[dependabot]

Bumps qltysh/qlty-action/coverage from 2.4.0 to 2.5.0.

Release notes

Sourced from qltysh/qlty-action/coverage's releases.

v2.5.0

Improved

• The Qlty CLI must now pass its attestation check before it runs. If no attestation matches the downloaded CLI, or the check rejects it, the step fails, including in the coverage action with skip-errors: true. Pinning cli-version to a release older than 0.555.0, which have no attestation, now fails; remove cli-version or set a current release (#212)
• When the attestation check cannot finish because GitHub or Sigstore is unavailable, the coverage action follows skip-errors: with skip-errors: true it logs the error and passes the step without running the CLI. The install and fmt actions fail (#216)
• The attestation check needs GitHub CLI (gh) 2.67.0 or later. Without a usable gh, as on many self-hosted runners and container: jobs, the actions log a warning that the run is unverified and continue (#212)
• The attestation lookup always goes to github.com, even when GH_HOST points at GitHub Enterprise; in that case set github-token to a github.com token (#212)

Changelog

Sourced from qltysh/qlty-action/coverage's changelog.

Changelog

v2.5.0 (2026-10-23)

Improved

• The Qlty CLI must now pass its attestation check before it runs. If no attestation matches the downloaded CLI, or the check rejects it, the step fails, including in the coverage action with skip-errors: true. Pinning cli-version to a release older than 0.555.0, which have no attestation, now fails; remove cli-version or set a current release (#212)
• When the attestation check cannot finish because GitHub or Sigstore is unavailable, the coverage action follows skip-errors: with skip-errors: true it logs the error and passes the step without running the CLI. The install and fmt actions fail (#216)
• The attestation check needs GitHub CLI (gh) 2.67.0 or later. Without a usable gh, as on many self-hosted runners and container: jobs, the actions log a warning that the run is unverified and continue (#212)
• The attestation lookup always goes to github.com, even when GH_HOST points at GitHub Enterprise; in that case set github-token to a github.com token (#212)

v2.4.0 (2026-09-24)

Fixed

• Security updates to bundled dependencies (#207, #208, #209)

v2.3.0 (2026-07-09)

New

• Add a selected input to the coverage action for marking an upload as covering a selected subset of the test suite, which contributes to diff coverage only and is excluded from total coverage (#200)

v2.2.3 (2026-07-07)

• Internal release process improvements (no user-facing changes) (#196)

v2.2.2 (2026-07-07)

Fixed

• Security updates to bundled dependencies (#190, #191)

v2.2.1 (2026-06-02)

• Bump action runtime to node24

v2.2.0 (2025-08-11)

• Testing release process (no changes)

v2.1.0 (2025-08-08)

New

• support "dry-run" option for command complete

Improved

• Use log level "error" instead of "warning" when a catastrophic error occurs but "skip-errors" is true

... (truncated)

Commits

• ebcd284 Release v2.5.0 (#217)
• e82937b Let skip-errors cover an attestation check that cannot finish (#216)
• 2ba2e43 Treat a missing attestation as a verification failure (#212)
• 85038b0 Track .qlty/.gitignore from qlty's current template (#214)
• 88daebc Bump Node to 24.22.1 to distrust compromised eMudhra intermediates (#213)
• 2d73d36 Publish releases from maintainer-pushed tags and drop the #cust-public webhoo...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)