chore(ci): bump NDDev-OpenNetwork/ci-workflows/.github/workflows/zizmor-sarif.yml from 0.1.24 to 0.1.29

[dependabot]

Bumps NDDev-OpenNetwork/ci-workflows/.github/workflows/zizmor-sarif.yml from 0.1.24 to 0.1.29.

Release notes

Sourced from NDDev-OpenNetwork/ci-workflows/.github/workflows/zizmor-sarif.yml's releases.

0.1.29

• Publishable re-cut of 0.1.28. Tag 0.1.28 was pushed as an unsigned lightweight ref carrying no nddev-public-release-promotion/v2 record, so the promotion gate correctly refused it — and release tags are immutable, so it cannot be updated in place. This tag is the signed annotated promotion-record tag the content always needed. Tree content is identical to 0.1.28; no GitHub release exists for 0.1.27 or 0.1.28.

0.1.26

• dependabot-catalog-convergence repaired. The job now builds the trusted tool environment and launches sync_action_catalog.py through the execution-contract launcher. The bare python3 -I invocation could not resolve the ci_workflows_tools verified-file-spec package, so every convergence run since the sibling-import migration failed with ModuleNotFoundError. The workflow is registered in the catalog used_by for setup-python and setup-uv like every other consumer.
• Catalog review record. setup-rust-toolchain v2.0.0 review outcome is now persisted in catalog/tools.yml: the major bump stays held because the implicit RUSTFLAGS=-D warnings default becomes build.warnings (cargo

  = 1.97), which would silently weaken the gate for callers on older toolchains. The Dependabot PR remains the tracking surface.

0.1.25

• Refuse ./action refs inside workflow_call workflows. ./ in a called workflow resolves against the caller's workspace, never this repository's, so uses: ./actions/x in a reusable fails at job setup for every cross-repository consumer. check_pinned_actions.py now rejects the pattern; the affected workflows were repaired in 0.1.24.
• Scheduled tool refresh, 2026-09-21. Bumped twelve action pins and three CLI pins to their current upstream releases: codeql-action v4.38.1, setup-android v4.0.4, setup-r v2.14.0, codecov-action v7.1.1, typos v1.50.2, checkov-action v12.3125.0, github-action-benchmark v1.22.2, setup-uv v10.1.0, setup-java v6.0.1, setup-buildx-action v4.4.1, build-push-action v7.4.0, install-action v2.87.17; osv-scanner 2.6.0, semgrep 1.177.0 and syft 1.52.0 with re-verified release checksums. setup-rust-toolchain stays on v1.17.0 (upstream v2.0.0 is a major bump pending input-contract review) and zizmor stays on 1.26.1 (upstream v1.30.1 reports 65 new low findings on this tree, held for dedicated triage). Every catalog last_verified restamped to the audit date.

Changelog

Sourced from NDDev-OpenNetwork/ci-workflows/.github/workflows/zizmor-sarif.yml's changelog.

Changelog

This file is a release ledger: every heading below is a real release, and scripts/check_release_ledger.py enforces that in both directions.

The project follows Semantic Versioning.

[Unreleased]

• Bump urllib3 to 2.8.0 in requirements-qt.txt (recompiled via uv pip compile --upgrade-package urllib3): the osv-scan runtime fixture flagged PYSEC-2026-4176 and PYSEC-2026-4177 on the pinned 2.7.0.
• Fix the dependabot-catalog-convergence update-branch guard. A bound pull request already current with the base made the API answer no new commits, which matched neither the success pattern nor a real error — the job exited before converging the catalog and left dependabot bumps red on tool-registry/catalog.

[0.1.29] - 2026-09-28

• Publishable re-cut of 0.1.28. Tag 0.1.28 was pushed as an unsigned lightweight ref carrying no nddev-public-release-promotion/v2 record, so the promotion gate correctly refused it — and release tags are immutable, so it cannot be updated in place. This tag is the signed annotated promotion-record tag the content always needed. Tree content is identical to 0.1.28; no GitHub release exists for 0.1.27 or 0.1.28.

[0.1.28] - 2026-09-28

• Seven product facts re-verified after the 0.1.27 preflight stop. The product-facts-calendar release gate correctly refused tag 0.1.27: appveyor-public, semaphore-cloud-free, semaphore-community, azure-pipelines-private, bitbucket-free, buildkite-personal and ubicloud-free had all passed their expires_after. Each was re-read against its source_urls on 2026-09-28 and carries a staggered new expires_after. Three records needed correction, not just a date bump: Buildkite's plan is now named Free with 2,000 Linux vCPU minutes/month (was Personal/500), up to 10 concurrent jobs (was 3), up to 5 users (was 1) and 30-day retention (was 90); Semaphore's community edition moved from /community (404) to /open-source and is branded Semaphore Open Source; Ubicloud's credit statement was reconfirmed. No GitHub release exists for tag 0.1.27 — publication was stopped before the publish job.

[0.1.27] - 2026-09-28

• rust-supply-chain tool defaults refreshed. cargo_audit_version now defaults to 0.22.2 and cargo_machete_version to 0.9.2, the current upstream releases. Both remain caller-overridable inputs; only the default moved.

... (truncated)

Commits

• d92026c Merge pull request #144 from NDDev-OpenNetwork/release/0.1.29
• 5b773dc chore(release): 0.1.29
• 80698bd Merge pull request #142 from NDDev-OpenNetwork/release/0.1.28
• fd48db9 chore(release): 0.1.28
• 4326739 Merge pull request #141 from NDDev-OpenNetwork/fix/product-facts-refresh
• 80e9517 fix(catalog): re-verify seven expired product facts, correct three
• 84aaaa8 Merge pull request #139 from NDDev-OpenNetwork/release/0.1.27
• c22d68f chore(release): 0.1.27
• f09a486 Merge pull request #138 from NDDev-OpenNetwork/chore/rust-supply-chain-defaults
• 2a03f48 chore(rust-supply-chain): refresh caller-overridable tool defaults
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)