ci(deps): bump the github-actions group across 1 directory with 8 updates

[dependabot]

Bumps the github-actions group with 8 updates in the / directory:

Package	From	To
NDDev-OpenNetwork/ci-workflows/.github/workflows/actionlint.yml	0.1.10	0.1.17
NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml	0.1.10	0.1.17
NDDev-OpenNetwork/ci-workflows/.github/workflows/cross-platform-smoke.yml	0.1.10	0.1.17
NDDev-OpenNetwork/ci-workflows/.github/workflows/public-dependency-review.yml	0.1.10	0.1.17
step-security/harden-runner	2.20.0	2.21.1
actions/attest	4.2.0	4.2.2
NDDev-OpenNetwork/ci-workflows/.github/workflows/public-scorecard-json.yml	0.1.10	0.1.17
NDDev-OpenNetwork/ci-workflows/.github/workflows/secret-scan.yml	0.1.10	0.1.17

Updates NDDev-OpenNetwork/ci-workflows/.github/workflows/actionlint.yml from 0.1.10 to 0.1.17

Release notes

Sourced from NDDev-OpenNetwork/ci-workflows/.github/workflows/actionlint.yml's releases.

0.1.17

• Re-verify GitLab Free and Open Source allowances against current primary sources, with separate review deadlines and explicit eligibility conditions.

• Preserve complete redacted private security evidence in a bounded, checksummed run-log ZIP when artifact upload fails. Scanner enforcement and failed fallback remain blocking; no new token permission or external storage is required.

• Add optional check_name to the private-free security bundle so callers can retain an existing required check identity when migrating away from SARIF publication, with all four scanners and evidence artifacts preserved.

• Synchronize pins by catalog action family, preserving independent subpath actions and reusable workflows in the same repository. Apply the reviewed dependency updates from #92 with matching catalog and transitive-image records; historical evidence digests are no longer rewritten by an unrelated action update.

• Stop treating the publisher as an Enterprise Cloud buyer of Code Security, Secret Protection and Code Quality. Paid programmes stay explicitly selectable; public CodeQL, SARIF, Scorecard and attestations stay. Private repositories without those purchases use the private-free programme. A live GitHub plan belongs to one organization and is not copied between accounts. Consumer adoption resolves the programme from the immutable release being pinned, not from main. Private attestations stay an Enterprise Cloud plan gate, independent of the three add-ons.

• Dependabot catalog convergence commits only catalog and generated docs, so the default GITHUB_TOKEN can push without workflows permission. Catalog-only follows the unique workflow pin per action and fails closed when identities are mixed, so the catalog cannot describe a pin the tree does not share. Ordinary merge in this repository does not require a general CI status check; ci-gate stays truthful advisory evidence. Authored skill metadata: mappings stay mappings.

• Re-verify four vendor allowance records with staggered review dates, correct Ubicloud's monthly credit and Harness's conditional CI credit semantics, and align the disclosed Checkov image tag with the existing pinned action.

• Publish unsuccessful completed self-workflow attempts as unassigned, repository-local CI evidence; preserve actual conclusions and exact attempts.

• Accept exact matching development-commit comments and correct nested action pin validation and container whitespace rejection. Keep registrations scoped to their actual action paths.

• Declare both git-submodule and reusable-workflow consumption in the GDS module contract. Refresh its projection using the existing stable bundle.

• Place the Docker publisher permission explanation inline so the pinned pedantic audit recognizes it; workflow permissions and behavior are unchanged.

0.1.16

• security-bundle authenticates its exact called-workflow source fetch with

... (truncated)

Changelog

Sourced from NDDev-OpenNetwork/ci-workflows/.github/workflows/actionlint.yml's changelog.

Changelog

This file is a release ledger: every heading below is a real release, and scripts/check_release_ledger.py enforces that in both directions.

The project follows Semantic Versioning.

[Unreleased]

[0.1.26] - 2026-09-21

• dependabot-catalog-convergence repaired. The job now builds the trusted tool environment and launches sync_action_catalog.py through the execution-contract launcher. The bare python3 -I invocation could not resolve the ci_workflows_tools verified-file-spec package, so every convergence run since the sibling-import migration failed with ModuleNotFoundError. The workflow is registered in the catalog used_by for setup-python and setup-uv like every other consumer.
• Catalog review record. setup-rust-toolchain v2.0.0 review outcome is now persisted in catalog/tools.yml: the major bump stays held because the implicit RUSTFLAGS=-D warnings default becomes build.warnings (cargo

  = 1.97), which would silently weaken the gate for callers on older toolchains. The Dependabot PR remains the tracking surface.

