From 1c9dfcf74044bb6bad340482f4737a55080947c0 Mon Sep 17 00:00:00 2001
From: Xianpeng Shen <3353385+shenxianpeng@users.noreply.github.com>
Date: Sat, 31 Oct 2026 19:53:47 +0000
Subject: [PATCH 1/2] chore: declare the Codecov secret, fix the CodeQL input
 and add a Dependabot cooldown

- py-coverage.yml declares CODECOV_TOKEN, so callers can pass just that
  secret instead of secrets: inherit (zizmor secrets-inherit).
- codeql.yml: language had a default but was required, so the default
  never applied (actionlint).
- Dependabot: 7-day cooldown (zizmor dependabot-cooldown).
---
 .github/dependabot.yml            | 2 ++
 .github/workflows/codeql.yml      | 2 +-
 .github/workflows/py-coverage.yml | 4 ++++
 3 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index e8d9778..9589ee7 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -9,6 +9,8 @@ updates:
     directory: /
     schedule:
       interval: "monthly"
+    cooldown:
+      default-days: 7
     commit-message:
       prefix: "chore:"
     groups:
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index abefbdf..23a3bab 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -4,7 +4,7 @@ on:
   workflow_call:
     inputs:
       language:
-        required: true
+        required: false
         type: string
         default: "python"
         description: what is your project language
diff --git a/.github/workflows/py-coverage.yml b/.github/workflows/py-coverage.yml
index 10ed08d..6f8b3e7 100644
--- a/.github/workflows/py-coverage.yml
+++ b/.github/workflows/py-coverage.yml
@@ -2,6 +2,10 @@ name: Upload coverage reports
 
 on:
   workflow_call:
+    secrets:
+      CODECOV_TOKEN:
+        description: Token for uploading the report to Codecov
+        required: false
 
 jobs:
   publish-coverage-reports:

From dc795bf1c8906ce11134132fbd6594a17a4aeeb7 Mon Sep 17 00:00:00 2001
From: Xianpeng Shen <3353385+shenxianpeng@users.noreply.github.com>
Date: Sat, 31 Oct 2026 20:09:17 +0000
Subject: [PATCH 2/2] fix: require CODECOV_TOKEN in the shared coverage
 workflow

---
 .github/workflows/py-coverage.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/py-coverage.yml b/.github/workflows/py-coverage.yml
index 6f8b3e7..01b454e 100644
--- a/.github/workflows/py-coverage.yml
+++ b/.github/workflows/py-coverage.yml
@@ -5,7 +5,7 @@ on:
     secrets:
       CODECOV_TOKEN:
         description: Token for uploading the report to Codecov
-        required: false
+        required: true
 
 jobs:
   publish-coverage-reports: