ci(deps): bump the github-actions group across 1 directory with 8 updates

.github/workflows/actionlint.yml

@@ -24,7 +24,7 @@ jobs:
     name: actionlint
     permissions:
       contents: read
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/actionlint.yml@66fc19d6ee02c703bc219aa4f31d5f98a3def54b # 0.1.10
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/actionlint.yml@b4421b8660a7b6462095a9f492ea012b2a609abe # 0.1.17
     with:
       # Public repo: pull_request runs untrusted fork code. Pin the hosted runner
       # explicitly — several ci-workflows reusables now default `runner` to the

.github/workflows/codeql.yml

@@ -40,7 +40,7 @@ jobs:
       matrix:
         os: [ubuntu-latest]
         language: ["javascript-typescript", "python"]
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml@66fc19d6ee02c703bc219aa4f31d5f98a3def54b # 0.1.10
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml@b4421b8660a7b6462095a9f492ea012b2a609abe # 0.1.17
     with:
       runner: ${{ matrix.os }}
       languages: '["${{ matrix.language }}"]'

.github/workflows/cross-platform.yml

@@ -30,7 +30,7 @@ jobs:
       fail-fast: false
       matrix:
         os: [ubuntu-latest, windows-latest, macos-latest]
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/cross-platform-smoke.yml@66fc19d6ee02c703bc219aa4f31d5f98a3def54b # 0.1.10
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/cross-platform-smoke.yml@b4421b8660a7b6462095a9f492ea012b2a609abe # 0.1.17
     with:
       os_list: '["${{ matrix.os }}"]'
       timeout_minutes: 10

.github/workflows/dependency-review.yml

@@ -21,7 +21,7 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-dependency-review.yml@66fc19d6ee02c703bc219aa4f31d5f98a3def54b # 0.1.10
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-dependency-review.yml@b4421b8660a7b6462095a9f492ea012b2a609abe # 0.1.17
     with:
       fail_on_severity: moderate
       comment_summary_in_pr: on-failure

.github/workflows/instruction-docs-check.yml

@@ -23,7 +23,7 @@ jobs:
     timeout-minutes: 8
     steps:
       - name: Harden runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920  # v2.20.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1  # v2.21.1
         with:
           egress-policy: audit
       - name: Checkout

.github/workflows/release.yml

@@ -31,7 +31,7 @@ jobs:
       attestations: write
     steps:
       - name: Harden runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920  # v2.20.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1  # v2.21.1
         with:
           egress-policy: audit
       - name: Checkout
@@ -171,12 +171,12 @@ jobs:
           retention-days: 30
       - name: Attest release evidence bundle
         if: matrix.os == 'ubuntu-latest'
-        uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6  # v4.2.0
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6  # v4.2.2
         with:
           subject-path: release-evidence.tgz
       - name: Attest generated SBOM
         if: matrix.os == 'ubuntu-latest'
-        uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6  # v4.2.0
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6  # v4.2.2
         with:
           subject-path: sbom.json
       - name: Publish GitHub Release

.github/workflows/sbom.yml

@@ -18,7 +18,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Harden runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920  # v2.20.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1  # v2.21.1
         with:
           egress-policy: audit
       - name: Checkout

.github/workflows/scorecard.yml

@@ -20,6 +20,6 @@ jobs:
       id-token: write
       contents: read
       actions: read
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-scorecard-json.yml@66fc19d6ee02c703bc219aa4f31d5f98a3def54b # 0.1.10
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-scorecard-json.yml@b4421b8660a7b6462095a9f492ea012b2a609abe # 0.1.17
     with:
       publish_results: false

.github/workflows/secret-scan.yml

@@ -21,7 +21,7 @@ jobs:
     name: gitleaks
     permissions:
       contents: read
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/secret-scan.yml@66fc19d6ee02c703bc219aa4f31d5f98a3def54b # 0.1.10
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/secret-scan.yml@b4421b8660a7b6462095a9f492ea012b2a609abe # 0.1.17
     with:
       # Public repo: pull_request runs untrusted fork code. Pin the hosted runner
       # explicitly — several ci-workflows reusables now default `runner` to the