build(deps): bump ci-workflows to v0.17.2

.github/scripts/workflow-pin-metadata.test.cjs

@@ -6,8 +6,8 @@ const test = require("node:test");
 const repositoryRoot = path.resolve(__dirname, "..", "..");
 const workflowDirectory = path.join(repositoryRoot, ".github", "workflows");
 const ciWorkflowsReference = "melodic-software/ci-workflows/";
-const ciWorkflowsSha = "d26c750691b5498fab529d115b63f84aa7aecebe";
-const ciWorkflowsVersion = "v0.17.0";
+const ciWorkflowsSha = "0f8176e87e0be518f382664779655011bf95784a";
+const ciWorkflowsVersion = "v0.17.2";
 const expectedCiWorkflowsReferences = 21;
 const canonicalReference =
   /^\s*uses:\s+melodic-software\/ci-workflows\/[^\s@#]+@(?<sha>[0-9a-f]{40})\s+#\s+(?<version>v(?:0|[1-9][0-9]*)\.(?:0|[1-9][0-9]*)\.(?:0|[1-9][0-9]*))\s*$/;
@@ -108,13 +108,13 @@ test("ci-workflows references use a full SHA with one release version", () => {
     1,
     "ci-workflows references must move as one reviewed compatibility pin",
   );
-  assert.equal(references[0], ciWorkflowsSha, "ci-workflows must use the reviewed v0.17.0 SHA");
+  assert.equal(references[0], ciWorkflowsSha, "ci-workflows must use the reviewed v0.17.2 SHA");
   assert.equal(
     new Set(versions).size,
     1,
     "ci-workflows references must name one release version for online pin verification",
   );
-  assert.equal(versions[0], ciWorkflowsVersion, "ci-workflows must identify release v0.17.0");
+  assert.equal(versions[0], ciWorkflowsVersion, "ci-workflows must identify release v0.17.2");
 });
 
 test("go-quality uses the exact reusable caller contract", () => {

.github/workflows/ci.yml

@@ -26,7 +26,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Lint Markdown
-        uses: melodic-software/ci-workflows/.github/actions/markdown@d26c750691b5498fab529d115b63f84aa7aecebe # v0.17.0
+        uses: melodic-software/ci-workflows/.github/actions/markdown@0f8176e87e0be518f382664779655011bf95784a # v0.17.2
         with:
           config: .markdownlint-cli2.jsonc
 
@@ -40,7 +40,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Lint shell
-        uses: melodic-software/ci-workflows/.github/actions/shellcheck@d26c750691b5498fab529d115b63f84aa7aecebe # v0.17.0
+        uses: melodic-software/ci-workflows/.github/actions/shellcheck@0f8176e87e0be518f382664779655011bf95784a # v0.17.2
         with:
           rcfile: .shellcheckrc
 
@@ -54,7 +54,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Check shell formatting
-        uses: melodic-software/ci-workflows/.github/actions/shfmt@d26c750691b5498fab529d115b63f84aa7aecebe # v0.17.0
+        uses: melodic-software/ci-workflows/.github/actions/shfmt@0f8176e87e0be518f382664779655011bf95784a # v0.17.2
 
   typos:
     name: Spelling
@@ -66,7 +66,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Check spelling
-        uses: melodic-software/ci-workflows/.github/actions/typos@d26c750691b5498fab529d115b63f84aa7aecebe # v0.17.0
+        uses: melodic-software/ci-workflows/.github/actions/typos@0f8176e87e0be518f382664779655011bf95784a # v0.17.2
         with:
           config: _typos.toml
 
@@ -80,7 +80,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Check EditorConfig conformance
-        uses: melodic-software/ci-workflows/.github/actions/editorconfig@d26c750691b5498fab529d115b63f84aa7aecebe # v0.17.0
+        uses: melodic-software/ci-workflows/.github/actions/editorconfig@0f8176e87e0be518f382664779655011bf95784a # v0.17.2
         with:
           config: .editorconfig-checker.json
 
@@ -95,7 +95,7 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
       - name: Scan for secrets
-        uses: melodic-software/ci-workflows/.github/actions/gitleaks@d26c750691b5498fab529d115b63f84aa7aecebe # v0.17.0
+        uses: melodic-software/ci-workflows/.github/actions/gitleaks@0f8176e87e0be518f382664779655011bf95784a # v0.17.2
         with:
           config: .gitleaks.toml
 
