0.1.29

• Publishable re-cut of 0.1.28. Tag 0.1.28 was pushed as an unsigned
  lightweight ref carrying no nddev-public-release-promotion/v2 record, so
  the promotion gate correctly refused it — and release tags are immutable,
  so it cannot be updated in place. This tag is the signed annotated
  promotion-record tag the content always needed. Tree content is identical
  to 0.1.28; no GitHub release exists for 0.1.27 or 0.1.28.

0.1.26

• dependabot-catalog-convergence repaired. The job now builds the
  trusted tool environment and launches sync_action_catalog.py through the
  execution-contract launcher. The bare python3 -I invocation could not
  resolve the ci_workflows_tools verified-file-spec package, so every
  convergence run since the sibling-import migration failed with
  ModuleNotFoundError. The workflow is registered in the catalog used_by
  for setup-python and setup-uv like every other consumer.
• Catalog review record. setup-rust-toolchain v2.0.0 review outcome is
  now persisted in catalog/tools.yml: the major bump stays held because the
  implicit RUSTFLAGS=-D warnings default becomes build.warnings (cargo

  = 1.97), which would silently weaken the gate for callers on older
  toolchains. The Dependabot PR remains the tracking surface.

0.1.25

• Refuse ./action refs inside workflow_call workflows. ./ in a
  called workflow resolves against the caller's workspace, never this
  repository's, so uses: ./actions/x in a reusable fails at job setup for
  every cross-repository consumer. check_pinned_actions.py now rejects the
  pattern; the affected workflows were repaired in 0.1.24.
• Scheduled tool refresh, 2026-09-21. Bumped twelve action pins and three
  CLI pins to their current upstream releases: codeql-action v4.38.1,
  setup-android v4.0.4, setup-r v2.14.0, codecov-action v7.1.1, typos
  v1.50.2, checkov-action v12.3125.0, github-action-benchmark v1.22.2,
  setup-uv v10.1.0, setup-java v6.0.1, setup-buildx-action v4.4.1,
  build-push-action v7.4.0, install-action v2.87.17; osv-scanner 2.6.0,
  semgrep 1.177.0 and syft 1.52.0 with re-verified release checksums.
  setup-rust-toolchain stays on v1.17.0 (upstream v2.0.0 is a major bump
  pending input-contract review) and zizmor stays on 1.26.1 (upstream
  v1.30.1 reports 65 new low findings on this tree, held for dedicated
  triage). Every catalog last_verified restamped to the audit date.

0.1.24

• Fix a reusable workflow that could not reach its own vendored actions.
  ./actions/... in a called workflow resolves against the caller's
  workspace, never this repository. Five uses: were written that way while
  vendoring, and each one fails at job setup for every cross-repository
  caller:

  • ci-feedback.yml has used ./actions/ci-feedback since 0.1.21. It runs
    no checkout, so the workspace is empty and the step cannot resolve. The
    job only fires on a failed conclusion, so it stayed hidden until
    2026-09-20, when github-device-sync run 35541640707 reported
    Can't find 'action.yml' ... under /home/runner/work/github-device-sync/github-device-sync/actions/ci-feedback.
    Every reusable caller of the CI-feedback path has been silently unable to
    publish evidence for three releases.
  • private-security-bundle-free.yml gained four ./actions/tool-cache
    references in 0.1.22/0.1.23, replacing the fully-qualified
    NDDev-Archive/github-actions-garm/actions/tool-cache@468af475 that
    worked. It does check out the caller, so the path resolved into the
    caller's tree: setup-systems run 35541466805 failed with
    Can't find 'action.yml' ... under .../setup-systems/setup-systems/actions/tool-cache.

  All five now name the repository explicitly and pin it:
  NDDev-OpenNetwork/ci-workflows/actions/<name>@96215b32. That commit is
  0.1.23, which is where both actions already live, so the pin is real and
  immutable. Vendoring the action was correct; addressing it with ./ was
  not, and the distinction is that a reusable workflow has no path to its own
  repository unless it names it.

0.1.23

• tool-cache: vendor the composite action into actions/tool-cache/
  (byte-identical to NDDev-Archive/github-actions-garm 468af475) and
  repoint the four uses: in private-security-bundle-free.yml to the
  same-repository path. An archived dependency cannot receive fixes; the live
  copy now lives beside the workflow that runs it, matching the ci-feedback
  vendoring in 0.1.21.
• Examples and docs: the retired GARM label classes (nddev-linux-standard,
  nddev-linux-untrusted, nddev-linux-integration) are replaced by the live
  nddev-linux label in docs/03, examples/nddev/security-private-selfhosted.yml,
  and the deny_runner/docker-build comments; ADR-0004 records the cutover
  as a dated amendment.

0.1.21

• ci-feedback: vendor the reusable workflow and its composite action into
  this repository. Their home NDDev-OpenNetwork/github-actions moved to
  NDDev-Archive/github-actions-garm on 2026-09-17, and an archived
  repository cannot serve a workflow_call, so every caller of
  ci-feedback-events.yml failed at resolution. The workflow now lives at
  .github/workflows/ci-feedback.yml and the action at actions/ci-feedback/;
  callers reference the same-repository path. Other repositories' own
  ci-feedback-events.yml files still point at the archived path and need the
  same repoint. tool-cache action references are repointed at the moved
  repository (same pinned commit).

0.1.20

• Re-verify three expired product facts (circleci-free,
  circleci-open-source, harness-free) against their recorded
  source_urls; all claims still hold verbatim. Carries the
  rust-supply-chain toolchain fix unchanged from the 0.1.19 tag —
  that tag exists but its release was never published because release
  preflight declined on the expired facts; pin 0.1.20.

ci-workflows 0.1.18

Patch release after the official-runner cutover.

• fleet_contract is NDDev-OpenNetwork/github-actions-light / official-actions-runner
• NDDev example routes private Linux classes to nddev-linux
• Restores green ci on main (PR #112, issues #110/#111)

Source: the merge commit of PR #113.

0.1.17

• Re-verify GitLab Free and Open Source allowances against current primary
  sources, with separate review deadlines and explicit eligibility conditions.

• Preserve complete redacted private security evidence in a bounded, checksummed
  run-log ZIP when artifact upload fails. Scanner enforcement and failed fallback
  remain blocking; no new token permission or external storage is required.

• Add optional check_name to the private-free security bundle so callers can
  retain an existing required check identity when migrating away from SARIF
  publication, with all four scanners and evidence artifacts preserved.

• Synchronize pins by catalog action family, preserving independent subpath actions
  and reusable workflows in the same repository. Apply the reviewed dependency
  updates from #92 with matching catalog and transitive-image records; historical
  evidence digests are no longer rewritten by an unrelated action update.

• Stop treating the publisher as an Enterprise Cloud buyer of Code Security,
  Secret Protection and Code Quality. Paid programmes stay explicitly
  selectable; public CodeQL, SARIF, Scorecard and attestations stay. Private
  repositories without those purchases use the private-free programme. A live
  GitHub plan belongs to one organization and is not copied between accounts.
  Consumer adoption resolves the programme from the immutable release being
  pinned, not from main. Private attestations stay an Enterprise Cloud plan
  gate, independent of the three add-ons.

• Dependabot catalog convergence commits only catalog and generated docs, so
  the default GITHUB_TOKEN can push without workflows permission.
  Catalog-only follows the unique workflow pin per action and fails closed
  when identities are mixed, so the catalog cannot describe a pin the tree
  does not share. Ordinary merge in this repository does not require a
  general CI status check; ci-gate stays truthful advisory evidence.
  Authored skill metadata: mappings stay mappings.

• Re-verify four vendor allowance records with staggered review dates, correct
  Ubicloud's monthly credit and Harness's conditional CI credit semantics, and
  align the disclosed Checkov image tag with the existing pinned action.

• Publish unsuccessful completed self-workflow attempts as unassigned,
  repository-local CI evidence; preserve actual conclusions and exact attempts.

• Accept exact matching development-commit comments and correct nested action
  pin validation and container whitespace rejection. Keep registrations scoped to their actual action paths.

• Declare both git-submodule and reusable-workflow consumption in the GDS
  module contract. Refresh its projection using the existing stable bundle.

• Place the Docker publisher permission explanation inline so the pinned
  pedantic audit recognizes it; workflow permissions and behavior are unchanged.

0.1.16

• security-bundle authenticates its exact called-workflow source fetch with
  the job token, so a shared fleet egress address cannot exhaust GitHub's
  anonymous allowance and stop the gate before any scanner runs.