[0.1.25] - 2026-09-21

• Refuse ./action refs inside workflow_call workflows. ./ in a called workflow resolves against the caller's workspace, never this repository's, so uses: ./actions/x in a reusable fails at job setup for every cross-repository consumer. check_pinned_actions.py now rejects the pattern; the affected workflows were repaired in 0.1.24.
• Scheduled tool refresh, 2026-09-21. Bumped twelve action pins and three CLI pins to their current upstream releases: codeql-action v4.38.1, setup-android v4.0.4, setup-r v2.14.0, codecov-action v7.1.1, typos v1.50.2, checkov-action v12.3125.0, github-action-benchmark v1.22.2, setup-uv v10.1.0, setup-java v6.0.1, setup-buildx-action v4.4.1, build-push-action v7.4.0, install-action v2.87.17; osv-scanner 2.6.0, semgrep 1.177.0 and syft 1.52.0 with re-verified release checksums. setup-rust-toolchain stays on v1.17.0 (upstream v2.0.0 is a major bump pending input-contract review) and zizmor stays on 1.26.1 (upstream v1.30.1 reports 65 new low findings on this tree, held for dedicated triage). Every catalog last_verified restamped to the audit date.

[0.1.24] - 2026-09-20

• Fix a reusable workflow that could not reach its own vendored actions. ./actions/... in a called workflow resolves against the caller's workspace, never this repository. Five uses: were written that way while vendoring, and each one fails at job setup for every cross-repository caller:

... (truncated)

Commits

• b4421b8 Merge pull request #108 from NDDev-OpenNetwork/chore/release-0.1.17
• 3fcc7af chore(release): 0.1.17
• 0ad473d Merge pull request #106 from NDDev-OpenNetwork/chore/pin-reusable-workflows-2...
• f50edc7 chore(ci): sync catalog pin for github-actions ci-feedback
• 01fb74b chore(ci): pin reusable workflows to current module mains
• 9eb9e07 Merge pull request #104 from NDDev-OpenNetwork/chore/no-unattributed-extra-ap...
• e0dc39b fix(ruleset): disable extra approval for unattributed agent commits
• a624689 Merge pull request #100 from NDDev-OpenNetwork/fix/security-evidence-log-fall...
• 8419bdf fix: retain security evidence when artifact delivery fails
• 3e70397 Merge pull request #99 from NDDev-OpenNetwork/fix/pin-the-fuzzing-base-image
• Additional commits viewable in compare view

Updates NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml from 0.1.10 to 0.1.17

Release notes

Sourced from NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml's releases.

0.1.17

• Re-verify GitLab Free and Open Source allowances against current primary sources, with separate review deadlines and explicit eligibility conditions.

• Preserve complete redacted private security evidence in a bounded, checksummed run-log ZIP when artifact upload fails. Scanner enforcement and failed fallback remain blocking; no new token permission or external storage is required.

• Add optional check_name to the private-free security bundle so callers can retain an existing required check identity when migrating away from SARIF publication, with all four scanners and evidence artifacts preserved.

• Synchronize pins by catalog action family, preserving independent subpath actions and reusable workflows in the same repository. Apply the reviewed dependency updates from #92 with matching catalog and transitive-image records; historical evidence digests are no longer rewritten by an unrelated action update.

• Stop treating the publisher as an Enterprise Cloud buyer of Code Security, Secret Protection and Code Quality. Paid programmes stay explicitly selectable; public CodeQL, SARIF, Scorecard and attestations stay. Private repositories without those purchases use the private-free programme. A live GitHub plan belongs to one organization and is not copied between accounts. Consumer adoption resolves the programme from the immutable release being pinned, not from main. Private attestations stay an Enterprise Cloud plan gate, independent of the three add-ons.

• Dependabot catalog convergence commits only catalog and generated docs, so the default GITHUB_TOKEN can push without workflows permission. Catalog-only follows the unique workflow pin per action and fails closed when identities are mixed, so the catalog cannot describe a pin the tree does not share. Ordinary merge in this repository does not require a general CI status check; ci-gate stays truthful advisory evidence. Authored skill metadata: mappings stay mappings.

• Re-verify four vendor allowance records with staggered review dates, correct Ubicloud's monthly credit and Harness's conditional CI credit semantics, and align the disclosed Checkov image tag with the existing pinned action.

• Publish unsuccessful completed self-workflow attempts as unassigned, repository-local CI evidence; preserve actual conclusions and exact attempts.

• Accept exact matching development-commit comments and correct nested action pin validation and container whitespace rejection. Keep registrations scoped to their actual action paths.

• Declare both git-submodule and reusable-workflow consumption in the GDS module contract. Refresh its projection using the existing stable bundle.

• Place the Docker publisher permission explanation inline so the pinned pedantic audit recognizes it; workflow permissions and behavior are unchanged.

0.1.16

• security-bundle authenticates its exact called-workflow source fetch with

... (truncated)

Changelog

Sourced from NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml's changelog.

Changelog

This file is a release ledger: every heading below is a real release, and scripts/check_release_ledger.py enforces that in both directions.

The project follows Semantic Versioning.

