Bumps the actions group with 3 updates: [actions/checkout](https://github.com/actions/checkout), [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) and [codecov/codecov-action](https://github.com/codecov/codecov-action).


Updates `actions/checkout` from 6.0.2 to 6.0.3
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@de0fac2...df4cb1c)

Updates `sigstore/cosign-installer` from 4.1.1 to 4.1.2
- [Release notes](https://github.com/sigstore/cosign-installer/releases)
- [Commits](sigstore/cosign-installer@cad07c2...6f9f177)

Updates `codecov/codecov-action` from 6.0.0 to 6.0.1
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](codecov/codecov-action@57e3a13...e79a696)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: sigstore/cosign-installer
  dependency-version: 4.1.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: codecov/codecov-action
  dependency-version: 6.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [undici](https://github.com/nodejs/undici) from 6.24.1 to 6.27.0.
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v6.24.1...v6.27.0)

---
updated-dependencies:
- dependency-name: undici
  dependency-version: 6.27.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

The undici 6.24.1 -> 6.27.0 bump (#565) updated package-lock.json but
did not regenerate the bundled dist/index.js. The validate workflow's
build job rebuilds dist/ and fails on any uncommitted changes, which
broke CI on master.

Signed-off-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Adds a workflow that, on Dependabot PRs, rebuilds the ncc-bundled dist/
and pushes it back onto the PR branch, so a dependency bump and its
matching dist/ land in a single PR and the validate workflow stays green.

Pushing the dist commit uses GH_PAT (the default GITHUB_TOKEN is read-only
on Dependabot runs and its pushes do not re-trigger checks). The job is a
no-op until GH_PAT is available as a Dependabot secret.

Signed-off-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* ci: use a GitHub App token to rebuild dist on dependabot PRs

Replaces GH_PAT (a broad org PAT) with a GitHub App token for pushing the
rebuilt dist/ back to Dependabot PR branches. An App token is scoped to
this repo with minimal permissions and is short-lived, so it is much safer
to expose on the (semi-trusted) Dependabot PR build than a wide PAT.

The job stays a no-op until the DIST_REBUILD_APP_ID and
DIST_REBUILD_APP_PRIVATE_KEY Dependabot secrets are configured.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>

* ci: use GORELEASER_APP_ID/GORELEASER_APP_KEY for dist rebuild

Use the existing GoReleaser GitHub App secrets instead of dedicated
DIST_REBUILD_* ones.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>

---------

Signed-off-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Signed-off-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>

Signed-off-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>

Signed-off-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>

Signed-off-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>