PR: Branch Merge by Git-Hub-Chris · Pull Request #171 · microsoft/Agent365-python

Git-Hub-Chris · 2026-02-08T00:37:35Z

Pull Request: Matching the upstream.

PR: Branch merger. Keeping code up-to-date.

PR: Branch Merge. Updating status badge. (microsoft#131). Keeping code up-to-date.

PR: Branch merger. Keeping code up-to-date.

Adding in 'CodeQL' status badge. Updating the README.md.

feat: Add chat history API for Semantic Kernel (microsoft#149). Keeping code up-to-date.

Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>

…urity-remediation [StepSecurity] ci: Harden GitHub Actions. Keeping code up-to-date.

Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 6.8.0 to 7.2.1. - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@d0cc045...803947b) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 7.2.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4.6.2 to 6.0.0. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@ea165f8...b7c566a) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [actions/checkout](https://github.com/actions/checkout) from 4.3.1 to 6.0.2. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@34e1148...de0fac2) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.4.0 to 2.4.3. - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](ossf/scorecard-action@62b2cac...4eaacf0) --- updated-dependencies: - dependency-name: ossf/scorecard-action dependency-version: 2.4.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [actions/setup-python](https://github.com/actions/setup-python) from 5.6.0 to 6.2.0. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@a26af69...a309ff8) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: 6.2.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

…tral-sh/setup-uv-7.2.1 Bump astral-sh/setup-uv from 6.8.0 to 7.2.1.

…tions/upload-artifact-6.0.0 Bump actions/upload-artifact from 4.6.2 to 6.0.0.

…tions/checkout-6.0.2 Bump actions/checkout from 4.3.1 to 6.0.2.

…ion-2.4.3

…ctions/setup-python-6.2.0 Bump actions/setup-python from 5.6.0 to 6.2.0.

…ion-2.4.3

Bumps the uv group with 1 update in the / directory: [protobuf](https://github.com/protocolbuffers/protobuf). Updates `protobuf` from 5.29.5 to 6.33.5 - [Release notes](https://github.com/protocolbuffers/protobuf/releases) - [Commits](https://github.com/protocolbuffers/protobuf/commits) --- updated-dependencies: - dependency-name: protobuf dependency-version: 6.33.5 dependency-type: indirect dependency-group: uv ... Signed-off-by: dependabot[bot] <support@github.com>

…sf/scorecard-action-2.4.3 Bump ossf/scorecard-action from 2.4.0 to 2.4.3.

Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 7.2.1 to 7.3.0. - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@803947b...eac588a) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 7.3.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

Bump protobuf from 5.29.5 to 6.33.5 in the uv group across 1 directory.

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.32.0 to 4.32.2. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@439137e...45cbd0c) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.32.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [step-security/harden-runner](https://github.com/step-security/harden-runner) from 2.14.1 to 2.14.2. - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](step-security/harden-runner@e3f713f...5ef0c07) --- updated-dependencies: - dependency-name: step-security/harden-runner dependency-version: 2.14.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

Copilot

Pull request overview

This PR aligns the branch with upstream by updating dependency lock state and introducing/refreshing repository automation for supply-chain security and CI.

Changes:

Updated uv.lock dependency resolutions (notably openapi-core and werkzeug).
Added repository automation: pre-commit config, Dependabot for GitHub Actions, and security workflows (Scorecards, Dependency Review, CodeQL).
Hardened and pinned CI workflow actions (commit-SHA pinning) and adjusted integration test gating + PyPI publishing secret.

