chore(deps): bump the github-actions group across 1 directory with 7 updates

[dependabot]

Bumps the github-actions group with 7 updates in the / directory:

Package	From	To
NDDev-it-com/nddev-ci-workflows/.github/workflows/actionlint.yml	0.5.1	0.10.0
NDDev-it-com/nddev-ci-workflows/.github/workflows/public-codeql.yml	0.5.1	0.10.0
NDDev-it-com/nddev-ci-workflows/.github/workflows/cross-platform-smoke.yml	0.5.1	0.10.0
NDDev-it-com/nddev-ci-workflows/.github/workflows/public-dependency-review.yml	0.5.1	0.10.0
step-security/harden-runner	2.19.4	2.20.0
NDDev-it-com/nddev-ci-workflows/.github/workflows/public-scorecard-json.yml	0.5.1	0.10.0
NDDev-it-com/nddev-ci-workflows/.github/workflows/secret-scan.yml	0.5.1	0.10.0

Updates NDDev-it-com/nddev-ci-workflows/.github/workflows/actionlint.yml from 0.5.1 to 0.10.0

Release notes

Sourced from NDDev-it-com/nddev-ci-workflows/.github/workflows/actionlint.yml's releases.

0.10.0

Added

• Three repository-operation skills for agents under .agents/skills/ (mirrored to .claude/skills/): nddev-repo-orientation (instant mental model, file map, contract index, and a task router), nddev-change-flow (the complete golden-path checklist, including paired-variant mirroring and the runtime-coverage "static-only dance"), and nddev-release-flow (version prep, the signed tag, the immutable-release verification checklist, and the post-release ledger re-promotion). They complement the eight portable CI/GitHub-Actions doctrine skills and route to the catalog and agent instructions as the source of truth rather than duplicating volatile facts. EXPECTED_SKILLS and the AGENTS.md / .claude/CLAUDE.md skill sections now describe the two groups.

Changed

• Re-promote the release-supply-chain.yml runtime-coverage record to runtime-proven after the 0.9.0 release run (…/actions/runs/29173277373 at e27d4e3) re-executed the current workflow live, recording the fresh run URL and proven_digest. Completes the honesty cycle opened when RVR-P2-011 edited the workflow and correctly dropped it to static-only.

0.9.0

Fixed

• Sync the attested-release permission + Syft contract into every consumer-facing surface. 0.8.1 added artifact-metadata: write to the attesting jobs and bumped Syft to 1.46.0 in the workflows and release validator, but the caller-facing docs, examples, and catalog still showed the old three-scope set and Syft 1.42.3. Because a caller's GITHUB_TOKEN permissions are the ceiling for a reusable workflow, a consumer copying the stale three-scope example under-scopes the attest step. Update the release-supply-chain.yml caller permissions in README.md, examples/public-oss/release.yml, and docs/04/docs/09; add artifact-metadata: write to the artifact-attestations, slsa-build-provenance, and attested releases-packages capabilities in catalog/capabilities.yml; correct the Syft version in README.md, docs/07, and docs/13; and add a 0.8.1 caller migration note. Contract- truth synchronization only — no workflow behavior change.

• Remove volatile GitHub tariffs from the ci-free-tier-planner skill and guard against regression. .agents/skills/ci-free-tier-planner/SKILL.md hard-coded plan quotas (Actions minute allowances, storage/cache sizes, and the attestation / dependency-review / secret-protection / environment plan gates), contradicting the project rule that volatile plan/price/quota facts live only in the freshness-enforced catalog/product-facts.yml. A product

... (truncated)

Changelog

Sourced from NDDev-it-com/nddev-ci-workflows/.github/workflows/actionlint.yml's changelog.

Changelog

[Unreleased]

Fixed

• Add an opt-in fetch_depth input to go-ci.yml, preserving the shallow default while allowing ancestry-aware validation to fetch pull-request merge parents with fetch_depth: 0.

Changed

• Update the full-SHA-pinned Checkov action from v12.1347.0 to v12.3112.0, including its bundled Checkov engine change from 2.0.930 to 3.3.6. Record live workflow_call evidence from an isolated Terraform fixture that produced seven expected CKV findings while honoring soft_fail: true. The upstream action still references its engine image by the mutable ghcr.io/bridgecrewio/checkov:3.3.6 tag; the outer action commit remains immutable, but that nested image is a documented residual supply-chain risk.

• Exclude swift-actions/setup-swift from the broad GitHub Actions Dependabot group so major Swift action updates receive a separate review and runtime consumer proof instead of blocking unrelated stable action updates.