[Unreleased]

[0.1.26] - 2026-09-21

• dependabot-catalog-convergence repaired. The job now builds the trusted tool environment and launches sync_action_catalog.py through the execution-contract launcher. The bare python3 -I invocation could not resolve the ci_workflows_tools verified-file-spec package, so every convergence run since the sibling-import migration failed with ModuleNotFoundError. The workflow is registered in the catalog used_by for setup-python and setup-uv like every other consumer.
• Catalog review record. setup-rust-toolchain v2.0.0 review outcome is now persisted in catalog/tools.yml: the major bump stays held because the implicit RUSTFLAGS=-D warnings default becomes build.warnings (cargo

  = 1.97), which would silently weaken the gate for callers on older toolchains. The Dependabot PR remains the tracking surface.

[0.1.25] - 2026-09-21

• Refuse ./action refs inside workflow_call workflows. ./ in a called workflow resolves against the caller's workspace, never this repository's, so uses: ./actions/x in a reusable fails at job setup for every cross-repository consumer. check_pinned_actions.py now rejects the pattern; the affected workflows were repaired in 0.1.24.
• Scheduled tool refresh, 2026-09-21. Bumped twelve action pins and three CLI pins to their current upstream releases: codeql-action v4.38.1, setup-android v4.0.4, setup-r v2.14.0, codecov-action v7.1.1, typos v1.50.2, checkov-action v12.3125.0, github-action-benchmark v1.22.2, setup-uv v10.1.0, setup-java v6.0.1, setup-buildx-action v4.4.1, build-push-action v7.4.0, install-action v2.87.17; osv-scanner 2.6.0, semgrep 1.177.0 and syft 1.52.0 with re-verified release checksums. setup-rust-toolchain stays on v1.17.0 (upstream v2.0.0 is a major bump pending input-contract review) and zizmor stays on 1.26.1 (upstream v1.30.1 reports 65 new low findings on this tree, held for dedicated triage). Every catalog last_verified restamped to the audit date.

[0.1.24] - 2026-09-20

• Fix a reusable workflow that could not reach its own vendored actions. ./actions/... in a called workflow resolves against the caller's workspace, never this repository. Five uses: were written that way while vendoring, and each one fails at job setup for every cross-repository caller:

... (truncated)

Commits

• b4421b8 Merge pull request #108 from NDDev-OpenNetwork/chore/release-0.1.17
• 3fcc7af chore(release): 0.1.17
• 0ad473d Merge pull request #106 from NDDev-OpenNetwork/chore/pin-reusable-workflows-2...
• f50edc7 chore(ci): sync catalog pin for github-actions ci-feedback
• 01fb74b chore(ci): pin reusable workflows to current module mains
• 9eb9e07 Merge pull request #104 from NDDev-OpenNetwork/chore/no-unattributed-extra-ap...
• e0dc39b fix(ruleset): disable extra approval for unattributed agent commits
• a624689 Merge pull request #100 from NDDev-OpenNetwork/fix/security-evidence-log-fall...
• 8419bdf fix: retain security evidence when artifact delivery fails
• 3e70397 Merge pull request #99 from NDDev-OpenNetwork/fix/pin-the-fuzzing-base-image
• Additional commits viewable in compare view

Updates NDDev-OpenNetwork/ci-workflows/.github/workflows/cross-platform-smoke.yml from 0.1.10 to 0.1.17

Release notes

Sourced from NDDev-OpenNetwork/ci-workflows/.github/workflows/cross-platform-smoke.yml's releases.

0.1.17

• Re-verify GitLab Free and Open Source allowances against current primary sources, with separate review deadlines and explicit eligibility conditions.

• Preserve complete redacted private security evidence in a bounded, checksummed run-log ZIP when artifact upload fails. Scanner enforcement and failed fallback remain blocking; no new token permission or external storage is required.

• Add optional check_name to the private-free security bundle so callers can retain an existing required check identity when migrating away from SARIF publication, with all four scanners and evidence artifacts preserved.

• Synchronize pins by catalog action family, preserving independent subpath actions and reusable workflows in the same repository. Apply the reviewed dependency updates from #92 with matching catalog and transitive-image records; historical evidence digests are no longer rewritten by an unrelated action update.

• Stop treating the publisher as an Enterprise Cloud buyer of Code Security, Secret Protection and Code Quality. Paid programmes stay explicitly selectable; public CodeQL, SARIF, Scorecard and attestations stay. Private repositories without those purchases use the private-free programme. A live GitHub plan belongs to one organization and is not copied between accounts. Consumer adoption resolves the programme from the immutable release being pinned, not from main. Private attestations stay an Enterprise Cloud plan gate, independent of the three add-ons.

• Dependabot catalog convergence commits only catalog and generated docs, so the default GITHUB_TOKEN can push without workflows permission. Catalog-only follows the unique workflow pin per action and fails closed when identities are mixed, so the catalog cannot describe a pin the tree does not share. Ordinary merge in this repository does not require a general CI status check; ci-gate stays truthful advisory evidence. Authored skill metadata: mappings stay mappings.

