Align GHA maintenance: dependabot silently drops action updates #129

Found while fixing the same defect in fgm/envrun
(envrun#25). The dependabot config
here is byte-identical, so the same failure mode applies, and it has run longer
here because this repo uses more actions.

1. Dependabot silently drops updates

.github/dependabot.yml sets no open-pull-requests-limit, so it takes the
default of 5, and eight actions are in use. Worse, unmerged PRs keep holding
that quota: once five sit open, nothing new is proposed at all.

Every batch this repo has had is exactly five PRs:

• 2026-01-01 → Bump actions/setup-go from 6.0.0 to 6.1.0 #113–Bump peter-evans/create-pull-request from 7.0.8 to 8.0.0 #117, merged 2026-01-02
• 2026-02-01 → chore(deps): bump step-security/harden-runner from 2.13.1 to 2.14.1 #118–chore(deps): bump actions/checkout from 6.0.1 to 6.0.2 #122, merged 2026-04-05 → March starved
• 2026-05-02 → chore(deps): bump actions/upload-artifact from 6.0.0 to 7.0.1 #124–chore(deps): bump step-security/harden-runner from 2.14.1 to 2.19.0 #128, unmerged until 2026-08-23 → June, July, August starved

Six of the last eight months produced no updates at all. The resulting lag, as
of 2026-08-23:

Four of them a full major behind.

Fix, as merged in envrun — grouping makes the limit unreachable, and the raised
limit is belt and braces:

  - package-ecosystem: github-actions
    directory: /
    schedule:
      interval: "monthly"
    open-pull-requests-limit: 10
    groups:
      github-actions:
        patterns: ["*"]

2. Codecov signing-key rotation (self-resolving, recorded for the record)

workflow.yml fails at the codecov upload with:

gpg: Signature made Thu Jul  9 01:37:57 2026 UTC
gpg:                using RSA key 27034E7FDB850E0BBC2C62FF806BB28AED779869
gpg: Can't check signature: No public key
==> Could not verify signature. Please contact Codecov if problem continues
##[error]Process completed with exit code 1

fail_ci_if_error: true promotes that to a failed build.

This is not version lag as such: the codecov-action-6.0.0 branch passed on
2026-05-02 and fails today with the above. Codecov rotated the CLI signing key
around 2026-07-09, and only action releases shipping the new key still verify.
v7.0.0 works — envrun runs it and is green.

The lag did hide it: main had no push between 2026-04-05 and 2026-08-23, so
the first red run on main is today's merge of #124.

Dependabot has since regenerated #125 as 5.5.1 → 7.0.0, which resolves it.
The other open bump PRs fail the same way until they carry that change.

3. The Update cron does not do what its comment says

- cron: "0 2 1-7 * 6" # 2am UTC, monthly on the first Saturday of each month

When day-of-month and day-of-week are both restricted, cron ORs them. This
fires on days 1–7 of every month plus every Saturday. Run history for August
confirms it: the 1st through the 8th, then the 15th and the 22nd — ten runs
rather than one.

envrun fixed this by moving to a weekly cron plus a check-first-saturday.yml
job gate.

4. Tool dependencies are never updated

update.yml runs only go get -t -u ./..., which never touches the tool
directive. Both tool dependencies have been frozen since they were added in #99
on 2025-09-19:

• honnef.co/go/tools v0.6.1 — envrun is on v0.8.1
• golang.org/x/tools v0.37.0 — envrun is on v0.49.0

envrun covers this with a second line, go get -u tool.

Related: go-version: ${{ env.GO_VERSION }} is hardcoded to 1.24 while
go.mod says go 1.24.7. envrun uses go-version-file: go.mod, which cannot
drift.

5. Minor

The Go Report Card badge on README line 4 is dead — the service shut down. It
was removed from envrun in 6111b88.

Items 3 and 4 are independent of the dependabot defect and could be split out if
that is easier to review.