@@ -109,7 +109,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Check local links and anchors
-        uses: melodic-software/ci-workflows/.github/actions/lychee-offline@d26c750691b5498fab529d115b63f84aa7aecebe # v0.17.0
+        uses: melodic-software/ci-workflows/.github/actions/lychee-offline@0f8176e87e0be518f382664779655011bf95784a # v0.17.2
         with:
           config: lychee.toml
 
@@ -123,7 +123,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Scan comment hygiene
-        uses: melodic-software/ci-workflows/.github/actions/comment-hygiene@d26c750691b5498fab529d115b63f84aa7aecebe # v0.17.0
+        uses: melodic-software/ci-workflows/.github/actions/comment-hygiene@0f8176e87e0be518f382664779655011bf95784a # v0.17.2
 
   actionlint:
     name: Actionlint
@@ -135,7 +135,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Lint workflows
-        uses: melodic-software/ci-workflows/.github/actions/actionlint@d26c750691b5498fab529d115b63f84aa7aecebe # v0.17.0
+        uses: melodic-software/ci-workflows/.github/actions/actionlint@0f8176e87e0be518f382664779655011bf95784a # v0.17.2
 
   jsonschema:
     name: JSON schemas
@@ -147,12 +147,12 @@ jobs:
         with:
           persist-credentials: false
       - name: Validate Dependabot configuration
-        uses: melodic-software/ci-workflows/.github/actions/check-jsonschema@d26c750691b5498fab529d115b63f84aa7aecebe # v0.17.0
+        uses: melodic-software/ci-workflows/.github/actions/check-jsonschema@0f8176e87e0be518f382664779655011bf95784a # v0.17.2
         with:
           builtin-schema: vendor.dependabot
           files: .github/dependabot.yml
       - name: Validate workflows
-        uses: melodic-software/ci-workflows/.github/actions/check-jsonschema@d26c750691b5498fab529d115b63f84aa7aecebe # v0.17.0
+        uses: melodic-software/ci-workflows/.github/actions/check-jsonschema@0f8176e87e0be518f382664779655011bf95784a # v0.17.2
         with:
           builtin-schema: vendor.github-workflows
           files: .github/workflows/*.yml
@@ -167,7 +167,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Check executable bits
-        uses: melodic-software/ci-workflows/.github/actions/exec-bit@d26c750691b5498fab529d115b63f84aa7aecebe # v0.17.0
+        uses: melodic-software/ci-workflows/.github/actions/exec-bit@0f8176e87e0be518f382664779655011bf95784a # v0.17.2
 
   machine-specific-paths:
     name: Machine-specific paths
@@ -179,7 +179,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Check machine-specific paths
-        uses: melodic-software/ci-workflows/.github/actions/machine-specific-paths@d26c750691b5498fab529d115b63f84aa7aecebe # v0.17.0
+        uses: melodic-software/ci-workflows/.github/actions/machine-specific-paths@0f8176e87e0be518f382664779655011bf95784a # v0.17.2
         with:
           # These files assert the official image's fixed in-container runner
           # home. They contain no host/user path; keep the exception exact.
@@ -201,7 +201,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Check index-level EOL drift
-        uses: melodic-software/ci-workflows/.github/actions/eol-renormalize@d26c750691b5498fab529d115b63f84aa7aecebe # v0.17.0
+        uses: melodic-software/ci-workflows/.github/actions/eol-renormalize@0f8176e87e0be518f382664779655011bf95784a # v0.17.2
 
   zizmor:
     name: Zizmor
@@ -212,7 +212,7 @@ jobs:
       # workflows cannot elevate. Lane stays annotations-only
       # (upload-sarif defaults false); grant write so the job can start.
       security-events: write # Mandatory match for the reusable's own grant; see above.
-    uses: melodic-software/ci-workflows/.github/workflows/zizmor.yml@d26c750691b5498fab529d115b63f84aa7aecebe # v0.17.0
+    uses: melodic-software/ci-workflows/.github/workflows/zizmor.yml@0f8176e87e0be518f382664779655011bf95784a # v0.17.2
     with:
       paths: .
 
@@ -244,7 +244,7 @@ jobs:
   go-quality:
     permissions:
       contents: read
-    uses: melodic-software/ci-workflows/.github/workflows/go-quality.yml@d26c750691b5498fab529d115b63f84aa7aecebe # v0.17.0
+    uses: melodic-software/ci-workflows/.github/workflows/go-quality.yml@0f8176e87e0be518f382664779655011bf95784a # v0.17.2
     with:
       config: .golangci.yml
 
@@ -405,7 +405,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Aggregate lane results
-        uses: melodic-software/ci-workflows/.github/actions/ci-status@d26c750691b5498fab529d115b63f84aa7aecebe # v0.17.0
+        uses: melodic-software/ci-workflows/.github/actions/ci-status@0f8176e87e0be518f382664779655011bf95784a # v0.17.2
         with:
           results: >-
             ${{ needs.markdown.result }}

.github/workflows/do-not-merge.yml

@@ -24,4 +24,4 @@ jobs:
     permissions:
       pull-requests: read # the reusable gate reads the PR's labels only
       actions: read # mandatory to start the reusable; see pr-title.yml for why
-    uses: melodic-software/ci-workflows/.github/workflows/do-not-merge-gate.yml@d26c750691b5498fab529d115b63f84aa7aecebe # v0.17.0
+    uses: melodic-software/ci-workflows/.github/workflows/do-not-merge-gate.yml@0f8176e87e0be518f382664779655011bf95784a # v0.17.2

.github/workflows/link-check.yml

@@ -14,7 +14,7 @@ jobs:
     permissions:
       contents: read # Reusable checker reads repository Markdown.
       issues: write # Reusable checker maintains the scheduled failure issue.
-    uses: melodic-software/ci-workflows/.github/workflows/link-check.yml@d26c750691b5498fab529d115b63f84aa7aecebe # v0.17.0
+    uses: melodic-software/ci-workflows/.github/workflows/link-check.yml@0f8176e87e0be518f382664779655011bf95784a # v0.17.2
     with:
       args: >-
         --cache

.github/workflows/pr-issue-linkage.yml

@@ -25,7 +25,7 @@ jobs:
     permissions:
       pull-requests: read # the reusable now reads the live PR body itself
       actions: read # mandatory to start the reusable; see pr-title.yml for why
-    uses: melodic-software/ci-workflows/.github/workflows/pr-issue-linkage.yml@d26c750691b5498fab529d115b63f84aa7aecebe # v0.17.0
+    uses: melodic-software/ci-workflows/.github/workflows/pr-issue-linkage.yml@0f8176e87e0be518f382664779655011bf95784a # v0.17.2
     with:
       # Generated PR bodies cannot carry the closing-keyword + contract-header
       # markers; exact-login exemption per the reusable's contract, never a

.github/workflows/pr-title.yml

@@ -21,4 +21,4 @@ jobs:
       # `prerequisite-result`, so the resolver never runs, but the grant is
       # still mandatory for the reusable to start at all.
       actions: read # Mandatory match for the reusable's own grant; see above.
-    uses: melodic-software/ci-workflows/.github/workflows/semantic-pr.yml@d26c750691b5498fab529d115b63f84aa7aecebe # v0.17.0
+    uses: melodic-software/ci-workflows/.github/workflows/semantic-pr.yml@0f8176e87e0be518f382664779655011bf95784a # v0.17.2

release/dependencies.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "resolvedAt": "2026-08-21T07:40:00.0000000Z",
+  "resolvedAt": "2026-08-27T08:00:00.0000000Z",
   "go": {
     "version": "1.26.6",
     "source": "https://go.dev/dl/?mode=json"
@@ -137,8 +137,8 @@
   "repositoryPins": [
     {
       "repository": "melodic-software/ci-workflows",
-      "commit": "d26c750691b5498fab529d115b63f84aa7aecebe",
-      "source": "https://github.com/melodic-software/ci-workflows/tree/d26c750691b5498fab529d115b63f84aa7aecebe"
+      "commit": "0f8176e87e0be518f382664779655011bf95784a",
+      "source": "https://github.com/melodic-software/ci-workflows/tree/0f8176e87e0be518f382664779655011bf95784a"
     }
   ],
   "reusableWorkflows": []