chore(deps): update dependency opendefensecloud/dev-kit to v3

[renovate]

This PR contains the following updates:

Package	Update	Change	Pending
opendefensecloud/dev-kit	major	v2.2.0 → v3.0.0	v3.1.0 (+4)

---

Release Notes

opendefensecloud/dev-kit

v3.0.0

Compare Source

Migrating from v2

v3.0.0 is breaking: the governance workflows move into dev-kit as reusable workflows, and make repo-settings no longer installs update-action-pins.yml. In each consuming repository, in order:

1. Bump all three dev-kit pins to v3.0.0 — DEV_KIT_VERSION in the Makefile, the flake.nix input, and setup-nix in the workflows. With renovate-config they arrive together in one dev-kit PR; when it changes flake.nix, commit nix flake update dev-kit on the branch (its PR body says so).
2. Replace the local copies of update-action-pins, conventional-commits, osv-scanner, issues-add-labels and issues-add-to-project with the stubs from the README's "Governance workflows" section. scorecard stays a standalone workflow.
3. Update REPO_STATUS_CHECKS to the names reusable workflows report, <stub job> / <called job> (e.g. update-action-pins / Check action pins, osv-scanner / scan-pr / osv-scan), then have a repo admin run make repo-settings. Do both in the same change, or the old names stay required and never report.
4. Add .common.mk-configs to .gitignore — it records which shared configs common.mk fetched.

Optional:

• Shared formatting is opt-in: run make fmt-all once, commit, then set DEV_KIT_FORMATTING := on before -include common.mk.
• renovate-dev-kit-lock commits the relocked flake.lock to Renovate's dev-kit PR. It needs the dev-kit-bot app and the DEV_KIT_BOT_APP_* org secrets on the repository (currently solution-arsenal only).
• Pin runs-on in your own workflows to ubuntu-24.04, as dev-kit's reusable workflows now do.

No stub triggers on merge_group; see the README before enabling a merge queue.

Changes

• feat: add check-go-version and report unavailable goVersion @​AlexHardAtWork (#​33)
• feat!: make governance workflows reusable @​dermorz (#​41)
• feat: moved common linting configs and setups to dev-kit @​rebEllieous (#​34)
• fix: stop auto-approving pushes onto Renovate branches @​yocaba (#​36)
• feat: check headers regarding copyright and license @​yocaba (#​35)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: abfe499d-cc7e-4354-b96a-7fbda5707474

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}