chore(ci): converge ci-workflows pins on 0.1.24

.cargo/audit.toml

@@ -1,23 +1,17 @@
-# One advisory is ignored here. Ignoring is not "accepted risk" by default: it
-# is a claim that the vulnerable code is not in what we ship, and the claim has
-# to be checkable from this file.
+# No advisory is currently ignored here. Ignoring is not "accepted risk" by
+# default: it is a claim that the vulnerable code is not in what we ship, and
+# the claim has to be checkable from this file.
 #
-# RUSTSEC-2023-0071 -- Marvin attack, a timing side channel in `rsa`. There is
-# no patched release; the advisory has been open since 2023 with `patched: []`.
-#
-# `rsa` reaches this lockfile through `sqlx-mysql`, which `sqlx-macros-core`
-# depends on so the compile-time query checker can understand every driver.
-# Only the `sqlite` feature is enabled here, so `sqlx-mysql` is never built and
-# `rsa` is never linked. `cargo audit` reads the lockfile, which lists optional
-# dependencies whether or not their feature is on, so it sees a crate that this
-# binary does not contain.
-#
-# Check the claim rather than trusting this comment:
+# The one hold this file used to carry was RUSTSEC-2023-0071 -- the Marvin
+# timing side channel in `rsa`, which reached the lockfile through
+# `sqlx-mysql` while only the `sqlite` feature was enabled. `rsa` no longer
+# resolves at all, so the hold was released rather than kept as an unused
+# ignore.
 #
+# If `rsa` ever returns to the lockfile, the claim to re-check is:
+
 #     cargo tree -i rsa -e normal      # "nothing to print" -- not in the graph
 #     cargo tree -i sqlx-mysql -e normal
-#
-# If either ever prints a path, this entry is wrong and must go.
 
 [advisories]
-ignore = ["RUSTSEC-2023-0071"]
+ignore = []

.github/workflows/ci.yml

@@ -40,7 +40,7 @@ jobs:
     name: rust
     permissions:
       contents: read
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/rust-ci.yml@9231ee7421354867b0fe0e019c4e20dcce5d05e7
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/rust-ci.yml@37a827f921f62353664fc4bcd872f05b65efe71a # 0.1.24
     with:
       # Two, not three. Windows is absent because nothing here is built for it:
       # the deliverable is a Linux container, and macOS is kept because it is
@@ -65,7 +65,7 @@ jobs:
     name: supply-chain
     permissions:
       contents: read
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/rust-supply-chain.yml@1ab6708b62ec7bd17f2d8a519c6fcc39edb22243
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/rust-supply-chain.yml@37a827f921f62353664fc4bcd872f05b65efe71a # 0.1.24
     with:
       enable_audit: true
       # cargo-deny and cargo-machete are off deliberately, not by omission.
@@ -81,7 +81,7 @@ jobs:
     name: actionlint
     permissions:
       contents: read
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/actionlint.yml@1ab6708b62ec7bd17f2d8a519c6fcc39edb22243
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/actionlint.yml@37a827f921f62353664fc4bcd872f05b65efe71a # 0.1.24
 
   pr-hygiene:
     name: pr-hygiene
@@ -90,7 +90,7 @@ jobs:
       contents: read
       issues: write # the stale bot closes threads
       pull-requests: write # the labeler applies labels
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/pr-hygiene.yml@1ab6708b62ec7bd17f2d8a519c6fcc39edb22243
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/pr-hygiene.yml@37a827f921f62353664fc4bcd872f05b65efe71a # 0.1.24
     with:
       # The stock configuration rejects any body line over 100 characters, and
       # Dependabot writes a 144-character compare link into every git-ref bump.

.github/workflows/image.yml

@@ -70,7 +70,7 @@ jobs:
     permissions:
       contents: read
       packages: write # ghcr.io push and the registry layer cache
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/docker-build.yml@9231ee7421354867b0fe0e019c4e20dcce5d05e7
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/docker-build.yml@37a827f921f62353664fc4bcd872f05b65efe71a # 0.1.24
     with:
       image: ghcr.io/nddev-opennetwork/nremote-server
       tags: ${{ needs.plan.outputs.tags }}

.github/workflows/security.yml

@@ -26,7 +26,7 @@ jobs:
       actions: read # CodeQL reads the workflow definitions it analyses
       contents: read
       security-events: write # CodeQL publishes its findings to code scanning
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml@1ab6708b62ec7bd17f2d8a519c6fcc39edb22243
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml@37a827f921f62353664fc4bcd872f05b65efe71a # 0.1.24
     with:
       languages: '["rust", "actions"]'
       queries: security-and-quality
@@ -40,7 +40,7 @@ jobs:
     permissions:
       contents: read
       pull-requests: write # writes the review it produces
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-dependency-review.yml@1ab6708b62ec7bd17f2d8a519c6fcc39edb22243
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-dependency-review.yml@37a827f921f62353664fc4bcd872f05b65efe71a # 0.1.24
     with:
       fail_on_severity: moderate
 
@@ -52,24 +52,24 @@ jobs:
       contents: read
       id-token: write # mints the OIDC token its publication is signed with
       security-events: write # Scorecard publishes its findings to code scanning
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-scorecard.yml@9231ee7421354867b0fe0e019c4e20dcce5d05e7
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-scorecard.yml@37a827f921f62353664fc4bcd872f05b65efe71a # 0.1.24
 
   osv:
     name: osv
     permissions:
       contents: read
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/osv-scan.yml@1ab6708b62ec7bd17f2d8a519c6fcc39edb22243
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/osv-scan.yml@37a827f921f62353664fc4bcd872f05b65efe71a # 0.1.24
 
   zizmor:
     name: zizmor
     permissions:
       actions: read # the SARIF upload reads this run to attach its results
       contents: read
       security-events: write # zizmor publishes its findings to code scanning
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/zizmor-sarif.yml@9231ee7421354867b0fe0e019c4e20dcce5d05e7
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/zizmor-sarif.yml@37a827f921f62353664fc4bcd872f05b65efe71a # 0.1.24
 
   secret-scan:
     name: secret-scan
     permissions:
       contents: read
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/secret-scan.yml@9231ee7421354867b0fe0e019c4e20dcce5d05e7
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/secret-scan.yml@37a827f921f62353664fc4bcd872f05b65efe71a # 0.1.24

osv-scanner.toml

@@ -1,22 +1,13 @@
-# Six advisories are held here, each with the reason it is held and a date the
+# Five advisories are held here, each with the reason it is held and a date the
 # reason expires. None of them is "we looked and it seemed fine": every entry
 # either names the code path that does not exist, or names the work that would
 # close it.
 #
 # Thirteen more were closed rather than held, by refreshing the lockfile and
-# raising sqlx, tungstenite, flexi_logger, deadpool and users. Holding is the
-# exception, not the routine.
-
-[[IgnoredVulns]]
-id = "RUSTSEC-2023-0071"
-ignoreUntil = 2026-12-01
-reason = """
-Marvin attack in `rsa`, no patched release since 2023. Reaches the lockfile
-through `sqlx-mysql`, which `sqlx-macros-core` depends on so the compile-time
-query checker understands every driver. Only the `sqlite` feature is enabled,
-so `cargo tree -i rsa -e normal` prints nothing and the crate is not linked.
-The same reasoning and the same check are in .cargo/audit.toml.
-"""
+# raising sqlx, tungstenite, flexi_logger, deadpool and users. A fourteenth,
+# RUSTSEC-2023-0071 (`rsa` via `sqlx-mysql`), left the lockfile entirely, so its
+# hold was released -- holding an advisory for a crate nothing resolves only
+# trips the unused-ignore gate. Holding is the exception, not the routine.
 
 [[IgnoredVulns]]
 id = "RUSTSEC-2025-0141"