Reviewed changes

Copilot reviewed 6 out of 7 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
`uv.lock`	Syncs locked dependency versions to match upstream resolution.
`.pre-commit-config.yaml`	Adds local pre-commit hooks (gitleaks, whitespace fixes, pylint).
`.github/workflows/scorecards.yml`	Adds OpenSSF Scorecards workflow for supply-chain/security posture reporting.
`.github/workflows/dependency-review.yml`	Adds dependency review on PRs to block known-vulnerable dependency changes.
`.github/workflows/codeql.yml`	Adds CodeQL scanning for Python on PRs/pushes/schedule.
`.github/workflows/ci.yml`	Pins actions by SHA, adds runner hardening, refines integration test gating, updates artifact upload action, switches publish secret to `PYPI_TOKEN`.
`.github/dependabot.yml`	Enables daily Dependabot updates for GitHub Actions.

.github/workflows/ci.yml

…ithub/codeql-action-4.32.2 Bump github/codeql-action from 3.32.0 to 4.32.2.

…tep-security/harden-runner-2.14.2 Bump step-security/harden-runner from 2.14.1 to 2.14.2.

Copilot

Pull request overview

Copilot reviewed 6 out of 7 changed files in this pull request and generated 6 comments.

.github/workflows/ci.yml

.pre-commit-config.yaml

.github/workflows/ci.yml

Bumps the uv group with 1 update in the / directory: [cryptography](https://github.com/pyca/cryptography). Updates `cryptography` from 46.0.4 to 46.0.5 - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@46.0.4...46.0.5) --- updated-dependencies: - dependency-name: cryptography dependency-version: 46.0.5 dependency-type: indirect dependency-group: uv ... Signed-off-by: dependabot[bot] <support@github.com>

Bump cryptography from 46.0.4 to 46.0.5 in the uv group across 1 directory.

Copilot

Pull request overview

Copilot reviewed 4 out of 7 changed files in this pull request and generated 2 comments.

.github/workflows/ci.yml

.github/workflows/dependency-review.yml

Bumps the uv group with 1 update in the / directory: [langchain-core](https://github.com/langchain-ai/langchain). Updates `langchain-core` from 1.2.9 to 1.2.11 - [Release notes](https://github.com/langchain-ai/langchain/releases) - [Commits](langchain-ai/langchain@langchain-core==1.2.9...langchain-core==1.2.11) --- updated-dependencies: - dependency-name: langchain-core dependency-version: 1.2.11 dependency-type: indirect dependency-group: uv ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6. - [Release notes](https://github.com/actions/checkout/releases) - [Commits](actions/checkout@v4...v6) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.32.2 to 4.32.3. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@45cbd0c...9e907b5) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.32.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

Bump langchain-core from 1.2.9 to 1.2.11 in the uv group across 1 directory.

…ctions/checkout-6 Bump actions/checkout from 4 to 6.

…ithub/codeql-action-4.32.3 Bump github/codeql-action from 4.32.2 to 4.32.3.

Copilot

Pull request overview

Copilot reviewed 5 out of 7 changed files in this pull request and generated 4 comments.

Copilot · 2026-02-15T02:17:24Z

.github/workflows/ci.yml

    steps:
+    - name: Harden the runner (Audit all outbound calls)
+      uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+      with:
+        egress-policy: audit
+
    - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2


The steps: list items are not indented under steps, which makes this workflow YAML invalid. Indent each - name: entry beneath steps: (e.g., two more spaces) so GitHub Actions can parse the job.

Copilot · 2026-02-15T02:17:24Z

.github/workflows/ci.yml

    steps:
+    - name: Harden the runner (Audit all outbound calls)
+      uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+      with:
+        egress-policy: audit
+
    - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      with:


Same indentation issue here: the - name: entries appear at the same indentation level as steps:. This is invalid YAML; indent the step entries under steps: for this job as well.

Copilot · 2026-02-15T02:17:24Z

.github/workflows/ci.yml

    steps:
+    - name: Harden the runner (Audit all outbound calls)
+      uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+      with:
+        egress-policy: audit
+
    - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2


Same YAML indentation problem in this job: steps: is followed by step entries that are not indented beneath it. This will prevent the workflow from running.

