PR: Branch Merge #171

Git-Hub-Chris · 2026-02-08T00:37:35Z

Pull Request: Matching the upstream.

PR: Branch merger. Keeping code up-to-date.

PR: Branch Merge. Updating status badge. (microsoft#131). Keeping code up-to-date.

PR: Branch merger. Keeping code up-to-date.

Adding in 'CodeQL' status badge. Updating the README.md.

feat: Add chat history API for Semantic Kernel (microsoft#149). Keeping code up-to-date.

Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>

…urity-remediation [StepSecurity] ci: Harden GitHub Actions. Keeping code up-to-date.

Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 6.8.0 to 7.2.1. - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@d0cc045...803947b) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 7.2.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4.6.2 to 6.0.0. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@ea165f8...b7c566a) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [actions/checkout](https://github.com/actions/checkout) from 4.3.1 to 6.0.2. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@34e1148...de0fac2) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.4.0 to 2.4.3. - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](ossf/scorecard-action@62b2cac...4eaacf0) --- updated-dependencies: - dependency-name: ossf/scorecard-action dependency-version: 2.4.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [actions/setup-python](https://github.com/actions/setup-python) from 5.6.0 to 6.2.0. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@a26af69...a309ff8) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: 6.2.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

…tral-sh/setup-uv-7.2.1 Bump astral-sh/setup-uv from 6.8.0 to 7.2.1.

…tions/upload-artifact-6.0.0 Bump actions/upload-artifact from 4.6.2 to 6.0.0.

…tions/checkout-6.0.2 Bump actions/checkout from 4.3.1 to 6.0.2.

…ion-2.4.3

…ctions/setup-python-6.2.0 Bump actions/setup-python from 5.6.0 to 6.2.0.

…ion-2.4.3

Bumps the uv group with 1 update in the / directory: [protobuf](https://github.com/protocolbuffers/protobuf). Updates `protobuf` from 5.29.5 to 6.33.5 - [Release notes](https://github.com/protocolbuffers/protobuf/releases) - [Commits](https://github.com/protocolbuffers/protobuf/commits) --- updated-dependencies: - dependency-name: protobuf dependency-version: 6.33.5 dependency-type: indirect dependency-group: uv ... Signed-off-by: dependabot[bot] <support@github.com>

…sf/scorecard-action-2.4.3 Bump ossf/scorecard-action from 2.4.0 to 2.4.3.

Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 7.2.1 to 7.3.0. - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@803947b...eac588a) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 7.3.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

Bump protobuf from 5.29.5 to 6.33.5 in the uv group across 1 directory.

…-7.3.0

…stral-sh/setup-uv-7.3.0 Bump astral-sh/setup-uv from 7.2.1 to 7.3.0.

Bumps the uv group with 1 update in the / directory: [werkzeug](https://github.com/pallets/werkzeug). Updates `werkzeug` from 3.1.1 to 3.1.5 - [Release notes](https://github.com/pallets/werkzeug/releases) - [Changelog](https://github.com/pallets/werkzeug/blob/main/CHANGES.rst) - [Commits](pallets/werkzeug@3.1.1...3.1.5) --- updated-dependencies: - dependency-name: werkzeug dependency-version: 3.1.5 dependency-type: indirect dependency-group: uv ... Signed-off-by: dependabot[bot] <support@github.com>

Bump werkzeug from 3.1.1 to 3.1.5 in the uv group across 1 directory.

Git-Hub-Chris · 2026-02-08T00:55:19Z

@microsoft-github-policy-service agree

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.32.0 to 4.32.2. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@439137e...45cbd0c) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.32.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [step-security/harden-runner](https://github.com/step-security/harden-runner) from 2.14.1 to 2.14.2. - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](step-security/harden-runner@e3f713f...5ef0c07) --- updated-dependencies: - dependency-name: step-security/harden-runner dependency-version: 2.14.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

Copilot

Pull request overview

This PR aligns the branch with upstream by updating dependency lock state and introducing/refreshing repository automation for supply-chain security and CI.