• Make private-static.yml caller-provided install and validation command blocks fail on the first unsuccessful command, and enforce both fail-fast runners through the reusable-workflow contract validator.

[0.10.0] - 2026-07-12

Added

• Three repository-operation skills for agents under .agents/skills/ (mirrored to .claude/skills/): nddev-repo-orientation (instant mental model, file map, contract index, and a task router), nddev-change-flow (the complete golden-path checklist, including paired-variant mirroring and the runtime-coverage "static-only dance"), and nddev-release-flow (version prep, the signed tag, the immutable-release verification checklist, and the post-release ledger re-promotion). They complement the eight portable CI/GitHub-Actions doctrine skills and route to the catalog and agent instructions as the source of truth rather than duplicating volatile facts. EXPECTED_SKILLS and the AGENTS.md / .claude/CLAUDE.md skill sections now describe the two groups.

Changed

• Re-promote the release-supply-chain.yml runtime-coverage record to runtime-proven after the 0.9.0 release run (…/actions/runs/29173277373 at e27d4e3) re-executed the current workflow

... (truncated)

Commits

• eb7bd95 chore(release): prepare 0.10.0 (#25)
• fca92d5 feat(skills): add three repo-operation skills for agents (#24)
• 3ac8306 docs(agents): record runtime-coverage digest guard + runtime-bundle subset co...
• a443f8e chore(runtime-coverage): re-promote release-supply-chain after the 0.9.0 run ...
• e27d4e3 chore(release): prepare 0.9.0 (#20)
• 5401369 fix(release): bound runtime bundle to archive_paths so the source SBOM covers...
• 94cc56c fix(runtime-coverage): bind runtime-proven to a repo-scoped run + content dig...
• 02443af fix(skills): move volatile tariffs out of ci-free-tier-planner into the ledge...
• 9b17891 chore(deps): add 7 uncataloged actions to tools.yml + bump 6 drifted pins (#16)
• 16ec971 fix(docs): sync attested-release 4-scope + Syft 1.46.0 into consumer surfaces...
• Additional commits viewable in compare view

Updates NDDev-it-com/nddev-ci-workflows/.github/workflows/public-codeql.yml from 0.5.1 to 0.10.0

Release notes

Sourced from NDDev-it-com/nddev-ci-workflows/.github/workflows/public-codeql.yml's releases.

0.10.0

Added

• Three repository-operation skills for agents under .agents/skills/ (mirrored to .claude/skills/): nddev-repo-orientation (instant mental model, file map, contract index, and a task router), nddev-change-flow (the complete golden-path checklist, including paired-variant mirroring and the runtime-coverage "static-only dance"), and nddev-release-flow (version prep, the signed tag, the immutable-release verification checklist, and the post-release ledger re-promotion). They complement the eight portable CI/GitHub-Actions doctrine skills and route to the catalog and agent instructions as the source of truth rather than duplicating volatile facts. EXPECTED_SKILLS and the AGENTS.md / .claude/CLAUDE.md skill sections now describe the two groups.

Changed

• Re-promote the release-supply-chain.yml runtime-coverage record to runtime-proven after the 0.9.0 release run (…/actions/runs/29173277373 at e27d4e3) re-executed the current workflow live, recording the fresh run URL and proven_digest. Completes the honesty cycle opened when RVR-P2-011 edited the workflow and correctly dropped it to static-only.

0.9.0

Fixed

• Sync the attested-release permission + Syft contract into every consumer-facing surface. 0.8.1 added artifact-metadata: write to the attesting jobs and bumped Syft to 1.46.0 in the workflows and release validator, but the caller-facing docs, examples, and catalog still showed the old three-scope set and Syft 1.42.3. Because a caller's GITHUB_TOKEN permissions are the ceiling for a reusable workflow, a consumer copying the stale three-scope example under-scopes the attest step. Update the release-supply-chain.yml caller permissions in README.md, examples/public-oss/release.yml, and docs/04/docs/09; add artifact-metadata: write to the artifact-attestations, slsa-build-provenance, and attested releases-packages capabilities in catalog/capabilities.yml; correct the Syft version in README.md, docs/07, and docs/13; and add a 0.8.1 caller migration note. Contract- truth synchronization only — no workflow behavior change.

