build(deps): bump NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml from 9eb9e070ae87b0fc3bdbd2cbed5afe3b92f7e2c7 to b5789d6bb6a1c1e64dfac7fb93bdfe06bce0b726

[dependabot]

Bumps NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml from 9eb9e070ae87b0fc3bdbd2cbed5afe3b92f7e2c7 to b5789d6bb6a1c1e64dfac7fb93bdfe06bce0b726.

Changelog

Sourced from NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml's changelog.

Changelog

This file is a release ledger: every heading below is a real release, and scripts/check_release_ledger.py enforces that in both directions.

The project follows Semantic Versioning.

[Unreleased]

[0.1.26] - 2026-09-21

• dependabot-catalog-convergence repaired. The job now builds the trusted tool environment and launches sync_action_catalog.py through the execution-contract launcher. The bare python3 -I invocation could not resolve the ci_workflows_tools verified-file-spec package, so every convergence run since the sibling-import migration failed with ModuleNotFoundError. The workflow is registered in the catalog used_by for setup-python and setup-uv like every other consumer.
• Catalog review record. setup-rust-toolchain v2.0.0 review outcome is now persisted in catalog/tools.yml: the major bump stays held because the implicit RUSTFLAGS=-D warnings default becomes build.warnings (cargo

  = 1.97), which would silently weaken the gate for callers on older toolchains. The Dependabot PR remains the tracking surface.

[0.1.25] - 2026-09-21

• Refuse ./action refs inside workflow_call workflows. ./ in a called workflow resolves against the caller's workspace, never this repository's, so uses: ./actions/x in a reusable fails at job setup for every cross-repository consumer. check_pinned_actions.py now rejects the pattern; the affected workflows were repaired in 0.1.24.
• Scheduled tool refresh, 2026-09-21. Bumped twelve action pins and three CLI pins to their current upstream releases: codeql-action v4.38.1, setup-android v4.0.4, setup-r v2.14.0, codecov-action v7.1.1, typos v1.50.2, checkov-action v12.3125.0, github-action-benchmark v1.22.2, setup-uv v10.1.0, setup-java v6.0.1, setup-buildx-action v4.4.1, build-push-action v7.4.0, install-action v2.87.17; osv-scanner 2.6.0, semgrep 1.177.0 and syft 1.52.0 with re-verified release checksums. setup-rust-toolchain stays on v1.17.0 (upstream v2.0.0 is a major bump pending input-contract review) and zizmor stays on 1.26.1 (upstream v1.30.1 reports 65 new low findings on this tree, held for dedicated triage). Every catalog last_verified restamped to the audit date.

[0.1.24] - 2026-09-20

• Fix a reusable workflow that could not reach its own vendored actions. ./actions/... in a called workflow resolves against the caller's workspace, never this repository. Five uses: were written that way while vendoring, and each one fails at job setup for every cross-repository caller:

... (truncated)

Commits

• b5789d6 Merge pull request #129 from NDDev-OpenNetwork/dependabot/github_actions/gith...
• a7b90bd Merge pull request #137 from NDDev-OpenNetwork/release/0.1.26
• 43883b0 chore(release): 0.1.26
• 88bec7c Merge pull request #135 from NDDev-OpenNetwork/docs/rust-toolchain-v2-hold
• 07899de chore(deps): synchronize action catalog
• 7e4a53e docs(catalog): record the setup-rust-toolchain v2 review outcome
• 0ec8ab8 Merge branch 'main' into dependabot/github_actions/github-actions-037a365596
• 55c0f77 Merge pull request #132 from NDDev-OpenNetwork/fix/dependabot-convergence-lau...
• 91a03e4 fix(ci): launch dependabot catalog sync through the contract launcher
• 21a358f Merge branch 'main' into dependabot/github_actions/github-actions-037a365596
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[dependabot]

Superseded by #482.