chore: sync main into develop

.github/actions/marketplace-login/action.yml

@@ -42,7 +42,7 @@ runs:
         done
 
     - name: Sign in with Marketplace workload identity
-      uses: azure/login@v3
+      uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3.1.0
       with:
         client-id: ${{ inputs.client-id }}
         tenant-id: ${{ inputs.tenant-id }}

.github/code-quality-py.instructions.md

@@ -1,103 +1,103 @@
----
-applyTo: '**/*.py'
----
-# Systematic Code-Quality Pass Instructions for Python Codebase
-
-> Should check copilot-instructions.md for general guidelines first, but these are specific to Python files and should be applied in addition to any general instructions.
-
-You are performing a systematic code-quality pass on a Python codebase. Work through every folder one at a time. For each Python file, apply ALL of the following rules, then compile-check every edited file before moving to the next folder.
-
-## 1. Copyright & Module Docstring
-- Every `.py` file (except empty `__init__.py`) must start with:
-  ```
-  # Copyright (c) Microsoft Corporation.
-  # Licensed under the MIT License.
-  ```
-- Immediately after, add or replace the module-level docstring. It must:
-  - Describe what the module does in 1-2 sentences.
-  - Mention its role in the broader system (e.g., which pipeline stage, what it depends on).
-  - NOT contain generic filler like "This module provides utilities for…"
-
-## 2. Package `__init__.py`
-- If empty, add the copyright header and a package docstring listing sub-modules with one-line descriptions.
-
-## 3. Class Docstrings
-- Replace generic class docstrings with structured ones:
-  ```
-  """One-line summary.
-
-  Responsibilities:
-      1. First responsibility.
-      2. Second responsibility.
-
-  Attributes:
-      attr_name: Description.
-  """
-  ```
-- For dataclasses / Pydantic models, list all fields under "Attributes:".
-
-## 4. Method / Function Docstrings
-- Every public and non-trivial private method must have a docstring.
-- Use this structure:
-  ```
-  """One-line summary.
-
-  Steps:                    ← only for complex multi-step methods
-      1. First step.
-      2. Second step.
-
-  Args:
-      param: Description.
-
-  Returns:
-      Description.
-
-  Raises:
-      ExceptionType: When condition.
-  """
-  ```
-- Simple one-line methods (getters, delegates) get a single-line docstring.
-
-## 5. Comment Cleanup - REMOVE These
-- **Redundant inline comments** that just restate the code:
-  `# Create Claim_Process entry in Cosmos DB` above `new_claim_process = Claim_Process(...)`
-- **Banner comments** / section dividers:
-  `############################################################`
-  `## Initialize AgentFrameworkHelper and add it to the app  ##`
-  `############################################################`
-- **Commented-out code** (dead imports, print statements, old logic).
-- **Heritage/provenance comments** referencing deleted files:
-  `Replaces create_quiet_logger() from quiet_logging.py`
-- **Placeholder comments** that describe unimplemented intent:
-  `# Placeholder for document processing logic`
-- **"For demonstration" / "Here you would typically"** comments.
-
-## 6. Comment Cleanup - KEEP These
-- **Actionable TODOs** with clear intent: `# TODO: Make configurable if needed`
-- **Non-obvious "why" comments** that explain a design decision:
-  `# Avoid unbounded growth on very chatty endpoints.`
-- **Contract/protocol comments** that document external API behavior:
-  `# Image files bypass the 'extract' step.`
-
-## 7. Fix Stale References
-- Search for outdated terminology (old project names, old class names, old pipeline descriptions) and correct them to match the current code.
-
-## 8. Remove Dead Code
-- Delete unused imports.
-- Delete `pass` in `else` blocks that only existed to hold a now-deleted comment.
-- Delete redundant assignments like `claim_id = claim_id`.
-- Delete duplicate imports (e.g., `import os` at module level AND inside a function).
-
-## 9. Compile-Check
-- After finishing each folder, run `python -m py_compile <file>` on every edited file.
-- Fix any errors before proceeding to the next folder.
-
-## Working Process
-1. List the directory tree of the target folder.
-2. Read all Python files in the folder.
-3. Create a TODO list for the folder (one item per file + one for compile-check).
