From b49aed4794d40d61d7151c2ccc3bf4032d7099e0 Mon Sep 17 00:00:00 2001 From: rldyourmnd Date: Mon, 21 Sep 2026 03:18:26 +0500 Subject: [PATCH] chore(ci): converge ci-workflows pins on 0.1.23 Previous pins in this repository: ci-feedback-events.yml 9adc78a8; codeql.yml 9eb9e070; release.yml 9eb9e070. A fleet audit found eight distinct ci-workflows pins in use across the estate, from 0.1.11 (88 commits behind main) to 0.1.21. 0.1.23 is the first tag carrying the vendored tool-cache action and the retired GARM label vocabulary, so it is the single current target. Input contracts were diffed across every reusable this repository calls for the whole 0.1.16..0.1.23 range: no input was removed and none became required, so this is a pin move with no caller change. Signed-off-by: rldyourmnd Co-Authored-By: Claude Opus 5 --- .github/workflows/ci-feedback-events.yml | 2 +- .github/workflows/codeql.yml | 2 +- .github/workflows/release.yml | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci-feedback-events.yml b/.github/workflows/ci-feedback-events.yml index 02cea74..91fdf51 100644 --- a/.github/workflows/ci-feedback-events.yml +++ b/.github/workflows/ci-feedback-events.yml @@ -19,7 +19,7 @@ jobs: permissions: actions: read # Read exact completed run and job metadata. issues: write # Publish bounded failure evidence in this repository. - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/ci-feedback.yml@9adc78a8a79553e1002134bd4f901dc7822d25b5 # commit:9adc78a8a79553e1002134bd4f901dc7822d25b5 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/ci-feedback.yml@96215b32fbc751716b5c0b758a7a7ca202246574 # 0.1.23 with: run-id: ${{ format('{0}', github.event.workflow_run.id) }} run-attempt: ${{ format('{0}', github.event.workflow_run.run_attempt) }} diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index ed0fe6a..018e674 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -31,7 +31,7 @@ jobs: actions: read contents: read security-events: write - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml@9eb9e070ae87b0fc3bdbd2cbed5afe3b92f7e2c7 # commit:9eb9e070ae87b0fc3bdbd2cbed5afe3b92f7e2c7 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml@96215b32fbc751716b5c0b758a7a7ca202246574 # 0.1.23 with: # Public repository: `pull_request` runs untrusted fork code. Name the # hosted runner explicitly — the reusable's default belongs to the pinned diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index f1f44f4..99e286e 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -41,7 +41,7 @@ jobs: permissions: actions: read # verify exact public workflow evidence contents: read # read the signed annotated tag - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/release-promotion-gate.yml@9eb9e070ae87b0fc3bdbd2cbed5afe3b92f7e2c7 # commit:9eb9e070ae87b0fc3bdbd2cbed5afe3b92f7e2c7 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/release-promotion-gate.yml@96215b32fbc751716b5c0b758a7a7ca202246574 # 0.1.23 with: version: ${{ needs.resolve.outputs.version }} runner: ubuntu-latest @@ -62,7 +62,7 @@ jobs: id-token: write # mint Sigstore identity attestations: write # persist provenance and SBOM attestations artifact-metadata: write # persist attested artifact metadata - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/release-supply-chain.yml@9eb9e070ae87b0fc3bdbd2cbed5afe3b92f7e2c7 # commit:9eb9e070ae87b0fc3bdbd2cbed5afe3b92f7e2c7 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/release-supply-chain.yml@96215b32fbc751716b5c0b758a7a7ca202246574 # 0.1.23 with: version: ${{ needs.resolve.outputs.version }} package_name: cd-workflows