fix(ci): preserve component identities and converge dependency pins

.github/workflows/ci.yml

@@ -44,7 +44,7 @@ jobs:
       contents: read
     steps:
       - name: Harden runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c  # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1  # v2.21.1
         with:
           egress-policy: block
           allowed-endpoints: >
@@ -99,7 +99,7 @@ jobs:
       contents: read
     steps:
       - name: Harden runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c  # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1  # v2.21.1
         with:
           egress-policy: block
           allowed-endpoints: >

.github/workflows/cpp-ci.yml

@@ -95,7 +95,7 @@ jobs:
 
       - name: Set up ccache
         if: ${{ inputs.enable_ccache }}
-        uses: hendrikmuhs/ccache-action@d62db5f07c26379fc4b4e0916f098a92573c3b03  # v1.2.23
+        uses: hendrikmuhs/ccache-action@f09c25b45002a07be2955cbe52e8cee55643f89d  # v1.2.24
         with:
           key: ${{ inputs.ccache_key }}
 

.github/workflows/dependabot-catalog-convergence.yml

@@ -31,7 +31,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Harden runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
       - name: Checkout trusted generator

.github/workflows/docs-quality.yml

@@ -75,7 +75,7 @@ jobs:
 
       - name: Spell check (typos)
         if: ${{ inputs.typos }}
-        uses: crate-ci/typos@8a48f81b6c64dcfea44b3633223084c4be58ac5f  # v1.49.0
+        uses: crate-ci/typos@4d9c206a77c041268485162b8e2579ad7a5cb9a3  # v1.50.0
         with:
           files: ${{ inputs.typos_files }}
 

.github/workflows/grype-scan.yml

@@ -44,7 +44,7 @@ jobs:
           persist-credentials: false
 
       - name: Grype scan
-        uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2  # v7.4.0
+        uses: anchore/scan-action@27805bf3b4e84b4a5c980df22ed233c00390a439  # v7.4.2
         with:
           path: ${{ inputs.path }}
           fail-build: ${{ inputs.fail_build }}

.github/workflows/iac-scan.yml

@@ -48,7 +48,7 @@ jobs:
           persist-credentials: false
 
       - name: Checkov
-        uses: bridgecrewio/checkov-action@59b9d7edfcad5b87fbe3f473a9a134a721ad03f8  # v12.3119.0
+        uses: bridgecrewio/checkov-action@f967808197a8d784d3e72919f38c3ff0cda7884e  # v12.3122.0
         with:
           directory: ${{ inputs.directory }}
           framework: ${{ inputs.framework }}

.github/workflows/maintenance.yml

@@ -39,7 +39,7 @@ jobs:
       issues: write   # file/update the single tracking issue
     steps:
       - name: Harden runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c  # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1  # v2.21.1
         with:
           egress-policy: block
           allowed-endpoints: >

.github/workflows/nddev-security-bundle.yml

@@ -40,7 +40,7 @@ jobs:
       security-events: write  # publish zizmor SARIF to code scanning
     steps:
       - name: Harden runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c  # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1  # v2.21.1
         with:
           egress-policy: audit
 
@@ -160,7 +160,7 @@ jobs:
 
       - name: Upload zizmor SARIF
         if: ${{ !cancelled() && steps.scan.conclusion != 'skipped' }}
-        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28  # v4.37.8
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
         with:
           sarif_file: ${{ runner.temp }}/private-security-zizmor.sarif
           category: zizmor

.github/workflows/public-codeql.yml

@@ -79,7 +79,7 @@ jobs:
         language: ${{ fromJSON(inputs.languages) }}
     steps:
       - name: Harden runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c  # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1  # v2.21.1
         with:
           egress-policy: ${{ inputs.egress_policy }}
 
@@ -115,21 +115,21 @@ jobs:
 
