From e89a1a9b0d7894fb7342c58916ef69429cc67810 Mon Sep 17 00:00:00 2001 From: rldyourmnd Date: Mon, 21 Sep 2026 03:41:08 +0500 Subject: [PATCH 1/2] chore(ci): converge ci-workflows pins on 0.1.24 Previous pins in this repository: ci-feedback-events.yml 9adc78a8; codeql.yml 9eb9e070; release.yml 9eb9e070. A fleet audit found eight distinct ci-workflows pins in use across the estate, from 0.1.11 (88 commits behind main) to 0.1.21. 0.1.24 is the convergence target rather than 0.1.23 because 0.1.23 could not be one. Vendoring left five `uses:` pointing at `./actions/...`, which in a called workflow resolves against the caller's workspace instead of ci-workflows, so every cross-repository caller failed at job setup. ci-feedback.yml had carried that defect since 0.1.21 and only surfaced on 2026-09-20 because its job fires solely on a failed conclusion. 0.1.24 names and pins the repository for all five. Input contracts were diffed across every reusable this repository calls for the whole 0.1.16..0.1.24 range: no input was removed and none became required, so this is a pin move with no caller change. Signed-off-by: rldyourmnd Co-Authored-By: Claude Opus 5 --- .github/workflows/ci-feedback-events.yml | 2 +- .github/workflows/codeql.yml | 2 +- .github/workflows/release.yml | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci-feedback-events.yml b/.github/workflows/ci-feedback-events.yml index 02cea74..7f49266 100644 --- a/.github/workflows/ci-feedback-events.yml +++ b/.github/workflows/ci-feedback-events.yml @@ -19,7 +19,7 @@ jobs: permissions: actions: read # Read exact completed run and job metadata. issues: write # Publish bounded failure evidence in this repository. - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/ci-feedback.yml@9adc78a8a79553e1002134bd4f901dc7822d25b5 # commit:9adc78a8a79553e1002134bd4f901dc7822d25b5 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/ci-feedback.yml@37a827f921f62353664fc4bcd872f05b65efe71a # 0.1.24 with: run-id: ${{ format('{0}', github.event.workflow_run.id) }} run-attempt: ${{ format('{0}', github.event.workflow_run.run_attempt) }} diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index ed0fe6a..cd0544d 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -31,7 +31,7 @@ jobs: actions: read contents: read security-events: write - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml@9eb9e070ae87b0fc3bdbd2cbed5afe3b92f7e2c7 # commit:9eb9e070ae87b0fc3bdbd2cbed5afe3b92f7e2c7 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml@37a827f921f62353664fc4bcd872f05b65efe71a # 0.1.24 with: # Public repository: `pull_request` runs untrusted fork code. Name the # hosted runner explicitly — the reusable's default belongs to the pinned diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index f1f44f4..ba07606 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -41,7 +41,7 @@ jobs: permissions: actions: read # verify exact public workflow evidence contents: read # read the signed annotated tag - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/release-promotion-gate.yml@9eb9e070ae87b0fc3bdbd2cbed5afe3b92f7e2c7 # commit:9eb9e070ae87b0fc3bdbd2cbed5afe3b92f7e2c7 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/release-promotion-gate.yml@37a827f921f62353664fc4bcd872f05b65efe71a # 0.1.24 with: version: ${{ needs.resolve.outputs.version }} runner: ubuntu-latest @@ -62,7 +62,7 @@ jobs: id-token: write # mint Sigstore identity attestations: write # persist provenance and SBOM attestations artifact-metadata: write # persist attested artifact metadata - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/release-supply-chain.yml@9eb9e070ae87b0fc3bdbd2cbed5afe3b92f7e2c7 # commit:9eb9e070ae87b0fc3bdbd2cbed5afe3b92f7e2c7 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/release-supply-chain.yml@37a827f921f62353664fc4bcd872f05b65efe71a # 0.1.24 with: version: ${{ needs.resolve.outputs.version }} package_name: cd-workflows From 7a3a09e5485e5f86992e02f7cda70aec9c88319d Mon Sep 17 00:00:00 2001 From: rldyourmnd Date: Mon, 21 Sep 2026 04:04:03 +0500 Subject: [PATCH 2/2] fix(ci): move the action catalog with the ci-workflows bump `catalog/actions.yml` is the authority every `uses:` in .github/ must match exactly -- name, SHA and release comment. The pin convergence changed the workflows but not the catalog, so `static validators` refused the branch on two counts: three ci-workflows entries still recorded the 0.1.21 commit, and ci-feedback was still declared under its pre-repoint home `NDDev-OpenNetwork/github-actions/...` while ci-feedback-events.yml has called `NDDev-OpenNetwork/ci-workflows/...` since 07489cf. All four entries now record 37a827f / 0.1.24, matching the workflow pins. Signed-off-by: rldyourmnd --- catalog/actions.yml | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/catalog/actions.yml b/catalog/actions.yml index af47a0c..7c8b432 100644 --- a/catalog/actions.yml +++ b/catalog/actions.yml @@ -20,15 +20,15 @@ actions: - name: actions/upload-artifact sha: "043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" version: "v7.0.1" + - name: NDDev-OpenNetwork/ci-workflows/.github/workflows/ci-feedback.yml + sha: "37a827f921f62353664fc4bcd872f05b65efe71a" + version: "0.1.24" - name: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml - sha: "9eb9e070ae87b0fc3bdbd2cbed5afe3b92f7e2c7" - version: "commit:9eb9e070ae87b0fc3bdbd2cbed5afe3b92f7e2c7" + sha: "37a827f921f62353664fc4bcd872f05b65efe71a" + version: "0.1.24" - name: NDDev-OpenNetwork/ci-workflows/.github/workflows/release-promotion-gate.yml - sha: "9eb9e070ae87b0fc3bdbd2cbed5afe3b92f7e2c7" - version: "commit:9eb9e070ae87b0fc3bdbd2cbed5afe3b92f7e2c7" + sha: "37a827f921f62353664fc4bcd872f05b65efe71a" + version: "0.1.24" - name: NDDev-OpenNetwork/ci-workflows/.github/workflows/release-supply-chain.yml - sha: "9eb9e070ae87b0fc3bdbd2cbed5afe3b92f7e2c7" - version: "commit:9eb9e070ae87b0fc3bdbd2cbed5afe3b92f7e2c7" - - name: NDDev-OpenNetwork/github-actions/.github/workflows/ci-feedback.yml - sha: "6064b7d98a4e6b852de7572de12b8889e8fbfe38" - version: "commit:6064b7d98a4e6b852de7572de12b8889e8fbfe38" + sha: "37a827f921f62353664fc4bcd872f05b65efe71a" + version: "0.1.24"