chore: converge ci-workflows pins on 0.1.26 and refresh dependencies

.gds/bundle.lock.yaml

@@ -4,14 +4,14 @@ schema_version: 1
 bundle:
   version: "0.9.7-dev"
   release_sequence: 0
-  source_tree_digest: "sha256:fe02c4580c0096f44bee9a34ddfba300a60e63825a4e95f31ccc5bb15dc71874"
-  digest: "sha256:b1eb23b12eaa04e622fbe81f873aca00815c85d154d28f1e8faa7e21b11c0052"
+  source_tree_digest: "sha256:4ef1a44ed62126887d79d92366bfa5717e667f6dc120653f404cf67af1951a66"
+  digest: "sha256:096d982e79fa540447861ac9a09399b5b6ccb8296ac1401a0dbea5327a313347"
 
 projection:
-  input_digest: "sha256:7b89757f969d6a784ddf171c26f0ce346290d5358cb3d1a38cec0f8e2b6e8d00"
-  output_digest: "sha256:f45b937412136b0e07ca680f9d4a3e9c2c1d50b1b1d50c443a1876920f9fbda2"
+  input_digest: "sha256:e1265a9c8ae3e836cb424c1fe9643e8b7b5c179120acb90e1ceed1c68da981b3"
+  output_digest: "sha256:4df46e053c6facae0ff05ec6d3aa41bf825101652bccde246f5943e891675355"
   files:
     - path: ".gds/compiled-policy.json"
       digest: "sha256:9f498788bdc34e52a0ab793c536e0e6a7b360c2e1a20446cbf03ed51986cdc6f"
     - path: ".github/workflows/gds-ci.yml"
-      digest: "sha256:1ed96da28022277030c59cd799b647f267e437ca717406bdf2891b88bceeba82"
+      digest: "sha256:a6c62e15759f55b957731b4a1ba8ad1bd401f1d9717c71f02dd6932c96e4b25b"

.gds/repository.yaml

@@ -81,7 +81,7 @@ ci:
   build_command: "go build -trimpath ./core/cmd/gds"
   test_command: "go test ./..."
   timeout_minutes: 30
-  workflow_ref: "NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@37a827f921f62353664fc4bcd872f05b65efe71a"
+  workflow_ref: "NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@a7b90bdf1ac12465cbd07072e3360442cfc8eec6"
   # A public repository, so GitHub-hosted runners are unmetered and a fork's
   # pull request cannot reach anything of ours. Self-hosted hardware here would
   # turn a fork PR into remote code execution on it.

.github/workflows/ci-feedback-events.yml

@@ -19,7 +19,7 @@ jobs:
     permissions:
       actions: read # Read exact completed run and job metadata.
       issues: write # Publish bounded failure evidence in this repository.
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/ci-feedback.yml@37a827f921f62353664fc4bcd872f05b65efe71a # commit:37a827f921f62353664fc4bcd872f05b65efe71a
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/ci-feedback.yml@a7b90bdf1ac12465cbd07072e3360442cfc8eec6 # commit:a7b90bdf1ac12465cbd07072e3360442cfc8eec6
     with:
       run-id: ${{ format('{0}', github.event.workflow_run.id) }}
       run-attempt: ${{ format('{0}', github.event.workflow_run.run_attempt) }}

.github/workflows/codeql.yml

@@ -31,7 +31,7 @@ jobs:
       actions: read
       contents: read
       security-events: write
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml@37a827f921f62353664fc4bcd872f05b65efe71a # 0.1.24
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml@a7b90bdf1ac12465cbd07072e3360442cfc8eec6 # 0.1.26
     with:
       # Public repository: `pull_request` runs untrusted fork code. Name the
       # hosted runner explicitly — the reusable's default belongs to the pinned

.github/workflows/gds-ci.yml

@@ -1,9 +1,9 @@
 # GENERATED FILE - DO NOT EDIT DIRECTLY
 # generator: gds
 # bundle: 0.9.7-dev
-# source-tree-digest: sha256:fe02c4580c0096f44bee9a34ddfba300a60e63825a4e95f31ccc5bb15dc71874
-# input-digest: sha256:7b89757f969d6a784ddf171c26f0ce346290d5358cb3d1a38cec0f8e2b6e8d00
-# output-digest: sha256:34152d66b8aec3c2352b91347df0196dc94749ccb4cf4c5357ccef1373217d71
+# source-tree-digest: sha256:4ef1a44ed62126887d79d92366bfa5717e667f6dc120653f404cf67af1951a66
+# input-digest: sha256:e1265a9c8ae3e836cb424c1fe9643e8b7b5c179120acb90e1ceed1c68da981b3
+# output-digest: sha256:4ef1ee2fcc42927eaedef9c85f7b421f87e5cc75ff7055ef520216a00f7d4b74
 # edit-source:
 #   - .gds/repository.yaml
 #   - policies/base/repository-default.yaml
@@ -34,7 +34,7 @@ jobs:
     name: GDS fast
     permissions:
       contents: read
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@37a827f921f62353664fc4bcd872f05b65efe71a
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@a7b90bdf1ac12465cbd07072e3360442cfc8eec6
     with:
       fetch_depth: 0
       # Public hosted CI uses GitHub's service cache; the pinned reusable
@@ -54,7 +54,7 @@ jobs:
     needs: fast
     permissions:
       contents: read
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@37a827f921f62353664fc4bcd872f05b65efe71a
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@a7b90bdf1ac12465cbd07072e3360442cfc8eec6
     with:
       fetch_depth: 0
       cache: true

CHANGELOG.md

@@ -5,6 +5,12 @@ Versioning.
 
 ## [Unreleased]
 
+- Converge the ci-workflows reusable callers on the signed 0.1.26 tag
+  (`a7b90bd`); the `gds-ci` projection pin moves through its canonical
+  `ci.workflow_ref` input.
+- Raise `agent-runtime` to v0.1.7 and `modernc.org/sqlite` to v1.59.0.
+- Recompile the hash-locked Python test requirements: rpds-py 2026.6.3,
+  packaging 26.3, pygments 2.21.0.
 - Add `gds evidence record` and `gds evidence verify`: repo-scoped session
   evidence for the repository the agent ran in, including every Git module
   inside its boundary. `record` binds the `.gds/repository.yaml` identity,

go.mod

@@ -3,12 +3,12 @@ module github.com/NDDev-OpenNetwork/github-device-sync
 go 1.27.1
 
 require (
-	github.com/NDDev-OpenNetwork/agent-runtime v0.1.2
+	github.com/NDDev-OpenNetwork/agent-runtime v0.1.7
 	github.com/dlclark/regexp2 v1.12.0
 	github.com/santhosh-tekuri/jsonschema/v6 v6.0.3
 	github.com/spf13/cobra v1.10.2
 	go.yaml.in/yaml/v4 v4.0.0-rc.6
-	modernc.org/sqlite v1.58.0
+	modernc.org/sqlite v1.59.0
 )
 
 require (

go.sum

@@ -1,5 +1,5 @@
-github.com/NDDev-OpenNetwork/agent-runtime v0.1.2 h1:BjZbWFyulBamcxkKGZycQKWrkEnKTzAx49j0Xrlw56M=
-github.com/NDDev-OpenNetwork/agent-runtime v0.1.2/go.mod h1:W8AOg6wT5coWm+VyUxmLhJw4xpOaJDPEQ7QK7SiClHk=
+github.com/NDDev-OpenNetwork/agent-runtime v0.1.7 h1:MayC0xT0adNMrpE5L8BZgQ4RtMfIfpT447Lb38ehzqM=
+github.com/NDDev-OpenNetwork/agent-runtime v0.1.7/go.mod h1:3uAlDqXz9SlMlBV8seJZvBsEu7OWW4ATXdr9fJuPyUQ=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/dlclark/regexp2 v1.12.0 h1:0j4c5qQmnC6XOWNjP3PIXURXN2gWx76rd3KvgdPkCz8=
 github.com/dlclark/regexp2 v1.12.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
@@ -63,8 +63,8 @@ modernc.org/opt v0.2.0 h1:tGyef5ApycA7FSEOMraay9SaTk5zmbx7Tu+cJs4QKZg=
 modernc.org/opt v0.2.0/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
 modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
 modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
-modernc.org/sqlite v1.58.0 h1:38u40/bwkfM7f0Myhosl+SEMltSDxnGdQf8o6Kjmys0=
-modernc.org/sqlite v1.58.0/go.mod h1:rsD2CckafgObKC4DhBlGBf+RiHxkc3hINGt1Xw32tVY=
+modernc.org/sqlite v1.59.0 h1:X1es1GpqBlS/5T+vbM4HLUdaa8OtQx468DF2vrx+38A=
+modernc.org/sqlite v1.59.0/go.mod h1:+paeT2A3iPRHkQDwG7oA6Tk0zQd5woMEI8q7orfry8k=
 modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
 modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
 modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=