chore(deps): update github actions

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
github/codeql-action	action	patch	v4.37.5 → v4.37.6
open-telemetry/shared-workflows	action	minor	v0.4.0 → v0.6.0

---

Release Notes

github/codeql-action (github/codeql-action)

v4.37.6

Compare Source

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #​4070

open-telemetry/shared-workflows (open-telemetry/shared-workflows)

v0.6.0

Compare Source

What's Changed

• Pin the pull request dashboard stable channel to v0.5.0 by @​trask in #​225
• Add reusable OSSF Scorecard workflow by @​trask in #​224

Full Changelog: open-telemetry/shared-workflows@v0.5.0...v0.6.0

v0.5.0

Compare Source

What's Changed

• Coalesce queued pull request dashboard refreshes by @​trask in #​76
• Opt-in otel-arrow for PR Dashboard workflow by @​drewrelmas in #​80
• Use CNCF-hosted runners for pull request dashboard by @​trask in #​79
• Add dotnet and dotnet-contrib for dashboard by @​martincostello in #​87
• Track top-level feedback separately in the PR dashboard by @​trask in #​78
• Monitor pull request dashboard rate limits by @​trask in #​88
• Restore GitHub-hosted PR dashboard runners by @​trask in #​90
• Clarify PR dashboard author action legend by @​trask in #​89
• Add live PR dashboard status comments by @​trask in #​77
• Show review guidance only when waiting on author by @​trask in #​93
• Ignore author-only PR annotations in dashboard by @​trask in #​94
• PR Dashboard: Route required CI failures to authors by @​trask in #​91
• PR Dashboard: Roll out status comment changes by @​trask in #​96
• Harden pull request dashboard against classification failures by @​trask in #​98
• Fix PR dashboard status comment permission by @​trask in #​99
• Enable PR dashboard for shared-workflows by @​trask in #​111
• Retry transient GraphQL internal errors by @​trask in #​122
• Fix PR dashboard top-level feedback routing by @​trask in #​107
• Fix PR dashboard legacy required statuses by @​trask in #​103
• Clarify required status check guidance by @​trask in #​102
• Add configurable labels to PR dashboard by @​trask in #​104
• Remove stale PR dashboard refresh link by @​trask in #​124
• PR Dashboard: Report non-blocking check failures by @​trask in #​105
• Add status refresh timestamp to PR dashboard comments by @​trask in #​115
• Add semantic-conventions to PR dashboard by @​trask in #​127
• Add author nudges and clean Copilot review routing by @​trask in #​129
• Use opaque keys for dashboard classifications by @​trask in #​132
• Include live status in PR dashboard issue reports by @​trask in #​135
• Prevent outdated pull request dashboard runs from publishing by @​trask in #​144
• Keep PR dashboard webhook updates scoped to one pull request by @​trask in #​139
• Redesign PR dashboard status comment layout by @​trask in #​145
• Reword dashboard status comment disclosure summary by @​trask in #​160
• Require clean Copilot review on main for opentelemetry-java-instrumentation by @​trask in #​162
• Require an author reply to close top-level PR dashboard feedback by @​trask in #​163
• Use GITHUB_TOKEN instead of a PAT for Copilot CLI by @​trask in #​170
• Fix Copilot CLI auth shadowed by the app token in GH_TOKEN by @​trask in #​175
• Run three pull request dashboard repositories in parallel by @​trask in #​174
• Convert the dashboard webhook to a Netlify v2 function by @​trask in #​171
• Stop the PR dashboard from treating its own comment as PR activity by @​trask in #​177
• Dispatch dashboard refresh only when a check suite completes by @​trask in #​166
• Ignore repository automation commands as top-level PR feedback by @​trask in #​181
• Add a reviewer-feedback classifier evaluation set by @​trask in #​183
• Give the dashboard publisher the same member visibility as the updater by @​trask in #​184
• Rebuild the eval baseline over five runs by @​trask in #​185
• Tolerate stale state branch fetch after push by @​trask in #​188
• Clarify the non-blocking check failure note by @​trask in #​189
• Soften the author nudge wording by @​trask in #​191
• Treat code scanning ruleset checks as required by @​trask in #​194
• Always show the route-override label on the dashboard by @​trask in #​190
• Route review threads by who spoke last instead of one model call each by @​trask in #​193
• Classify top-level reviewer feedback with the author-action binary by @​trask in #​196
• Remove post-rollout webhook compatibility paths by @​trask in #​197
• Skip resolve-targets for targeted dashboard refreshes by @​trask in #​168
• Add jittered backoff to dashboard state branch CAS retries by @​trask in #​203
• Refresh required check status for fork pull requests by @​trask in #​201
• Clear open items on a reviewer-routing override instead of masking the route by @​trask in #​205
• Date review thread wait age from comment creation time by @​trask in #​206
• Remove the retired top-level reviewer-feedback classifier by @​trask in #​210
• Do not advance a PR until CI and Copilot report by @​trask in #​199
• Run the pull request dashboard tests in CI by @​trask in #​218
• Remove the retired copilot route migration from the PR dashboard state loader by @​trask in #​213
• Refresh CI status from check suites only, and ignore default branch check events by @​trask in #​211
• Order top-level feedback by when it was posted, not when it was last edited by @​trask in #​215
• Name the eval fixture's fields for what they mean by @​trask in #​187
• Regenerate the reviewer-feedback eval baseline against the shipped prompt by @​trask in #​212
• Add staged rollout to the pull request dashboard by @​trask in #​214
• Make Copilot ⏳ mean a review is actually in flight by @​trask in #​217
• Stop posting a first status comment on untracked closed pull requests by @​trask in #​223

New Contributors

• @​drewrelmas made their first contribution in #​80
• @​martincostello made their first contribution in #​87

Full Changelog: open-telemetry/shared-workflows@v0.4.0...v0.5.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 07:59 AM, only on Tuesday (* 0-7 * * 2)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.