• Re-verify four vendor allowance records with staggered review dates, correct Ubicloud's monthly credit and Harness's conditional CI credit semantics, and align the disclosed Checkov image tag with the existing pinned action.

• Publish unsuccessful completed self-workflow attempts as unassigned, repository-local CI evidence; preserve actual conclusions and exact attempts.

• Accept exact matching development-commit comments and correct nested action pin validation and container whitespace rejection. Keep registrations scoped to their actual action paths.

• Declare both git-submodule and reusable-workflow consumption in the GDS module contract. Refresh its projection using the existing stable bundle.

• Place the Docker publisher permission explanation inline so the pinned pedantic audit recognizes it; workflow permissions and behavior are unchanged.

0.1.16

• security-bundle authenticates its exact called-workflow source fetch with

... (truncated)

Changelog

Sourced from NDDev-OpenNetwork/ci-workflows/.github/workflows/cross-platform-smoke.yml's changelog.

Changelog

This file is a release ledger: every heading below is a real release, and scripts/check_release_ledger.py enforces that in both directions.

The project follows Semantic Versioning.

[Unreleased]

[0.1.26] - 2026-09-21

• dependabot-catalog-convergence repaired. The job now builds the trusted tool environment and launches sync_action_catalog.py through the execution-contract launcher. The bare python3 -I invocation could not resolve the ci_workflows_tools verified-file-spec package, so every convergence run since the sibling-import migration failed with ModuleNotFoundError. The workflow is registered in the catalog used_by for setup-python and setup-uv like every other consumer.
• Catalog review record. setup-rust-toolchain v2.0.0 review outcome is now persisted in catalog/tools.yml: the major bump stays held because the implicit RUSTFLAGS=-D warnings default becomes build.warnings (cargo

  = 1.97), which would silently weaken the gate for callers on older toolchains. The Dependabot PR remains the tracking surface.

[0.1.25] - 2026-09-21

• Refuse ./action refs inside workflow_call workflows. ./ in a called workflow resolves against the caller's workspace, never this repository's, so uses: ./actions/x in a reusable fails at job setup for every cross-repository consumer. check_pinned_actions.py now rejects the pattern; the affected workflows were repaired in 0.1.24.
• Scheduled tool refresh, 2026-09-21. Bumped twelve action pins and three CLI pins to their current upstream releases: codeql-action v4.38.1, setup-android v4.0.4, setup-r v2.14.0, codecov-action v7.1.1, typos v1.50.2, checkov-action v12.3125.0, github-action-benchmark v1.22.2, setup-uv v10.1.0, setup-java v6.0.1, setup-buildx-action v4.4.1, build-push-action v7.4.0, install-action v2.87.17; osv-scanner 2.6.0, semgrep 1.177.0 and syft 1.52.0 with re-verified release checksums. setup-rust-toolchain stays on v1.17.0 (upstream v2.0.0 is a major bump pending input-contract review) and zizmor stays on 1.26.1 (upstream v1.30.1 reports 65 new low findings on this tree, held for dedicated triage). Every catalog last_verified restamped to the audit date.

[0.1.24] - 2026-09-20

• Fix a reusable workflow that could not reach its own vendored actions. ./actions/... in a called workflow resolves against the caller's workspace, never this repository. Five uses: were written that way while vendoring, and each one fails at job setup for every cross-repository caller:

... (truncated)

Commits

• b4421b8 Merge pull request #108 from NDDev-OpenNetwork/chore/release-0.1.17
• 3fcc7af chore(release): 0.1.17
• 0ad473d Merge pull request #106 from NDDev-OpenNetwork/chore/pin-reusable-workflows-2...
• f50edc7 chore(ci): sync catalog pin for github-actions ci-feedback
• 01fb74b chore(ci): pin reusable workflows to current module mains
• 9eb9e07 Merge pull request #104 from NDDev-OpenNetwork/chore/no-unattributed-extra-ap...
• e0dc39b fix(ruleset): disable extra approval for unattributed agent commits
• a624689 Merge pull request #100 from NDDev-OpenNetwork/fix/security-evidence-log-fall...
• 8419bdf fix: retain security evidence when artifact delivery fails
• 3e70397 Merge pull request #99 from NDDev-OpenNetwork/fix/pin-the-fuzzing-base-image
• Additional commits viewable in compare view

Updates NDDev-OpenNetwork/ci-workflows/.github/workflows/public-dependency-review.yml from 0.1.10 to 0.1.17

Release notes

Sourced from NDDev-OpenNetwork/ci-workflows/.github/workflows/public-dependency-review.yml's releases.

0.1.17

• Re-verify GitLab Free and Open Source allowances against current primary sources, with separate review deadlines and explicit eligibility conditions.

• Preserve complete redacted private security evidence in a bounded, checksummed run-log ZIP when artifact upload fails. Scanner enforcement and failed fallback remain blocking; no new token permission or external storage is required.

• Add optional check_name to the private-free security bundle so callers can retain an existing required check identity when migrating away from SARIF publication, with all four scanners and evidence artifacts preserved.

