[dependabot]

Bumps the actions group with 2 updates in the / directory: alibaba/open-code-review and zizmorcore/zizmor-action.

Updates alibaba/open-code-review from 1.12.9 to 1.13.1

Release notes

Sourced from alibaba/open-code-review's releases.

v1.13.1

🐛 Bug Fixes

• fix(config): fix bad config for providers or keys that cotains dots (self-defined) (#1661)
• fix(scan): surface llmloop token-budget stop on the run-level state (#1745)
• fix(frontend): update vulnerable development dependencies (#1751)
• fix(llmloop): count a grace-round task_done as completion (#1678)
• fix(vscode): update vulnerable development dependencies (#1746)

Other Changes

• chore(deps): bump google.golang.org/grpc to v1.83.2 (#1205)

Full Changelog: alibaba/open-code-review@v1.13.0...v1.13.1

v1.13.0

🚀 Features

• feat(auth): enable ChatGPT plan reviews through public Responses (#1622)
• feat(acp): support ACP service for OpenCodeReview (#1218)

🐛 Bug Fixes

• fix: follow up ChatGPT auth recovery and provider credentials (#1622) (#1718)
• fix(scan): record rendered prompt overflow as a failed review (#1652)
• fix(agent): make deleted files readable through file_read_diff (#1698)
• fix(agent): list deleted files under their own path in the change list (#1680)
• fix(opencode): preserve OCR output on Windows (#1606)

📖 Documentation

• docs(delegate): prevent pager hangs; ci: upgrade Go and x/net (#1062)

Other Changes

• ci(release): publish to npm via trusted publishing (#1732)
• test(allowlist): catch an extension disappearing from the allowlist (#1626)

Full Changelog: alibaba/open-code-review@v1.12.13...v1.13.0

v1.12.13

🐛 Bug Fixes

• fix(scan): treat "." as the repository root and convert separators first (#1598)
• fix(readme): use a proxy-friendly DeepWiki badge (#1673)
• fix(llm): clarify independent timeouts and deadline diagnostics (#1159)

... (truncated)

Commits

• 8eb8334 fix(config): fix bad config for providers or keys that cotains dots (self-def...
• 11ac6d4 fix(scan): surface llmloop token-budget stop on the run-level state (#1745)
• ea5ced2 fix(frontend): update vulnerable development dependencies (#1751)
• 81df1f6 fix(llmloop): count a grace-round task_done as completion (#1678)
• d73c9d3 fix(vscode): update vulnerable development dependencies (#1746)
• b842659 chore(deps): bump google.golang.org/grpc to v1.83.2 (#1205)
• 1672852 ci(release): publish to npm via trusted publishing (#1732)
• 3694a71 fix: follow up ChatGPT auth recovery and provider credentials (#1622) (#1718)
• c773421 feat(auth): enable ChatGPT plan reviews through public Responses (#1622)
• 4a3844c fix(scan): record rendered prompt overflow as a failed review (#1652)
• Additional commits viewable in compare view

Updates zizmorcore/zizmor-action from 0.6.4 to 0.7.1

Release notes

Sourced from zizmorcore/zizmor-action's releases.

v0.7.1

zizmor changes

Bug Fixes 🐛🔗

• Fixed a regression in 1.31.0 where some ignore comments/configurations would no longer apply to the dangerous-triggers audit

action changes

The default version of zizmor is now 1.31.1.

What's Changed

• Sync zizmor versions by @​github-actions[bot] in zizmorcore/zizmor-action#178

Full Changelog: zizmorcore/zizmor-action@v0.7.0...v0.7.1

v0.7.0

Sponsorship is appreciated!

zizmor notes

Enhancements 🌱🔗

• The typosquat-uses audit now supports pre-commit config inputs (#2437)

• The self-hosted-runner audit is now significantly more precise (#2350)

  Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

• The dangerous-triggers audit now considers the issue_comment trigger fundamentally dangerous (#2396)

• zizmor is now aware of the image_version workflow trigger (#2397)

• The dangerous-triggers audit now produces more precise finding/diagnostic spans (#2402)

• The cache-poisoning audit is now aware of pnpm/setup (#2409)

• The unpinned-images audit now produces more precise findings when the user's workflow contains an indirect matrix (#2395)

  Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

• The cache-poisoning audit is now aware of GitHub's new cache-mode: setting, and will skip any findings that would occur when a job has an effective cache-mode: none (#2418)

• The cache-poisoning audit now flags usages of cache-mode: write and cache-mode: write-only with dangerous triggers, i.e. triggers that give an attacker privileged code execution (#2426)

• zizmor now uses a tree-sitter grammar for PowerShell that's more precise/capable of capturing more non-trivial PowerShell expressions (#2444)

Bug Fixes 🐛🔗

... (truncated)

Commits

• 85b2b9f Sync zizmor versions (#178)
• 38c745a README: bump pins (#177)
• f9597c8 Sync zizmor versions (#175)
• 2181e51 Bump sync-zizmor-versions.py to Python 3.11 for locking (#174)
• 27d989b chore(deps): bump the github-actions group with 2 updates (#173)
• a91218c Bootstrap zizmor without Docker (#169)
• ee3f1bf chore(deps): bump the github-actions group with 2 updates (#170)
• 8eacaa5 README: bump pins (#167)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: QUIET
• Plan: Advanced
• Run ID: ca4098e5-7147-4361-a180-26d0d301b750

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}