From 8f30b865e2a5b00d52677dbd41cd01824c5e45be Mon Sep 17 00:00:00 2001 From: rldyourmnd Date: Mon, 21 Sep 2026 03:19:03 +0500 Subject: [PATCH] chore(ci): converge ci-workflows pins on 0.1.23 Previous pins in this repository: ci.yml 1ab6708b,9231ee74; image.yml 9231ee74; security.yml 1ab6708b,9231ee74. A fleet audit found eight distinct ci-workflows pins in use across the estate, from 0.1.11 (88 commits behind main) to 0.1.21. 0.1.23 is the first tag carrying the vendored tool-cache action and the retired GARM label vocabulary, so it is the single current target. Input contracts were diffed across every reusable this repository calls for the whole 0.1.16..0.1.23 range: no input was removed and none became required, so this is a pin move with no caller change. Signed-off-by: rldyourmnd Co-Authored-By: Claude Opus 5 --- .github/workflows/ci.yml | 8 ++++---- .github/workflows/image.yml | 2 +- .github/workflows/security.yml | 12 ++++++------ 3 files changed, 11 insertions(+), 11 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 27e7bdd..26a3211 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -40,7 +40,7 @@ jobs: name: rust permissions: contents: read - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/rust-ci.yml@9231ee7421354867b0fe0e019c4e20dcce5d05e7 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/rust-ci.yml@96215b32fbc751716b5c0b758a7a7ca202246574 # 0.1.23 with: # Two, not three. Windows is absent because nothing here is built for it: # the deliverable is a Linux container, and macOS is kept because it is @@ -65,7 +65,7 @@ jobs: name: supply-chain permissions: contents: read - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/rust-supply-chain.yml@1ab6708b62ec7bd17f2d8a519c6fcc39edb22243 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/rust-supply-chain.yml@96215b32fbc751716b5c0b758a7a7ca202246574 # 0.1.23 with: enable_audit: true # cargo-deny and cargo-machete are off deliberately, not by omission. @@ -81,7 +81,7 @@ jobs: name: actionlint permissions: contents: read - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/actionlint.yml@1ab6708b62ec7bd17f2d8a519c6fcc39edb22243 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/actionlint.yml@96215b32fbc751716b5c0b758a7a7ca202246574 # 0.1.23 pr-hygiene: name: pr-hygiene @@ -90,7 +90,7 @@ jobs: contents: read issues: write # the stale bot closes threads pull-requests: write # the labeler applies labels - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/pr-hygiene.yml@1ab6708b62ec7bd17f2d8a519c6fcc39edb22243 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/pr-hygiene.yml@96215b32fbc751716b5c0b758a7a7ca202246574 # 0.1.23 with: # The stock configuration rejects any body line over 100 characters, and # Dependabot writes a 144-character compare link into every git-ref bump. diff --git a/.github/workflows/image.yml b/.github/workflows/image.yml index 8472de7..f23a580 100644 --- a/.github/workflows/image.yml +++ b/.github/workflows/image.yml @@ -70,7 +70,7 @@ jobs: permissions: contents: read packages: write # ghcr.io push and the registry layer cache - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/docker-build.yml@9231ee7421354867b0fe0e019c4e20dcce5d05e7 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/docker-build.yml@96215b32fbc751716b5c0b758a7a7ca202246574 # 0.1.23 with: image: ghcr.io/nddev-opennetwork/nremote-server tags: ${{ needs.plan.outputs.tags }} diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 4ecef74..6daeb54 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -26,7 +26,7 @@ jobs: actions: read # CodeQL reads the workflow definitions it analyses contents: read security-events: write # CodeQL publishes its findings to code scanning - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml@1ab6708b62ec7bd17f2d8a519c6fcc39edb22243 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml@96215b32fbc751716b5c0b758a7a7ca202246574 # 0.1.23 with: languages: '["rust", "actions"]' queries: security-and-quality @@ -40,7 +40,7 @@ jobs: permissions: contents: read pull-requests: write # writes the review it produces - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-dependency-review.yml@1ab6708b62ec7bd17f2d8a519c6fcc39edb22243 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-dependency-review.yml@96215b32fbc751716b5c0b758a7a7ca202246574 # 0.1.23 with: fail_on_severity: moderate @@ -52,13 +52,13 @@ jobs: contents: read id-token: write # mints the OIDC token its publication is signed with security-events: write # Scorecard publishes its findings to code scanning - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-scorecard.yml@9231ee7421354867b0fe0e019c4e20dcce5d05e7 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-scorecard.yml@96215b32fbc751716b5c0b758a7a7ca202246574 # 0.1.23 osv: name: osv permissions: contents: read - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/osv-scan.yml@1ab6708b62ec7bd17f2d8a519c6fcc39edb22243 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/osv-scan.yml@96215b32fbc751716b5c0b758a7a7ca202246574 # 0.1.23 zizmor: name: zizmor @@ -66,10 +66,10 @@ jobs: actions: read # the SARIF upload reads this run to attach its results contents: read security-events: write # zizmor publishes its findings to code scanning - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/zizmor-sarif.yml@9231ee7421354867b0fe0e019c4e20dcce5d05e7 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/zizmor-sarif.yml@96215b32fbc751716b5c0b758a7a7ca202246574 # 0.1.23 secret-scan: name: secret-scan permissions: contents: read - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/secret-scan.yml@9231ee7421354867b0fe0e019c4e20dcce5d05e7 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/secret-scan.yml@96215b32fbc751716b5c0b758a7a7ca202246574 # 0.1.23