• Remove volatile GitHub tariffs from the ci-free-tier-planner skill and guard against regression. .agents/skills/ci-free-tier-planner/SKILL.md hard-coded plan quotas (Actions minute allowances, storage/cache sizes, and the attestation / dependency-review / secret-protection / environment plan gates), contradicting the project rule that volatile plan/price/quota facts live only in the freshness-enforced catalog/product-facts.yml. A product

... (truncated)

Changelog

Sourced from NDDev-it-com/nddev-ci-workflows/.github/workflows/public-codeql.yml's changelog.

Changelog

[Unreleased]

Fixed

• Add an opt-in fetch_depth input to go-ci.yml, preserving the shallow default while allowing ancestry-aware validation to fetch pull-request merge parents with fetch_depth: 0.

Changed

• Update the full-SHA-pinned Checkov action from v12.1347.0 to v12.3112.0, including its bundled Checkov engine change from 2.0.930 to 3.3.6. Record live workflow_call evidence from an isolated Terraform fixture that produced seven expected CKV findings while honoring soft_fail: true. The upstream action still references its engine image by the mutable ghcr.io/bridgecrewio/checkov:3.3.6 tag; the outer action commit remains immutable, but that nested image is a documented residual supply-chain risk.

• Exclude swift-actions/setup-swift from the broad GitHub Actions Dependabot group so major Swift action updates receive a separate review and runtime consumer proof instead of blocking unrelated stable action updates.

• Make private-static.yml caller-provided install and validation command blocks fail on the first unsuccessful command, and enforce both fail-fast runners through the reusable-workflow contract validator.

[0.10.0] - 2026-07-12

Added

• Three repository-operation skills for agents under .agents/skills/ (mirrored to .claude/skills/): nddev-repo-orientation (instant mental model, file map, contract index, and a task router), nddev-change-flow (the complete golden-path checklist, including paired-variant mirroring and the runtime-coverage "static-only dance"), and nddev-release-flow (version prep, the signed tag, the immutable-release verification checklist, and the post-release ledger re-promotion). They complement the eight portable CI/GitHub-Actions doctrine skills and route to the catalog and agent instructions as the source of truth rather than duplicating volatile facts. EXPECTED_SKILLS and the AGENTS.md / .claude/CLAUDE.md skill sections now describe the two groups.

Changed

• Re-promote the release-supply-chain.yml runtime-coverage record to runtime-proven after the 0.9.0 release run (…/actions/runs/29173277373 at e27d4e3) re-executed the current workflow

... (truncated)

Commits

• eb7bd95 chore(release): prepare 0.10.0 (#25)
• fca92d5 feat(skills): add three repo-operation skills for agents (#24)
• 3ac8306 docs(agents): record runtime-coverage digest guard + runtime-bundle subset co...
• a443f8e chore(runtime-coverage): re-promote release-supply-chain after the 0.9.0 run ...
• e27d4e3 chore(release): prepare 0.9.0 (#20)
• 5401369 fix(release): bound runtime bundle to archive_paths so the source SBOM covers...
• 94cc56c fix(runtime-coverage): bind runtime-proven to a repo-scoped run + content dig...
• 02443af fix(skills): move volatile tariffs out of ci-free-tier-planner into the ledge...
• 9b17891 chore(deps): add 7 uncataloged actions to tools.yml + bump 6 drifted pins (#16)
• 16ec971 fix(docs): sync attested-release 4-scope + Syft 1.46.0 into consumer surfaces...
• Additional commits viewable in compare view

Updates NDDev-it-com/nddev-ci-workflows/.github/workflows/cross-platform-smoke.yml from 0.5.1 to 0.10.0

Release notes

Sourced from NDDev-it-com/nddev-ci-workflows/.github/workflows/cross-platform-smoke.yml's releases.

0.10.0

Added

• Three repository-operation skills for agents under .agents/skills/ (mirrored to .claude/skills/): nddev-repo-orientation (instant mental model, file map, contract index, and a task router), nddev-change-flow (the complete golden-path checklist, including paired-variant mirroring and the runtime-coverage "static-only dance"), and nddev-release-flow (version prep, the signed tag, the immutable-release verification checklist, and the post-release ledger re-promotion). They complement the eight portable CI/GitHub-Actions doctrine skills and route to the catalog and agent instructions as the source of truth rather than duplicating volatile facts. EXPECTED_SKILLS and the AGENTS.md / .claude/CLAUDE.md skill sections now describe the two groups.

Changed

• Re-promote the release-supply-chain.yml runtime-coverage record to runtime-proven after the 0.9.0 release run (…/actions/runs/29173277373 at e27d4e3) re-executed the current workflow live, recording the fresh run URL and proven_digest. Completes the honesty cycle opened when RVR-P2-011 edited the workflow and correctly dropped it to static-only.

