chore(ci): bump NDDev-OpenNetwork/ci-workflows/.github/workflows/pr-hygiene.yml from 0.1.24 to 0.1.26

[dependabot]

Bumps NDDev-OpenNetwork/ci-workflows/.github/workflows/pr-hygiene.yml from 0.1.24 to 0.1.26.

Release notes

Sourced from NDDev-OpenNetwork/ci-workflows/.github/workflows/pr-hygiene.yml's releases.

0.1.26

• dependabot-catalog-convergence repaired. The job now builds the trusted tool environment and launches sync_action_catalog.py through the execution-contract launcher. The bare python3 -I invocation could not resolve the ci_workflows_tools verified-file-spec package, so every convergence run since the sibling-import migration failed with ModuleNotFoundError. The workflow is registered in the catalog used_by for setup-python and setup-uv like every other consumer.
• Catalog review record. setup-rust-toolchain v2.0.0 review outcome is now persisted in catalog/tools.yml: the major bump stays held because the implicit RUSTFLAGS=-D warnings default becomes build.warnings (cargo

  = 1.97), which would silently weaken the gate for callers on older toolchains. The Dependabot PR remains the tracking surface.

0.1.25

• Refuse ./action refs inside workflow_call workflows. ./ in a called workflow resolves against the caller's workspace, never this repository's, so uses: ./actions/x in a reusable fails at job setup for every cross-repository consumer. check_pinned_actions.py now rejects the pattern; the affected workflows were repaired in 0.1.24.
• Scheduled tool refresh, 2026-09-21. Bumped twelve action pins and three CLI pins to their current upstream releases: codeql-action v4.38.1, setup-android v4.0.4, setup-r v2.14.0, codecov-action v7.1.1, typos v1.50.2, checkov-action v12.3125.0, github-action-benchmark v1.22.2, setup-uv v10.1.0, setup-java v6.0.1, setup-buildx-action v4.4.1, build-push-action v7.4.0, install-action v2.87.17; osv-scanner 2.6.0, semgrep 1.177.0 and syft 1.52.0 with re-verified release checksums. setup-rust-toolchain stays on v1.17.0 (upstream v2.0.0 is a major bump pending input-contract review) and zizmor stays on 1.26.1 (upstream v1.30.1 reports 65 new low findings on this tree, held for dedicated triage). Every catalog last_verified restamped to the audit date.

Changelog

Sourced from NDDev-OpenNetwork/ci-workflows/.github/workflows/pr-hygiene.yml's changelog.

Changelog

This file is a release ledger: every heading below is a real release, and scripts/check_release_ledger.py enforces that in both directions.

The project follows Semantic Versioning.

[Unreleased]

[0.1.29] - 2026-09-28

• Publishable re-cut of 0.1.28. Tag 0.1.28 was pushed as an unsigned lightweight ref carrying no nddev-public-release-promotion/v2 record, so the promotion gate correctly refused it — and release tags are immutable, so it cannot be updated in place. This tag is the signed annotated promotion-record tag the content always needed. Tree content is identical to 0.1.28; no GitHub release exists for 0.1.27 or 0.1.28.

[0.1.28] - 2026-09-28

• Seven product facts re-verified after the 0.1.27 preflight stop. The product-facts-calendar release gate correctly refused tag 0.1.27: appveyor-public, semaphore-cloud-free, semaphore-community, azure-pipelines-private, bitbucket-free, buildkite-personal and ubicloud-free had all passed their expires_after. Each was re-read against its source_urls on 2026-09-28 and carries a staggered new expires_after. Three records needed correction, not just a date bump: Buildkite's plan is now named Free with 2,000 Linux vCPU minutes/month (was Personal/500), up to 10 concurrent jobs (was 3), up to 5 users (was 1) and 30-day retention (was 90); Semaphore's community edition moved from /community (404) to /open-source and is branded Semaphore Open Source; Ubicloud's credit statement was reconfirmed. No GitHub release exists for tag 0.1.27 — publication was stopped before the publish job.

[0.1.27] - 2026-09-28

• rust-supply-chain tool defaults refreshed. cargo_audit_version now defaults to 0.22.2 and cargo_machete_version to 0.9.2, the current upstream releases. Both remain caller-overridable inputs; only the default moved.

[0.1.26] - 2026-09-21

• dependabot-catalog-convergence repaired. The job now builds the trusted tool environment and launches sync_action_catalog.py through the execution-contract launcher. The bare python3 -I invocation could not resolve the ci_workflows_tools verified-file-spec package, so every convergence run since the sibling-import migration failed with ModuleNotFoundError. The workflow is registered in the catalog used_by for setup-python and setup-uv like every other consumer.

... (truncated)

Commits

• a7b90bd Merge pull request #137 from NDDev-OpenNetwork/release/0.1.26
• 43883b0 chore(release): 0.1.26
• 88bec7c Merge pull request #135 from NDDev-OpenNetwork/docs/rust-toolchain-v2-hold
• 7e4a53e docs(catalog): record the setup-rust-toolchain v2 review outcome
• 55c0f77 Merge pull request #132 from NDDev-OpenNetwork/fix/dependabot-convergence-lau...
• 91a03e4 fix(ci): launch dependabot catalog sync through the contract launcher
• 17a7c6e Merge pull request #128 from NDDev-OpenNetwork/chore/release-0.1.25
• 7d4c188 chore(release): 0.1.25
• 8f92e48 Merge pull request #127 from NDDev-OpenNetwork/chore/tool-refresh-2026-09-21
• 52a9007 chore(tools): scheduled pin refresh to 2026-09-21 upstream releases
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)