Update weekly update

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
github/codeql-action	action	patch	v4.37.6 → v4.37.7
graalvm/setup-graalvm	action	patch	v1.6.3 → v1.6.4
jdx/mise-action	action	patch	v4.2.4 → v4.2.5
open-telemetry/shared-workflows	action	minor	v0.4.0 → v0.7.0
open-telemetry/shared-workflows	action	minor	v0.6.0 → v0.7.0
python (source)	final	patch	3.14.6-slim → 3.14.7-slim
python (source)	stage	patch	3.14.6 → 3.14.7

---

Release Notes

github/codeql-action (github/codeql-action)

v4.37.7

Compare Source

• Update default CodeQL bundle version to 2.26.3. #​4085

graalvm/setup-graalvm (graalvm/setup-graalvm)

v1.6.4

Compare Source

What's Changed

• Bump js-yaml from 5.2.0 to 5.2.2 by @​dependabot[bot] in #​230
• Bump the "all" group with 2 updates across multiple ecosystems by @​dependabot[bot] in #​232

Full Changelog: graalvm/setup-graalvm@v1.6.3...v1.6.4

jdx/mise-action (jdx/mise-action)

v4.2.5: : Resilient mise downloads with automatic retries

Compare Source

A small patch release that makes setup more resilient to transient network failures when downloading mise.

Fixed

Retry mise downloads after transient failures (#​597 by @​jdx)

The download helpers previously made a single curl or wget attempt, so a transient GitHub release-asset HTTP or TLS failure would abort setup before mise or any user command could run (see #​596).

Downloads now run through a retry wrapper that makes up to five attempts with a 2s pause between failures, logging a warning on each retry. This applies consistently to binary, checksum, signature, and version fetches. Checksum and minisign verification still run only after a successful download — never inside the retry loop — so integrity guarantees are unchanged.

Full Changelog: jdx/mise-action@v4.2.4...v4.2.5

open-telemetry/shared-workflows (open-telemetry/shared-workflows)

v0.7.0

Compare Source

What's Changed

• Collapse completed author reminders as outdated by @​trask in #​229
• Add controlled PR dashboard promotions by @​trask in #​234
• Add opentelemetry-specification to pull request dashboard by @​jack-berg in #​238
• Run every Scorecard invocation to completion by @​trask in #​237
• Retry transient GitHub API TLS failures by @​trask in #​241
• Route completed review replies by approval state by @​trask in #​243
• Classify review preambles as needing nothing from the author by @​trask in #​245
• Bypass Copilot review for manual reviewer handoffs by @​trask in #​240
• Tell the reviewer-feedback classifier who a comment addresses by @​trask in #​248

New Contributors

• @​jack-berg made their first contribution in #​238

Full Changelog: open-telemetry/shared-workflows@v0.6.0...v0.7.0

v0.6.0

Compare Source

What's Changed

• Pin the pull request dashboard stable channel to v0.5.0 by @​trask in #​225
• Add reusable OSSF Scorecard workflow by @​trask in #​224

Full Changelog: open-telemetry/shared-workflows@v0.5.0...v0.6.0

v0.5.0

Compare Source

What's Changed

• Coalesce queued pull request dashboard refreshes by @​trask in #​76
• Opt-in otel-arrow for PR Dashboard workflow by @​drewrelmas in #​80
• Use CNCF-hosted runners for pull request dashboard by @​trask in #​79
• Add dotnet and dotnet-contrib for dashboard by @​martincostello in #​87
• Track top-level feedback separately in the PR dashboard by @​trask in #​78
• Monitor pull request dashboard rate limits by @​trask in #​88
• Restore GitHub-hosted PR dashboard runners by @​trask in #​90
• Clarify PR dashboard author action legend by @​trask in #​89
• Add live PR dashboard status comments by @​trask in #​77
• Show review guidance only when waiting on author by @​trask in #​93
• Ignore author-only PR annotations in dashboard by @​trask in #​94
• PR Dashboard: Route required CI failures to authors by @​trask in #​91
• PR Dashboard: Roll out status comment changes by @​trask in #​96
• Harden pull request dashboard against classification failures by @​trask in #​98
• Fix PR dashboard status comment permission by @​trask in #​99
• Enable PR dashboard for shared-workflows by @​trask in #​111
• Retry transient GraphQL internal errors by @​trask in #​122
• Fix PR dashboard top-level feedback routing by @​trask in #​107
• Fix PR dashboard legacy required statuses by @​trask in #​103
• Clarify required status check guidance by @​trask in #​102
• Add configurable labels to PR dashboard by @​trask in #​104
• Remove stale PR dashboard refresh link by @​trask in #​124
• PR Dashboard: Report non-blocking check failures by @​trask in #​105
• Add status refresh timestamp to PR dashboard comments by @​trask in #​115
• Add semantic-conventions to PR dashboard by @​trask in #​127
• Add author nudges and clean Copilot review routing by @​trask in #​129
• Use opaque keys for dashboard classifications by @​trask in #​132
• Include live status in PR dashboard issue reports by @​trask in #​135
• Prevent outdated pull request dashboard runs from publishing by @​trask in #​144
• Keep PR dashboard webhook updates scoped to one pull request by @​trask in #​139
• Redesign PR dashboard status comment layout by @​trask in #​145
• Reword dashboard status comment disclosure summary by @​trask in #​160
• Require clean Copilot review on main for opentelemetry-java-instrumentation by @​trask in #​162
• Require an author reply to close top-level PR dashboard feedback by @​trask in #​163
• Use GITHUB_TOKEN instead of a PAT for Copilot CLI by @​trask in #​170
• Fix Copilot CLI auth shadowed by the app token in GH_TOKEN by @​trask in #​175
• Run three pull request dashboard repositories in parallel by @​trask in #​174
• Convert the dashboard webhook to a Netlify v2 function by @​trask in #​171
• Stop the PR dashboard from treating its own comment as PR activity by @​trask in #​177
• Dispatch dashboard refresh only when a check suite completes by @​trask in #​166
• Ignore repository automation commands as top-level PR feedback by @​trask in #​181
• Add a reviewer-feedback classifier evaluation set by @​trask in #​183
• Give the dashboard publisher the same member visibility as the updater by @​trask in #​184
• Rebuild the eval baseline over five runs by @​trask in #​185
• Tolerate stale state branch fetch after push by @​trask in #​188
• Clarify the non-blocking check failure note by @​trask in #​189
• Soften the author nudge wording by @​trask in #​191
• Treat code scanning ruleset checks as required by @​trask in #​194
• Always show the route-override label on the dashboard by @​trask in #​190
• Route review threads by who spoke last instead of one model call each by @​trask in #​193
• Classify top-level reviewer feedback with the author-action binary by @​trask in #​196
• Remove post-rollout webhook compatibility paths by @​trask in #​197
• Skip resolve-targets for targeted dashboard refreshes by @​trask in #​168
• Add jittered backoff to dashboard state branch CAS retries by @​trask in #​203
• Refresh required check status for fork pull requests by @​trask in #​201
• Clear open items on a reviewer-routing override instead of masking the route by @​trask in #​205
• Date review thread wait age from comment creation time by @​trask in #​206
• Remove the retired top-level reviewer-feedback classifier by @​trask in #​210
• Do not advance a PR until CI and Copilot report by @​trask in #​199
• Run the pull request dashboard tests in CI by @​trask in #​218
• Remove the retired copilot route migration from the PR dashboard state loader by @​trask in #​213
• Refresh CI status from check suites only, and ignore default branch check events by @​trask in #​211
• Order top-level feedback by when it was posted, not when it was last edited by @​trask in #​215
• Name the eval fixture's fields for what they mean by @​trask in #​187
• Regenerate the reviewer-feedback eval baseline against the shipped prompt by @​trask in #​212
• Add staged rollout to the pull request dashboard by @​trask in #​214
• Make Copilot ⏳ mean a review is actually in flight by @​trask in #​217
• Stop posting a first status comment on untracked closed pull requests by @​trask in #​223

New Contributors

• @​drewrelmas made their first contribution in #​80
• @​martincostello made their first contribution in #​87

Full Changelog: open-telemetry/shared-workflows@v0.4.0...v0.5.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 07:59 AM, only on Tuesday (* 0-7 * * 2)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[opentelemetry-pr-dashboard]

Pull request dashboard status

Merged · refreshed 2026-08-18 21:05 UTC

Status above doesn't look right?

• Anything look wrong? Report it with what you expected; it helps us improve the dashboard.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.24%. Comparing base (f4bb945) to head (280f05d).

Additional details and impacted files

@@             Coverage Diff              @@
##               main    #8729      +/-   ##
============================================
- Coverage     91.26%   91.24%   -0.03%     
+ Complexity    10461    10460       -1     
============================================
  Files          1006     1006              
  Lines         28244    28244              
  Branches       3564     3564              
============================================
- Hits          25778    25771       -7     
- Misses         1674     1681       +7     
  Partials        792      792              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.