Changes:

Updated uv.lock dependency resolutions (notably openapi-core and werkzeug).
Added repository automation: pre-commit config, Dependabot for GitHub Actions, and security workflows (Scorecards, Dependency Review, CodeQL).
Hardened and pinned CI workflow actions (commit-SHA pinning) and adjusted integration test gating + PyPI publishing secret.

Reviewed changes

Copilot reviewed 6 out of 7 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
`uv.lock`	Syncs locked dependency versions to match upstream resolution.
`.pre-commit-config.yaml`	Adds local pre-commit hooks (gitleaks, whitespace fixes, pylint).
`.github/workflows/scorecards.yml`	Adds OpenSSF Scorecards workflow for supply-chain/security posture reporting.
`.github/workflows/dependency-review.yml`	Adds dependency review on PRs to block known-vulnerable dependency changes.
`.github/workflows/codeql.yml`	Adds CodeQL scanning for Python on PRs/pushes/schedule.
`.github/workflows/ci.yml`	Pins actions by SHA, adds runner hardening, refines integration test gating, updates artifact upload action, switches publish secret to `PYPI_TOKEN`.
`.github/dependabot.yml`	Enables daily Dependabot updates for GitHub Actions.

Copilot · 2026-02-10T03:52:13Z

.github/workflows/ci.yml

@@ -129,15 +144,15 @@ jobs:

    - name: Run integration tests
      # Only run integration tests if secrets are available


The step comment says integration tests run when secrets are available, but the if: condition also restricts execution to push events. Update the comment (or the condition) so the documentation matches the actual behavior (e.g., mention push-only execution).

Suggested change

# Only run integration tests if secrets are available

# Only run integration tests on push events when required secrets and variables are available

…ithub/codeql-action-4.32.2 Bump github/codeql-action from 3.32.0 to 4.32.2.

…tep-security/harden-runner-2.14.2 Bump step-security/harden-runner from 2.14.1 to 2.14.2.

Copilot

Pull request overview

Copilot reviewed 6 out of 7 changed files in this pull request and generated 6 comments.

Copilot · 2026-02-10T04:02:16Z

.github/workflows/ci.yml

    steps:
+    - name: Harden the runner (Audit all outbound calls)
+      uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+      with:
+        egress-policy: audit
+


Same indentation issue here: step entries are not nested under steps: (list items are at the same indentation). This will break the workflow parsing for this job.

.github/workflows/ci.yml

Copilot · 2026-02-10T04:02:17Z

.pre-commit-config.yaml

+  - id: gitleaks
+- repo: https://github.com/pre-commit/pre-commit-hooks
+  rev: v4.4.0
+  hooks:
+  - id: end-of-file-fixer
+  - id: trailing-whitespace
+- repo: https://github.com/pylint-dev/pylint
+  rev: v2.17.2
+  hooks:
+  - id: pylint


The hooks list items are not indented under hooks: (they're at the same indentation level), which makes this YAML invalid and will prevent pre-commit from loading. Indent each - id: entry under hooks: consistently (e.g., two more spaces than hooks:).

Suggested change

- id: gitleaks

- repo: https://github.com/pre-commit/pre-commit-hooks

rev: v4.4.0

hooks:

- id: end-of-file-fixer

- id: trailing-whitespace

- repo: https://github.com/pylint-dev/pylint

rev: v2.17.2

hooks:

- id: pylint

- id: gitleaks

- repo: https://github.com/pre-commit/pre-commit-hooks

rev: v4.4.0

hooks:

- id: end-of-file-fixer

- id: trailing-whitespace

- repo: https://github.com/pylint-dev/pylint

rev: v2.17.2

hooks:

- id: pylint

Copilot · 2026-02-10T04:02:17Z

.pre-commit-config.yaml

+  - id: gitleaks
+- repo: https://github.com/pre-commit/pre-commit-hooks
+  rev: v4.4.0
+  hooks:
+  - id: end-of-file-fixer
+  - id: trailing-whitespace
+- repo: https://github.com/pylint-dev/pylint
+  rev: v2.17.2
+  hooks:
+  - id: pylint


The hook entries under hooks: are not indented as children of hooks: (same indentation level), which makes the config invalid YAML. Indent these - id: items under hooks:.

