chore(deps): update all-ci-dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
codecov/codecov-action	action	minor	v5.3.1 -> v5.4.0
securego/gosec	action	patch	v2.22.1 -> v2.22.2
sigstore/cosign-installer	action	patch	v3.8.0 -> v3.8.1
slsa-framework/slsa-github-generator	action	minor	v2.0.0 -> v2.1.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

codecov/codecov-action (codecov/codecov-action)

v5.4.0

Compare Source

What's Changed

• update wrapper submodule to 0.2.0, add recurse_submodules arg by @​matt-codecov in https://github.com/codecov/codecov-action/pull/1780
• build(deps): bump actions/upload-artifact from 4.6.0 to 4.6.1 by @​app/dependabot in https://github.com/codecov/codecov-action/pull/1775
• build(deps): bump ossf/scorecard-action from 2.4.0 to 2.4.1 by @​app/dependabot in https://github.com/codecov/codecov-action/pull/1776
• build(deps): bump github/codeql-action from 3.28.9 to 3.28.10 by @​app/dependabot in https://github.com/codecov/codecov-action/pull/1777
• Clarify in README that use_pypi bypasses integrity checks too by @​webknjaz in https://github.com/codecov/codecov-action/pull/1773
• Fix use of safe.directory inside containers by @​Flamefire in https://github.com/codecov/codecov-action/pull/1768
• Fix description for report_type input by @​craigscott-crascit in https://github.com/codecov/codecov-action/pull/1770
• build(deps): bump github/codeql-action from 3.28.8 to 3.28.9 by @​app/dependabot in https://github.com/codecov/codecov-action/pull/1765
• Fix a typo in the example by @​miranska in https://github.com/codecov/codecov-action/pull/1758
• build(deps): bump github/codeql-action from 3.28.5 to 3.28.8 by @​app/dependabot in https://github.com/codecov/codecov-action/pull/1757
• build(deps): bump github/codeql-action from 3.28.1 to 3.28.5 by @​app/dependabot in https://github.com/codecov/codecov-action/pull/1753

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.3.1..v5.4.0

securego/gosec (securego/gosec)

v2.22.2

Compare Source

Changelog

• 136f6c0 Update to go version 1.24.1 and 1.23.7 (#​1313)
• 047453a chore(deps): update all dependencies (#​1310)
• 76ccee5 chore(deps): update all dependencies (#​1308)
• a9eb1c9 Update gosec version in the GitHub action to v2.22.1 (#​1307)
• 89c5da3 chore(deps): update module google.golang.org/api to v0.221.0 (#​1305)

sigstore/cosign-installer (sigstore/cosign-installer)

v3.8.1

Compare Source

What's Changed

• use cosign 2.4.3 and other updates by @​cpanato in https://github.com/sigstore/cosign-installer/pull/182

Full Changelog: sigstore/cosign-installer@v3...v3.8.1

slsa-framework/slsa-github-generator (slsa-framework/slsa-github-generator)

v2.1.0

Compare Source

v2.1.0: Sigstore Bundles for Generic Generator and Go Builder

The workflows generator_generic_slsa3.yml and builder_go_slsa3.yml
have been updated to produce signed Sigstore Bundles, just like all the other builders
that use the BYOB framework.

The workflow logs will now print a LogIndex, rather than a LogUUID. Both are equally searchanble on
https://search.sigstore.dev/.

v2.1.0: Vars context recorded in provenance

• Updated: GitHub vars context is now recorded in provenance for the generic and
  container generators. The vars context cannot affect the build in the Go
  builder so it is not recorded.

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 48.00%. Comparing base (23ec6e9) to head (28fb5c2).
Report is 4 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main       #4   +/-   ##
=======================================
  Coverage   48.00%   48.00%           
=======================================
  Files           7        7           
  Lines         602      602           
=======================================
  Hits          289      289           
  Misses        283      283           
  Partials       30       30           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.