0.9.0

Fixed

• Sync the attested-release permission + Syft contract into every consumer-facing surface. 0.8.1 added artifact-metadata: write to the attesting jobs and bumped Syft to 1.46.0 in the workflows and release validator, but the caller-facing docs, examples, and catalog still showed the old three-scope set and Syft 1.42.3. Because a caller's GITHUB_TOKEN permissions are the ceiling for a reusable workflow, a consumer copying the stale three-scope example under-scopes the attest step. Update the release-supply-chain.yml caller permissions in README.md, examples/public-oss/release.yml, and docs/04/docs/09; add artifact-metadata: write to the artifact-attestations, slsa-build-provenance, and attested releases-packages capabilities in catalog/capabilities.yml; correct the Syft version in README.md, docs/07, and docs/13; and add a 0.8.1 caller migration note. Contract- truth synchronization only — no workflow behavior change.

• Remove volatile GitHub tariffs from the ci-free-tier-planner skill and guard against regression. .agents/skills/ci-free-tier-planner/SKILL.md hard-coded plan quotas (Actions minute allowances, storage/cache sizes, and the attestation / dependency-review / secret-protection / environment plan gates), contradicting the project rule that volatile plan/price/quota facts live only in the freshness-enforced catalog/product-facts.yml. A product

... (truncated)

Changelog

Sourced from NDDev-it-com/nddev-ci-workflows/.github/workflows/cross-platform-smoke.yml's changelog.

Changelog

[Unreleased]

Fixed

• Add an opt-in fetch_depth input to go-ci.yml, preserving the shallow default while allowing ancestry-aware validation to fetch pull-request merge parents with fetch_depth: 0.

Changed

• Update the full-SHA-pinned Checkov action from v12.1347.0 to v12.3112.0, including its bundled Checkov engine change from 2.0.930 to 3.3.6. Record live workflow_call evidence from an isolated Terraform fixture that produced seven expected CKV findings while honoring soft_fail: true. The upstream action still references its engine image by the mutable ghcr.io/bridgecrewio/checkov:3.3.6 tag; the outer action commit remains immutable, but that nested image is a documented residual supply-chain risk.

• Exclude swift-actions/setup-swift from the broad GitHub Actions Dependabot group so major Swift action updates receive a separate review and runtime consumer proof instead of blocking unrelated stable action updates.

• Make private-static.yml caller-provided install and validation command blocks fail on the first unsuccessful command, and enforce both fail-fast runners through the reusable-workflow contract validator.

[0.10.0] - 2026-07-12

Added

• Three repository-operation skills for agents under .agents/skills/ (mirrored to .claude/skills/): nddev-repo-orientation (instant mental model, file map, contract index, and a task router), nddev-change-flow (the complete golden-path checklist, including paired-variant mirroring and the runtime-coverage "static-only dance"), and nddev-release-flow (version prep, the signed tag, the immutable-release verification checklist, and the post-release ledger re-promotion). They complement the eight portable CI/GitHub-Actions doctrine skills and route to the catalog and agent instructions as the source of truth rather than duplicating volatile facts. EXPECTED_SKILLS and the AGENTS.md / .claude/CLAUDE.md skill sections now describe the two groups.

Changed

• Re-promote the release-supply-chain.yml runtime-coverage record to runtime-proven after the 0.9.0 release run (…/actions/runs/29173277373 at e27d4e3) re-executed the current workflow

... (truncated)

Commits

• eb7bd95 chore(release): prepare 0.10.0 (#25)
• fca92d5 feat(skills): add three repo-operation skills for agents (#24)
• 3ac8306 docs(agents): record runtime-coverage digest guard + runtime-bundle subset co...
• a443f8e chore(runtime-coverage): re-promote release-supply-chain after the 0.9.0 run ...
• e27d4e3 chore(release): prepare 0.9.0 (#20)
• 5401369 fix(release): bound runtime bundle to archive_paths so the source SBOM covers...
• 94cc56c fix(runtime-coverage): bind runtime-proven to a repo-scoped run + content dig...
• 02443af fix(skills): move volatile tariffs out of ci-free-tier-planner into the ledge...
• 9b17891 chore(deps): add 7 uncataloged actions to tools.yml + bump 6 drifted pins (#16)
• 16ec971 fix(docs): sync attested-release 4-scope + Syft 1.46.0 into consumer surfaces...
• Additional commits viewable in compare view

Updates NDDev-it-com/nddev-ci-workflows/.github/workflows/public-dependency-review.yml from 0.5.1 to 0.10.0

Release notes

Sourced from NDDev-it-com/nddev-ci-workflows/.github/workflows/public-dependency-review.yml's releases.

