[ChiaAutomation]

Note

Low Risk
Changes affect CI, Dependabot, and supply-chain workflows only; no application runtime or auth logic is modified.

Overview
Syncs repo-content-updater managed CI/config templates and adds guardrails around Actions Node versions and dependency scanning.

Dependabot is narrowed to pip (with Chia pypi/download registries and insecure-external-code-execution: allow) and github-actions only; gomod, npm, cargo, and swift updates are removed, default reviewers are dropped, and github-actions updates exclude the dependency-review workflows.

A new check-node-runtime workflow runs .github/scripts/check_node_runtime.sh, which flags workflows and local actions using node12/node16/node20 (including resolved third-party action manifests via the GitHub API).

Check commit signing now runs on all PRs (branch filter removed), uses minimal contents: read permissions, and checks out with filter: blob:none since only commit metadata is needed.

Dependency review skips private Chia repos for the dependency-review job, fixes duplicate AGPL entries in deny-licenses, and adds an OSV Scanner reusable workflow job (recursive scan, SARIF upload off) for Chia-Network PRs.

^{Reviewed by Cursor Bugbot for commit a40d1bd. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Stale Bugbot comment from a previous run.

[coveralls-official]

Coverage Report for CI Build 41863820022

Coverage remained the same at 94.438%

Details

• Coverage remained the same as the base build.
• Patch coverage: No coverable lines changed in this PR.
• No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	1252
Covered Lines:	1198
Line Coverage:	95.69%
Relevant Branches:	420
Covered Branches:	381
Branch Coverage:	90.71%
Branches in Coverage %:	Yes
Coverage Strength:	11.48 hits per line

---

💛 - Coveralls

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Check fails on existing action pin

High Severity

The new job flags node20 as unsupported and scans every workflow, including unchanged publish-to-pypi.yml, which still pins actions/upload-artifact@v4. That action’s manifest still declares node20 (Node 24 starts at v6), so this check fails on the current tree and the PR cannot stay green until that pin is bumped.

Additional Locations (1)

• .github/workflows/check-node-runtime.yml#L29-L34

 

^{Reviewed by Cursor Bugbot for commit 9fd18ba. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 9a9cdcf. Configure here.}