chore(deps): bump the github-actions group across 1 directory with 2 updates

[dependabot]

Bumps the github-actions group with 2 updates in the / directory: NDDev-Technocracy-Sandbox/ci-workflows/.github/workflows/ci-feedback.yml and NDDev-Technocracy-Sandbox/ci-workflows/.github/workflows/public-codeql.yml.

Updates NDDev-Technocracy-Sandbox/ci-workflows/.github/workflows/ci-feedback.yml from 0.1.26 to 0.1.29

Release notes

Sourced from NDDev-Technocracy-Sandbox/ci-workflows/.github/workflows/ci-feedback.yml's releases.

0.1.29

• Publishable re-cut of 0.1.28. Tag 0.1.28 was pushed as an unsigned lightweight ref carrying no nddev-public-release-promotion/v2 record, so the promotion gate correctly refused it — and release tags are immutable, so it cannot be updated in place. This tag is the signed annotated promotion-record tag the content always needed. Tree content is identical to 0.1.28; no GitHub release exists for 0.1.27 or 0.1.28.

Changelog

Sourced from NDDev-Technocracy-Sandbox/ci-workflows/.github/workflows/ci-feedback.yml's changelog.

Changelog

This file is a release ledger: every heading below is a real release, and scripts/check_release_ledger.py enforces that in both directions.

The project follows Semantic Versioning.

[Unreleased]

• Reconcile active workflow/action references, identity checks, consumer examples and validators after the repository transfer to NDDev-Technocracy-Sandbox. Retain all executable dependency SHAs, permissions and immutable releases; GitHub Actions does not follow repository redirects. Historical Scorecard receipts retain their recorded repository identity.

• Select the existing checksum-verified Gitleaks binary mode for this repository's own scan; history scope and scanner version remain unchanged.

• Reverify GitHub larger-runner and self-hosted execution billing facts against official documentation. State the larger-runner organization/enterprise Team/Enterprise Cloud restriction explicitly and retain separate storage costs.

• Isolate synthetic tier-selection Git fixtures from user/system hooks and make promotion-renderer fixtures resolve their real jq/sha256sum prerequisites on macOS as well as Linux.

• Run cargo-deny 0.20.2 natively through the checksum-pinned installer, removing Docker Hub anonymous pull limits from dependency checks. Retain runner selection, check names, permissions and caller arguments; parse argument strings into argv without shell evaluation.

• Harden private-security-bundle-free submodule sync. A symlink planted at a declared submodule path on a reused runner would have redirected the no-keys cleanup (rm -rf "$path"/* dereferences a symlinked directory) and a keyed submodule update alike — links are now unlinked outright rather than followed, and the temporary deploy-key directory is removed by an EXIT trap instead of persisting until the job ends.

• Fix private-security-bundle-free scanning stale submodule worktrees. On a reused self-hosted worktree the caller checkout leaves previously cloned submodules untouched (git clean -ffdx does not remove an initialized submodule — its path is a tracked gitlink), so the recursive gates read whatever revision an earlier job left behind. A new optional submodule_deploy_keys secret carries path base64-ssh-private-key pairs; when supplied, every declared submodule is checked out at its recorded gitlink and verified before scanning, and when absent stale submodule worktrees are emptied so leftovers can never report as this commit's content.

• Give both private security bundles a fresh implementation checkout for each invocation, preserving stale runner files. Materialize the selected Git history before Gitleaks and fail when any required object is unavailable.

... (truncated)

Commits

• d92026c Merge pull request #144 from NDDev-OpenNetwork/release/0.1.29
• 5b773dc chore(release): 0.1.29
• 80698bd Merge pull request #142 from NDDev-OpenNetwork/release/0.1.28
• fd48db9 chore(release): 0.1.28
• 4326739 Merge pull request #141 from NDDev-OpenNetwork/fix/product-facts-refresh
• 80e9517 fix(catalog): re-verify seven expired product facts, correct three
• 84aaaa8 Merge pull request #139 from NDDev-OpenNetwork/release/0.1.27
• c22d68f chore(release): 0.1.27
• f09a486 Merge pull request #138 from NDDev-OpenNetwork/chore/rust-supply-chain-defaults
• 2a03f48 chore(rust-supply-chain): refresh caller-overridable tool defaults
• Additional commits viewable in compare view

Updates NDDev-Technocracy-Sandbox/ci-workflows/.github/workflows/public-codeql.yml from 0.1.26 to 0.1.29

Release notes

Sourced from NDDev-Technocracy-Sandbox/ci-workflows/.github/workflows/public-codeql.yml's releases.

0.1.29

• Publishable re-cut of 0.1.28. Tag 0.1.28 was pushed as an unsigned lightweight ref carrying no nddev-public-release-promotion/v2 record, so the promotion gate correctly refused it — and release tags are immutable, so it cannot be updated in place. This tag is the signed annotated promotion-record tag the content always needed. Tree content is identical to 0.1.28; no GitHub release exists for 0.1.27 or 0.1.28.

Changelog

Sourced from NDDev-Technocracy-Sandbox/ci-workflows/.github/workflows/public-codeql.yml's changelog.

Changelog

This file is a release ledger: every heading below is a real release, and scripts/check_release_ledger.py enforces that in both directions.

The project follows Semantic Versioning.

[Unreleased]

• Reconcile active workflow/action references, identity checks, consumer examples and validators after the repository transfer to NDDev-Technocracy-Sandbox. Retain all executable dependency SHAs, permissions and immutable releases; GitHub Actions does not follow repository redirects. Historical Scorecard receipts retain their recorded repository identity.

• Select the existing checksum-verified Gitleaks binary mode for this repository's own scan; history scope and scanner version remain unchanged.

• Reverify GitHub larger-runner and self-hosted execution billing facts against official documentation. State the larger-runner organization/enterprise Team/Enterprise Cloud restriction explicitly and retain separate storage costs.

• Isolate synthetic tier-selection Git fixtures from user/system hooks and make promotion-renderer fixtures resolve their real jq/sha256sum prerequisites on macOS as well as Linux.

• Run cargo-deny 0.20.2 natively through the checksum-pinned installer, removing Docker Hub anonymous pull limits from dependency checks. Retain runner selection, check names, permissions and caller arguments; parse argument strings into argv without shell evaluation.

• Harden private-security-bundle-free submodule sync. A symlink planted at a declared submodule path on a reused runner would have redirected the no-keys cleanup (rm -rf "$path"/* dereferences a symlinked directory) and a keyed submodule update alike — links are now unlinked outright rather than followed, and the temporary deploy-key directory is removed by an EXIT trap instead of persisting until the job ends.

• Fix private-security-bundle-free scanning stale submodule worktrees. On a reused self-hosted worktree the caller checkout leaves previously cloned submodules untouched (git clean -ffdx does not remove an initialized submodule — its path is a tracked gitlink), so the recursive gates read whatever revision an earlier job left behind. A new optional submodule_deploy_keys secret carries path base64-ssh-private-key pairs; when supplied, every declared submodule is checked out at its recorded gitlink and verified before scanning, and when absent stale submodule worktrees are emptied so leftovers can never report as this commit's content.

• Give both private security bundles a fresh implementation checkout for each invocation, preserving stale runner files. Materialize the selected Git history before Gitleaks and fail when any required object is unavailable.

... (truncated)

Commits

• d92026c Merge pull request #144 from NDDev-OpenNetwork/release/0.1.29
• 5b773dc chore(release): 0.1.29
• 80698bd Merge pull request #142 from NDDev-OpenNetwork/release/0.1.28
• fd48db9 chore(release): 0.1.28
• 4326739 Merge pull request #141 from NDDev-OpenNetwork/fix/product-facts-refresh
• 80e9517 fix(catalog): re-verify seven expired product facts, correct three
• 84aaaa8 Merge pull request #139 from NDDev-OpenNetwork/release/0.1.27
• c22d68f chore(release): 0.1.27
• f09a486 Merge pull request #138 from NDDev-OpenNetwork/chore/rust-supply-chain-defaults
• 2a03f48 chore(rust-supply-chain): refresh caller-overridable tool defaults
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: ci, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[dependabot]

Looks like these dependencies are no longer updatable, so this is no longer needed.