fix(reusable): name this repository when using its vendored actions

.github/workflows/ci-feedback.yml

@@ -31,13 +31,13 @@ jobs:
       issues: write # Publish bounded failure evidence in the caller repository.
     steps:
       # Trusted immutable action code only. No checkout of the triggering PR.
-      # The action lives beside this workflow: the previous home moved to
-      # NDDev-Archive, and an archived repository cannot serve a reusable
-      # call, so every caller of the old path failed at resolution.
-      # A same-repository `uses:` is bound to the caller's own commit: the
-      # strongest pin is the checkout itself, so the unpinned-uses audit does
-      # not apply.
-      - uses: ./actions/ci-feedback  # zizmor: ignore[unpinned-uses]
+      # The action lives beside this workflow, but `./` in a called workflow
+      # resolves against the CALLER's workspace, not this repository: with no
+      # checkout the workspace is empty, and with one it holds the caller's
+      # tree. Either way `./actions/ci-feedback` cannot resolve, which is how
+      # 0.1.21 shipped this path broken for every reusable caller. Name the
+      # repository explicitly and pin it.
+      - uses: NDDev-OpenNetwork/ci-workflows/actions/ci-feedback@96215b32fbc751716b5c0b758a7a7ca202246574  # 0.1.23
         with:
           run-id: ${{ inputs.run-id }}
           run-attempt: ${{ inputs.run-attempt }}

.github/workflows/private-security-bundle-free.yml

@@ -150,7 +150,7 @@ jobs:
       - name: Restore pinned uv archive
         if: ${{ steps.baked-uv.outputs.available != 'true' }}
         id: uv-archive
-        uses: ./actions/tool-cache  # zizmor: ignore[unpinned-uses] vendored from github-actions-garm@468af475
+        uses: NDDev-OpenNetwork/ci-workflows/actions/tool-cache@96215b32fbc751716b5c0b758a7a7ca202246574  # 0.1.23
         with:
           url: https://github.com/astral-sh/uv/releases/download/0.11.30/uv-x86_64-unknown-linux-gnu.tar.gz
           sha256: 04bc7d180d6138bf6dc08387acf507a823f397a98fea55da36b0ccc7fbce3b68
@@ -173,23 +173,23 @@ jobs:
           printf '%s\n' "$RUNNER_TEMP/private-security-tools/bin" >> "$GITHUB_PATH"
 
       - name: Restore actionlint archive
-        uses: ./actions/tool-cache  # zizmor: ignore[unpinned-uses] vendored from github-actions-garm@468af475
+        uses: NDDev-OpenNetwork/ci-workflows/actions/tool-cache@96215b32fbc751716b5c0b758a7a7ca202246574  # 0.1.23
         with:
           url: https://github.com/rhysd/actionlint/releases/download/v1.7.12/actionlint_1.7.12_linux_amd64.tar.gz
           sha256: 8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8
           output: ${{ runner.temp }}/private-security-tools/actionlint.tar.gz
           max-bytes: '16777216'
 
       - name: Restore OSV-Scanner binary
-        uses: ./actions/tool-cache  # zizmor: ignore[unpinned-uses] vendored from github-actions-garm@468af475
+        uses: NDDev-OpenNetwork/ci-workflows/actions/tool-cache@96215b32fbc751716b5c0b758a7a7ca202246574  # 0.1.23
         with:
           url: https://github.com/google/osv-scanner/releases/download/v2.5.0/osv-scanner_linux_amd64
           sha256: edcfc41d257db36148f065055655fe3fcfc434b0b423ea67468a84c207524e0c
           output: ${{ runner.temp }}/private-security-tools/osv-scanner
           max-bytes: '268435456'
 
       - name: Restore gitleaks archive
-        uses: ./actions/tool-cache  # zizmor: ignore[unpinned-uses] vendored from github-actions-garm@468af475
+        uses: NDDev-OpenNetwork/ci-workflows/actions/tool-cache@96215b32fbc751716b5c0b758a7a7ca202246574  # 0.1.23
         with:
           url: https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz
           sha256: 551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb

CHANGELOG.md

@@ -7,6 +7,35 @@ The project follows Semantic Versioning.
 
 ## [Unreleased]
 
+## [0.1.24] - 2026-09-20
+
+- **Fix a reusable workflow that could not reach its own vendored actions.**
+  `./actions/...` in a called workflow resolves against the *caller's*
+  workspace, never this repository. Five `uses:` were written that way while
+  vendoring, and each one fails at job setup for every cross-repository
+  caller:
+  - `ci-feedback.yml` has used `./actions/ci-feedback` since 0.1.21. It runs
+    no checkout, so the workspace is empty and the step cannot resolve. The
+    job only fires on a failed conclusion, so it stayed hidden until
+    2026-09-20, when `github-device-sync` run 35541640707 reported
+    `Can't find 'action.yml' ... under
+    /home/runner/work/github-device-sync/github-device-sync/actions/ci-feedback`.
+    Every reusable caller of the CI-feedback path has been silently unable to
+    publish evidence for three releases.
+  - `private-security-bundle-free.yml` gained four `./actions/tool-cache`
+    references in 0.1.22/0.1.23, replacing the fully-qualified
+    `NDDev-Archive/github-actions-garm/actions/tool-cache@468af475` that
+    worked. It *does* check out the caller, so the path resolved into the
+    caller's tree: `setup-systems` run 35541466805 failed with
+    `Can't find 'action.yml' ... under .../setup-systems/setup-systems/actions/tool-cache`.
+
+  All five now name the repository explicitly and pin it:
+  `NDDev-OpenNetwork/ci-workflows/actions/<name>@96215b32`. That commit is
+  0.1.23, which is where both actions already live, so the pin is real and
+  immutable. Vendoring the action was correct; addressing it with `./` was
+  not, and the distinction is that a reusable workflow has no path to its own
+  repository unless it names it.
+
 ## [0.1.23] - 2026-09-20
 
 - `tool-cache`: vendor the composite action into `actions/tool-cache/`

VERSION

@@ -1 +1 @@
-0.1.23
+0.1.24

catalog/cache-contract.yml

@@ -153,13 +153,15 @@ producers:
     upstream_default: null
     default_caches: true
     note: A cache action by construction; callers opt in by adding the step.
-  - action: ./actions/tool-cache
+  - action: NDDev-OpenNetwork/ci-workflows/actions/tool-cache
     control: null
     upstream_default: null
     default_caches: false
     note: >-
       Vendored from NDDev-Archive/github-actions-garm/actions/tool-cache
-      468af475. Cache use is conditional on a complete per-job Drakkars
+      468af475 and addressed by this repository's own name: a called workflow
+      cannot reach its vendored actions through `./`, which resolves against
+      the caller's workspace. Cache use is conditional on a complete per-job Drakkars
       assignment. GitHub-hosted runners and malformed or unavailable
       assignments use the checksum-verified upstream path; private writes
       remain inside the caller's injected trust prefix.