[rldyourmnd]

Summary

Tool pins checked against upstream on 2026-10-18:

Tool	Before	After	Digest source
uv	0.11.30	0.13.1	release .sha256 files (x86_64 eadd9d27…, aarch64 9041c73c…)
OSV-Scanner	v2.6.0	v2.7.0	osv-scanner_SHA256SUMS (160c6253…; the old pin ca69b3d3… matched its own upstream file)
actionlint	1.7.12	1.7.12	newest release
gitleaks	8.30.1	8.30.1	newest release
zizmor	1.26.1	1.26.1 (held)	see below

zizmor stays at 1.26.1. 1.31.1 reports 65 low findings on this tree, all from the self-repository audit, which asks for GitHub's $/… reusable-workflow syntax instead of ./…. actionlint 1.7.12, the newest release, rejects $/ as a malformed workflow call ([workflow-call]), so the two gates cannot both pass. Through the security bundles, the audit would also fail every consumer that calls its own ./.github/workflows/*. catalog/tools.yml records this; revisit when actionlint accepts $/.

A separate commit fixes a pre-existing core failure on main. The github-actions bump (3d8e5bd, #211) moved the private bundle's four tool-cache pins to 581821d but left their comments on 616f45b, and check_pinned_actions.py refuses that. actions/tool-cache is byte-identical in both commits.

Type of change

• Fix to an existing workflow
• Pinned tool/action version bump

Threat-model note (required for workflow / permission changes)

Same tools, same download hosts (github.com releases), same checksum-verified installs. Only the pinned versions and their upstream digests change. No new actions, egress or trust.

Permissions diff (required for workflow / permission changes)

None. No permissions: block changes.

Checklist

• All third-party actions pinned to a full 40-char commit SHA with a release-version or matching # commit:<full SHA> comment (no tags/branches).
• Least-privilege permissions (top-level {}, per-job minimal scopes). Unchanged.
• concurrency and timeout-minutes present on new/changed workflows/jobs. Unchanged.
• persist-credentials: false on all read-only actions/checkout steps. Unchanged.
• No ${{ inputs.* }} / ${{ github.event.* }} interpolated inside run:.
• Paid public/GHAS actions are absent from private-free/cross-tier files.
• actionlint passes locally.
• zizmor --pedantic passes locally: 1.26.1 with GH_TOKEN, no findings.
• README capability table and docs/ / catalog/ updated: catalog/tools.yml, generate_docs.py re-run (no generated diff).
• CHANGELOG.md updated under [Unreleased].
• Commits are signed (-S) and signed off (-s, DCO); Conventional Commit messages.

Local evidence:

• validate_all.py --tier core: OK. --tier touched: OK.
• The full run fails only product-facts-calendar, three external facts that expired on 2026-10-15/16. That is the scheduled/advisory tier and is unrelated to this change.

Tier impact

• Public (free OSS suite)
• Private free tier (zero-cost only)
• Private paid tier (GHAS / harden-runner features)