chore(deps): bump the github-actions group across 1 directory with 3 updates

[dependabot]

Bumps the github-actions group with 3 updates in the / directory: NDDev-OpenNetwork/github-actions/.github/workflows/ci-feedback.yml, NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml and NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml.

Updates NDDev-OpenNetwork/github-actions/.github/workflows/ci-feedback.yml from a0dc5592333dcfdf2a3d239ed1f2b128899e5482 to a8fd623d86582ec13c434f7cd124ea6b8170dd5e

Changelog

Sourced from NDDev-OpenNetwork/github-actions/.github/workflows/ci-feedback.yml's changelog.

Changelog

Unreleased

• Recovery requires exact complete progress evidence, preserves unresolved identities on checkpoint/restart failures, and never replays interrupted restart authorization. Blocked/suppressed stalled work remains unhealthy; FileStore admits only one unfinished attempt across concurrent decisions. Scoped action ownership and admission fencing remain separate rollout work.

• Publish background CI failures as unassigned repository-local issues with exact run/attempt/job identity. Classify actions/ci-feedback/feedback.py in the network-bootstrap inventory. The in-repo workflow_run caller includes cancelled so already-failed jobs on a cancelled attempt still reach publish(); a clean cancel still creates no issue. Dedup trusts the configured immutable bot account ID, not arbitrary App bots, and recovers a durable marker after a lost POST reply. This publisher does not invent an agent consumer or execute log text.

• Scale up from durable admitted queue ownership, not GitHub DesiredRunnerCount. After a sibling runner is deleted, GitHub reports zero assigned jobs while JobAssigned waiters still need a runner, so autoscale never called create and Almaty Candidate certified cycled a new UUID every five minutes with the scale set at 0. Pre-job creates also bind a queued non-terminal waiter when the journal is not yet assigned, and terminal lineage is omitted from retry inventory. This is GARM v0.2.1-nddev.91.

• Pack 4 GiB workers onto the member with the least remaining memory that still fits, instead of spreading onto empty 16 GiB hosts. The emptiest- member tie-break is what parked 4 GiB warms on gha-runner-2 and left 8 GiB Almaty JIT with nowhere to land. This is v0.1.5-nddev.129.

• Yield 4 GiB warm refill while an 8 GiB job is waiting. A 4 GiB warm cannot be claimed by linux-release or priority-integration, and placing it on an empty 16 GiB member is what kept Almaty 8 GiB JIT queued. ReconcileWarm treats the smaller class target as zero until the larger wait clears, and the same-size warms of a different pool yield too. This is v0.1.5-nddev.128.

• Do not count terminal queue lineage as live wait. A completed or cancelled GitHub job is retained so a replacement UUID can inherit FirstQueuedAt, but observer oldest-queued metrics treated those markers as GitHub-queued work. On 2026-09-06 that paged lifecycle_queued_delivery_stall for a finished nddev-linux-fast schedule and cancelled linux-release jobs. ReadActive omits non-running terminal intents.

• When Incus placement refuses a cold create, preempt unclaimed warms on one Incus member until their reserved memory covers the request. Fleet-sum Evaluate already admitted, so .126 stopped after the first 4 GiB warm

... (truncated)

Commits

• a8fd623 Merge pull request #423: trusted self-workflow failure feedback
• cf86b3c ci: include CodeQL in background failure feedback
• 3912e3a Merge pull request #421 from NDDev-OpenNetwork/integrate/recovery-evidence-20...
• 5549459 fix(recovery): preserve exact evidence and serialize attempt admission
• See full diff in compare view

Updates NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml from 0.1.11 to 0.1.15

Release notes

Sourced from NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml's releases.

0.1.14

• Enable Corepack's pnpm and Yarn shims before activating the caller-pinned package-manager version, so hosted Node jobs resolve the requested binary instead of finding no pnpm or the image's unrelated Yarn Classic install.

0.1.13

• Added an optional dedicated runner for Docker-based cargo-deny so cargo-audit and cargo-machete can use a lighter runner without weakening supply-chain coverage.

Changelog

Sourced from NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml's changelog.

Changelog

This file is a release ledger: every heading below is a real release, and scripts/check_release_ledger.py enforces that in both directions.

The project follows Semantic Versioning.

[Unreleased]

• Publish unsuccessful completed self-workflow attempts as unassigned, repository-local CI evidence; preserve actual conclusions and exact attempts.

• Accept exact matching development-commit comments and correct nested action pin validation and container whitespace rejection. Keep registrations scoped to their actual action paths.

• Declare both git-submodule and reusable-workflow consumption in the GDS module contract. Refresh its projection using the existing stable bundle.

• Place the Docker publisher permission explanation inline so the pinned pedantic audit recognizes it; workflow permissions and behavior are unchanged.

[0.1.16] - 2026-09-02

• security-bundle authenticates its exact called-workflow source fetch with the job token, so a shared fleet egress address cannot exhaust GitHub's anonymous allowance and stop the gate before any scanner runs.

[0.1.15] - 2026-08-31

• docker-build.yml: reusable BuildKit image build whose layer cache outlives the runner (registry cache on ghcr by default, gha and none backends), registered across the catalog with an infra example.
• security-bundle (free): the called-workflow source fetch retries and falls back to protocol v0, and evidence uploads only when the scan ran.
• Dependabot pin-registry synchronization for the bumped action set.

