[dependabot]

Bumps the github-actions group with 1 update: alibaba/open-code-review.

Updates alibaba/open-code-review from 1.12.6 to 1.12.11

Release notes

Sourced from alibaba/open-code-review's releases.

v1.12.11

🚀 Features

• feat(allowlist): add Jinja template support (#1056)

🐛 Bug Fixes

• fix(idea): list merge commit files against the first parent (#1544)
• fix(make): append .exe to the dev binary on Windows (#1573)
• fix(extensions): generate provider catalogs from Go registry (#1212)
• fix(viewer): restore Files Reviewed pagination by guarding hidden rows (#1576)

Full Changelog: alibaba/open-code-review@v1.12.10...v1.12.11

v1.12.10

🚀 Features

• feat(llm): exercise a tool-call round trip in ocr llm test (#1394)
• feat(llm): add OpenRouter to list of providers (#1522)
• feat(session): add 'ocr session rm' to delete a saved session (#1490)

🐛 Bug Fixes

• fix(llmloop): account for tool_calls and arguments in messageTokens (#1413)
• fix(llm): trim environment-sourced endpoint values (#1414)
• fix(tool): keep non-ASCII paths literal in file_find results (#1530)
• fix(opencode): handle long background context (#1010)
• fix(action): allow checkpoints after out-of-diff findings (#1524)
• fix(config): remove OCR_CONFIG_PATH (#1537)
• fix(llm): replay tool_call extra_content and surface provider error bodies (#1393)

📖 Documentation

• docs(cli-reference): list the manifest status values in the status field (#1587)
• docs(readme): replace Go weekly badge with all-language weekly badge (#1559)
• docs(review-rules): document merge_system_rule in all five locales (#1555)

Full Changelog: alibaba/open-code-review@v1.12.9...v1.12.10

v1.12.9

🐛 Bug Fixes

• fix(session): preserve findings across file renames (#1529)
• fix(config): preserve unknown JSON fields during config updates (#1508)
• fix(review): keep git stderr out of --commit background (#1467)
• fix(ci): pin workflow action references to full commit SHAs (#856)
• fix(viewer): wrap long session metadata on mobile (#1458)

... (truncated)

Commits

• a758d9c feat(allowlist): add Jinja template support (#1056)
• 01af446 fix(idea): list merge commit files against the first parent (#1544)
• 998604b fix(make): append .exe to the dev binary on Windows (#1573)
• f93ff15 fix(extensions): generate provider catalogs from Go registry (#1212)
• ebb6983 fix(viewer): restore Files Reviewed pagination by guarding hidden rows (#1576)
• 579b931 fix(llmloop): account for tool_calls and arguments in messageTokens (#1413)
• 1af527d docs(cli-reference): list the manifest status values in the status field (#1587)
• 486022d fix(llm): trim environment-sourced endpoint values (#1414)
• 7dcaab2 feat(llm): exercise a tool-call round trip in ocr llm test (#1394)
• d19649b fix(tool): keep non-ASCII paths literal in file_find results (#1530)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

🔍 OpenCodeReview found 1 issue(s) in this PR.

• ✅ Successfully posted inline: 0 comment(s)
• 📋 Routed to summary by policy: 1 comment(s)

---

📄 .github/workflows/ocr-review.yml (L165-L165)

⚠️ GitHub could not post this as an inline comment: Routed to summary (severity low · category maintainability)

Action 版本已更新到 v1.12.11，但 ocr_version 输入仍然固定在 '1.12.4'。这意味着 action wrapper 是 v1.12.11，但它内部下载/使用的 OCR CLI 二进制仍是 1.12.4。如果这次升级的目的是获取 v1.12.11 的修复或新功能，ocr_version 也可能需要同步更新为 '1.12.11'（或者移除该行，让 action 使用其默认匹配版本）。如果 ocr_version 是有意固定的，请忽略此建议。