Update weekly update

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/create-github-app-token	action	minor	v3.2.0 → v3.3.0
github/codeql-action	action	patch	v4.38.2 → v4.38.3
jdx/mise-action	action	patch	v5.1.1 → v5.1.2
open-telemetry/shared-workflows	workflow	minor	v0.18.0 → v0.20.0
python (source)	final	minor	3.14.8-slim → 3.15.0-slim
python (source)	stage	minor	3.14.8 → 3.15.0

---

Release Notes

actions/create-github-app-token

v3.3.0

Compare Source

Features

• update permission inputs (#​399) (a47236f)

Bug Fixes

• deps: bump nested undici from 6.24.0 to 6.29.0 (#​403) (12461a3)
• deps: bump the production-dependencies group across 1 directory with 3 updates (#​395) (a69c19d)

github/codeql-action

v4.38.3

Compare Source

• Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #​4188
• Update default CodeQL bundle version to 2.27.2. #​4203
• Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #​4184

jdx/mise-action

v5.1.2: : mise_dir now sets MISE_DATA_DIR; auto_update handles a locked mise binary

Compare Source

The mise_dir input now also sets where mise installs tools, so those tools end up in the cache. With auto_update: true, the action no longer crashes on Windows when the mise binary is still in use.

Fixed

• mise_dir now exports MISE_DATA_DIR. Before this release, mise_dir moved the mise binary and the cache path, but mise kept installing tools to ~/.local/share/mise. The saved cache didn't include the tools. On runners where ~/.local isn't writable, the step failed with EACCES: permission denied. When mise_dir is set, the action now exports MISE_DATA_DIR=<mise_dir>, so tools are installed into the directory that gets cached. If your workflow sets a different MISE_DATA_DIR, the mise_dir input overrides it. If mise_dir isn't set, nothing changes. mise's state directory (~/.local/state/mise) stays where it is. If that path also can't be written, set MISE_STATE_DIR yourself. (#​672 by @​jdx, fixes #​668)

  - uses: jdx/mise-action@v5
    with:
      mise_dir: ${{ runner.tool_cache }}/mise/data

• auto_update no longer crashes when it can't replace mise.exe. On Windows, the step used to fail with a bare EPERM: operation not permitted, unlink '…\mise.exe' if another process was still using the binary. Now, if version isn't pinned and the existing binary passes verification against its recorded version, the action prints a warning and continues with that version. In any other case, the step fails with a message that says the file is in use and how to fix it. A pinned version never quietly keeps an older binary. (#​665 by @​jdx, fixes #​664)

Documentation

• The README explains how to use mise's MISE_ENABLE_TOOLS setting as a job-level allowlist. Unlike install_args, the allowlist applies to the action's install and to later mise commands. If jobs use different allowlists, add the value to a custom cache_key. (#​667 by @​zeitlinger)
• The Rust cache section is updated for mise 2026.9.2 and later, where mise install repairs a restored toolchain instead of leaving rustfmt missing. Swatinem/rust-cache now works alongside mise-managed Rust. (#​670 by @​jdx)

Full Changelog: jdx/mise-action@v5.1.1...v5.1.2

open-telemetry/shared-workflows

v0.20.0

Compare Source

What's Changed

• Promote pull request dashboard to v0.19.0 by @​otelbot-shared-workflows[bot] in #​449
• Separate live dashboard refreshes from maintenance work by @​trask in #​453
• Bump scorecard-action to 2.5.0 + revert local workaround by @​Kielek in #​457
• Remove dashboard code_ref compatibility after promotion by @​trask in #​438
• Isolate Git checkouts for queue-owned dashboard processors by @​trask in #​454
• Handle Copilot review quota exhaustion by @​trask in #​452
• Add snapshot-only storage for generated data branches by @​trask in #​436
• Add Go repositories to the pull request dashboard by @​MrAlias in #​458

New Contributors

• @​Kielek made their first contribution in #​457

Full Changelog: open-telemetry/shared-workflows@v0.19.0...v0.20.0

v0.19.0

Compare Source

What's Changed

• Promote pull request dashboard to v0.18.0 by @​otelbot-shared-workflows[bot] in #​437
• Require clean Copilot reviews for OBI by @​MrAlias in #​431
• Request initial Copilot reviews through the dashboard app by @​trask in #​444
• Recover stalled dashboard publisher runs by @​trask in #​440
• Own dashboard execution with durable queue leases by @​trask in #​441

New Contributors

• @​MrAlias made their first contribution in #​431

Full Changelog: open-telemetry/shared-workflows@v0.18.0...v0.19.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 07:59 AM, only on Tuesday (* 0-7 * * 2)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[opentelemetry-pr-dashboard]

Pull request dashboard status

Merged · refreshed 2026-10-13 19:31 UTC

Status above doesn't look right?

• Anything look wrong? Report it with what you expected; it helps us improve the dashboard.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.61%. Comparing base (7e8b629) to head (3471327).

Additional details and impacted files

@@            Coverage Diff            @@
##               main    #8943   +/-   ##
=========================================
  Coverage     90.61%   90.61%           
  Complexity    10882    10882           
=========================================
  Files          1015     1015           
  Lines         29731    29731           
  Branches       3876     3876           
=========================================
  Hits          26942    26942           
  Misses         1872     1872           
  Partials        917      917           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.