch config file by @​halostatue in KineticCafe/actions-dco#219

Full Changelog: KineticCafe/actions-dco@v3.1.1...v3.2.0

v3.1.1: Fix author parsing when null

What's Changed

• fix: Fix author parsing when null by @​halostatue in KineticCafe/actions-dco#217

Full Changelog: KineticCafe/actions-dco@v3.1.0...v3.1.1

Changelog

Sourced from KineticCafe/actions-dco's changelog.

KineticCafe/actions-dco Changelog

3.2.0 / 2026-07-25

• Added a test case to detect regression of #216[issue-216] or similar parsing errors.

• Modified the error handling of JSON response decoding to include a more meaningful error.

• Added support for reading .github/dco-check.toml or .dco-check.toml from the repo root on the default branch. If present, this takes precedence over any inline configuration (config:) key. This prevents a PR from "accidentally" changing the DCO check policy. See the configuration documentation for details.

• Added a configuration report to the output logs so that transient configurations are still reported for review.

3.1.1 / 2026-07-25

• Resolved #216[issue-216] with a fix to the OpenAPI generator oaspec.

3.1.0 / 2026-05-15

• Reshaped the sign-off summary written to the action and optionally as a commit comment. The message as added with 3.0.0 was accurate but meaningless. It has now be modified to produce meaningful summaries.

  Each commit that fails (up to X commits) will be included in a DCO failure table:

  | Commit     | Subject                       | Issue                    |
  | ---------- | ----------------------------- | ------------------------ |
  | `ff882225` | deps: Bump the actions group… | No Signed-off-by trailer |

  When commits are passed, skipped or exempt, they are included in a "pass" table grouped by the identity responsible that signed off:

  | Identity                | Commits                        |
  | ----------------------- | ------------------------------ |
  | dependabot[bot]         | 1 (bot, skipped)               |
  | Alice <al…@example.org> | 2 (signed off)                 |
  | Bob <bob@example.com>   | 1 (exempt domain @example.com) |

  The comment will be headed with a subject indicating that the check was

... (truncated)

Commits

• 5f160e3 feat: Add used configuration report
• b1fee4e chore: Build for release
• c963bcb chore: Remove inline config
• 5704499 chore: Bump release version and add changelog
• fc47443 feat: Support default branch config file
• 54e60fa chore: Carry decode errors up and present better errors.
• a171fbc chore: Clean up documentation
• cd84bf8 chore: Add regression test for unknown authors
• 15d7c62 chore: Update action dependencies
• 3ac7462 chore: Use oaspec 0.69.0
• Additional commits viewable in compare view

[Chris0Jeky]

Fresh adversarial review — current head 0731e630290772ef65189c5bfbde291df1c3c8e9.

Findings

HIGH — required Windows regression lane is red

Backend Unit (windows-latest) failed on merge ref a7a50401854031130e694ffec1e807209b466ca4: six CLI subprocess tests timed out at the harness's 30-second limit, leaving dotnet/conhost processes for runner cleanup. The one-line DCO-action SHA update does not explain the failure, and nearby Dependabot merge refs at the same base passed, so it cannot be dismissed as flaky. Tracked as #1530.

No separate workflow-security finding: the action remains SHA-pinned, DCO passed, and v3.2.0's default-branch configuration lookup is a hardening change rather than PR-controlled policy input. I read all existing PR-conversation comments, reviews, and review threads: all were empty.

Residual merge gates

• Investigate/fix [Bug] Diagnose Windows CLI subprocess timeouts in required backend unit CI #1530 or obtain a new green required CI run at this exact head.
• The prior merge ref used ff1ee066; main is now 397ba9d2368a7c5e7eb2daf31e1e43640b3ca144, so refresh/re-prove against the current base after the CI fix.
• The Taskdeck Execution project item is Pending with no Priority; derive and set Priority V (no linked Taskdeck issue) before handoff.

Recommendation: not mergeable until the red CI gate is resolved and the current-base/governance gates are green.