Copilot · 2026-02-15T02:17:24Z

.github/workflows/ci.yml

    - name: Run integration tests
      # Only run integration tests if secrets are available
-      if: ${{ vars.RUN_INTEGRATION_TESTS == 'true' }}
+      if: github.event_name == 'push' && secrets.AZURE_OPENAI_API_KEY != '' && vars.AZURE_OPENAI_ENDPOINT != '' && vars.AZURE_OPENAI_DEPLOYMENT != '' && vars.AZURE_OPENAI_API_VERSION != ''


This if: guard can evaluate to true when repository variables are unset because undefined vars are null and null != '' is true in GitHub Actions expressions. Use a null/empty-safe check (e.g., vars.NAME in boolean context or vars.NAME != '' && vars.NAME != null) so integration tests only run when all required values are actually present.

Suggested change

if: github.event_name == 'push' && secrets.AZURE_OPENAI_API_KEY != '' && vars.AZURE_OPENAI_ENDPOINT != '' && vars.AZURE_OPENAI_DEPLOYMENT != '' && vars.AZURE_OPENAI_API_VERSION != ''

if: github.event_name == 'push' && secrets.AZURE_OPENAI_API_KEY && vars.AZURE_OPENAI_ENDPOINT && vars.AZURE_OPENAI_DEPLOYMENT && vars.AZURE_OPENAI_API_VERSION

Git-Hub-Chris and others added 30 commits January 23, 2026 20:20

Update README.md

9bb5e38

Update README.md

4649bb2

Merge pull request #1 from microsoft/main

27119b2

PR: Branch merger. Keeping code up-to-date.

Merge branch 'main' into main

17aca78

Merge branch 'main' into main

b0f9339

Merge branch 'main' into main

f7ea187

Merge branch 'main' into main

7dd9d09

Merge branch 'main' into main

bae2f85

Merge pull request #2 from microsoft/main

62ff7f8

PR: Branch Merge. Updating status badge. (microsoft#131). Keeping code up-to-date.

Merge pull request #3 from microsoft/main

13f8ac1

PR: Branch merger. Keeping code up-to-date.

Update README.md

a20304f

Adding in 'CodeQL' status badge. Updating the README.md.

Merge pull request #4 from microsoft/main

52f164b

feat: Add chat history API for Semantic Kernel (microsoft#149). Keeping code up-to-date.

[StepSecurity] ci: Harden GitHub Actions

7e9240c

Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>

Merge pull request #5 from step-security-bot/chore/GHA-300524-stepsec…

5528af8

…urity-remediation [StepSecurity] ci: Harden GitHub Actions. Keeping code up-to-date.

Merge pull request #6 from Git-Hub-Chris/dependabot/github_actions/as…

be9d039

…tral-sh/setup-uv-7.2.1 Bump astral-sh/setup-uv from 6.8.0 to 7.2.1.

Merge pull request #7 from Git-Hub-Chris/dependabot/github_actions/ac…

e0ef1ab

…tions/upload-artifact-6.0.0 Bump actions/upload-artifact from 4.6.2 to 6.0.0.

Merge pull request #8 from Git-Hub-Chris/dependabot/github_actions/ac…

4b70844

…tions/checkout-6.0.2 Bump actions/checkout from 4.3.1 to 6.0.2.

Merge branch 'main' into dependabot/github_actions/ossf/scorecard-act…

562b086

…ion-2.4.3

Merge pull request #10 from Git-Hub-Chris/dependabot/github_actions/a…

561d2aa

…ctions/setup-python-6.2.0 Bump actions/setup-python from 5.6.0 to 6.2.0.

Merge branch 'main' into dependabot/github_actions/ossf/scorecard-act…

74e025b

…ion-2.4.3

Merge pull request #9 from Git-Hub-Chris/dependabot/github_actions/os…

1cc4371

…sf/scorecard-action-2.4.3 Bump ossf/scorecard-action from 2.4.0 to 2.4.3.