[0.1.14] - 2026-08-30

• Enable Corepack's pnpm and Yarn shims before activating the caller-pinned package-manager version, so hosted Node jobs resolve the requested binary instead of finding no pnpm or the image's unrelated Yarn Classic install.

[0.1.13] - 2026-08-27

• Added an optional dedicated runner for Docker-based cargo-deny so cargo-audit and cargo-machete can use a lighter runner without weakening supply-chain coverage.

[0.1.12] - 2026-08-27

• The signed 0.1.12 tag is retained as immutable rejected evidence because its candidate changelog used the next local-calendar date rather than the

... (truncated)

Commits

• 706233f Merge pull request #78 from NDDev-OpenNetwork/fix/upload-evidence-only-when-t...
• bdbcf13 fix(security): upload evidence only when the scan ran
• 143645d Merge pull request #76 from NDDev-OpenNetwork/fix/fetch-the-called-workflow-r...
• 92a9f69 fix(security): fetch the called workflow resiliently
• 483a3df Merge pull request #74 from NDDev-OpenNetwork/release/0.1.14
• c18582d chore(release): prepare 0.1.14
• 800357e Merge pull request #73 from NDDev-OpenNetwork/fix/enable-corepack-shims
• e20700e fix(node): enable Corepack shims before activation
• e3270c5 Merge pull request #72 from NDDev-OpenNetwork/rollout/gds-070-stable
• 240c93b chore(gds): promote stable bundle 0.7.0
• Additional commits viewable in compare view

Updates NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml from 0.1.11 to 0.1.15

Release notes

Sourced from NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml's releases.

0.1.14

• Enable Corepack's pnpm and Yarn shims before activating the caller-pinned package-manager version, so hosted Node jobs resolve the requested binary instead of finding no pnpm or the image's unrelated Yarn Classic install.

0.1.13

• Added an optional dedicated runner for Docker-based cargo-deny so cargo-audit and cargo-machete can use a lighter runner without weakening supply-chain coverage.

Changelog

Sourced from NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml's changelog.

Changelog

This file is a release ledger: every heading below is a real release, and scripts/check_release_ledger.py enforces that in both directions.

The project follows Semantic Versioning.

[Unreleased]

• Publish unsuccessful completed self-workflow attempts as unassigned, repository-local CI evidence; preserve actual conclusions and exact attempts.

• Accept exact matching development-commit comments and correct nested action pin validation and container whitespace rejection. Keep registrations scoped to their actual action paths.

• Declare both git-submodule and reusable-workflow consumption in the GDS module contract. Refresh its projection using the existing stable bundle.

• Place the Docker publisher permission explanation inline so the pinned pedantic audit recognizes it; workflow permissions and behavior are unchanged.

[0.1.16] - 2026-09-02

• security-bundle authenticates its exact called-workflow source fetch with the job token, so a shared fleet egress address cannot exhaust GitHub's anonymous allowance and stop the gate before any scanner runs.

[0.1.15] - 2026-08-31

• docker-build.yml: reusable BuildKit image build whose layer cache outlives the runner (registry cache on ghcr by default, gha and none backends), registered across the catalog with an infra example.
• security-bundle (free): the called-workflow source fetch retries and falls back to protocol v0, and evidence uploads only when the scan ran.
• Dependabot pin-registry synchronization for the bumped action set.

[0.1.14] - 2026-08-30

• Enable Corepack's pnpm and Yarn shims before activating the caller-pinned package-manager version, so hosted Node jobs resolve the requested binary instead of finding no pnpm or the image's unrelated Yarn Classic install.

[0.1.13] - 2026-08-27

• Added an optional dedicated runner for Docker-based cargo-deny so cargo-audit and cargo-machete can use a lighter runner without weakening supply-chain coverage.

[0.1.12] - 2026-08-27

• The signed 0.1.12 tag is retained as immutable rejected evidence because its candidate changelog used the next local-calendar date rather than the

... (truncated)

Commits

• 706233f Merge pull request #78 from NDDev-OpenNetwork/fix/upload-evidence-only-when-t...
• bdbcf13 fix(security): upload evidence only when the scan ran
• 143645d Merge pull request #76 from NDDev-OpenNetwork/fix/fetch-the-called-workflow-r...
• 92a9f69 fix(security): fetch the called workflow resiliently
• 483a3df Merge pull request #74 from NDDev-OpenNetwork/release/0.1.14
• c18582d chore(release): prepare 0.1.14
• 800357e Merge pull request #73 from NDDev-OpenNetwork/fix/enable-corepack-shims
• e20700e fix(node): enable Corepack shims before activation
• e3270c5 Merge pull request #72 from NDDev-OpenNetwork/rollout/gds-070-stable
• 240c93b chore(gds): promote stable bundle 0.7.0
• Additional commits viewable in compare view

[dependabot]

Labels

The following labels could not be found: ci, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[rldyourmnd]

Superseded by merged #91, which adopts these immutable references through the canonical anchor, regenerates caller and golden provenance, and corrects the publisher annotation. Full local Go quick validation, context/projection regressions, 47 Python tests and actionlint passed. Original bot history is preserved.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml