ci(deps): bump Glyndor/.github/.github/workflows/dco.yml from 1.10.1 to 1.11.0

[dependabot]

Bumps Glyndor/.github/.github/workflows/dco.yml from 1.10.1 to 1.11.0.

Release notes

Sourced from Glyndor/.github/.github/workflows/dco.yml's releases.

v1.11.0

New reusable: schedule-freshness

Fails a check when a scheduled workflow has not succeeded recently enough. Every other guard in this organisation is an assertion that fails loudly; a cron that stops firing is the exception, because it emits nothing at all and "no alert" reads exactly like "all clear".

That is not hypothetical. Every scheduled workflow in the org stopped on 2026-06-29. podup and apt recovered on 07-15 after activity and a disable/enable cycle; authcore, epistle, unitpm and glyndor.net stayed dark for four more weeks, all of them reporting active throughout. It cost a real finding — authcore's GO-2026-5856 came from running govulncheck by hand, not from the weekly audit that exists to catch it.

Call it from a workflow that already runs often, so the absence of a scheduled run becomes a red check on ordinary work:

permissions:
  contents: read
  actions: read # a called workflow cannot elevate beyond its caller
jobs:
audit:
uses: Glyndor/.github/.github/workflows/schedule-freshness.yml@<sha> # v1.11.0
with:
workflow: audit.yml
max-age-days: 15 # about two periods of a weekly cron

Add it only once the schedule has fired successfully at least once — with nothing on record there is nothing to measure, and the job reports that as a failure, which for an established workflow is exactly right.

go-fuzz: the input that caused a crash is kept

go test -fuzz writes a failing input under <package>/testdata/fuzz/<Target>/ in the workspace, and the runner is destroyed moments later, so a find used to degrade into log text somebody had to retype. It is uploaded as an artifact on failure now, which is what lets it be committed as a permanent regression case.

Proven before it was tagged

Glyndor/authcore#226 exercised both branches of the freshness logic against real data before this tag existed — reporting a 27-day gap on fuzz.yml and no successful scheduled run at all on audit.yml — and went green once the schedules resumed on 2026-07-27. The org rule is that a consumer proves a reusable green before it gets a version, because a broken reusable is a simultaneous outage everywhere and a tag cannot be withdrawn.

Full Changelog: Glyndor/.github@v1.10.1...v1.11.0

Commits

• 41d31f1 feat: make a stalled cron fail a check, and keep fuzz reproducers (#105)
• b0da280 docs: generate a page per reusable, with the check names it emits (#104)
• 8857ed7 ci: record why there is no Dependabot cooldown (#103)
• b159fa2 ci: re-register Dependabot and record why the file is the switch (#102)
• f7491b3 docs: list powershell-ci, release-verify and workflow-lint, and pin the examp...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[Jaro-c]

Superseded by #258, which puts every caller on v1.12.0 in one change rather than moving them one at a time — including the two that were pinned bare while Glyndor/.github#106 waited for a consumer to prove it green.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.