       - name: Initialize CodeQL
         if: ${{ inputs.config_file == '' }}
-        uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28  # v4.37.8
+        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
         with:
           languages: ${{ matrix.language }}
           queries: ${{ inputs.queries }}
 
       - name: Initialize CodeQL with config
         if: ${{ inputs.config_file != '' }}
-        uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28  # v4.37.8
+        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
         with:
           languages: ${{ matrix.language }}
           config-file: ${{ inputs.config_file }}
 
       - name: Autobuild
         if: ${{ inputs.autobuild && inputs.build_command == '' }}
-        uses: github/codeql-action/autobuild@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28  # v4.37.8
+        uses: github/codeql-action/autobuild@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
 
       - name: Custom build
         if: ${{ inputs.build_command != '' }}
@@ -139,13 +139,13 @@ jobs:
 
       - name: Analyze
         if: ${{ inputs.output_directory == '' }}
-        uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28  # v4.37.8
+        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
         with:
           category: "/language:${{ matrix.language }}"
 
       - name: Analyze with output directory
         if: ${{ inputs.output_directory != '' }}
-        uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28  # v4.37.8
+        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
         with:
           category: "/language:${{ matrix.language }}"
           output: ${{ inputs.output_directory }}

.github/workflows/public-dependency-review.yml

@@ -36,7 +36,7 @@ jobs:
       pull-requests: write    # post the dependency-review summary comment
     steps:
       - name: Harden runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c  # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1  # v2.21.1
         with:
           egress-policy: audit
 

.github/workflows/public-scorecard-analysis.yml

@@ -34,7 +34,7 @@ jobs:
       actions: read           # Scorecard inspects workflow definitions
     steps:
       - name: Harden runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c  # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1  # v2.21.1
         with:
           egress-policy: audit
 

.github/workflows/public-scorecard-json.yml

@@ -39,7 +39,7 @@ jobs:
       actions: read           # Scorecard inspects workflow definitions
     steps:
       - name: Harden runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c  # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1  # v2.21.1
         with:
           egress-policy: audit
 

.github/workflows/public-scorecard.yml

@@ -51,7 +51,7 @@ jobs:
       actions: read           # Scorecard inspects workflow definitions
     steps:
       - name: Harden runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c  # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1  # v2.21.1
         with:
           egress-policy: audit
 
@@ -165,7 +165,7 @@ jobs:
       - name: Upload SARIF to code scanning
         id: upload-sarif
         if: ${{ github.event_name != 'pull_request' || inputs.upload_sarif_on_forks || github.event.pull_request.head.repo.full_name == github.repository }}
-        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28  # v4.37.8
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
         with:
           sarif_file: results.sarif
           category: ${{ inputs.sarif_category }}

.github/workflows/qt-ci.yml

@@ -289,7 +289,7 @@ jobs:
 
       - name: Set up ccache
         if: ${{ inputs.enable_ccache }}
-        uses: hendrikmuhs/ccache-action@d62db5f07c26379fc4b4e0916f098a92573c3b03  # v1.2.23
+        uses: hendrikmuhs/ccache-action@f09c25b45002a07be2955cbe52e8cee55643f89d  # v1.2.24
         with:
           key: ${{ inputs.ccache_key }}
 

.github/workflows/r-ci.yml

@@ -64,7 +64,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up R
-        uses: r-lib/actions/setup-r@d3c5be51b12e724e68f33216ca3c148b66d5f0b6  # v2.12.1
+        uses: r-lib/actions/setup-r@465b7d8e732ca3921382b1674c59bada9cbf3399  # v2.13.0
         with:
           r-version: ${{ inputs.r_version }}
           use-public-rspm: ${{ inputs.use_public_rspm }}

.github/workflows/release.yml

@@ -46,7 +46,7 @@ jobs:
       version: ${{ steps.v.outputs.version }}
     steps:
       - name: Harden runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c  # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1  # v2.21.1
         with:
           egress-policy: block
           allowed-endpoints: >