0.10.0

Added

• Three repository-operation skills for agents under .agents/skills/ (mirrored to .claude/skills/): nddev-repo-orientation (instant mental model, file map, contract index, and a task router), nddev-change-flow (the complete golden-path checklist, including paired-variant mirroring and the runtime-coverage "static-only dance"), and nddev-release-flow (version prep, the signed tag, the immutable-release verification checklist, and the post-release ledger re-promotion). They complement the eight portable CI/GitHub-Actions doctrine skills and route to the catalog and agent instructions as the source of truth rather than duplicating volatile facts. EXPECTED_SKILLS and the AGENTS.md / .claude/CLAUDE.md skill sections now describe the two groups.

Changed

• Re-promote the release-supply-chain.yml runtime-coverage record to runtime-proven after the 0.9.0 release run (…/actions/runs/29173277373 at e27d4e3) re-executed the current workflow live, recording the fresh run URL and proven_digest. Completes the honesty cycle opened when RVR-P2-011 edited the workflow and correctly dropped it to static-only.

0.9.0

Fixed

• Sync the attested-release permission + Syft contract into every consumer-facing surface. 0.8.1 added artifact-metadata: write to the attesting jobs and bumped Syft to 1.46.0 in the workflows and release validator, but the caller-facing docs, examples, and catalog still showed the old three-scope set and Syft 1.42.3. Because a caller's GITHUB_TOKEN permissions are the ceiling for a reusable workflow, a consumer copying the stale three-scope example under-scopes the attest step. Update the release-supply-chain.yml caller permissions in README.md, examples/public-oss/release.yml, and docs/04/docs/09; add artifact-metadata: write to the artifact-attestations, slsa-build-provenance, and attested releases-packages capabilities in catalog/capabilities.yml; correct the Syft version in README.md, docs/07, and docs/13; and add a 0.8.1 caller migration note. Contract- truth synchronization only — no workflow behavior change.

• Remove volatile GitHub tariffs from the ci-free-tier-planner skill and guard against regression. .agents/skills/ci-free-tier-planner/SKILL.md hard-coded plan quotas (Actions minute allowances, storage/cache sizes, and the attestation / dependency-review / secret-protection / environment plan gates), contradicting the project rule that volatile plan/price/quota facts live only in the freshness-enforced catalog/product-facts.yml. A product

... (truncated)

Changelog

Sourced from NDDev-it-com/nddev-ci-workflows/.github/workflows/public-dependency-review.yml's changelog.

Changelog

[Unreleased]

Fixed

• Add an opt-in fetch_depth input to go-ci.yml, preserving the shallow default while allowing ancestry-aware validation to fetch pull-request merge parents with fetch_depth: 0.

Changed

• Update the full-SHA-pinned Checkov action from v12.1347.0 to v12.3112.0, including its bundled Checkov engine change from 2.0.930 to 3.3.6. Record live workflow_call evidence from an isolated Terraform fixture that produced seven expected CKV findings while honoring soft_fail: true. The upstream action still references its engine image by the mutable ghcr.io/bridgecrewio/checkov:3.3.6 tag; the outer action commit remains immutable, but that nested image is a documented residual supply-chain risk.

• Exclude swift-actions/setup-swift from the broad GitHub Actions Dependabot group so major Swift action updates receive a separate review and runtime consumer proof instead of blocking unrelated stable action updates.

• Make private-static.yml caller-provided install and validation command blocks fail on the first unsuccessful command, and enforce both fail-fast runners through the reusable-workflow contract validator.

[0.10.0] - 2026-07-12

Added

• Three repository-operation skills for agents under .agents/skills/ (mirrored to .claude/skills/): nddev-repo-orientation (instant mental model, file map, contract index, and a task router), nddev-change-flow (the complete golden-path checklist, including paired-variant mirroring and the runtime-coverage "static-only dance"), and nddev-release-flow (version prep, the signed tag, the immutable-release verification checklist, and the post-release ledger re-promotion). They complement the eight portable CI/GitHub-Actions doctrine skills and route to the catalog and agent instructions as the source of truth rather than duplicating volatile facts. EXPECTED_SKILLS and the AGENTS.md / .claude/CLAUDE.md skill sections now describe the two groups.

