chore(ci): bump NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml from 0.1.20 to 0.1.21

[dependabot]

Bumps NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml from 0.1.20 to 0.1.21.

Release notes

Sourced from NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml's releases.

0.1.21

• ci-feedback: vendor the reusable workflow and its composite action into this repository. Their home NDDev-OpenNetwork/github-actions moved to NDDev-Archive/github-actions-garm on 2026-09-17, and an archived repository cannot serve a workflow_call, so every caller of ci-feedback-events.yml failed at resolution. The workflow now lives at .github/workflows/ci-feedback.yml and the action at actions/ci-feedback/; callers reference the same-repository path. Other repositories' own ci-feedback-events.yml files still point at the archived path and need the same repoint. tool-cache action references are repointed at the moved repository (same pinned commit).

Changelog

Sourced from NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml's changelog.

Changelog

This file is a release ledger: every heading below is a real release, and scripts/check_release_ledger.py enforces that in both directions.

The project follows Semantic Versioning.

[Unreleased]

[0.1.26] - 2026-09-21

• dependabot-catalog-convergence repaired. The job now builds the trusted tool environment and launches sync_action_catalog.py through the execution-contract launcher. The bare python3 -I invocation could not resolve the ci_workflows_tools verified-file-spec package, so every convergence run since the sibling-import migration failed with ModuleNotFoundError. The workflow is registered in the catalog used_by for setup-python and setup-uv like every other consumer.
• Catalog review record. setup-rust-toolchain v2.0.0 review outcome is now persisted in catalog/tools.yml: the major bump stays held because the implicit RUSTFLAGS=-D warnings default becomes build.warnings (cargo

  = 1.97), which would silently weaken the gate for callers on older toolchains. The Dependabot PR remains the tracking surface.

[0.1.25] - 2026-09-21

• Refuse ./action refs inside workflow_call workflows. ./ in a called workflow resolves against the caller's workspace, never this repository's, so uses: ./actions/x in a reusable fails at job setup for every cross-repository consumer. check_pinned_actions.py now rejects the pattern; the affected workflows were repaired in 0.1.24.
• Scheduled tool refresh, 2026-09-21. Bumped twelve action pins and three CLI pins to their current upstream releases: codeql-action v4.38.1, setup-android v4.0.4, setup-r v2.14.0, codecov-action v7.1.1, typos v1.50.2, checkov-action v12.3125.0, github-action-benchmark v1.22.2, setup-uv v10.1.0, setup-java v6.0.1, setup-buildx-action v4.4.1, build-push-action v7.4.0, install-action v2.87.17; osv-scanner 2.6.0, semgrep 1.177.0 and syft 1.52.0 with re-verified release checksums. setup-rust-toolchain stays on v1.17.0 (upstream v2.0.0 is a major bump pending input-contract review) and zizmor stays on 1.26.1 (upstream v1.30.1 reports 65 new low findings on this tree, held for dedicated triage). Every catalog last_verified restamped to the audit date.

[0.1.24] - 2026-09-20

• Fix a reusable workflow that could not reach its own vendored actions. ./actions/... in a called workflow resolves against the caller's workspace, never this repository. Five uses: were written that way while vendoring, and each one fails at job setup for every cross-repository caller:

... (truncated)

Commits

• 9f10031 Merge pull request #118 from NDDev-OpenNetwork/chore/release-0.1.21
• 65d4bf2 chore(release): 0.1.21
• 9adc78a Merge pull request #117 from NDDev-OpenNetwork/fix/ci-feedback-vendored
• 40de4f9 fix(ci-feedback): vendor the reusable workflow and action in-repo
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Looks like NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml is up-to-date now, so this is no longer needed.