-4. Edit files, marking each TODO as you go.
-5. Compile-check all edited files.
-6. Move to the next folder.
-
-Start with the folder I specify and work through it completely before asking what to do next.
+---
+applyTo: '**/*.py'
+---
+# Systematic Code-Quality Pass Instructions for Python Codebase
+
+> Should check copilot-instructions.md for general guidelines first, but these are specific to Python files and should be applied in addition to any general instructions.
+
+You are performing a systematic code-quality pass on a Python codebase. Work through every folder one at a time. For each Python file, apply ALL of the following rules, then compile-check every edited file before moving to the next folder.
+
+## 1. Copyright & Module Docstring
+- Every `.py` file (except empty `__init__.py`) must start with:
+  ```
+  # Copyright (c) Microsoft Corporation.
+  # Licensed under the MIT License.
+  ```
+- Immediately after, add or replace the module-level docstring. It must:
+  - Describe what the module does in 1-2 sentences.
+  - Mention its role in the broader system (e.g., which pipeline stage, what it depends on).
+  - NOT contain generic filler like "This module provides utilities for…"
+
+## 2. Package `__init__.py`
+- If empty, add the copyright header and a package docstring listing sub-modules with one-line descriptions.
+
+## 3. Class Docstrings
+- Replace generic class docstrings with structured ones:
+  ```
+  """One-line summary.
+
+  Responsibilities:
+      1. First responsibility.
+      2. Second responsibility.
+
+  Attributes:
+      attr_name: Description.
+  """
+  ```
+- For dataclasses / Pydantic models, list all fields under "Attributes:".
+
+## 4. Method / Function Docstrings
+- Every public and non-trivial private method must have a docstring.
+- Use this structure:
+  ```
+  """One-line summary.
+
+  Steps:                    ← only for complex multi-step methods
+      1. First step.
+      2. Second step.
+
+  Args:
+      param: Description.
+
+  Returns:
+      Description.
+
+  Raises:
+      ExceptionType: When condition.
+  """
+  ```
+- Simple one-line methods (getters, delegates) get a single-line docstring.
+
+## 5. Comment Cleanup - REMOVE These
+- **Redundant inline comments** that just restate the code:
+  `# Create Claim_Process entry in Cosmos DB` above `new_claim_process = Claim_Process(...)`
+- **Banner comments** / section dividers:
+  `############################################################`
+  `## Initialize AgentFrameworkHelper and add it to the app  ##`
+  `############################################################`
+- **Commented-out code** (dead imports, print statements, old logic).
+- **Heritage/provenance comments** referencing deleted files:
+  `Replaces create_quiet_logger() from quiet_logging.py`
+- **Placeholder comments** that describe unimplemented intent:
+  `# Placeholder for document processing logic`
+- **"For demonstration" / "Here you would typically"** comments.
+
+## 6. Comment Cleanup - KEEP These
+- **Actionable TODOs** with clear intent: `# TODO: Make configurable if needed`
+- **Non-obvious "why" comments** that explain a design decision:
+  `# Avoid unbounded growth on very chatty endpoints.`
+- **Contract/protocol comments** that document external API behavior:
+  `# Image files bypass the 'extract' step.`
+
+## 7. Fix Stale References
+- Search for outdated terminology (old project names, old class names, old pipeline descriptions) and correct them to match the current code.
+
+## 8. Remove Dead Code
+- Delete unused imports.
+- Delete `pass` in `else` blocks that only existed to hold a now-deleted comment.
+- Delete redundant assignments like `claim_id = claim_id`.
+- Delete duplicate imports (e.g., `import os` at module level AND inside a function).
+
+## 9. Compile-Check
+- After finishing each folder, run `python -m py_compile <file>` on every edited file.
+- Fix any errors before proceeding to the next folder.
+
+## Working Process
+1. List the directory tree of the target folder.
+2. Read all Python files in the folder.
+3. Create a TODO list for the folder (one item per file + one for compile-check).
+4. Edit files, marking each TODO as you go.
+5. Compile-check all edited files.
+6. Move to the next folder.
+
+Start with the folder I specify and work through it completely before asking what to do next.

