[dependabot]

Bumps the actions-minor-and-patch group with 1 update: soulteary/goreportcard-action.

Updates soulteary/goreportcard-action from 1.1.4 to 1.1.7

Release notes

Sourced from soulteary/goreportcard-action's releases.

Go Report Card v1.1.7

Unit-test coverage

• Total Go statement coverage: 98.94%.
• CI now enforces a 95% floor using exact statement counts across all production Go packages, including CLI entry points.
• Add deterministic tests for analyzer protocols, report output, CLI policies, baselines, file-system errors and configuration boundaries.
• Preserve real-analyzer integration checks and validate with the race detector.

Fixes

• Preserve the original file and line when diagnostic messages reference another source location.

• Preserve nested source paths in generated repository links.

• Exclude directories and .go files from license detection.

• Reap analyzer subprocesses after parse failures and oversized output, releasing temporary directories on Windows.

• Reap analyzer subprocesses after parse failures and oversized output, releasing temporary directories on Windows.

• Reap analyzer subprocesses after parse failures and oversized output, releasing temporary directories on Windows.

• Parse Windows drive-letter diagnostics and reject malformed output without panicking.

• Reap analyzer subprocesses after parse failures and oversized output, releasing temporary directories on Windows.

Cross-platform CLI archives and SHA-256 checksums are attached.

Go Report Card v1.1.6

Unit-test coverage

• Total Go statement coverage: 98.94%.
• CI now enforces a 95% floor using exact statement counts across all production Go packages, including CLI entry points.
• Add deterministic tests for analyzer protocols, report output, CLI policies, baselines, file-system errors and configuration boundaries.
• Preserve real-analyzer integration checks and validate with the race detector.

Fixes

• Preserve nested source paths in generated repository links.
• Exclude directories and .go files from license detection.
• Reap analyzer subprocesses after parse failures and oversized output, releasing temporary directories on Windows.
• Parse Windows drive-letter diagnostics and reject malformed output without panicking.
• Reap analyzer subprocesses after parse failures and oversized output, releasing temporary directories on Windows.

Cross-platform CLI archives and SHA-256 checksums are attached.

Go Report Card v1.1.5

Changes

• Capitalize the badge label as Go Report and update the README badge example.
• Include the latest GitHub Actions dependency updates.

Validation

• Unit tests and GitHub CI passed.
• Release archives and checksums are attached.

Changelog

Sourced from soulteary/goreportcard-action's changelog.

Changelog

All notable changes to this project are documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

[1.1.7] - 2026-11-03

Fixed

• Keep the original file and line when diagnostic messages contain another source location.

[1.1.6] - 2026-11-03

Changed

• Raise total Go statement coverage to 98.94% with deterministic unit tests for success, failure and boundary cases.
• Enforce a 95% coverage floor across all production Go packages in CI, retaining real-analyzer integration checks.
• Preserve nested file paths in GitHub and golang.org source links.
• Require actual license files instead of accepting directories or Go source files.
• Parse Windows drive-letter diagnostics and reject malformed tool output without panicking.
• Reap analyzer subprocesses on malformed or oversized output so Windows working directories are released.
• Make CLI flag parsing independently testable without global flag state.

[1.1.5] - 2026-11-03

Fixed

• Capitalize report badge labels and refresh the README badge example.

Added

• The release workflow can now publish from a manual run (workflow_dispatch with publish: true). Previously the publish step was gated on github.event_name == 'push', so a manual run built, signed and attested the archives and then discarded them — there was no way to recover a tag-push run that failed or never started, short of deleting and re-pushing an already released tag. A manual publish refuses a version that is not an existing tag, and checks out that tag rather than main, so the archives are built from the released commit.

  Build provenance is skipped when a recovery run's built tree is not GITHUB_SHA. actions/attest-build-provenance takes the source commit for its SLSA predicate from the event context and has no input to override it, so a recovery dispatched from main for an older tag would attest a commit the archives were not built from; a wrong source claim is worse than none. The run logs a warning saying so. Dispatching the recovery from the tag itself keeps the context and the tree in agreement and the attestation is emitted as usual — that is the preferred path for any tag whose release.yml already carries the publish input. Tag-push releases are unaffected and always attested. checksums.txt, the SBOM and the cosign bundles are computed over the actual

... (truncated)

Commits

• 9744d02 fix: preserve diagnostic locations when messages contain source references
• 24e1ec2 chore: update Go quality reports
• 3e119ae fix: validate native diagnostics and parse Windows drive paths
• 8fcc3a1 fix: reap analyzer processes after output parsing failures
• c7cd879 ci: enforce 95 percent coverage and refresh test evidence
• 3bf8112 test: raise coverage and fix license and source link edge cases
• b99aa1b chore: update Go quality reports
• 7d91826 docs: record badge capitalization release
• b7e6651 fix: capitalize report badge display labels
• 285c4fe Merge pull request #19 from soulteary/dependabot/github_actions/github-action...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions