chore(deps): bump sigstore/gh-action-sigstore-python from 3.4.0 to 3.5.0

[dependabot]

Bumps sigstore/gh-action-sigstore-python from 3.4.0 to 3.5.0.

Release notes

Sourced from sigstore/gh-action-sigstore-python's releases.

v3.5.0

What's Changed

• The action now uses sigstore 4.5.0
• Bump other dependencies

Full Changelog: sigstore/gh-action-sigstore-python@v3.4.0...v3.5.0

Commits

• 790bc6b build(deps): bump github/codeql-action/upload-sarif in the actions group (#445)
• 513a149 build(deps): bump platformdirs in the python-dependencies group (#446)
• 74e0040 Bump sigstore from 4.4 to 4.5 (#444)
• 52538fd build(deps): bump the actions group across 1 directory with 4 updates (#439)
• cbab91d build(deps): bump the python-dependencies group across 1 directory with 9 upd...
• 1d3524c build(deps): bump softprops/action-gh-release from 3.0.1 to 3.0.2 in the acti...
• a174484 build(deps): bump sigstore from 4.3.0 to 4.4.0 in the python-dependencies gro...
• 0b384a6 build(deps): bump the actions group with 2 updates (#429)
• f11d8f8 build(deps): bump typing-extensions in the python-dependencies group (#430)
• 258577b build(deps): bump the python-dependencies group with 2 updates (#428)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

🤖 Claude Code Review

PR Code Review

Scope: Single-line diff bumping sigstore/gh-action-sigstore-python from v3.4.0 → v3.5.0 in .github/workflows/publish-to-pypi.yaml (line 86). This is a Dependabot-style CI dependency bump with no source code changes.

Code Quality

• ✅ Style/formatting — YAML syntax unchanged, only the version tag string updated.
• ✅ No commented-out code.
• ✅ N/A — no new variables introduced.
• ✅ DRY — single reference to the action, no duplication.
• ✅ Defects — no logic changes; this is a pinned-version bump for a third-party GitHub Action. No bugs, race conditions, or crashes introduced. One note: the action is pinned by version tag (@v3.5.0) rather than by commit SHA. This is a pre-existing pattern (not introduced by this PR), but worth flagging as a supply-chain hardening opportunity — pinning Actions to a full commit SHA is the safer practice recommended by GitHub's security hardening guidance, since tags can be moved/re-pointed by the upstream maintainer or a compromised account. Not a blocker for this PR since it's consistent with the rest of the workflow.
• ✅ .claude/CLAUDE.md reviewed — unrelated to this diff, no changes made to it, and its content is already general-purpose (no local-machine-specific paths beyond the documented /opt/senzing/er/lib prerequisite, which is appropriately general).

Testing

• ✅ N/A — CI workflow version bump, no application code affected. No unit/integration tests required.
• ✅ Edge cases — N/A.
• ✅ Coverage — N/A, doesn't touch src/.

Documentation

• ✅ README — not applicable to this change.
• ✅ API docs — not applicable.
• ✅ Inline comments — not applicable (no complex logic).
• ⚠️ CHANGELOG.md — not updated. Given this repo's history (recent commits are all dependency bumps: docker/login-action, twine, etc.), this appears to be the established convention for automated dependency-bump PRs — CHANGELOG updates are likely reserved for user-facing SDK changes, not CI tooling bumps. Not flagging as a real issue unless the project's CHANGELOG policy says otherwise.
• ✅ Markdown/CommonMark — no .md files touched in this diff.

Security

• ✅ No hardcoded credentials.
• ✅ Input validation — N/A.
• ✅ Error handling — N/A.
• ✅ No sensitive data in logs.
• ✅ No .lic files or AQAAAD-prefixed strings present in this diff.

Summary

This is a clean, low-risk automated dependency bump with no defects. Nothing blocking. The only forward-looking suggestion (not required for this PR) is to consider pinning third-party GitHub Actions to commit SHAs instead of version tags across the workflow for stronger supply-chain integrity — but that's a repo-wide convention question, not something to fix in a single Dependabot bump.

Verdict: ✅ Approve

Automated code review analyzing defects and coding standards

[github-actions]

Super-linter summary

Language	Validation result
CHECKOV	Pass ✅
GITHUB_ACTIONS	Pass ✅
GITHUB_ACTIONS_ZIZMOR	Pass ✅
GITLEAKS	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
JSCPD	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Pass ✅
YAML	Pass ✅
YAML_PRETTIER	Pass ✅

All files and directories linted successfully

For more information, see the GitHub Actions workflow run

Powered by Super-linter

[github-actions]

Coverage report

Click to see where and how coverage changed

File	Statements	Missing	Coverage	Coverage (new stmts)	Lines missing
src/senzing
szengineflags.py
szerror.py
Project Total

This report was generated by python-coverage-comment-action

[github-actions]

🤖 Claude Code Review

PR Code Review

This PR is a single-line version bump: sigstore/gh-action-sigstore-python action pinned version updated from v3.4.0 to v3.5.0 in .github/workflows/publish-to-pypi.yaml (line 86).

Code Quality

• ✅ Follows standard conventions — GitHub Actions version pins are typically referenced by tag; this is consistent with the existing style in the file.
• ✅ No commented-out code.
• ✅ N/A — no variables introduced.
• ✅ N/A — no duplication introduced.
• ✅ No defects identified. This is a dependency version bump only, no logic change. No bugs, edge cases, or security issues introduced by the diff itself.
• ✅ No .claude/CLAUDE.md changes in this diff.

Testing

• ✅ N/A — no new functions/endpoints. A version bump in a workflow doesn't require new unit/integration tests.
• ✅ N/A — no edge cases introduced.
• ✅ N/A — coverage not applicable to a workflow YAML change.

Documentation

• ✅ N/A — no README/API/CHANGELOG impact expected for a CI action bump (note: repo's recent commit history, e.g. 2196334, 1c3cb46, shows other dependency bumps also didn't touch CHANGELOG.md, so this is consistent with existing practice).
• ✅ N/A — no markdown files touched.

Security

• ✅ No hardcoded credentials.
• ✅ N/A — no input handling changed.
• ✅ N/A — no error handling changed.
• ✅ No sensitive data.
• ✅ No .lic files or AQAAAD-prefixed strings present in this diff.

One note (not blocking)

The action is pinned by tag (@v3.5.0) rather than by immutable commit SHA. This matches the pre-existing convention in the file (the prior line also used @v3.4.0), so it's not a regression introduced by this PR — just flagging that pinning third-party GitHub Actions by SHA is generally considered a stronger supply-chain security practice than pinning by mutable tag. This would be a repo-wide convention change, not something to fix in this single-line bump PR.

Overall: ✅ Approve. This is a routine, low-risk dependency version bump (likely from Dependabot) with no functional or security concerns.

Automated code review analyzing defects and coding standards