fix(reusable): name this repository when using its vendored actions

[rldyourmnd]

./actions/... in a called workflow resolves against the caller's workspace, never against the repository that holds the workflow. Five uses: were written that way while vendoring, and every one of them fails at job setup for a cross-repository caller.

Two live failures, both observed today

ci-feedback.yml — ./actions/ci-feedback since 0.1.21. The job runs no checkout, so the workspace is empty. Its if: only fires on a failed conclusion, which is why three releases shipped with the CI-feedback path silently unable to publish anything. It was finally exercised in github-device-sync run 35541640707:

Can't find 'action.yml', 'action.yaml' or 'Dockerfile' under
'/home/runner/work/github-device-sync/github-device-sync/actions/ci-feedback'

private-security-bundle-free.yml — four ./actions/tool-cache references added in 0.1.22/0.1.23, replacing NDDev-Archive/github-actions-garm/actions/tool-cache@468af475, which was fully qualified and worked. This workflow does check out the caller, so the relative path resolved into the caller's tree. NDDev-it-com/setup-systems run 35541466805:

Can't find 'action.yml', 'action.yaml' or 'Dockerfile' under
'.../setup-systems/setup-systems/actions/tool-cache'

Fix

All five now name the repository and pin it: NDDev-OpenNetwork/ci-workflows/actions/<name>@96215b32. That commit is 0.1.23, where both vendored actions already live, so the pin is real and immutable rather than a forward reference.

catalog/cache-contract.yml declares the producer under the same string — cache-contract compares the uses: text exactly, and caught the mismatch when only the workflow was changed.

Vendoring the actions was right. Addressing them with ./ was not: a called workflow has no path to its own repository unless it names it.

Verification

validate_all.py --tier core — RC=0, 47 validators OK, zero failures, including cache-contract, pinned-actions, actionlint-contract and runner-routing.

Consumer impact

The estate-wide convergence onto 0.1.23 is held for this. The four private callers of private-security-bundle-free.yml (setup-systems, nddev-platform-backend, nddev-seo-service, nddev-observability-service) cannot pass on 0.1.23; every reusable caller of ci-feedback.yml is affected too. Consumers will be pointed at the release carrying this fix instead.

🤖 Generated with Claude Code