• Synchronize pins by catalog action family, preserving independent subpath actions and reusable workflows in the same repository. Apply the reviewed dependency updates from #92 with matching catalog and transitive-image records; historical evidence digests are no longer rewritten by an unrelated action update.

• Stop treating the publisher as an Enterprise Cloud buyer of Code Security, Secret Protection and Code Quality. Paid programmes stay explicitly selectable; public CodeQL, SARIF, Scorecard and attestations stay. Private repositories without those purchases use the private-free programme. A live GitHub plan belongs to one organization and is not copied between accounts. Consumer adoption resolves the programme from the immutable release being pinned, not from main. Private attestations stay an Enterprise Cloud plan gate, independent of the three add-ons.

• Dependabot catalog convergence commits only catalog and generated docs, so the default GITHUB_TOKEN can push without workflows permission. Catalog-only follows the unique workflow pin per action and fails closed when identities are mixed, so the catalog cannot describe a pin the tree does not share. Ordinary merge in this repository does not require a general CI status check; ci-gate stays truthful advisory evidence. Authored skill metadata: mappings stay mappings.

• Re-verify four vendor allowance records with staggered review dates, correct Ubicloud's monthly credit and Harness's conditional CI credit semantics, and align the disclosed Checkov image tag with the existing pinned action.

• Publish unsuccessful completed self-workflow attempts as unassigned, repository-local CI evidence; preserve actual conclusions and exact attempts.

• Accept exact matching development-commit comments and correct nested action pin validation and container whitespace rejection. Keep registrations scoped to their actual action paths.

• Declare both git-submodule and reusable-workflow consumption in the GDS module contract. Refresh its projection using the existing stable bundle.

• Place the Docker publisher permission explanation inline so the pinned pedantic audit recognizes it; workflow permissions and behavior are unchanged.

0.1.16

• security-bundle authenticates its exact called-workflow source fetch with

... (truncated)

Changelog

Sourced from NDDev-OpenNetwork/ci-workflows/.github/workflows/public-dependency-review.yml's changelog.

Changelog

This file is a release ledger: every heading below is a real release, and scripts/check_release_ledger.py enforces that in both directions.

The project follows Semantic Versioning.

[Unreleased]

[0.1.26] - 2026-09-21

• dependabot-catalog-convergence repaired. The job now builds the trusted tool environment and launches sync_action_catalog.py through the execution-contract launcher. The bare python3 -I invocation could not resolve the ci_workflows_tools verified-file-spec package, so every convergence run since the sibling-import migration failed with ModuleNotFoundError. The workflow is registered in the catalog used_by for setup-python and setup-uv like every other consumer.
• Catalog review record. setup-rust-toolchain v2.0.0 review outcome is now persisted in catalog/tools.yml: the major bump stays held because the implicit RUSTFLAGS=-D warnings default becomes build.warnings (cargo

  = 1.97), which would silently weaken the gate for callers on older toolchains. The Dependabot PR remains the tracking surface.

[0.1.25] - 2026-09-21

• Refuse ./action refs inside workflow_call workflows. ./ in a called workflow resolves against the caller's workspace, never this repository's, so uses: ./actions/x in a reusable fails at job setup for every cross-repository consumer. check_pinned_actions.py now rejects the pattern; the affected workflows were repaired in 0.1.24.
• Scheduled tool refresh, 2026-09-21. Bumped twelve action pins and three CLI pins to their current upstream releases: codeql-action v4.38.1, setup-android v4.0.4, setup-r v2.14.0, codecov-action v7.1.1, typos v1.50.2, checkov-action v12.3125.0, github-action-benchmark v1.22.2, setup-uv v10.1.0, setup-java v6.0.1, setup-buildx-action v4.4.1, build-push-action v7.4.0, install-action v2.87.17; osv-scanner 2.6.0, semgrep 1.177.0 and syft 1.52.0 with re-verified release checksums. setup-rust-toolchain stays on v1.17.0 (upstream v2.0.0 is a major bump pending input-contract review) and zizmor stays on 1.26.1 (upstream v1.30.1 reports 65 new low findings on this tree, held for dedicated triage). Every catalog last_verified restamped to the audit date.

[0.1.24] - 2026-09-20

• Fix a reusable workflow that could not reach its own vendored actions. ./actions/... in a called workflow resolves against the caller's workspace, never this repository. Five uses: were written that way while vendoring, and each one fails at job setup for every cross-repository caller:

... (truncated)

Commits

• b4421b8 Merge pull request #108 from NDDev-OpenNetwork/chore/release-0.1.17
• 3fcc7af chore(release): 0.1.17
• 0ad473d Merge pull request #106 from NDDev-OpenNetwork/chore/pin-reusable-workflows-2...
• f50edc7 chore(ci): sync catalog pin for github-actions ci-feedback
• 01fb74b chore(ci): pin reusable workflows to current module mains
• 9eb9e07 Merge pull request #104 from NDDev-OpenNetwork/chore/no-unattributed-extra-ap...
• e0dc39b fix(ruleset): disable extra approval for unattributed agent commits
• a624689 Merge pull request #100 from NDDev-OpenNetwork/fix/security-evidence-log-fall...
• 8419bdf fix: retain security evidence when artifact delivery fails
• 3e70397 Merge pull request #99 from NDDev-OpenNetwork/fix/pin-the-fuzzing-base-image
• Additional commits viewable in compare view

Updates step-security/harden-runner from 2.20.0 to 2.21.1

Release notes

Sourced from step-security/harden-runner's releases.

v2.21.1

What's Changed

• Improved performance of the disable-sudo feature.
• Fixed an issue in the Community tier where new endpoints required by the GitHub Actions runner were not being implicitly allowed in block mode.
• Fixed the Harden-Runner post step failing on Linux distributions that do not have a merged /usr filesystem layout (for example Debian 11), where /usr/bin/echo does not exist. This mainly affected self-hosted runners.
• Documentation updates: clarified which features are in the Community (free) vs Enterprise tier.

Full Changelog: step-security/harden-runner@v2.21.0...v2.21.1

v2.21.0

What's Changed

• Support for denied endpoints in block mode. This is included in the enterprise tier. Customers can deny outbound calls, for example, to public package registries.
• Improved Support for AWS CodeBuild GitHub Actions Runners.
• Bug fixes.

Full Changelog: step-security/harden-runner@v2.20.1...v2.21.0

v2.20.1

What's Changed

• AWS CodeBuild-hosted runner support
• Implicitly allow single-labeled (internal) domains in block-mode

Full Changelog: step-security/harden-runner@v2.20.0...v2.20.1

Commits

• e14015d Merge pull request #690 from step-security/rc-43
• 9001249 docs: update harden-runner version pin to v2.21.0 in getting started example
• a447fba docs: expand enterprise feature list and document custom VM and ubuntu-slim l...
• b0eaf8d docs: clarify community vs enterprise tiers and add maintained actions section
• 063e8e3 Merge pull request #687 from rohan-stepsecurity/rp/fix/bin-echo-fallback
• f46bdc1 chore: bump agent-ebpf to v1.9.1 and agent to v0.16.3
• 42e6daa fix: fall back to /bin/echo for non-usr-merged distros
• 05e3151 Merge pull request #684 from step-security/rc-42
• 0f37afa fix: ignore denied-endpoints on non-enterprise tier
• 93b58ee fix: resolve cache host read-first and never downgrade egress policy
• Additional commits viewable in compare view

Updates actions/attest from 4.2.0 to 4.2.2

Release notes

Sourced from actions/attest's releases.

v4.2.2

What's Changed

• Bump @​sigstore/oci from 0.7.1 to 0.7.2 by @​bdehamer in actions/attest#469
• Bump brace-expansion by @​dependabot[bot] in actions/attest#468
• Bump ip-address from 10.2.0 to 10.4.0 by @​dependabot[bot] in actions/attest#467

Full Changelog: actions/attest@v4.2.1...v4.2.2

v4.2.1

What's Changed

• Bump tar from 7.5.17 to 7.5.21 by @​dependabot[bot] in actions/attest#459
• fix: strip OCI image tag when pushing attestation to registry by @​bdehamer in actions/attest#464

Full Changelog: actions/attest@v4.2.0...v4.2.1

Commits

• 1e69f48 Bump ip-address from 10.2.0 to 10.4.0 (#467)
• 02787ce Bump brace-expansion (#468)
• 98ac037 bump @​sigstore/oci from 0.7.1 to 0.7.2 (#469)
• 508db95 fix: strip OCI image tag when pushing attestation to registry (#464)
• dda48f2 Bump the npm-development group across 1 directory with 6 updates (#461)
• 7d789a3 Bump the actions-minor group with 3 updates (#463)
• 1f3ca2f Add release-cutter canvas extension (#454)
• d215549 Bump tar from 7.5.17 to 7.5.21 (#459)
• 20c90ed Bump the npm-development group with 2 updates (#455)
• 43c2c81 Bump the actions-minor group with 4 updates (#456)
• Additional commits viewable in compare view

Updates NDDev-OpenNetwork/ci-workflows/.github/workflows/public-scorecard-json.yml from 0.1.10 to 0.1.17

Release notes

Sourced from NDDev-OpenNetwork/ci-workflows/.github/workflows/public-scorecard-json.yml's releases.

0.1.17

• Re-verify GitLab Free and Open Source allowances against current primary sources, with separate review deadlines and explicit eligibility conditions.

• Preserve complete redacted private security evidence in a bounded, checksummed run-log ZIP when artifact upload fails. Scanner enforcement and failed fallback remain blocking; no new token permission or external storage is required.

• Add optional check_name to the private-free security bundle so callers can retain an existing required check identity when migrating away from SARIF publication, with all four scanners and evidence artifacts preserved.