Changed

• Re-promote the release-supply-chain.yml runtime-coverage record to runtime-proven after the 0.9.0 release run (…/actions/runs/29173277373 at e27d4e3) re-executed the current workflow

... (truncated)

Commits

• eb7bd95 chore(release): prepare 0.10.0 (#25)
• fca92d5 feat(skills): add three repo-operation skills for agents (#24)
• 3ac8306 docs(agents): record runtime-coverage digest guard + runtime-bundle subset co...
• a443f8e chore(runtime-coverage): re-promote release-supply-chain after the 0.9.0 run ...
• e27d4e3 chore(release): prepare 0.9.0 (#20)
• 5401369 fix(release): bound runtime bundle to archive_paths so the source SBOM covers...
• 94cc56c fix(runtime-coverage): bind runtime-proven to a repo-scoped run + content dig...
• 02443af fix(skills): move volatile tariffs out of ci-free-tier-planner into the ledge...
• 9b17891 chore(deps): add 7 uncataloged actions to tools.yml + bump 6 drifted pins (#16)
• 16ec971 fix(docs): sync attested-release 4-scope + Syft 1.46.0 into consumer surfaces...
• Additional commits viewable in compare view

Updates step-security/harden-runner from 2.19.4 to 2.20.0

Release notes

Sourced from step-security/harden-runner's releases.

v2.20.0

What's Changed

• Support for block policy for MacOS and Windows GitHub-hosted runners
• Support for Bitrise MacOS GitHub Actions runners
• HTTPS monitoring support for Bun for Linux runners (enterprise tier)

Full Changelog: step-security/harden-runner@v2.19.4...v2.20.0

Commits

• bf7454d Merge pull request #673 from step-security/fix/aggregate-error-startup-hang
• 1188420 Update non-TLS agent to v0.16.2
• 162cfea Update non-TLS agent to v0.16.1
• eb9e1f4 Bring macOS runner updates from PR 674
• 1a10b01 Update Windows agent to v1.0.7
• 8b4a105 Apply npm audit fixes with release-age cooldown
• 3626e03 Default TLS status check failures to enabled
• 100e08b Update agent-ebpf to v1.8.12
• 774f75f Update agent to v1.8.9
• f312657 Extend missing-agent-dir guard to Linux and macOS cleanup paths
• Additional commits viewable in compare view

Updates NDDev-it-com/nddev-ci-workflows/.github/workflows/public-scorecard-json.yml from 0.5.1 to 0.10.0

Release notes

Sourced from NDDev-it-com/nddev-ci-workflows/.github/workflows/public-scorecard-json.yml's releases.

0.10.0

Added

• Three repository-operation skills for agents under .agents/skills/ (mirrored to .claude/skills/): nddev-repo-orientation (instant mental model, file map, contract index, and a task router), nddev-change-flow (the complete golden-path checklist, including paired-variant mirroring and the runtime-coverage "static-only dance"), and nddev-release-flow (version prep, the signed tag, the immutable-release verification checklist, and the post-release ledger re-promotion). They complement the eight portable CI/GitHub-Actions doctrine skills and route to the catalog and agent instructions as the source of truth rather than duplicating volatile facts. EXPECTED_SKILLS and the AGENTS.md / .claude/CLAUDE.md skill sections now describe the two groups.

Changed

• Re-promote the release-supply-chain.yml runtime-coverage record to runtime-proven after the 0.9.0 release run (…/actions/runs/29173277373 at e27d4e3) re-executed the current workflow live, recording the fresh run URL and proven_digest. Completes the honesty cycle opened when RVR-P2-011 edited the workflow and correctly dropped it to static-only.

0.9.0

Fixed

• Sync the attested-release permission + Syft contract into every consumer-facing surface. 0.8.1 added artifact-metadata: write to the attesting jobs and bumped Syft to 1.46.0 in the workflows and release validator, but the caller-facing docs, examples, and catalog still showed the old three-scope set and Syft 1.42.3. Because a caller's GITHUB_TOKEN permissions are the ceiling for a reusable workflow, a consumer copying the stale three-scope example under-scopes the attest step. Update the release-supply-chain.yml caller permissions in README.md, examples/public-oss/release.yml, and docs/04/docs/09; add artifact-metadata: write to the artifact-attestations, slsa-build-provenance, and attested releases-packages capabilities in catalog/capabilities.yml; correct the Syft version in README.md, docs/07, and docs/13; and add a 0.8.1 caller migration note. Contract- truth synchronization only — no workflow behavior change.

