[dependabot]

Bumps devantler-tech/.github/.github/workflows/apply-signed-fixes.yaml from 14.0.0 to 17.0.0.

Release notes

Sourced from devantler-tech/.github/.github/workflows/apply-signed-fixes.yaml's releases.

v17.0.0

17.0.0 (2026-10-29)

Features

• todo: retire the temporary vendor exclusion switch (#799) (84f4cdd)

BREAKING CHANGES

• todo: retire the temporary vendor exclusion switch (#799)

v16.0.1

16.0.1 (2026-10-29)

Bug Fixes

• recovery: retire the verified rollout switch (#796) (7a209dc)

v16.0.0

16.0.0 (2026-10-29)

Features

• todos: exclude conventional vendor roots by default (#795) (d46f985)

BREAKING CHANGES

• todos: exclude conventional vendor roots by default (#795)

v15.0.1

15.0.1 (2026-10-29)

Bug Fixes

• ci: isolate explicit public evidence read credentials (#798) (d3c754c)

v15.0.0

15.0.0 (2026-10-28)

Bug Fixes

• actions: bind catalogue components to defining source (#792) (582f136)

... (truncated)

Commits

• 84f4cdd feat(todo)!: retire the temporary vendor exclusion switch (#799)
• 7a209dc fix(recovery): retire the verified rollout switch (#796)
• d46f985 feat(todos)!: exclude conventional vendor roots by default (#795)
• d3c754c fix(ci): isolate explicit public evidence read credentials (#798)
• 582f136 fix(actions)!: bind catalogue components to defining source (#792)
• 8e2dfbd fix(release): publish existing tags without a creation target (#791)
• 7b18478 perf(ci): compare Go runner capacity policies (#789)
• ba60525 fix(governance): record provider adoption decisions (#790)
• 0b13751 fix: prove release recovery writer capability through GitHub (#788)
• 3c142ab fix(deps): bump devantler-tech/.github/.github/workflows/apply-signed-fixes.y...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-code-quality]

Code coverage overview

Languages: Go

Go / code-coverage/test

main 9e4b1da	dependabot/github_ac... 9f82ac3	+/-
50%	50%	0%

Go / code-coverage/go

main 9e4b1da	dependabot/github_ac... 9f82ac3	+/-
50%	100%	+50%

View coverage of the 1 most impacted file.

File	main 9e4b1da	dependabot/github_ac... 9f82ac3	+/-
value.go	0%	100%	+100%

ℹ️ Calculations represent line coverage. Results may change as calculations are updated.

---

_{Updated October 29, 2026 12:28 UTC}

[devantler]

🤖 Generated by the Agentic Engineer

Blocker: none

Cleared 2026-10-29: Both CI repairs shipped through protected PR 801 at 737bb3b, verified main CI 40869787030 and published v17.0.1. Issues 800 and 802 are closed with acceptance evidence. Refresh the bot branch, then require fresh-head CI and the full release-range assessment before merge.

Previous record (historical):

> 🤖 Generated by the Agentic Engineer

<!-- pr-blocker-record -->

**Blocker:** devantler-tech/.github#800 | upstream | last-verified 2026-10-29: Current head 2b83a72d9dabb48a6d0e81f4895a036ed8835d0b fails [test-publish-contracts](https://github.com/devantler-tech/.github/actions/runs/40841025992/job/123337159347) because the application-promotion check errors under jq 1.8, which open issue 800 owns (repair draft PR 801). It also fails [lint-ci-coverage-parity](https://github.com/devantler-tech/.github/actions/runs/40841025992/job/123337159408) on the Go disk-cleanup capacity-observation bound, which open issue 802 owns. Neither failure is caused by this bump. Upstream release review of v17.0.0: its only breaking change retires the TODO-scan vendor-exclusion input, which this workflow reference does not use. Resume after the 800 and 802 repairs merge: let Dependabot rebase, then collect fresh current-head CI. No rerun or check suppression is justified by the present result.

[devantler]

🤖 Generated by the Agentic Engineer

The shared CI repairs are merged and verified on main. This branch contains only the original Dependabot commit and has no authored adaptation to discard. Refresh it against the repaired base; fresh current-head CI, substantive review and the complete release-range assessment remain required before merge.

@dependabot rebase

[devantler]

🤖 Generated by the Agentic Engineer

The bot refresh request produced no acknowledgement or branch movement. After rechecking ownership and the unchanged original bot head, I used the expected-head base update. GitHub verifies signed merge 9f82ac32025353ab58f6db9e53a6f37aba69c235, with exact parents 2b83a72d9dabb48a6d0e81f4895a036ed8835d0b and actual main 9e4b1da9c6aa7dcd1f765e5089f886649a7370dc.

The branch now includes both verified runner-tool repairs and the merged finite lint-job headroom change. Fresh CI and a complete release-range assessment remain required; earlier red checks and prior-head reviews are not clearance. No auto-merge or review request was added by this run.