Merge branch 'main' into dependabot/uv/uv-915b9422ef

240ae69

Merge pull request #11 from Git-Hub-Chris/dependabot/uv/uv-915b9422ef

4ce64bd

Bump protobuf from 5.29.5 to 6.33.5 in the uv group across 1 directory.

dependabot bot and others added 4 commits February 10, 2026 00:42

Push commit

e30aca8

Push commit

13f4f92

Copilot AI review requested due to automatic review settings February 10, 2026 03:47

Copilot started reviewing on behalf of Git-Hub-Chris February 10, 2026 03:48 View session

Copilot AI reviewed Feb 10, 2026

View reviewed changes

.github/workflows/ci.yml Show resolved Hide resolved

Git-Hub-Chris added 2 commits February 9, 2026 20:57

Merge pull request #15 from Git-Hub-Chris/dependabot/github_actions/g…

439f35e

…ithub/codeql-action-4.32.2 Bump github/codeql-action from 3.32.0 to 4.32.2.

Merge pull request #16 from Git-Hub-Chris/dependabot/github_actions/s…

a9b5ddc

…tep-security/harden-runner-2.14.2 Bump step-security/harden-runner from 2.14.1 to 2.14.2.

Copilot AI review requested due to automatic review settings February 10, 2026 03:58

Copilot started reviewing on behalf of Git-Hub-Chris February 10, 2026 03:58 View session

Merge branch 'main' into main

be7cf91

Copilot AI reviewed Feb 10, 2026

View reviewed changes

dependabot bot and others added 3 commits February 11, 2026 03:01

Merge pull request #17 from Git-Hub-Chris/dependabot/uv/uv-d1091effbf

12a3d21

Bump cryptography from 46.0.4 to 46.0.5 in the uv group across 1 directory.

Merge branch 'main' into main

c52753a

Copilot AI review requested due to automatic review settings February 11, 2026 06:47

Copilot started reviewing on behalf of Git-Hub-Chris February 11, 2026 06:48 View session

Copilot AI reviewed Feb 11, 2026

View reviewed changes

.github/workflows/ci.yml Show resolved Hide resolved

.github/workflows/dependency-review.yml Outdated Show resolved Hide resolved

dependabot bot and others added 5 commits February 11, 2026 16:04

Merge branch 'main' into main

c795109

Merge pull request #18 from Git-Hub-Chris/dependabot/uv/uv-eb94b2281d

46bb8f0

Bump langchain-core from 1.2.9 to 1.2.11 in the uv group across 1 directory.

Copilot AI review requested due to automatic review settings February 15, 2026 02:13

Merge pull request #19 from Git-Hub-Chris/dependabot/github_actions/a…

b9e5a26

…ctions/checkout-6 Bump actions/checkout from 4 to 6.

Copilot started reviewing on behalf of Git-Hub-Chris February 15, 2026 02:14 View session

Merge pull request #20 from Git-Hub-Chris/dependabot/github_actions/g…

54ac161

…ithub/codeql-action-4.32.3 Bump github/codeql-action from 4.32.2 to 4.32.3.

Copilot AI reviewed Feb 15, 2026

View reviewed changes

Git-Hub-Chris closed this Feb 15, 2026

	if: github.event_name == 'push' && secrets.AZURE_OPENAI_API_KEY != '' && vars.AZURE_OPENAI_ENDPOINT != '' && vars.AZURE_OPENAI_DEPLOYMENT != '' && vars.AZURE_OPENAI_API_VERSION != ''
	if: github.event_name == 'push' && secrets.AZURE_OPENAI_API_KEY && vars.AZURE_OPENAI_ENDPOINT && vars.AZURE_OPENAI_DEPLOYMENT && vars.AZURE_OPENAI_API_VERSION

Conversation

Git-Hub-Chris commented Feb 8, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Feb 15, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 15, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 15, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 15, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Comments