fix(catalog): sync drifted action pins and remove a dead input

.github/workflows/sql-ci.yml

@@ -1,17 +1,14 @@
 name: sql-ci
 
-# Reusable SQL CI for BOTH tiers: pinned setup-python, and
-# sqlfluff lint (dialect-aware) plus an optional caller command passed via env.
+# Reusable SQL CI for BOTH tiers: pinned setup-uv, and sqlfluff lint
+# (dialect-aware) plus an optional caller command passed via env.
 
 on:
   workflow_call:
     inputs:
       runner:
         type: string
         default: 'ubuntu-latest'
-      python_version:
-        type: string
-        default: '3.13'
       working_directory:
         type: string
         default: '.'

CHANGELOG.md

@@ -2,6 +2,24 @@
 
 ## [Unreleased]
 
+### Fixed
+
+- **The catalog recorded four action pins that no workflow used.** `setup-node`,
+  `setup-java`, `setup-swift`, and `checkov-action` had drifted a version behind
+  the SHA their `used_by` workflows actually reference — `setup-swift` by a full
+  major (`v2.4.0` recorded, `v3` shipped). `validate_catalog.py` checked only the
+  pin's *shape* and that `used_by` paths existed, never that the pin matched
+  reality, so the gate stayed green while the declared source of truth was wrong
+  in four places. Pins synced and `validate_catalog.py` now fails when a
+  catalog pin does not appear verbatim in each of its `used_by` workflows.
+- **`sql-ci.yml` declared a `python_version` input that nothing read.** It was
+  the only never-read input across all reusables; the workflow has no
+  `setup-python` step at all and provisions Python through `setup-uv`. A caller
+  passing it got a silently ignored value. Input removed and the header comment
+  corrected from "pinned setup-python" to "pinned setup-uv".
+- `docs/12-community-dx.md` listed five community-health files as still missing;
+  all five have shipped. Only the optional `.github/FUNDING.yml` remains absent.
+
 ### Added
 
 - **Self-application of the public OSS security suite.** This repository shipped

catalog/tools.yml

@@ -220,11 +220,11 @@ tools:
     name: swift-actions/setup-swift
     homepage: "https://github.com/swift-actions/setup-swift"
     kind: action
-    current_version: "v2.4.0"
-    pin: "swift-actions/setup-swift@7ca6abe6b3b0e8b5421b88be48feee39cbf52c6a"
+    current_version: v3
+    pin: swift-actions/setup-swift@364295d9c23900ce04d4e5cc708387921b4e50f9
     used_by:
       - .github/workflows/swift-ci.yml
-    last_verified: "2026-07-08"
+    last_verified: 2026-07-25
 
   - id: setup-r
     name: r-lib/actions/setup-r
@@ -370,11 +370,11 @@ tools:
     name: bridgecrewio/checkov-action
     homepage: "https://github.com/bridgecrewio/checkov-action"
     kind: action
-    current_version: "v12.3112.0"
-    pin: "bridgecrewio/checkov-action@a7683e7b72a04503521247973281ec8142e1ac1f"
+    current_version: v12.3114.0
+    pin: bridgecrewio/checkov-action@7b972723c44fb3d256283fac96fae5d7c1894bb7
     used_by:
       - .github/workflows/iac-scan.yml
-    last_verified: "2026-07-13"
+    last_verified: 2026-07-25
 
   - id: github-action-benchmark
     name: benchmark-action/github-action-benchmark
@@ -391,13 +391,13 @@ tools:
     name: actions/setup-node
     homepage: "https://github.com/actions/setup-node"
     kind: action
-    current_version: "v6.4.0"
-    pin: "actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e"
+    current_version: v7.0.0
+    pin: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
     used_by:
       - .github/workflows/benchmark.yml
       - .github/workflows/benchmark-compare.yml
       - .github/workflows/mutation-testing.yml
-    last_verified: "2026-07-12"
+    last_verified: 2026-07-25
 
   - id: setup-uv
     name: astral-sh/setup-uv
@@ -465,12 +465,12 @@ tools:
     name: actions/setup-java
     homepage: "https://github.com/actions/setup-java"
     kind: action
-    current_version: "v5.5.0"
-    pin: "actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a"
+    current_version: v5.6.0
+    pin: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95
     used_by:
       - .github/workflows/java-ci.yml
       - .github/workflows/kotlin-android-ci.yml
-    last_verified: "2026-07-12"
+    last_verified: 2026-07-25
 
   - id: setup-terraform
     name: hashicorp/setup-terraform

docs/12-community-dx.md

@@ -21,10 +21,10 @@ GitHub-native community surfaces and the health checklist.
 | `.github/FUNDING.yml` | Sponsorship links |
 
 This repository already ships `README.md`, `LICENSE`, `NOTICE`, `SECURITY.md`,
-and `.github/CODEOWNERS`. The remaining files (`CONTRIBUTING.md`,
-`CODE_OF_CONDUCT.md`, `SUPPORT.md`, `.github/ISSUE_TEMPLATE/`,
-`.github/PULL_REQUEST_TEMPLATE.md`, `.github/FUNDING.yml`) are the community
-surfaces to add for a fully green health check.
+`.github/CODEOWNERS`, `CONTRIBUTING.md`, `CODE_OF_CONDUCT.md`, `SUPPORT.md`,
+`.github/ISSUE_TEMPLATE/`, and `.github/PULL_REQUEST_TEMPLATE.md`. Only
+`.github/FUNDING.yml` is absent, and it is optional — add it if sponsorship is
+ever accepted.
 
 ## Issue forms
 

scripts/validate_catalog.py

@@ -169,8 +169,29 @@ def check() -> list[str]:
                 if kind == "container" and not CONTAINER_PIN_RE.match(pin):
                     problems.append(f"tool `{tid}`: container pin is not digest-pinned: {pin}")
             for used_by in tool.get("used_by", []):
-                if not (REPO_ROOT / used_by).exists():
+                used_path = REPO_ROOT / used_by
+                if not used_path.exists():
                     problems.append(f"tool `{tid}`: used_by path does not exist: {used_by}")
+                    continue
+                # The catalog is the declared source of truth for supply-chain
+                # posture, so a pin it records must be the pin the workflow
+                # actually uses. Checking only the pin's shape let four tools
+                # drift a full version behind (setup-swift by a major) while
+                # the gate stayed green.
+                if kind != "action" or not isinstance(pin, str) or "@" not in pin:
+                    continue
+                action_ref, pinned_sha = pin.split("@", 1)
+                actual = set(
+                    re.findall(
+                        rf"{re.escape(action_ref)}@([0-9a-f]{{40}})",
+                        used_path.read_text(encoding="utf-8"),
+                    )
+                )
+                for found in sorted(actual - {pinned_sha}):
+                    problems.append(
+                        f"tool `{tid}`: catalog pin {pinned_sha} does not match "
+                        f"{found} used in {used_by}"
+                    )
     elif tools_doc is not None:
         problems.append("tools.yml: expected a top-level mapping")