.github/workflows/rust-supply-chain.yml

@@ -97,7 +97,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Install cargo-audit
-        uses: taiki-e/install-action@b6ff580856c41316412a0b9b60540fbc6f8c82cc  # v2.86.7
+        uses: taiki-e/install-action@1ed6d7be6168f6c9046541087ff549b6bc581fdf  # v2.87.2
         with:
           tool: cargo-audit@${{ inputs.cargo_audit_version }}
       - name: Run cargo-audit
@@ -116,7 +116,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Install cargo-machete
-        uses: taiki-e/install-action@b6ff580856c41316412a0b9b60540fbc6f8c82cc  # v2.86.7
+        uses: taiki-e/install-action@1ed6d7be6168f6c9046541087ff549b6bc581fdf  # v2.87.2
         with:
           tool: cargo-machete@${{ inputs.cargo_machete_version }}
       - name: Run cargo-machete

.github/workflows/zizmor-sarif.yml

@@ -47,7 +47,7 @@ jobs:
       security-events: write  # publish zizmor SARIF to code scanning
     steps:
       - name: Harden runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c  # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1  # v2.21.1
         with:
           egress-policy: audit
 
@@ -82,7 +82,7 @@ jobs:
             "${ZIZMOR_TARGET}" > zizmor.sarif
 
       - name: Upload SARIF to code scanning
-        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28  # v4.37.8
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
         with:
           sarif_file: zizmor.sarif
           category: zizmor

CHANGELOG.md

@@ -7,6 +7,11 @@ The project follows Semantic Versioning.
 
 ## [Unreleased]
 
+- Synchronize pins by catalog action family, preserving independent subpath actions
+  and reusable workflows in the same repository. Apply the reviewed dependency
+  updates from #92 with matching catalog and transitive-image records; historical
+  evidence digests are no longer rewritten by an unrelated action update.
+
 - Stop treating the publisher as an Enterprise Cloud buyer of Code Security,
   Secret Protection and Code Quality. Paid programmes stay explicitly
   selectable; public CodeQL, SARIF, Scorecard and attestations stay. Private

catalog/action-images.yml

@@ -33,7 +33,7 @@ images:
       published-evidence path for the public tier, so a substituted image would
       change what the SARIF and JSON attest to.
   - action: bridgecrewio/checkov-action
-    image: docker://ghcr.io/bridgecrewio/checkov:3.3.13
+    image: docker://ghcr.io/bridgecrewio/checkov:3.3.16
     used_by:
       - .github/workflows/iac-scan.yml
     reason: >-

catalog/python-execution.yml

@@ -625,6 +625,9 @@
       "_workflow_yaml",
       "check_python_execution_contract",
       "check_scorecard_evidence_contract"
+    ],
+    "sync_action_catalog.py": [
+      "_strict_yaml"
     ]
   },
   "direct_external_imports": {

catalog/scorecard-evidence.yml

@@ -11,7 +11,7 @@ entrypoint_matrix:
       contents: read
     harden_runner:
       required: true
-      pin: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c
+      pin: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1
       egress_policy: audit
       position: first
     allowed_callers:
@@ -38,7 +38,7 @@ entrypoint_matrix:
       security-events: write
     harden_runner:
       required: true
-      pin: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c
+      pin: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1
       egress_policy: audit
       position: first
     allowed_callers:
@@ -66,7 +66,7 @@ category_contract:
     guid: null
   source_urls:
     - https://github.com/ossf/scorecard/blob/v5.5.0/pkg/scorecard/sarif.go
-    - https://github.com/github/codeql-action/blob/db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28/src/upload-lib.ts
+    - https://github.com/github/codeql-action/blob/cdf488f595d80d6e07e03d4674febd5ab45fa938/src/upload-lib.ts
     - https://docs.github.com/en/code-security/reference/code-scanning/sarif-files/sarif-support-for-code-scanning
 attempts:
   - attempt: 1