Suggested change

- id: gitleaks

- repo: https://github.com/pre-commit/pre-commit-hooks

rev: v4.4.0

hooks:

- id: end-of-file-fixer

- id: trailing-whitespace

- repo: https://github.com/pylint-dev/pylint

rev: v2.17.2

hooks:

- id: pylint

- id: gitleaks

- repo: https://github.com/pre-commit/pre-commit-hooks

rev: v4.4.0

hooks:

- id: end-of-file-fixer

- id: trailing-whitespace

- repo: https://github.com/pylint-dev/pylint

rev: v2.17.2

hooks:

- id: pylint

Copilot · 2026-02-10T04:02:17Z

.pre-commit-config.yaml

+  - id: gitleaks
+- repo: https://github.com/pre-commit/pre-commit-hooks
+  rev: v4.4.0
+  hooks:
+  - id: end-of-file-fixer
+  - id: trailing-whitespace
+- repo: https://github.com/pylint-dev/pylint
+  rev: v2.17.2
+  hooks:
+  - id: pylint


The - id: pylint entry is not indented under hooks: which breaks YAML structure for this repo section. Indent the list item(s) under hooks:.

Suggested change

- id: gitleaks

- repo: https://github.com/pre-commit/pre-commit-hooks

rev: v4.4.0

hooks:

- id: end-of-file-fixer

- id: trailing-whitespace

- repo: https://github.com/pylint-dev/pylint

rev: v2.17.2

hooks:

- id: pylint

- id: gitleaks

- repo: https://github.com/pre-commit/pre-commit-hooks

rev: v4.4.0

hooks:

- id: end-of-file-fixer

- id: trailing-whitespace

- repo: https://github.com/pylint-dev/pylint

rev: v2.17.2

hooks:

- id: pylint

Copilot · 2026-02-10T04:02:18Z

.github/workflows/ci.yml

    steps:
+    - name: Harden the runner (Audit all outbound calls)
+      uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+      with:
+        egress-policy: audit


The steps list items (- name: ...) are aligned with steps: instead of being indented beneath it. This makes the workflow YAML invalid and will prevent the job from running. Indent all step entries under steps: by two additional spaces.

Git-Hub-Chris and others added 30 commits January 23, 2026 20:20

Update README.md

9bb5e38

Update README.md

4649bb2

Merge pull request #1 from microsoft/main

27119b2

PR: Branch merger. Keeping code up-to-date.

Merge branch 'main' into main

17aca78

Merge branch 'main' into main

b0f9339

Merge branch 'main' into main

f7ea187

Merge branch 'main' into main

7dd9d09

Merge branch 'main' into main

bae2f85

Merge pull request #2 from microsoft/main

62ff7f8

PR: Branch Merge. Updating status badge. (microsoft#131). Keeping code up-to-date.

Merge pull request #3 from microsoft/main

13f8ac1

PR: Branch merger. Keeping code up-to-date.

Update README.md

a20304f

Adding in 'CodeQL' status badge. Updating the README.md.

Merge pull request #4 from microsoft/main

52f164b

feat: Add chat history API for Semantic Kernel (microsoft#149). Keeping code up-to-date.

[StepSecurity] ci: Harden GitHub Actions

7e9240c

Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>

Merge pull request #5 from step-security-bot/chore/GHA-300524-stepsec…

5528af8

…urity-remediation [StepSecurity] ci: Harden GitHub Actions. Keeping code up-to-date.

Merge pull request #6 from Git-Hub-Chris/dependabot/github_actions/as…

be9d039

…tral-sh/setup-uv-7.2.1 Bump astral-sh/setup-uv from 6.8.0 to 7.2.1.

Merge pull request #7 from Git-Hub-Chris/dependabot/github_actions/ac…

e0ef1ab

…tions/upload-artifact-6.0.0 Bump actions/upload-artifact from 4.6.2 to 6.0.0.

Merge pull request #8 from Git-Hub-Chris/dependabot/github_actions/ac…

4b70844

…tions/checkout-6.0.2 Bump actions/checkout from 4.3.1 to 6.0.2.

Merge branch 'main' into dependabot/github_actions/ossf/scorecard-act…

562b086

…ion-2.4.3

Merge pull request #10 from Git-Hub-Chris/dependabot/github_actions/a…

561d2aa

…ctions/setup-python-6.2.0 Bump actions/setup-python from 5.6.0 to 6.2.0.

Merge branch 'main' into dependabot/github_actions/ossf/scorecard-act…

74e025b

…ion-2.4.3

Merge pull request #9 from Git-Hub-Chris/dependabot/github_actions/os…

1cc4371

…sf/scorecard-action-2.4.3 Bump ossf/scorecard-action from 2.4.0 to 2.4.3.

Merge branch 'main' into dependabot/uv/uv-915b9422ef

240ae69

Merge pull request #11 from Git-Hub-Chris/dependabot/uv/uv-915b9422ef

4ce64bd

Bump protobuf from 5.29.5 to 6.33.5 in the uv group across 1 directory.

Git-Hub-Chris added 2 commits February 7, 2026 17:33

Merge branch 'main' into dependabot/github_actions/astral-sh/setup-uv…

4dcbc0c

…-7.3.0

Merge pull request #13 from Git-Hub-Chris/dependabot/github_actions/a…

70a3bad

…stral-sh/setup-uv-7.3.0 Bump astral-sh/setup-uv from 7.2.1 to 7.3.0.

Git-Hub-Chris requested a review from a team as a code owner February 8, 2026 00:37

Git-Hub-Chris and others added 3 commits February 7, 2026 17:37

Merge branch 'main' into main

75ad10a

Merge pull request #14 from Git-Hub-Chris/dependabot/uv/uv-a2d74a3e0a

fc076b1

Bump werkzeug from 3.1.1 to 3.1.5 in the uv group across 1 directory.

Git-Hub-Chris and others added 10 commits February 7, 2026 18:10

Push Commit

aa989a8

Merge branch 'main' of https://github.com/Git-Hub-Chris/Agent365-python

4dd97e2

Push commit

3ab4971

Push commit

771309d

Push commit

103499b

Push commit

decd42c

Push commit

e30aca8

Push commit

13f4f92

Copilot AI review requested due to automatic review settings February 10, 2026 03:47

Copilot started reviewing on behalf of Git-Hub-Chris February 10, 2026 03:48 View session

Copilot AI reviewed Feb 10, 2026

View reviewed changes

Git-Hub-Chris added 2 commits February 9, 2026 20:57

Merge pull request #15 from Git-Hub-Chris/dependabot/github_actions/g…

439f35e

…ithub/codeql-action-4.32.2 Bump github/codeql-action from 3.32.0 to 4.32.2.

Merge pull request #16 from Git-Hub-Chris/dependabot/github_actions/s…

a9b5ddc

…tep-security/harden-runner-2.14.2 Bump step-security/harden-runner from 2.14.1 to 2.14.2.

Copilot AI review requested due to automatic review settings February 10, 2026 03:58

Copilot started reviewing on behalf of Git-Hub-Chris February 10, 2026 03:58 View session

Merge branch 'main' into main

be7cf91

Copilot AI reviewed Feb 10, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

PR: Branch Merge #171

PR: Branch Merge #171

Git-Hub-Chris commented Feb 8, 2026

Uh oh!

Git-Hub-Chris commented Feb 8, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Feb 10, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Feb 10, 2026

Uh oh!

Uh oh!

Copilot AI Feb 10, 2026

Uh oh!

Copilot AI Feb 10, 2026

Uh oh!

Copilot AI Feb 10, 2026

Uh oh!

Copilot AI Feb 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		@@ -129,15 +144,15 @@ jobs:

		- name: Run integration tests
		# Only run integration tests if secrets are available

	# Only run integration tests if secrets are available
	# Only run integration tests on push events when required secrets and variables are available

PR: Branch Merge #171

Are you sure you want to change the base?

PR: Branch Merge #171

Conversation

Git-Hub-Chris commented Feb 8, 2026

Uh oh!

Git-Hub-Chris commented Feb 8, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants