From 8caa544288ed950ff89bc406c4053ab28c4393bc Mon Sep 17 00:00:00 2001 From: rldyourmnd Date: Mon, 21 Sep 2026 03:41:34 +0500 Subject: [PATCH] chore(ci): converge ci-workflows pins on 0.1.24 Previous pins in this repository: ci.yml 26749820; security.yml 26749820. A fleet audit found eight distinct ci-workflows pins in use across the estate, from 0.1.11 (88 commits behind main) to 0.1.21. 0.1.24 is the convergence target rather than 0.1.23 because 0.1.23 could not be one. Vendoring left five `uses:` pointing at `./actions/...`, which in a called workflow resolves against the caller's workspace instead of ci-workflows, so every cross-repository caller failed at job setup. ci-feedback.yml had carried that defect since 0.1.21 and only surfaced on 2026-09-20 because its job fires solely on a failed conclusion. 0.1.24 names and pins the repository for all five. Input contracts were diffed across every reusable this repository calls for the whole 0.1.16..0.1.24 range: no input was removed and none became required, so this is a pin move with no caller change. Signed-off-by: rldyourmnd Co-Authored-By: Claude Opus 5 --- .github/workflows/ci.yml | 8 ++++---- .github/workflows/security.yml | 12 ++++++------ 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index f99a2be..98d08d1 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -30,7 +30,7 @@ jobs: name: rust permissions: contents: read - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/rust-ci.yml@26749820fad5bde1f1726636af5b04d329ed2fe5 # 0.1.20 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/rust-ci.yml@37a827f921f62353664fc4bcd872f05b65efe71a # 0.1.24 with: toolchain: '1.98.0' # The three-OS matrix is the evidence ADR-0113 asks for, and standard @@ -46,7 +46,7 @@ jobs: name: supply-chain permissions: contents: read - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/rust-supply-chain.yml@26749820fad5bde1f1726636af5b04d329ed2fe5 # 0.1.20 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/rust-supply-chain.yml@37a827f921f62353664fc4bcd872f05b65efe71a # 0.1.24 with: enable_deny: true enable_audit: true @@ -56,7 +56,7 @@ jobs: name: actionlint permissions: contents: read - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/actionlint.yml@26749820fad5bde1f1726636af5b04d329ed2fe5 # 0.1.20 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/actionlint.yml@37a827f921f62353664fc4bcd872f05b65efe71a # 0.1.24 pr-hygiene: name: pr-hygiene @@ -68,7 +68,7 @@ jobs: # that would use them is off. issues: write # the stale bot closes threads pull-requests: write # the labeler applies labels - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/pr-hygiene.yml@26749820fad5bde1f1726636af5b04d329ed2fe5 # 0.1.20 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/pr-hygiene.yml@37a827f921f62353664fc4bcd872f05b65efe71a # 0.1.24 boundary: diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index c79b7c5..faad62e 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -26,7 +26,7 @@ jobs: actions: read # CodeQL reads the workflow definitions it analyses contents: read security-events: write # CodeQL publishes its findings to code scanning - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml@26749820fad5bde1f1726636af5b04d329ed2fe5 # 0.1.20 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml@37a827f921f62353664fc4bcd872f05b65efe71a # 0.1.24 with: languages: '["rust", "actions"]' queries: security-and-quality @@ -37,7 +37,7 @@ jobs: permissions: contents: read pull-requests: write # writes the review it produces - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-dependency-review.yml@26749820fad5bde1f1726636af5b04d329ed2fe5 # 0.1.20 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-dependency-review.yml@37a827f921f62353664fc4bcd872f05b65efe71a # 0.1.24 with: fail_on_severity: moderate @@ -52,13 +52,13 @@ jobs: contents: read id-token: write # mints the OIDC token Scorecard's publication is signed with security-events: write # Scorecard publishes its findings to code scanning - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-scorecard.yml@26749820fad5bde1f1726636af5b04d329ed2fe5 # 0.1.20 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-scorecard.yml@37a827f921f62353664fc4bcd872f05b65efe71a # 0.1.24 osv: name: osv permissions: contents: read - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/osv-scan.yml@26749820fad5bde1f1726636af5b04d329ed2fe5 # 0.1.20 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/osv-scan.yml@37a827f921f62353664fc4bcd872f05b65efe71a # 0.1.24 zizmor: name: zizmor @@ -66,10 +66,10 @@ jobs: actions: read # the SARIF upload reads this run to attach its results contents: read security-events: write # zizmor publishes its findings to code scanning - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/zizmor-sarif.yml@26749820fad5bde1f1726636af5b04d329ed2fe5 # 0.1.20 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/zizmor-sarif.yml@37a827f921f62353664fc4bcd872f05b65efe71a # 0.1.24 secret-scan: name: secret-scan permissions: contents: read - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/secret-scan.yml@26749820fad5bde1f1726636af5b04d329ed2fe5 # 0.1.20 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/secret-scan.yml@37a827f921f62353664fc4bcd872f05b65efe71a # 0.1.24