• Remove volatile GitHub tariffs from the ci-free-tier-planner skill and guard against regression. .agents/skills/ci-free-tier-planner/SKILL.md hard-coded plan quotas (Actions minute allowances, storage/cache sizes, and the attestation / dependency-review / secret-protection / environment plan gates), contradicting the project rule that volatile plan/price/quota facts live only in the freshness-enforced catalog/product-facts.yml. A product

... (truncated)

Changelog

Sourced from NDDev-it-com/nddev-ci-workflows/.github/workflows/public-scorecard-json.yml's changelog.

Changelog

[Unreleased]

Fixed

• Add an opt-in fetch_depth input to go-ci.yml, preserving the shallow default while allowing ancestry-aware validation to fetch pull-request merge parents with fetch_depth: 0.

Changed

• Update the full-SHA-pinned Checkov action from v12.1347.0 to v12.3112.0, including its bundled Checkov engine change from 2.0.930 to 3.3.6. Record live workflow_call evidence from an isolated Terraform fixture that produced seven expected CKV findings while honoring soft_fail: true. The upstream action still references its engine image by the mutable ghcr.io/bridgecrewio/checkov:3.3.6 tag; the outer action commit remains immutable, but that nested image is a documented residual supply-chain risk.

• Exclude swift-actions/setup-swift from the broad GitHub Actions Dependabot group so major Swift action updates receive a separate review and runtime consumer proof instead of blocking unrelated stable action updates.

• Make private-static.yml caller-provided install and validation command blocks fail on the first unsuccessful command, and enforce both fail-fast runners through the reusable-workflow contract validator.

[0.10.0] - 2026-07-12

Added

• Three repository-operation skills for agents under .agents/skills/ (mirrored to .claude/skills/): nddev-repo-orientation (instant mental model, file map, contract index, and a task router), nddev-change-flow (the complete golden-path checklist, including paired-variant mirroring and the runtime-coverage "static-only dance"), and nddev-release-flow (version prep, the signed tag, the immutable-release verification checklist, and the post-release ledger re-promotion). They complement the eight portable CI/GitHub-Actions doctrine skills and route to the catalog and agent instructions as the source of truth rather than duplicating volatile facts. EXPECTED_SKILLS and the AGENTS.md / .claude/CLAUDE.md skill sections now describe the two groups.

Changed

• Re-promote the release-supply-chain.yml runtime-coverage record to runtime-proven after the 0.9.0 release run (…/actions/runs/29173277373 at e27d4e3) re-executed the current workflow

... (truncated)

Commits

• eb7bd95 chore(release): prepare 0.10.0 (#25)
• fca92d5 feat(skills): add three repo-operation skills for agents (#24)
• 3ac8306 docs(agents): record runtime-coverage digest guard + runtime-bundle subset co...
• a443f8e chore(runtime-coverage): re-promote release-supply-chain after the 0.9.0 run ...
• e27d4e3 chore(release): prepare 0.9.0 (#20)
• 5401369 fix(release): bound runtime bundle to archive_paths so the source SBOM covers...
• 94cc56c fix(runtime-coverage): bind runtime-proven to a repo-scoped run + content dig...
• 02443af fix(skills): move volatile tariffs out of ci-free-tier-planner into the ledge...
• 9b17891 chore(deps): add 7 uncataloged actions to tools.yml + bump 6 drifted pins (#16)
• 16ec971 fix(docs): sync attested-release 4-scope + Syft 1.46.0 into consumer surfaces...
• Additional commits viewable in compare view

Updates NDDev-it-com/nddev-ci-workflows/.github/workflows/secret-scan.yml from 0.5.1 to 0.10.0

Release notes

Sourced from NDDev-it-com/nddev-ci-workflows/.github/workflows/secret-scan.yml's releases.

0.10.0

Added

• Three repository-operation skills for agents under .agents/skills/ (mirrored to .claude/skills/): nddev-repo-orientation (instant mental model, file map, contract index, and a task router), nddev-change-flow (the complete golden-path checklist, including paired-variant mirroring and the runtime-coverage "static-only dance"), and nddev-release-flow (version prep, the signed tag, the immutable-release verification checklist, and the post-release ledger re-promotion). They complement the eight portable CI/GitHub-Actions doctrine skills and route to the catalog and agent instructions as the source of truth rather than duplicating volatile facts. EXPECTED_SKILLS and the AGENTS.md / .claude/CLAUDE.md skill sections now describe the two groups.

Changed

• Re-promote the release-supply-chain.yml runtime-coverage record to runtime-proven after the 0.9.0 release run (…/actions/runs/29173277373 at e27d4e3) re-executed the current workflow live, recording the fresh run URL and proven_digest. Completes the honesty cycle opened when RVR-P2-011 edited the workflow and correctly dropped it to static-only.

