chore(ci): bump NDDev-OpenNetwork/ci-workflows/.github/workflows/secret-scan.yml from 0.1.26 to 0.1.29

[dependabot]

Bumps NDDev-OpenNetwork/ci-workflows/.github/workflows/secret-scan.yml from 0.1.26 to 0.1.29.

Release notes

Sourced from NDDev-OpenNetwork/ci-workflows/.github/workflows/secret-scan.yml's releases.

0.1.29

• Publishable re-cut of 0.1.28. Tag 0.1.28 was pushed as an unsigned lightweight ref carrying no nddev-public-release-promotion/v2 record, so the promotion gate correctly refused it — and release tags are immutable, so it cannot be updated in place. This tag is the signed annotated promotion-record tag the content always needed. Tree content is identical to 0.1.28; no GitHub release exists for 0.1.27 or 0.1.28.

Changelog

Sourced from NDDev-OpenNetwork/ci-workflows/.github/workflows/secret-scan.yml's changelog.

Changelog

This file is a release ledger: every heading below is a real release, and scripts/check_release_ledger.py enforces that in both directions.

The project follows Semantic Versioning.

[Unreleased]

• Bump urllib3 to 2.8.0 in requirements-qt.txt (recompiled via uv pip compile --upgrade-package urllib3): the osv-scan runtime fixture flagged PYSEC-2026-4176 and PYSEC-2026-4177 on the pinned 2.7.0.
• Fix the dependabot-catalog-convergence update-branch guard. A bound pull request already current with the base made the API answer no new commits, which matched neither the success pattern nor a real error — the job exited before converging the catalog and left dependabot bumps red on tool-registry/catalog.

[0.1.29] - 2026-09-28

• Publishable re-cut of 0.1.28. Tag 0.1.28 was pushed as an unsigned lightweight ref carrying no nddev-public-release-promotion/v2 record, so the promotion gate correctly refused it — and release tags are immutable, so it cannot be updated in place. This tag is the signed annotated promotion-record tag the content always needed. Tree content is identical to 0.1.28; no GitHub release exists for 0.1.27 or 0.1.28.

[0.1.28] - 2026-09-28

• Seven product facts re-verified after the 0.1.27 preflight stop. The product-facts-calendar release gate correctly refused tag 0.1.27: appveyor-public, semaphore-cloud-free, semaphore-community, azure-pipelines-private, bitbucket-free, buildkite-personal and ubicloud-free had all passed their expires_after. Each was re-read against its source_urls on 2026-09-28 and carries a staggered new expires_after. Three records needed correction, not just a date bump: Buildkite's plan is now named Free with 2,000 Linux vCPU minutes/month (was Personal/500), up to 10 concurrent jobs (was 3), up to 5 users (was 1) and 30-day retention (was 90); Semaphore's community edition moved from /community (404) to /open-source and is branded Semaphore Open Source; Ubicloud's credit statement was reconfirmed. No GitHub release exists for tag 0.1.27 — publication was stopped before the publish job.

[0.1.27] - 2026-09-28

• rust-supply-chain tool defaults refreshed. cargo_audit_version now defaults to 0.22.2 and cargo_machete_version to 0.9.2, the current upstream releases. Both remain caller-overridable inputs; only the default moved.

... (truncated)

Commits

• d92026c Merge pull request #144 from NDDev-OpenNetwork/release/0.1.29
• 5b773dc chore(release): 0.1.29
• 80698bd Merge pull request #142 from NDDev-OpenNetwork/release/0.1.28
• fd48db9 chore(release): 0.1.28
• 4326739 Merge pull request #141 from NDDev-OpenNetwork/fix/product-facts-refresh
• 80e9517 fix(catalog): re-verify seven expired product facts, correct three
• 84aaaa8 Merge pull request #139 from NDDev-OpenNetwork/release/0.1.27
• c22d68f chore(release): 0.1.27
• f09a486 Merge pull request #138 from NDDev-OpenNetwork/chore/rust-supply-chain-defaults
• 2a03f48 chore(rust-supply-chain): refresh caller-overridable tool defaults
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)