From d8fb81beea0bdf0aa1032d92d89e25f1d6314238 Mon Sep 17 00:00:00 2001 From: rldyourmnd Date: Mon, 21 Sep 2026 03:41:42 +0500 Subject: [PATCH] chore(ci): converge ci-workflows pins on 0.1.24 Previous pins in this repository: ci.yml 1ab6708b,9231ee74; security.yml 1ab6708b,9231ee74. A fleet audit found eight distinct ci-workflows pins in use across the estate, from 0.1.11 (88 commits behind main) to 0.1.21. 0.1.24 is the convergence target rather than 0.1.23 because 0.1.23 could not be one. Vendoring left five `uses:` pointing at `./actions/...`, which in a called workflow resolves against the caller's workspace instead of ci-workflows, so every cross-repository caller failed at job setup. ci-feedback.yml had carried that defect since 0.1.21 and only surfaced on 2026-09-20 because its job fires solely on a failed conclusion. 0.1.24 names and pins the repository for all five. Input contracts were diffed across every reusable this repository calls for the whole 0.1.16..0.1.24 range: no input was removed and none became required, so this is a pin move with no caller change. Signed-off-by: rldyourmnd Co-Authored-By: Claude Opus 5 --- .github/workflows/ci.yml | 6 +++--- .github/workflows/security.yml | 10 +++++----- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 605cbb229..fa2b7806d 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -97,7 +97,7 @@ jobs: name: shared-library permissions: contents: read - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/rust-ci.yml@1ab6708b62ec7bd17f2d8a519c6fcc39edb22243 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/rust-ci.yml@37a827f921f62353664fc4bcd872f05b65efe71a # 0.1.24 with: working_directory: libs/hbb_common test_matrix_os: '["ubuntu-latest", "macos-latest"]' @@ -110,7 +110,7 @@ jobs: name: actionlint permissions: contents: read - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/actionlint.yml@9231ee7421354867b0fe0e019c4e20dcce5d05e7 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/actionlint.yml@37a827f921f62353664fc4bcd872f05b65efe71a # 0.1.24 pr-hygiene: name: pr-hygiene @@ -119,7 +119,7 @@ jobs: contents: read issues: write # the stale bot closes threads pull-requests: write # the labeler applies labels - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/pr-hygiene.yml@1ab6708b62ec7bd17f2d8a519c6fcc39edb22243 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/pr-hygiene.yml@37a827f921f62353664fc4bcd872f05b65efe71a # 0.1.24 with: # The stock configuration rejects any body line over 100 characters, and # Dependabot writes a 144-character compare link into every git-ref bump. diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 7c512699a..46ee5ea8e 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -24,7 +24,7 @@ jobs: actions: read # CodeQL reads the workflow definitions it analyses contents: read security-events: write # CodeQL publishes its findings to code scanning - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml@9231ee7421354867b0fe0e019c4e20dcce5d05e7 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml@37a827f921f62353664fc4bcd872f05b65efe71a # 0.1.24 with: # Actions only, and both absences are stated rather than implied. # @@ -46,7 +46,7 @@ jobs: permissions: contents: read pull-requests: write # writes the review it produces - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-dependency-review.yml@9231ee7421354867b0fe0e019c4e20dcce5d05e7 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-dependency-review.yml@37a827f921f62353664fc4bcd872f05b65efe71a # 0.1.24 with: fail_on_severity: moderate @@ -58,7 +58,7 @@ jobs: contents: read id-token: write # mints the OIDC token its publication is signed with security-events: write # Scorecard publishes its findings to code scanning - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-scorecard.yml@9231ee7421354867b0fe0e019c4e20dcce5d05e7 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-scorecard.yml@37a827f921f62353664fc4bcd872f05b65efe71a # 0.1.24 # There is no `osv` job, and the absence is the honest answer rather than an # oversight. @@ -85,10 +85,10 @@ jobs: actions: read # the SARIF upload reads this run to attach its results contents: read security-events: write # zizmor publishes its findings to code scanning - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/zizmor-sarif.yml@9231ee7421354867b0fe0e019c4e20dcce5d05e7 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/zizmor-sarif.yml@37a827f921f62353664fc4bcd872f05b65efe71a # 0.1.24 secret-scan: name: secret-scan permissions: contents: read - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/secret-scan.yml@1ab6708b62ec7bd17f2d8a519c6fcc39edb22243 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/secret-scan.yml@37a827f921f62353664fc4bcd872f05b65efe71a # 0.1.24