0.9.0

Fixed

• Sync the attested-release permission + Syft contract into every consumer-facing surface. 0.8.1 added artifact-metadata: write to the attesting jobs and bumped Syft to 1.46.0 in the workflows and release validator, but the caller-facing docs, examples, and catalog still showed the old three-scope set and Syft 1.42.3. Because a caller's GITHUB_TOKEN permissions are the ceiling for a reusable workflow, a consumer copying the stale three-scope example under-scopes the attest step. Update the release-supply-chain.yml caller permissions in README.md, examples/public-oss/release.yml, and docs/04/docs/09; add artifact-metadata: write to the artifact-attestations, slsa-build-provenance, and attested releases-packages capabilities in catalog/capabilities.yml; correct the Syft version in README.md, docs/07, and docs/13; and add a 0.8.1 caller migration note. Contract- truth synchronization only — no workflow behavior change.

• Remove volatile GitHub tariffs from the ci-free-tier-planner skill and guard against regression. .agents/skills/ci-free-tier-planner/SKILL.md hard-coded plan quotas (Actions minute allowances, storage/cache sizes, and the attestation / dependency-review / secret-protection / environment plan gates), contradicting the project rule that volatile plan/price/quota facts live only in the freshness-enforced catalog/product-facts.yml. A product

... (truncated)

Changelog

Sourced from NDDev-it-com/nddev-ci-workflows/.github/workflows/secret-scan.yml's changelog.

Changelog

[Unreleased]

Fixed

• Add an opt-in fetch_depth input to go-ci.yml, preserving the shallow default while allowing ancestry-aware validation to fetch pull-request merge parents with fetch_depth: 0.

Changed

• Update the full-SHA-pinned Checkov action from v12.1347.0 to v12.3112.0, including its bundled Checkov engine change from 2.0.930 to 3.3.6. Record live workflow_call evidence from an isolated Terraform fixture that produced seven expected CKV findings while honoring soft_fail: true. The upstream action still references its engine image by the mutable ghcr.io/bridgecrewio/checkov:3.3.6 tag; the outer action commit remains immutable, but that nested image is a documented residual supply-chain risk.

• Exclude swift-actions/setup-swift from the broad GitHub Actions Dependabot group so major Swift action updates receive a separate review and runtime consumer proof instead of blocking unrelated stable action updates.

• Make private-static.yml caller-provided install and validation command blocks fail on the first unsuccessful command, and enforce both fail-fast runners through the reusable-workflow contract validator.

[0.10.0] - 2026-07-12

Added

• Three repository-operation skills for agents under .agents/skills/ (mirrored to .claude/skills/): nddev-repo-orientation (instant mental model, file map, contract index, and a task router), nddev-change-flow (the complete golden-path checklist, including paired-variant mirroring and the runtime-coverage "static-only dance"), and nddev-release-flow (version prep, the signed tag, the immutable-release verification checklist, and the post-release ledger re-promotion). They complement the eight portable CI/GitHub-Actions doctrine skills and route to the catalog and agent instructions as the source of truth rather than duplicating volatile facts. EXPECTED_SKILLS and the AGENTS.md / .claude/CLAUDE.md skill sections now describe the two groups.

Changed

• Re-promote the release-supply-chain.yml runtime-coverage record to runtime-proven after the 0.9.0 release run (…/actions/runs/29173277373 at e27d4e3) re-executed the current workflow

... (truncated)

Commits

• eb7bd95 chore(release): prepare 0.10.0 (#25)
• fca92d5 feat(skills): add three repo-operation skills for agents (#24)
• 3ac8306 docs(agents): record runtime-coverage digest guard + runtime-bundle subset co...
• a443f8e chore(runtime-coverage): re-promote release-supply-chain after the 0.9.0 run ...
• e27d4e3 chore(release): prepare 0.9.0 (#20)
• 5401369 fix(release): bound runtime bundle to archive_paths so the source SBOM covers...
• 94cc56c fix(runtime-coverage): bind runtime-proven to a repo-scoped run + content dig...
• 02443af fix(skills): move volatile tariffs out of ci-free-tier-planner into the ledge...
• 9b17891 chore(deps): add 7 uncataloged actions to tools.yml + bump 6 drifted pins (#16)
• 16ec971 fix(docs): sync attested-release 4-scope + Syft 1.46.0 into consumer surfaces...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: ci. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.