deps(actions): bump KineticCafe/actions-dco from 3.1.0 to 3.2.0 in the actions-all group

[dependabot]

Bumps the actions-all group with 1 update: KineticCafe/actions-dco.

Updates KineticCafe/actions-dco from 3.1.0 to 3.2.0

Release notes

Sourced from KineticCafe/actions-dco's releases.

v3.2.0: Prefer Default Branch Configuration

• Added a test case to detect regression of #216 or similar parsing errors.
• Modified the error handling of JSON response decoding to include a more meaningful error.
• Added support for reading .github/dco-check.toml or .dco-check.toml from the repo root on the default branch. If present, this takes precedence over any inline configuration (config:) key. This prevents a PR from "accidentally" changing the DCO check policy. See the configuration documentation for details.
• Added a configuration report to the output logs so that transient configurations are still reported for review.

What's Changed

• deps: bump the actions group with 2 updates by @​dependabot[bot] in KineticCafe/actions-dco#214
• deps: bump actions/dependency-review-action from 4.9.0 to 5.0.0 by @​dependabot[bot] in KineticCafe/actions-dco#215
• chore: Default branch configuration by @​halostatue in KineticCafe/actions-dco#218
• feat: Support default branch config file by @​halostatue in KineticCafe/actions-dco#219

Full Changelog: KineticCafe/actions-dco@v3.1.1...v3.2.0

v3.1.1: Fix author parsing when null

What's Changed

• fix: Fix author parsing when null by @​halostatue in KineticCafe/actions-dco#217

Full Changelog: KineticCafe/actions-dco@v3.1.0...v3.1.1

Changelog

Sourced from KineticCafe/actions-dco's changelog.

KineticCafe/actions-dco Changelog

3.2.0 / 2026-07-25

• Added a test case to detect regression of #216[issue-216] or similar parsing errors.

• Modified the error handling of JSON response decoding to include a more meaningful error.

• Added support for reading .github/dco-check.toml or .dco-check.toml from the repo root on the default branch. If present, this takes precedence over any inline configuration (config:) key. This prevents a PR from "accidentally" changing the DCO check policy. See the configuration documentation for details.

• Added a configuration report to the output logs so that transient configurations are still reported for review.

3.1.1 / 2026-07-25

• Resolved #216[issue-216] with a fix to the OpenAPI generator oaspec.

3.1.0 / 2026-05-15

• Reshaped the sign-off summary written to the action and optionally as a commit comment. The message as added with 3.0.0 was accurate but meaningless. It has now be modified to produce meaningful summaries.

  Each commit that fails (up to X commits) will be included in a DCO failure table:

  | Commit     | Subject                       | Issue                    |
  | ---------- | ----------------------------- | ------------------------ |
  | `ff882225` | deps: Bump the actions group… | No Signed-off-by trailer |

  When commits are passed, skipped or exempt, they are included in a "pass" table grouped by the identity responsible that signed off:

  | Identity                | Commits                        |
  | ----------------------- | ------------------------------ |
  | dependabot[bot]         | 1 (bot, skipped)               |
  | Alice <al…@example.org> | 2 (signed off)                 |
  | Bob <bob@example.com>   | 1 (exempt domain @example.com) |

  The comment will be headed with a subject indicating that the check was

... (truncated)

Commits

• 5f160e3 feat: Add used configuration report
• b1fee4e chore: Build for release
• c963bcb chore: Remove inline config
• 5704499 chore: Bump release version and add changelog
• fc47443 feat: Support default branch config file
• 54e60fa chore: Carry decode errors up and present better errors.
• a171fbc chore: Clean up documentation
• cd84bf8 chore: Add regression test for unknown authors
• 15d7c62 chore: Update action dependencies
• 3ac7462 chore: Use oaspec 0.69.0
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[Chris0Jeky]

Fresh adversarial review — current head 0731e630290772ef65189c5bfbde291df1c3c8e9.

Findings

HIGH — required Windows regression lane is red

Backend Unit (windows-latest) failed on merge ref a7a50401854031130e694ffec1e807209b466ca4: six CLI subprocess tests timed out at the harness's 30-second limit, leaving dotnet/conhost processes for runner cleanup. The one-line DCO-action SHA update does not explain the failure, and nearby Dependabot merge refs at the same base passed, so it cannot be dismissed as flaky. Tracked as #1530.

No separate workflow-security finding: the action remains SHA-pinned, DCO passed, and v3.2.0's default-branch configuration lookup is a hardening change rather than PR-controlled policy input. I read all existing PR-conversation comments, reviews, and review threads: all were empty.

Residual merge gates

• Investigate/fix [Bug] Diagnose Windows CLI subprocess timeouts in required backend unit CI #1530 or obtain a new green required CI run at this exact head.
• The prior merge ref used ff1ee066; main is now 397ba9d2368a7c5e7eb2daf31e1e43640b3ca144, so refresh/re-prove against the current base after the CI fix.
• The Taskdeck Execution project item is Pending with no Priority; derive and set Priority V (no linked Taskdeck issue) before handoff.

Recommendation: not mergeable until the red CI gate is resolved and the current-base/governance gates are green.