.github/dependabot.yml

@@ -17,6 +17,8 @@ updates:
     labels:
       - "dependencies"
       - "github-actions"
+    cooldown:
+      default-days: 7
   - package-ecosystem: "npm"
     directory: "/plugins/agentops"
     schedule:

.github/workflows/_build.yml

@@ -39,7 +39,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.checkout_ref || github.ref }}
           fetch-depth: 0 # Full history required for setuptools-scm
@@ -59,7 +59,7 @@ jobs:
           echo "Release package version pinned to $VERSION from $TAG"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
           version: ">=0.9.0"
 
@@ -111,7 +111,7 @@ jobs:
           uv run python -c "from importlib.metadata import version; print(f'Version: {version(\"agentops-accelerator\")}')"
 
       - name: Upload build artifacts
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: dist
           path: dist/

.github/workflows/agentops-watchdog.yml

@@ -44,7 +44,7 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Azure login (OIDC)
         uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3.1.0
@@ -59,7 +59,7 @@ jobs:
           python-version: "3.11"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
 
       - name: Install AgentOps Toolkit (this branch)
         run: |
@@ -72,7 +72,7 @@ jobs:
       # downloads when the artifact does not exist yet, instead of
       # surfacing a red error annotation on every first run.
       - name: Restore watchdog history (if any)
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: agentops-watchdog-history
           path: .agentops/agent/
@@ -97,7 +97,7 @@ jobs:
 
       - name: Upload watchdog artifacts
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: agentops-watchdog-history
           path: |

.github/workflows/ci.yml

@@ -38,10 +38,10 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
           version: ">=0.9.0"
           enable-cache: false  # test matrix saves this cache key
@@ -67,7 +67,7 @@ jobs:
     if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0  # need the merge base to diff against develop
 
@@ -93,10 +93,10 @@ jobs:
         os: [ubuntu-latest, windows-latest]
         python-version: ["3.11", "3.12", "3.13"]
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
           version: ">=0.9.0"
 
@@ -111,7 +111,7 @@ jobs:
 
       - name: Upload test results
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: test-results-${{ matrix.os }}-py${{ matrix.python-version }}
           path: test-results.xml
@@ -120,10 +120,10 @@ jobs:
     runs-on: ubuntu-latest
     needs: test
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
           version: ">=0.9.0"
           enable-cache: false  # test matrix saves this cache key
@@ -138,7 +138,7 @@ jobs:
         run: uv run pytest tests/ --cov=agentops --cov-report=xml --cov-report=term-missing
 
       - name: Upload coverage
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: coverage-report
           path: coverage.xml
@@ -154,12 +154,12 @@ jobs:
     permissions:
       id-token: write  # Required for PyPI Trusted Publishing (OIDC)
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0 # Full history for setuptools-scm
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
           version: ">=0.9.0"
           enable-cache: false  # test matrix saves this cache key
@@ -213,7 +213,7 @@ jobs:
           echo "Dev version: ${{ steps.package-version.outputs.version }}"
 
       - name: Publish to TestPyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
         with:
           repository-url: https://test.pypi.org/legacy/
           verbose: true
@@ -278,7 +278,7 @@ jobs:
   build-vsix:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # CI uses the committed package.json version as-is (no publish, dry-run only).
       # The version in package.json is synced by cut-release.yml when a release branch is created.
@@ -306,7 +306,7 @@ jobs:
           echo "✅ VSIX packaging validated"
 
       - name: Upload VSIX artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: vsix
           path: plugins/agentops/*.vsix