• Synchronize pins by catalog action family, preserving independent subpath actions and reusable workflows in the same repository. Apply the reviewed dependency updates from #92 with matching catalog and transitive-image records; historical evidence digests are no longer rewritten by an unrelated action update.

• Stop treating the publisher as an Enterprise Cloud buyer of Code Security, Secret Protection and Code Quality. Paid programmes stay explicitly selectable; public CodeQL, SARIF, Scorecard and attestations stay. Private repositories without those purchases use the private-free programme. A live GitHub plan belongs to one organization and is not copied between accounts. Consumer adoption resolves the programme from the immutable release being pinned, not from main. Private attestations stay an Enterprise Cloud plan gate, independent of the three add-ons.

• Dependabot catalog convergence commits only catalog and generated docs, so the default GITHUB_TOKEN can push without workflows permission. Catalog-only follows the unique workflow pin per action and fails closed when identities are mixed, so the catalog cannot describe a pin the tree does not share. Ordinary merge in this repository does not require a general CI status check; ci-gate stays truthful advisory evidence. Authored skill metadata: mappings stay mappings.

• Re-verify four vendor allowance records with staggered review dates, correct Ubicloud's monthly credit and Harness's conditional CI credit semantics, and align the disclosed Checkov image tag with the existing pinned action.

• Publish unsuccessful completed self-workflow attempts as unassigned, repository-local CI evidence; preserve actual conclusions and exact attempts.

• Accept exact matching development-commit comments and correct nested action pin validation and container whitespace rejection. Keep registrations scoped to their actual action paths.

• Declare both git-submodule and reusable-workflow consumption in the GDS module contract. Refresh its projection using the existing stable bundle.

• Place the Docker publisher permission explanation inline so the pinned pedantic audit recognizes it; workflow permissions and behavior are unchanged.

0.1.16

• security-bundle authenticates its exact called-workflow source fetch with

... (truncated)

Changelog

Sourced from NDDev-OpenNetwork/ci-workflows/.github/workflows/public-scorecard-json.yml's changelog.

Changelog

This file is a release ledger: every heading below is a real release, and scripts/check_release_ledger.py enforces that in both directions.

The project follows Semantic Versioning.

[Unreleased]

[0.1.26] - 2026-09-21

• dependabot-catalog-convergence repaired. The job now builds the trusted tool environment and launches sync_action_catalog.py through the execution-contract launcher. The bare python3 -I invocation could not resolve the ci_workflows_tools verified-file-spec package, so every convergence run since the sibling-import migration failed with ModuleNotFoundError. The workflow is registered in the catalog used_by for setup-python and setup-uv like every other consumer.
• Catalog review record. setup-rust-toolchain v2.0.0 review outcome is now persisted in catalog/tools.yml: the major bump stays held because the implicit RUSTFLAGS=-D warnings default becomes build.warnings (cargo

  = 1.97), which would silently weaken the gate for callers on older toolchains. The Dependabot PR remains the tracking surface.

[0.1.25] - 2026-09-21

• Refuse ./action refs inside workflow_call workflows. ./ in a called workflow resolves against the caller's workspace, never this repository's, so uses: ./actions/x in a reusable fails at job setup for every cross-repository consumer. check_pinned_actions.py now rejects the pattern; the affected workflows were repaired in 0.1.24.
• Scheduled tool refresh, 2026-09-21. Bumped twelve action pins and three CLI pins to their current upstream releases: codeql-action v4.38.1, setup-android v4.0.4, setup-r v2.14.0, codecov-action v7.1.1, typos v1.50.2, checkov-action v12.3125.0, github-action-benchmark v1.22.2, setup-uv v10.1.0, setup-java v6.0.1, setup-buildx-action v4.4.1, build-push-action v7.4.0, install-action v2.87.17; osv-scanner 2.6.0, semgrep 1.177.0 and syft 1.52.0 with re-verified release checksums. setup-rust-toolchain stays on v1.17.0 (upstream v2.0.0 is a major bump pending input-contract review) and zizmor stays on 1.26.1 (upstream v1.30.1 reports 65 new low findings on this tree, held for dedicated triage). Every catalog last_verified restamped to the audit date.

[0.1.24] - 2026-09-20

• Fix a reusable workflow that could not reach its own vendored actions. ./actions/... in a called workflow resolves against the caller's workspace, never this repository. Five uses: were written that way while vendoring, and each one fails at job setup for every cross-repository caller:

... (truncated)

Commits

• b4421b8 Merge pull request #108 from NDDev-OpenNetwork/chore/release-0.1.17
• 3fcc7af chore(release): 0.1.17
• 0ad473d Merge pull request #106 from NDDev-OpenNetwork/chore/pin-reusable-workflows-2...
• f50edc7 chore(ci): sync catalog pin for github-actions ci-feedback
• 01fb74b chore(ci): pin reusable workflows to current module mains
• 9eb9e07 Merge pull request #104 from NDDev-OpenNetwork/chore/no-unattributed-extra-ap...
• e0dc39b fix(ruleset): disable extra approval for unattributed agent commits
• a624689 Merge pull request #100 from NDDev-OpenNetwork/fix/security-evidence-log-fall...
• 8419bdf fix: retain security evidence when artifact delivery fails
• 3e70397 Merge pull request #99 from NDDev-OpenNetwork/fix/pin-the-fuzzing-base-image
• Additional commits viewable in compare view

Updates NDDev-OpenNetwork/ci-workflows/.github/workflows/secret-scan.yml from 0.1.10 to 0.1.17

Release notes

Sourced from NDDev-OpenNetwork/ci-workflows/.github/workflows/secret-scan.yml's releases.

