chore(deps): bump the github-actions group with 3 updates

[dependabot]

Bumps the github-actions group with 3 updates: NDDev-OpenNetwork/ci-workflows/actions/ci-feedback, astral-sh/setup-uv and NDDev-OpenNetwork/ci-workflows/actions/tool-cache.

Updates NDDev-OpenNetwork/ci-workflows/actions/ci-feedback from 0.1.23 to 0.1.26

Release notes

Sourced from NDDev-OpenNetwork/ci-workflows/actions/ci-feedback's releases.

0.1.26

• dependabot-catalog-convergence repaired. The job now builds the trusted tool environment and launches sync_action_catalog.py through the execution-contract launcher. The bare python3 -I invocation could not resolve the ci_workflows_tools verified-file-spec package, so every convergence run since the sibling-import migration failed with ModuleNotFoundError. The workflow is registered in the catalog used_by for setup-python and setup-uv like every other consumer.
• Catalog review record. setup-rust-toolchain v2.0.0 review outcome is now persisted in catalog/tools.yml: the major bump stays held because the implicit RUSTFLAGS=-D warnings default becomes build.warnings (cargo

  = 1.97), which would silently weaken the gate for callers on older toolchains. The Dependabot PR remains the tracking surface.

0.1.25

• Refuse ./action refs inside workflow_call workflows. ./ in a called workflow resolves against the caller's workspace, never this repository's, so uses: ./actions/x in a reusable fails at job setup for every cross-repository consumer. check_pinned_actions.py now rejects the pattern; the affected workflows were repaired in 0.1.24.
• Scheduled tool refresh, 2026-09-21. Bumped twelve action pins and three CLI pins to their current upstream releases: codeql-action v4.38.1, setup-android v4.0.4, setup-r v2.14.0, codecov-action v7.1.1, typos v1.50.2, checkov-action v12.3125.0, github-action-benchmark v1.22.2, setup-uv v10.1.0, setup-java v6.0.1, setup-buildx-action v4.4.1, build-push-action v7.4.0, install-action v2.87.17; osv-scanner 2.6.0, semgrep 1.177.0 and syft 1.52.0 with re-verified release checksums. setup-rust-toolchain stays on v1.17.0 (upstream v2.0.0 is a major bump pending input-contract review) and zizmor stays on 1.26.1 (upstream v1.30.1 reports 65 new low findings on this tree, held for dedicated triage). Every catalog last_verified restamped to the audit date.

0.1.24

• Fix a reusable workflow that could not reach its own vendored actions. ./actions/... in a called workflow resolves against the caller's workspace, never this repository. Five uses: were written that way while vendoring, and each one fails at job setup for every cross-repository caller:
  • ci-feedback.yml has used ./actions/ci-feedback since 0.1.21. It runs no checkout, so the workspace is empty and the step cannot resolve. The job only fires on a failed conclusion, so it stayed hidden until 2026-09-20, when github-device-sync run 35541640707 reported Can't find 'action.yml' ... under /home/runner/work/github-device-sync/github-device-sync/actions/ci-feedback. Every reusable caller of the CI-feedback path has been silently unable to publish evidence for three releases.
  • private-security-bundle-free.yml gained four ./actions/tool-cache

... (truncated)

Changelog

Sourced from NDDev-OpenNetwork/ci-workflows/actions/ci-feedback's changelog.

Changelog

This file is a release ledger: every heading below is a real release, and scripts/check_release_ledger.py enforces that in both directions.

The project follows Semantic Versioning.

[Unreleased]

[0.1.29] - 2026-09-28

• Publishable re-cut of 0.1.28. Tag 0.1.28 was pushed as an unsigned lightweight ref carrying no nddev-public-release-promotion/v2 record, so the promotion gate correctly refused it — and release tags are immutable, so it cannot be updated in place. This tag is the signed annotated promotion-record tag the content always needed. Tree content is identical to 0.1.28; no GitHub release exists for 0.1.27 or 0.1.28.

[0.1.28] - 2026-09-28

• Seven product facts re-verified after the 0.1.27 preflight stop. The product-facts-calendar release gate correctly refused tag 0.1.27: appveyor-public, semaphore-cloud-free, semaphore-community, azure-pipelines-private, bitbucket-free, buildkite-personal and ubicloud-free had all passed their expires_after. Each was re-read against its source_urls on 2026-09-28 and carries a staggered new expires_after. Three records needed correction, not just a date bump: Buildkite's plan is now named Free with 2,000 Linux vCPU minutes/month (was Personal/500), up to 10 concurrent jobs (was 3), up to 5 users (was 1) and 30-day retention (was 90); Semaphore's community edition moved from /community (404) to /open-source and is branded Semaphore Open Source; Ubicloud's credit statement was reconfirmed. No GitHub release exists for tag 0.1.27 — publication was stopped before the publish job.

[0.1.27] - 2026-09-28

• rust-supply-chain tool defaults refreshed. cargo_audit_version now defaults to 0.22.2 and cargo_machete_version to 0.9.2, the current upstream releases. Both remain caller-overridable inputs; only the default moved.

[0.1.26] - 2026-09-21

• dependabot-catalog-convergence repaired. The job now builds the trusted tool environment and launches sync_action_catalog.py through the execution-contract launcher. The bare python3 -I invocation could not resolve the ci_workflows_tools verified-file-spec package, so every convergence run since the sibling-import migration failed with ModuleNotFoundError. The workflow is registered in the catalog used_by for setup-python and setup-uv like every other consumer.

... (truncated)

Commits

• a7b90bd Merge pull request #137 from NDDev-OpenNetwork/release/0.1.26
• 43883b0 chore(release): 0.1.26
• 88bec7c Merge pull request #135 from NDDev-OpenNetwork/docs/rust-toolchain-v2-hold
• 7e4a53e docs(catalog): record the setup-rust-toolchain v2 review outcome
• 55c0f77 Merge pull request #132 from NDDev-OpenNetwork/fix/dependabot-convergence-lau...
• 91a03e4 fix(ci): launch dependabot catalog sync through the contract launcher
• 17a7c6e Merge pull request #128 from NDDev-OpenNetwork/chore/release-0.1.25
• 7d4c188 chore(release): 0.1.25
• 8f92e48 Merge pull request #127 from NDDev-OpenNetwork/chore/tool-refresh-2026-09-21
• 52a9007 chore(tools): scheduled pin refresh to 2026-09-21 upstream releases
• Additional commits viewable in compare view

Updates astral-sh/setup-uv from 10.1.0 to 10.2.0

Release notes

Sourced from astral-sh/setup-uv's releases.

v10.2.0 🌈 Disable automatic cache saves for merge queues

Changes

This release contains the known-checksum of the most recent uv releases and also disabled the uploading(saving) of the cache when in a merge queue since theses caches would almost never be used.

🚀 Enhancements

• Disable automatic cache saves for merge queues @​eifinger (#1056)

🧰 Maintenance

• chore: update known checksums for 0.12.17 @github-actions[bot] (#1058)
• chore: update known checksums for 0.12.16 @github-actions[bot] (#1057)
• chore: update known checksums for 0.12.15 @github-actions[bot] (#1054)
• chore: update known checksums for 0.12.14 @github-actions[bot] (#1053)
• chore: update known checksums for 0.12.13 @github-actions[bot] (#1045)

📚 Documentation

• docs: update version references to v10.1.0 @github-actions[bot] (#1044)

⬆️ Dependency updates

• chore(deps): roll up Dependabot updates @​eifinger (#1059)

Commits

• c18668a chore(deps): roll up Dependabot updates (#1059)
• ffe1476 chore: update known checksums for 0.12.17 (#1058)
• f5548c5 chore: update known checksums for 0.12.16 (#1057)
• a761a4e Disable automatic cache saves for merge queues (#1056)
• 3377a30 chore: update known checksums for 0.12.15 (#1054)
• dfb5f38 chore: update known checksums for 0.12.14 (#1053)
• 45c121f chore: update known checksums for 0.12.13 (#1045)
• 8073452 docs: update version references to v10.1.0 (#1044)
• See full diff in compare view

Updates NDDev-OpenNetwork/ci-workflows/actions/tool-cache from 0.1.23 to 0.1.26

Release notes

Sourced from NDDev-OpenNetwork/ci-workflows/actions/tool-cache's releases.

0.1.26

• dependabot-catalog-convergence repaired. The job now builds the trusted tool environment and launches sync_action_catalog.py through the execution-contract launcher. The bare python3 -I invocation could not resolve the ci_workflows_tools verified-file-spec package, so every convergence run since the sibling-import migration failed with ModuleNotFoundError. The workflow is registered in the catalog used_by for setup-python and setup-uv like every other consumer.
• Catalog review record. setup-rust-toolchain v2.0.0 review outcome is now persisted in catalog/tools.yml: the major bump stays held because the implicit RUSTFLAGS=-D warnings default becomes build.warnings (cargo

  = 1.97), which would silently weaken the gate for callers on older toolchains. The Dependabot PR remains the tracking surface.

0.1.25

• Refuse ./action refs inside workflow_call workflows. ./ in a called workflow resolves against the caller's workspace, never this repository's, so uses: ./actions/x in a reusable fails at job setup for every cross-repository consumer. check_pinned_actions.py now rejects the pattern; the affected workflows were repaired in 0.1.24.
• Scheduled tool refresh, 2026-09-21. Bumped twelve action pins and three CLI pins to their current upstream releases: codeql-action v4.38.1, setup-android v4.0.4, setup-r v2.14.0, codecov-action v7.1.1, typos v1.50.2, checkov-action v12.3125.0, github-action-benchmark v1.22.2, setup-uv v10.1.0, setup-java v6.0.1, setup-buildx-action v4.4.1, build-push-action v7.4.0, install-action v2.87.17; osv-scanner 2.6.0, semgrep 1.177.0 and syft 1.52.0 with re-verified release checksums. setup-rust-toolchain stays on v1.17.0 (upstream v2.0.0 is a major bump pending input-contract review) and zizmor stays on 1.26.1 (upstream v1.30.1 reports 65 new low findings on this tree, held for dedicated triage). Every catalog last_verified restamped to the audit date.

0.1.24

• Fix a reusable workflow that could not reach its own vendored actions. ./actions/... in a called workflow resolves against the caller's workspace, never this repository. Five uses: were written that way while vendoring, and each one fails at job setup for every cross-repository caller:
  • ci-feedback.yml has used ./actions/ci-feedback since 0.1.21. It runs no checkout, so the workspace is empty and the step cannot resolve. The job only fires on a failed conclusion, so it stayed hidden until 2026-09-20, when github-device-sync run 35541640707 reported Can't find 'action.yml' ... under /home/runner/work/github-device-sync/github-device-sync/actions/ci-feedback. Every reusable caller of the CI-feedback path has been silently unable to publish evidence for three releases.
  • private-security-bundle-free.yml gained four ./actions/tool-cache

... (truncated)

Changelog

Sourced from NDDev-OpenNetwork/ci-workflows/actions/tool-cache's changelog.

Changelog

This file is a release ledger: every heading below is a real release, and scripts/check_release_ledger.py enforces that in both directions.

The project follows Semantic Versioning.

[Unreleased]

[0.1.29] - 2026-09-28

• Publishable re-cut of 0.1.28. Tag 0.1.28 was pushed as an unsigned lightweight ref carrying no nddev-public-release-promotion/v2 record, so the promotion gate correctly refused it — and release tags are immutable, so it cannot be updated in place. This tag is the signed annotated promotion-record tag the content always needed. Tree content is identical to 0.1.28; no GitHub release exists for 0.1.27 or 0.1.28.

[0.1.28] - 2026-09-28

• Seven product facts re-verified after the 0.1.27 preflight stop. The product-facts-calendar release gate correctly refused tag 0.1.27: appveyor-public, semaphore-cloud-free, semaphore-community, azure-pipelines-private, bitbucket-free, buildkite-personal and ubicloud-free had all passed their expires_after. Each was re-read against its source_urls on 2026-09-28 and carries a staggered new expires_after. Three records needed correction, not just a date bump: Buildkite's plan is now named Free with 2,000 Linux vCPU minutes/month (was Personal/500), up to 10 concurrent jobs (was 3), up to 5 users (was 1) and 30-day retention (was 90); Semaphore's community edition moved from /community (404) to /open-source and is branded Semaphore Open Source; Ubicloud's credit statement was reconfirmed. No GitHub release exists for tag 0.1.27 — publication was stopped before the publish job.

[0.1.27] - 2026-09-28

• rust-supply-chain tool defaults refreshed. cargo_audit_version now defaults to 0.22.2 and cargo_machete_version to 0.9.2, the current upstream releases. Both remain caller-overridable inputs; only the default moved.

[0.1.26] - 2026-09-21

• dependabot-catalog-convergence repaired. The job now builds the trusted tool environment and launches sync_action_catalog.py through the execution-contract launcher. The bare python3 -I invocation could not resolve the ci_workflows_tools verified-file-spec package, so every convergence run since the sibling-import migration failed with ModuleNotFoundError. The workflow is registered in the catalog used_by for setup-python and setup-uv like every other consumer.

... (truncated)

Commits

• a7b90bd Merge pull request #137 from NDDev-OpenNetwork/release/0.1.26
• 43883b0 chore(release): 0.1.26
• 88bec7c Merge pull request #135 from NDDev-OpenNetwork/docs/rust-toolchain-v2-hold
• 7e4a53e docs(catalog): record the setup-rust-toolchain v2 review outcome
• 55c0f77 Merge pull request #132 from NDDev-OpenNetwork/fix/dependabot-convergence-lau...
• 91a03e4 fix(ci): launch dependabot catalog sync through the contract launcher
• 17a7c6e Merge pull request #128 from NDDev-OpenNetwork/chore/release-0.1.25
• 7d4c188 chore(release): 0.1.25
• 8f92e48 Merge pull request #127 from NDDev-OpenNetwork/chore/tool-refresh-2026-09-21
• 52a9007 chore(tools): scheduled pin refresh to 2026-09-21 upstream releases
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions