chore(ci): bump NDDev-Technocracy-OpenNetwork/ci-workflows/.github/workflows/public-dependency-review.yml from 93eeb2a65e98a29e9dbff7909f67c6419abff046 to 5523113629318fbb770b80df00c254e739d7ee18

[dependabot]

Bumps NDDev-Technocracy-OpenNetwork/ci-workflows/.github/workflows/public-dependency-review.yml from 93eeb2a65e98a29e9dbff7909f67c6419abff046 to 5523113629318fbb770b80df00c254e739d7ee18.

Changelog

Sourced from NDDev-Technocracy-OpenNetwork/ci-workflows/.github/workflows/public-dependency-review.yml's changelog.

Changelog

This file is a release ledger: every heading below is a real release, and scripts/check_release_ledger.py enforces that in both directions.

The project follows Semantic Versioning.

[Unreleased]

• Activate the reviewed bounded downloader retry in all four private security bundle tool installs by advancing their independent action pins. Caller inputs, scanner versions, permissions and cache trust boundaries remain unchanged.

• Keep a bounded upstream tool-download retry available after a full transfer timeout: retain the 300-second per-attempt limit, use a 600-second retry window and at most two retries. Preserve HTTPS, artifact size and SHA-256 verification; exercise recovery, permanent stalls, checksum/size rejection and untrusted TLS with a local HTTPS fixture in the workflow contract checks.

• Use the owner's verified danil@nddev.ai contact address and regenerate current public ownership projections without changing effective policy.

• Reconcile active self-references, called-workflow identity and consumer examples with the confirmed OpenNetwork repository transfer. Keep immutable dependency SHAs and permissions unchanged. Restore recorded Scorecard identities from the pre-transfer evidence instead of relabelling historical execution receipts.

• Reconcile active workflow/action references, identity checks, consumer examples and validators after the repository transfer to NDDev-Technocracy-Sandbox. Retain all executable dependency SHAs, permissions and immutable releases; GitHub Actions does not follow repository redirects. Historical Scorecard receipts retain their recorded repository identity.

• Select the existing checksum-verified Gitleaks binary mode for this repository's own scan; history scope and scanner version remain unchanged.

• Reverify GitHub larger-runner and self-hosted execution billing facts against official documentation. State the larger-runner organization/enterprise Team/Enterprise Cloud restriction explicitly and retain separate storage costs.

• Isolate synthetic tier-selection Git fixtures from user/system hooks and make promotion-renderer fixtures resolve their real jq/sha256sum prerequisites on macOS as well as Linux.

• Run cargo-deny 0.20.2 natively through the checksum-pinned installer, removing Docker Hub anonymous pull limits from dependency checks. Retain runner selection, check names, permissions and caller arguments; parse argument strings into argv without shell evaluation.

• Harden private-security-bundle-free submodule sync. A symlink planted

... (truncated)

Commits

• 5523113 Merge pull request #197 from NDDev-Technocracy-OpenNetwork/fix/tool-cache-pin...
• 2d4d282 fix(security): activate bounded tool-download retries
• df2e379 Merge pull request #196 from NDDev-Technocracy-OpenNetwork/fix/tool-cache-ret...
• 616f45b fix(tool-cache): preserve retries after transfer timeout
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Looks like NDDev-Technocracy-OpenNetwork/ci-workflows/.github/workflows/public-dependency-review.yml is no longer a dependency, so this is no longer needed.