0.1.17

• Re-verify GitLab Free and Open Source allowances against current primary sources, with separate review deadlines and explicit eligibility conditions.

• Preserve complete redacted private security evidence in a bounded, checksummed run-log ZIP when artifact upload fails. Scanner enforcement and failed fallback remain blocking; no new token permission or external storage is required.

• Add optional check_name to the private-free security bundle so callers can retain an existing required check identity when migrating away from SARIF publication, with all four scanners and evidence artifacts preserved.

• Synchronize pins by catalog action family, preserving independent subpath actions and reusable workflows in the same repository. Apply the reviewed dependency updates from #92 with matching catalog and transitive-image records; historical evidence digests are no longer rewritten by an unrelated action update.

• Stop treating the publisher as an Enterprise Cloud buyer of Code Security, Secret Protection and Code Quality. Paid programmes stay explicitly selectable; public CodeQL, SARIF, Scorecard and attestations stay. Private repositories without those purchases use the private-free programme. A live GitHub plan belongs to one organization and is not copied between accounts. Consumer adoption resolves the programme from the immutable release being pinned, not from main. Private attestations stay an Enterprise Cloud plan gate, independent of the three add-ons.

• Dependabot catalog convergence commits only catalog and generated docs, so the default GITHUB_TOKEN can push without workflows permission. Catalog-only follows the unique workflow pin per action and fails closed when identities are mixed, so the catalog cannot describe a pin the tree does not share. Ordinary merge in this repository does not require a general CI status check; ci-gate stays truthful advisory evidence. Authored skill metadata: mappings stay mappings.

• Re-verify four vendor allowance records with staggered review dates, correct Ubicloud's monthly credit and Harness's conditional CI credit semantics, and align the disclosed Checkov image tag with the existing pinned action.

• Publish unsuccessful completed self-workflow attempts as unassigned, repository-local CI evidence; preserve actual conclusions and exact attempts.

• Accept exact matching development-commit comments and correct nested action pin validation and container whitespace rejection. Keep registrations scoped to their actual action paths.

• Declare both git-submodule and reusable-workflow consumption in the GDS module contract. Refresh its projection using the existing stable bundle.

• Place the Docker publisher permission explanation inline so the pinned pedantic audit recognizes it; workflow permissions and behavior are unchanged.

0.1.16

• security-bundle authenticates its exact called-workflow source fetch with

... (truncated)

Changelog

Sourced from NDDev-OpenNetwork/ci-workflows/.github/workflows/secret-scan.yml's changelog.

Changelog

This file is a release ledger: every heading below is a real release, and scripts/check_release_ledger.py enforces that in both directions.

The project follows Semantic Versioning.

[Unreleased]

[0.1.26] - 2026-09-21

• dependabot-catalog-convergence repaired. The job now builds the trusted tool environment and launches sync_action_catalog.py through the execution-contract launcher. The bare python3 -I invocation could not resolve the ci_workflows_tools verified-file-spec package, so every convergence run since the sibling-import migration failed with ModuleNotFoundError. The workflow is registered in the catalog used_by for setup-python and setup-uv like every other consumer.
• Catalog review record. setup-rust-toolchain v2.0.0 review outcome is now persisted in catalog/tools.yml: the major bump stays held because the implicit RUSTFLAGS=-D warnings default becomes build.warnings (cargo

  = 1.97), which would silently weaken the gate for callers on older toolchains. The Dependabot PR remains the tracking surface.

[0.1.25] - 2026-09-21

• Refuse ./action refs inside workflow_call workflows. ./ in a called workflow resolves against the caller's workspace, never this repository's, so uses: ./actions/x in a reusable fails at job setup for every cross-repository consumer. check_pinned_actions.py now rejects the pattern; the affected workflows were repaired in 0.1.24.
• Scheduled tool refresh, 2026-09-21. Bumped twelve action pins and three CLI pins to their current upstream releases: codeql-action v4.38.1, setup-android v4.0.4, setup-r v2.14.0, codecov-action v7.1.1, typos v1.50.2, checkov-action v12.3125.0, github-action-benchmark v1.22.2, setup-uv v10.1.0, setup-java v6.0.1, setup-buildx-action v4.4.1, build-push-action v7.4.0, install-action v2....

  Description has been truncated

[dependabot]

Labels

The following labels could not be found: ci, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.