chore(deps): bump the all group with 2 updates

[dependabot]

Bumps the all group with 2 updates: fgrosse/go-coverage-report and chainguard-dev/actions/kind-diag.

Updates fgrosse/go-coverage-report from 1.4.0 to 1.5.0

Release notes

Sourced from fgrosse/go-coverage-report's releases.

v1.5.0

• If the base commit of the pull request has no usable baseline run (e.g. because it failed, is still running or its artifact expired), the action now uses the nearest commit in the first-parent history of the base commit with a usable run instead of the latest run on the target branch. The runs of each commit are filtered client-side, since the filtered workflow runs API can return stale results, and further candidates are tried if a coverage artifact cannot be downloaded or does not fgrosse/go-coverage-report#113
• Add baseline-search-depth and baseline-max-downloads inputs to configure how far the action searches for a baseline fgrosse/go-coverage-report#113
• fgrosse/go-coverage-report#13
• Behavior change: By default, the baseline coverage is now taken from the latest successful run for the base commit of the pull request (new baseline-sha input, defaults to github.event.pull_request.base.sha) instead of the latest successful run on the target branch. If there is no such run, the action falls back to the latest successful run on the target branch and emits a warning. Set baseline-sha to ""fgrosse/go-coverage-report#110
• Add baseline-run-idfgrosse/go-coverage-report#110
• Improve diagnostics when no baseline coverage is available: warnings and the pull request comment now distinguish between no successful baseline run being found and the coverage artifact of the selected run not being downloadable, and the fgrosse/go-coverage-report#110
• Show a caution callout at the top of the pull request comment if the report does not compare against the base commit fgrosse/go-coverage-report#110
• Name the baseline commit and run in the details section of the report via the new -baseline-commit, -baseline-run-id and -baseline-run-urlfgrosse/go-coverage-report#110
• Simplify the details section of the report: rename it to "Coverage details" and drop its headings to avoid mixing many fgrosse/go-coverage-report#110

Changelog

Sourced from fgrosse/go-coverage-report's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

Nothing yet

[v1.5.0] - 2026-10-02

• If the base commit of the pull request has no usable baseline run (e.g. because it failed, is still running or its artifact expired), the action now uses the nearest commit in the first-parent history of the base commit with a usable run instead of the latest run on the target branch. The runs of each commit are filtered client-side, since the filtered workflow runs API can return stale results, and further candidates are tried if a coverage artifact cannot be downloaded or does not fgrosse/go-coverage-report#113
• Add baseline-search-depth and baseline-max-downloads inputs to configure how far the action searches for a baseline fgrosse/go-coverage-report#113
• fgrosse/go-coverage-report#13
• Behavior change: By default, the baseline coverage is now taken from the latest successful run for the base commit of the pull request (new baseline-sha input, defaults to github.event.pull_request.base.sha) instead of the latest successful run on the target branch. If there is no such run, the action falls back to the latest successful run on the target branch and emits a warning. Set baseline-sha to ""fgrosse/go-coverage-report#110
• Add baseline-run-idfgrosse/go-coverage-report#110
• Improve diagnostics when no baseline coverage is available: warnings and the pull request comment now distinguish between no successful baseline run being found and the coverage artifact of the selected run not being downloadable, and the fgrosse/go-coverage-report#110
• Show a caution callout at the top of the pull request comment if the report does not compare against the base commit fgrosse/go-coverage-report#110
• Name the baseline commit and run in the details section of the report via the new -baseline-commit, -baseline-run-id and -baseline-run-urlfgrosse/go-coverage-report#110
• Simplify the details section of the report: rename it to "Coverage details" and drop its headings to avoid mixing many fgrosse/go-coverage-report#110

[v1.4.0] - 2026-09-20

• Also report packages whose coverage changed without any of their files being changed, e.g. when running integration tests with go test -coverpkgfgrosse/go-coverage-report#102
• fgrosse/go-coverage-report#103
• Fix the excludefgrosse/go-coverage-report#104

[v1.3.1] - 2026-07-20

• fgrosse/go-coverage-report#82
• Fix the ::endgroup::fgrosse/go-coverage-report#89

[v1.3.0] - 2026-03-11

• Add event-name and target-branch inputs to support workflows triggered by events other than pushfgrosse/go-coverage-report#58
• fgrosse/go-coverage-report#72
• fgrosse/go-coverage-report#71
• Add --excludefgrosse/go-coverage-report#59
• Add structured outputs (total_coverage, coverage_delta, coverage_trend, total_statements, covered_statements, missed_statementsfgrosse/go-coverage-report#64

[v1.2.0] - 2024-08-28

... (truncated)

