You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.85%. Comparing base (096a68d) to head (fe30450).

@@            Coverage Diff             @@
##             main    #1417      +/-   ##
==========================================
+ Coverage   85.14%   90.85%   +5.71%     
==========================================
  Files          95       95              
  Lines        7283     7283              
==========================================
+ Hits         6201     6617     +416     
+ Misses        657      654       -3     
+ Partials      425       12     -413     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

Thanks @TerryHowe — your diagnosis was right. The remaining failure came from the dependency composite action exporting GOTOOLCHAIN=local after the job-level setting, as confirmed by the failed log. I pushed fe30450: the header action still installs and runs the same license-eye binary, while the dependency check now invokes that binary directly with a step-level GOTOOLCHAIN=auto. This keeps the scanner/config unchanged and avoids the composite action's internal Go 1.25 reset. actionlint v1.7.12 and git diff --check pass locally; CI is rerunning.

Thanks!