[dependabot]

Bumps devantler-tech/.github/.github/workflows/validate-go-project.yaml from 7.2.11 to 7.8.5.

Release notes

Sourced from devantler-tech/.github/.github/workflows/validate-go-project.yaml's releases.

v7.8.5

7.8.5 (2026-10-08)

Bug Fixes

• release: publish configuration from canonical catalogue (#541) (fca583a)

v7.8.4

7.8.4 (2026-10-08)

Bug Fixes

• cleanup: retry explicitly rate-limited inventory reads (#547) (50a5a7a)

v7.8.3

7.8.3 (2026-10-08)

Bug Fixes

• config: reconcile adopted business-site settings (#550) (b2019c1)

v7.8.2

7.8.2 (2026-10-08)

Bug Fixes

• installer: drain GitHub CLI version responses (#549) (529528c)

v7.8.1

7.8.1 (2026-10-08)

Performance Improvements

• ci: select affected .NET workflow tests (#540) (e436d08)

v7.8.0

7.8.0 (2026-10-08)

Features

• go: retain fixture toolchains when measured capacity is sufficient (#543) (a52214f)

v7.7.0

7.7.0 (2026-10-08)

... (truncated)

Commits

• fca583a fix(release): publish configuration from canonical catalogue (#541)
• ccb3331 chore(deps): bump devantler-tech/.github/.github/workflows/apply-signed-fixes...
• 10a0b98 chore(deps): bump fluxcd/flux2/action from 2.9.5 to 2.9.6 (#553)
• 793477f chore(deps): bump Homebrew/actions/setup-homebrew (#555)
• 50a5a7a fix(cleanup): retry explicitly rate-limited inventory reads (#547)
• 61dc9d4 chore(deps): bump github/stale-repos from 9.0.18 to 9.0.19 (#552)
• 0c70c6f chore(deps): bump actions/upload-code-coverage (#551)
• b2019c1 fix(config): reconcile adopted business-site settings (#550)
• 529528c fix(installer): drain GitHub CLI version responses (#549)
• e436d08 perf(ci): select affected .NET workflow tests (#540)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

✅MegaLinter analysis: Success

✅ Linters with no issues

actionlint, bash-exec, git_diff, hadolint, jscpd, jsonlint, lychee, markdown-table-formatter, markdownlint, prettier, prettier, shellcheck, shfmt, stylelint, syft, trivy-sbom, trufflehog, v8r, v8r, yamllint

See detailed reports in MegaLinter artifacts

Show us your support by starring ⭐ the repository

[devantler]

🤖 Generated by the Agentic Engineer

The native failure is the shared-workflow identity gate rejecting the proposed immutable revision. I audited fca583ac795d56928c5b542944b6e0963ea1e270 against the previously accepted ef34177c48310d4e8d6605233cb7218b926dcc55; the proposed workflow's SHA256 is a837a71306c54fff848b728666155b050edb72a3606f32477dbbfb8215ca31c6.

Its new disk measurement is disabled by default, its zero disk budget preserves unconditional reclamation, and its build, test, and race commands remain unchanged for this caller. The maintenance default changes to true, matching this caller's existing explicit true. The signed-fix decision and each apply-job condition still honor this caller's explicit false; their newer pinned workflows cannot execute through this call. Maintenance permissions, the caller's admission, secret mapping, and credential envelope remain unchanged.

The narrow adaptation adds only this reviewed full revision and its acceptance case. It retains all existing rejection controls for unknown commits, moving references, fork admission, new permissions or secrets, inherited secrets, and signed-fix opt-out changes. The original caller check fails before the adaptation; the complete workflow-contract suite passes afterward on Go 1.26.8. Native CI and substantive review of the adapted head are required before promotion and merge.

[github-code-quality]

Code Coverage Overview

Languages: Go

Go / code-coverage/go

The overall line coverage in commit 19c9900 in the dependabot/github_ac... branch remains at 71%, unchanged from commit 66ba54d in the main branch.

Show a line coverage summary of the most impacted files.

File	main 66ba54d	dependabot/github_ac... 19c9900	+/-
pkg/svc/mirror/keepalive.go	93%	89%	-4%
pkg/svc/provisi...etzner/token.go	77%	73%	-4%
pkg/cli/cluster...i/distconfig.go	78%	79%	+1%

[devantler]

🤖 Generated by the Agentic Engineer

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review skipped.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Important

Review skipped

This PR was authored by a bot without an assigned CodeRabbit review seat. Ask an organization administrator to assign a seat to the bot. See the seat-assignment guide. After the seat is assigned, request a review again.

⚙️ Run configuration

• Configuration used: Repository YAML (base), Organization UI (inherited)
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 15bb9d36-7743-461d-ac6c-da731d9909e6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devantler]

🤖 Generated by the Agentic Engineer

Self-review (fallback — CodeRabbit, Codex and Cursor Bugbot unavailable)

Reviewed commit: 19c9900

• CodeRabbit: its authenticated current-PR refusal, updated 2026-10-08T21:17:21Z after the request at this head, says the bot author has no assigned review seat. This applies to this PR; recovery requires an organization administrator to assign a seat. Neither the skipped invocation nor its success status is a substantive review.
• Codex: the authenticated provider notice, updated 2026-10-08T17:01:34Z and freshly reread, reports the account's code-review usage limit. The portfolio health scan still reports no subsequent recovery. The provider offers account credits/settings as recovery; no paid fallback is authorized.
• Cursor Bugbot: the authenticated provider notice, updated 2026-10-08T15:43:03Z and freshly reread, reports the user/team usage or spend limit. The portfolio health scan still reports no subsequent completed review; recovery requires the user/team administrator. There is no Bugbot check-run at this head.

I freshly read all PR conversation comments, review objects, the complete thread connection and head check-runs before this review. There are no unresolved threads or non-thread provider findings. The earlier empty bot approval at a different commit is not counted.

I reviewed the full two-file diff against freshly fetched main, and the immutable reusable workflow at fca583ac795d56928c5b542944b6e0963ea1e270 (downloaded bytes SHA-256 a837a71306c54fff848b728666155b050edb72a3606f32477dbbfb8215ca31c6). The caller still explicitly disables signed fixes. The callee honors that boolean through its shared admission output; all apply jobs require that output, while tidy, dead-code, vulnerability analysis and builds retain read-only repository credentials. The caller's event selection, permissions and secrets are unchanged.

The new measurement input defaults false and capacity budget defaults zero. With this caller's unchanged inputs, measurement checkouts do not run and cleanup still reclaims the same fixed toolchain paths. Unknown capacity also retains cleanup. Default-branch maintenance remains explicitly enabled. The addition is an audited full revision in both the acceptance list and its positive test; arbitrary SHAs, moving refs, foreign owners, broadened events, changed inputs and credential-envelope changes remain rejected by the existing negative controls.

Validation includes the RED/GREEN caller-contract proof and the full CI harness suite. Native checks at this exact head are settled and green, including the reusable Go workflow, managed and owned analysis, Windows tests and all 27 real Docker system-test rows. The invoked workflow's build/test/race-coverage and cleanup jobs actually ran, rather than only reporting a caller-level aggregate. No correctness or security finding remains.

Verdict: no P0/P1 findings

[devantler]

🤖 Generated by the Agentic Engineer

Readiness at 19c9900: the full native check set is settled, with no failed checks, no unresolved threads, no non-thread review findings and no merge conflict against freshly fetched main ba832a7. All readable required workflow gates pass. The code-quality ruleset has no direct verdict API; it remains enforced by the normal merge endpoint, whose current state is CLEAN. No bypass is used.

The current-head substantive review qualifies as GREEN through the documented local fallback after independently verified provider unavailability. The earlier empty approval and CodeRabbit service status are not counted as reviews.

User evaluation: CI run 37834082447 executed all 27 real cluster system-test rows successfully. This includes cluster creation, workload operations, nested provider readiness and cleanup. The reusable Go validation actually ran build, tests, race coverage, module hygiene, lint, dead-code and vulnerability checks; the read-only caller's signed-fix jobs stayed skipped as intended. Managed Go/JavaScript analysis and Windows tests also completed successfully at this head. This validates the consumed workflow update, rather than just its YAML syntax.

Promoting and performing the normal direct, exact-head squash merge.