Commits

• c4bf7e7 Release v1.5.0
• 2d3d0a9 action: fall back to the nearest ancestor of the base commit (#113)
• 7752bdc action: select the baseline by the PR base commit and explain it in the repor...
• 6093ed4 Bump github/codeql-action from 4.38.0 to 4.38.1 (#112)
• b1b031a go-coverage-report: drop package name limitation (#111)
• See full diff in compare view

Updates chainguard-dev/actions/kind-diag from 1.6.37 to 1.6.40

Release notes

Sourced from chainguard-dev/actions/kind-diag's releases.

v1.6.40

What's Changed

• fix(setup-eksctl): match archive checksum exactly by @​shimmerjs in chainguard-dev/actions#1066

New Contributors

• @​shimmerjs made their first contribution in chainguard-dev/actions#1066

Full Changelog: chainguard-dev/actions@v1.6.39...v1.6.40

v1.6.39

What's Changed

• fix(release): stop persisting checkout credentials by @​stevebeattie in chainguard-dev/actions#1065

Full Changelog: chainguard-dev/actions@v1.6.38...v1.6.39

v1.6.38

What's Changed

• build(deps): bump reviewdog/action-actionlint from 1.73.4 to 1.74.0 by @​dependabot[bot] in chainguard-dev/actions#1044
• build(deps): bump the actions group across 1 directory with 3 updates by @​dependabot[bot] in chainguard-dev/actions#1043
• ci: add stale workflow for inactive issues and PRs by @​cpanato in chainguard-dev/actions#1047
• otel-export: move to TypeScript 7 and bump deps to latest by @​cpanato in chainguard-dev/actions#1046
• build(deps): bump reviewdog/action-actionlint from 1.74.0 to 1.77.0 by @​dependabot[bot] in chainguard-dev/actions#1050
• build(deps-dev): bump @​types/node from 25.9.8 to 26.6.3 in /otel-export by @​dependabot[bot] in chainguard-dev/actions#1048
• docs: pin README examples, flag apko-build deprecation, drop stale TODOs by @​cpanato in chainguard-dev/actions#1051
• build(deps): bump the actions group across 8 directories with 8 updates by @​dependabot[bot] in chainguard-dev/actions#1049
• ci: suppress zizmor superfluous-actions on create-pull-request by @​cpanato in chainguard-dev/actions#1056
• release-notes: don't persist checkout credentials by @​cpanato in chainguard-dev/actions#1055
• setup-kind: validate registry-authority before writing GITHUB_ENV by @​cpanato in chainguard-dev/actions#1054
• ci: suppress zizmor github-env on fixed PATH/ENV writes by @​cpanato in chainguard-dev/actions#1053
• ci: suppress zizmor self-repository on local action refs by @​cpanato in chainguard-dev/actions#1052
• hugo2confluence: fix gomarkdown OOB read, require Go 1.27 by @​cpanato in chainguard-dev/actions#1058
• githubapp-token: install @​octokit/app from a lockfile by @​cpanato in chainguard-dev/actions#1057
• release-notes: set up the stable Go release instead of 1.25 by @​cpanato in chainguard-dev/actions#1059
• build(deps): bump @​octokit/app from 16.1.2 to 16.1.4 in /githubapp-token by @​dependabot[bot] in chainguard-dev/actions#1060
• fix(git-tag): push with the token input via a credential helper by @​stevebeattie in chainguard-dev/actions#1062

Full Changelog: chainguard-dev/actions@v1.6.37...v1.6.38

Commits

• 84b1be4 fix(setup-eksctl): match archive checksum exactly (#1066)
• ec1df73 fix(release): stop persisting checkout credentials (#1065)
• 0a46f70 fix(git-tag): push with the token input via a credential helper (#1062)
• afed75b build(deps): bump @​octokit/app from 16.1.2 to 16.1.4 in /githubapp-token (#1060)
• 4eb623e release-notes: set up the stable Go release instead of 1.25 (#1059)
• 24c9d6b githubapp-token: install @​octokit/app from a lockfile (#1057)
• 65926d1 hugo2confluence: fix gomarkdown OOB read, require Go 1.27 (#1058)
• de02a2b ci: suppress zizmor self-repository on local action refs (#1052)
• d2cfb82 ci: suppress zizmor github-env on fixed PATH/ENV writes (#1053)
• ee8d9ae setup-kind: validate registry-authority before writing GITHUB_ENV (#1054)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 79.66%. Comparing base (b88abda) to head (0db6659).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2053      +/-   ##
==========================================
+ Coverage   79.60%   79.66%   +0.05%     
==========================================
  Files          58       58              
  Lines        3384     3384              
==========================================
+ Hits         2694     2696       +2     
+ Misses        688      686       -2     
  Partials        2        2              

Flag	Coverage Δ
unit-tests	79.66% <ø> (+0.05%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[infernus01]

/lgtm

[tekton-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: infernus01

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [infernus01]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment