fix(catalog): refresh verified allowances and image disclosure

CHANGELOG.md

@@ -7,6 +7,9 @@ The project follows Semantic Versioning.
 
 ## [Unreleased]
 
+- Re-verify four vendor allowance records with staggered review dates, correct
+  Ubicloud's monthly credit and Harness's conditional CI credit semantics, and
+  align the disclosed Checkov image tag with the existing pinned action.
 - Publish unsuccessful completed self-workflow attempts as unassigned,
   repository-local CI evidence; preserve actual conclusions and exact attempts.
 - Accept exact matching development-commit comments and correct nested action

catalog/action-images.yml

@@ -33,7 +33,7 @@ images:
       published-evidence path for the public tier, so a substituted image would
       change what the SARIF and JSON attest to.
   - action: bridgecrewio/checkov-action
-    image: docker://ghcr.io/bridgecrewio/checkov:3.3.11
+    image: docker://ghcr.io/bridgecrewio/checkov:3.3.13
     used_by:
       - .github/workflows/iac-scan.yml
     reason: >-

catalog/product-facts.yml

@@ -994,8 +994,8 @@ facts:
   overage: upgrade
   status: vendor-verified
   source_authority: vendor
-  verified_at: '2026-08-10'
-  expires_after: '2026-09-04'
+  verified_at: '2026-09-07'
+  expires_after: '2026-10-01'
   source_urls:
   - https://www.blacksmith.sh/pricing
   notes:
@@ -1012,22 +1012,23 @@ facts:
   - Pay-as-you-go with recurring credit
   model: credit-quota
   allowance:
-    value: 2
+    value: 2.5
     unit: usd-credits
     period: month
     multipliers: {}
   conditions:
-  - About 1,250 runner minutes at cited base rate
+  - Advertised 1,250-minute equivalence uses the two-vCPU premium runner rate
   - Credit card required
   - Exact minutes depend on runner type
   payment_method: required
   overage: metered billing
   status: vendor-verified
   source_authority: vendor
-  verified_at: '2026-08-10'
-  expires_after: '2026-09-04'
+  verified_at: '2026-09-07'
+  expires_after: '2026-09-23'
   source_urls:
-  - https://www.ubicloud.com/use-cases/github-actions
+  - https://www.ubicloud.com/docs/about/pricing
+  - https://www.ubicloud.com/docs/github-actions-integration/quickstart
   notes: []
 - id: buddy-free
   provider: Buddy
@@ -1053,14 +1054,15 @@ facts:
   overage: upgrade
   status: vendor-verified
   source_authority: vendor
-  verified_at: '2026-08-10'
-  expires_after: '2026-09-04'
+  verified_at: '2026-09-07'
+  expires_after: '2026-10-03'
   source_urls:
   - https://buddy.works/pricing
+  - https://buddy.works/compare/circleci-alternative
   notes: []
 - id: harness-free
   provider: Harness
-  product: Continuous Delivery & Git Experience Free
+  product: Harness Cloud CI Free
   surface: hosted-ci
   repository_visibility:
   - public
@@ -1074,19 +1076,23 @@ facts:
     period: month
     multipliers: {}
   conditions:
-  - Harness Cloud may require card validation
+  - Free Cloud eligibility is subject to account verification and business-domain restrictions
   - Local runner is an alternative
   - Credit consumption depends on execution class
   payment_method: may-be-required
   overage: upgrade/purchase
-  status: vendor-verified
+  status: conditional
   source_authority: vendor
-  verified_at: '2026-08-10'
-  expires_after: '2026-09-04'
+  verified_at: '2026-09-07'
+  expires_after: '2026-09-17'
   source_urls:
   - https://www.harness.io/pricing
-  - https://developer.harness.io/docs/continuous-integration/get-started/ci-subscription-mgmt/
-  notes: []
+  - https://github.com/harness/developer-hub/blob/main/docs/continuous-integration/get-started/ci-subscription-mgmt.md
+  - https://github.com/harness/developer-hub/blob/main/docs/continuous-integration/ci-articles-faqs/continuous-integration-faqs.md
+  - https://www.harness.io/products/continuous-integration/harness-cloud
+  notes:
+  - Technical billing documentation defines 2,000 monthly credits with OS/resource multipliers.
+  - Marketing describes build minutes and no-card signup; do not promise universal minutes or unrestricted Cloud eligibility.
 - id: codemagic-personal
   provider: Codemagic
   product: Personal plan

docs/generated/free-tier-matrix.md

@@ -12,8 +12,8 @@ past its expiry, so a stale tier claim cannot silently mislead adopters.
 | `appcircle-always-free` | Appcircle | Always Free | public, private | Free | build-count-quota | 20 builds/month | vendor-verified | 2026-08-10 | 2026-10-02 |
 | `bitbucket-free` | Atlassian | Bitbucket Cloud Free + Pipelines | public, private | Free | recurring-quota | 50 build-minutes/month | official | 2026-08-10 | 2026-09-25 |
 | `bitrise-hobby` | Bitrise | Hobby plan | private | Hobby | credit-quota | 300 credits/month | vendor-verified | 2026-08-10 | 2026-10-02 |
-| `blacksmith-free` | Blacksmith | Free GitHub Actions runner pool | public, private | Free | recurring-quota | 3000 runner-minutes/month | vendor-verified | 2026-08-10 | 2026-09-04 |
-| `buddy-free` | Buddy | Free plan | public, private | Free | resource-quota | 300 pipeline-gb-minutes/month | vendor-verified | 2026-08-10 | 2026-09-04 |
+| `blacksmith-free` | Blacksmith | Free GitHub Actions runner pool | public, private | Free | recurring-quota | 3000 runner-minutes/month | vendor-verified | 2026-09-07 | 2026-10-01 |
+| `buddy-free` | Buddy | Free plan | public, private | Free | resource-quota | 300 pipeline-gb-minutes/month | vendor-verified | 2026-09-07 | 2026-10-03 |
 | `buildkite-personal` | Buildkite | Personal plan hosted agents | public, private | Personal | recurring-quota | 500 linux-vcpu-minutes/month | official | 2026-08-10 | 2026-09-25 |
 | `circleci-free` | CircleCI | Free plan | public, private | Free | credit-quota | 30000 credits/month | official | 2026-08-10 | 2026-09-18 |
 | `circleci-open-source` | CircleCI | Open Source plan credits | public | Approved OSS | application-grant | 400000 credits/month | official | 2026-08-10 | 2026-09-18 |
@@ -41,14 +41,14 @@ past its expiry, so a stale tier claim cannot silently mislead adopters.
 | `gitlab-free-hosted` | GitLab | GitLab.com Free compute | public, private | Free | recurring-quota | 400 compute-minutes/month | official | 2026-08-10 | 2026-09-11 |
 | `gitlab-open-source-program` | GitLab | GitLab for Open Source | public | Ultimate for qualifying OSS | application-grant | 50000 compute-minutes/month | official | 2026-08-10 | 2026-09-11 |
 | `google-cloud-build-free` | Google Cloud | Cloud Build free tier | public, private | Google Cloud Free Tier | recurring-quota | 2500 e2-standard-2-build-minutes/month | official | 2026-08-10 | 2026-10-16 |
-| `harness-free` | Harness | Continuous Delivery & Git Experience Free | public, private | Free | credit-quota | 2000 credits/month | vendor-verified | 2026-08-10 | 2026-09-04 |
+| `harness-free` | Harness | Harness Cloud CI Free | public, private | Free | credit-quota | 2000 credits/month | conditional | 2026-09-07 | 2026-09-17 |
 | `teamcity-professional` | JetBrains | TeamCity Professional | public, private, internal | Professional | zero-license-self-hosted | unmetered (build-minutes) | official | 2026-08-10 | 2026-10-23 |
 | `azure-pipelines-private` | Microsoft Azure DevOps | Azure Pipelines private projects | private | Free included parallel job | recurring-quota | 1800 hosted-minutes/month | official | 2026-08-10 | 2026-09-25 |
 | `azure-pipelines-public-retirement` | Microsoft Azure DevOps | Azure DevOps public projects | public | Legacy only | retiring | 0 new-public-projects/feature | deprecated | 2026-07-11 | 2027-01-01 |
 | `semaphore-cloud-free` | Semaphore | Cloud free recurring credit | public, private | Free | credit-quota | 15 usd-credits/month | official | 2026-08-10 | 2026-09-25 |
 | `semaphore-community` | Semaphore | Semaphore Community Edition | public, private, internal | Community | zero-license-self-hosted | unmetered (build-minutes) | official | 2026-08-10 | 2026-09-25 |
 | `travis-open-source-conditional` | Travis CI | Open source credits | public | OSS grant | application-grant | credits | conditional | 2026-08-10 | 2026-10-23 |
-| `ubicloud-free` | Ubicloud | GitHub Actions runners monthly credit | public, private | Pay-as-you-go with recurring credit | credit-quota | 2 usd-credits/month | vendor-verified | 2026-08-10 | 2026-09-04 |
+| `ubicloud-free` | Ubicloud | GitHub Actions runners monthly credit | public, private | Pay-as-you-go with recurring credit | credit-quota | 2.5 usd-credits/month | vendor-verified | 2026-09-07 | 2026-09-23 |
 
 ---
 Generated from catalog/product-facts.yml.