[dependabot]

Bumps NDDev-Technocracy-Archive/ci-workflows-20261014/.github/workflows/public-codeql.yml from 93eeb2a65e98a29e9dbff7909f67c6419abff046 to 4b53916e8a7b1c2dd220766b6dd4170a843f622e.

Changelog

Sourced from NDDev-Technocracy-Archive/ci-workflows-20261014/.github/workflows/public-codeql.yml's changelog.

Changelog

This file is a release ledger: every heading below is a real release, and scripts/check_release_ledger.py enforces that in both directions.

The project follows Semantic Versioning.

[Unreleased]

Fixed

• Make zizmor findings fail the gate in both security bundles and in zizmor-sarif.yml. With --format sarif zizmor exits 0 whatever it finds, so run_private_security_bundle.sh passed every consumer whatever the SARIF held and zizmor-sarif.yml's enforcement step never ran. The reported results now decide: the bundle prints each finding (rule, file:line) and fails; the SARIF workflow uploads first and then fails. ci proves the SARIF path refuses a template injection, like the plain path. Consumers moving to this pin must clear or deliberately ignore their pedantic low findings first.

• Re-verify the three product facts whose verification expired (GitLab for Open Source, Cloud Build and CodeBuild free tiers) against their sources; the GitLab pricing FAQ now names the open-source grant's period itself (50K compute minutes per month), so that fact no longer qualifies the monthly reading.

• Name the tool-cache action's own commit in the private security bundle's four pin comments; the github-actions bump moved the SHA to 581821d and left the comment on 616f45b, which check_pinned_actions.py refuses (the action's files are identical in both).

Changed

• Pin uv 0.13.1 (from 0.11.30) wherever workflows, examples and module validation install it, and OSV-Scanner v2.7.0 (from v2.6.0) in osv-scan.yml and the private security bundle, each verified against its upstream checksum file. actionlint 1.7.12 and gitleaks 8.30.1 are the newest releases.

• Pin zizmor 1.31.1 (from 1.26.1) in both zizmor workflows' defaults, the private security bundle and the documented commands. Its self-repository audit asks for GitHub's $/ syntax, which actionlint 1.7.12 rejects. All 65 findings on this tree are job-level reusable workflow calls, resolved from the caller's commit rather than the workspace; each carries an inline # zizmor: ignore[self-repository] until actionlint accepts $/, and a step-level ./ action is still reported (catalog/tools.yml). Consumers moving to this pin need the same comment on their own job-level uses: ./.github/workflows/... calls.

• Report allowlisted CI feedback failure codes and HTTP status without exposing remote response text, credentials, URLs or arbitrary exception messages. Preserve bounded requests, failed exit status and ambiguous-write reconciliation;

... (truncated)

Commits

• 4b53916 Merge pull request #217 from NDDev-Technocracy-Archive/fix/bundle-zizmor-enfo...
• 999232e fix(security): zizmor findings fail the bundles and the SARIF workflow
• 106d2b8 Merge pull request #216 from NDDev-Technocracy-Archive/chore/zizmor-1.31.1
• 99e11a0 chore(deps): pin zizmor 1.31.1; re-verify three expired product facts
• 9aff50f Merge pull request #215 from NDDev-Technocracy-Archive/chore/tool-pins-20261018
• 2aa5e4b chore(deps): pin uv 0.13.1 and OSV-Scanner v2.7.0
• 06fe698 fix(ci): name the tool-cache pin's own commit in its comment
• b74df9f Merge pull request #211 from NDDev-Technocracy-Archive/chore/actions-bump-208
• 55eb6e8 chore(deps): synchronize action catalog
• 3d8e5bd chore(deps): bump the github-actions group across 1 directory with 13 updates
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)