chore(ci): bump NDDev-OpenNetwork/ci-workflows/.github/workflows/pr-hygiene.yml from e90a2c7c6c25cd1fb9ac1c68adbc7535f8b17e1e to a624689c897c5f4733cf475159e77bba3a2b98c7

[dependabot]

Bumps NDDev-OpenNetwork/ci-workflows/.github/workflows/pr-hygiene.yml from e90a2c7c6c25cd1fb9ac1c68adbc7535f8b17e1e to a624689c897c5f4733cf475159e77bba3a2b98c7.

Changelog

Sourced from NDDev-OpenNetwork/ci-workflows/.github/workflows/pr-hygiene.yml's changelog.

Changelog

This file is a release ledger: every heading below is a real release, and scripts/check_release_ledger.py enforces that in both directions.

The project follows Semantic Versioning.

[Unreleased]

• Re-verify GitLab Free and Open Source allowances against current primary sources, with separate review deadlines and explicit eligibility conditions.

• Preserve complete redacted private security evidence in a bounded, checksummed run-log ZIP when artifact upload fails. Scanner enforcement and failed fallback remain blocking; no new token permission or external storage is required.

• Add optional check_name to the private-free security bundle so callers can retain an existing required check identity when migrating away from SARIF publication, with all four scanners and evidence artifacts preserved.

• Synchronize pins by catalog action family, preserving independent subpath actions and reusable workflows in the same repository. Apply the reviewed dependency updates from #92 with matching catalog and transitive-image records; historical evidence digests are no longer rewritten by an unrelated action update.

• Stop treating the publisher as an Enterprise Cloud buyer of Code Security, Secret Protection and Code Quality. Paid programmes stay explicitly selectable; public CodeQL, SARIF, Scorecard and attestations stay. Private repositories without those purchases use the private-free programme. A live GitHub plan belongs to one organization and is not copied between accounts. Consumer adoption resolves the programme from the immutable release being pinned, not from main. Private attestations stay an Enterprise Cloud plan gate, independent of the three add-ons.

• Dependabot catalog convergence commits only catalog and generated docs, so the default GITHUB_TOKEN can push without workflows permission. Catalog-only follows the unique workflow pin per action and fails closed when identities are mixed, so the catalog cannot describe a pin the tree does not share. Ordinary merge in this repository does not require a general CI status check; ci-gate stays truthful advisory evidence. Authored skill metadata: mappings stay mappings.

• Re-verify four vendor allowance records with staggered review dates, correct Ubicloud's monthly credit and Harness's conditional CI credit semantics, and align the disclosed Checkov image tag with the existing pinned action.

• Publish unsuccessful completed self-workflow attempts as unassigned, repository-local CI evidence; preserve actual conclusions and exact attempts.

• Accept exact matching development-commit comments and correct nested action pin validation and container whitespace rejection. Keep registrations scoped to their actual action paths.

• Declare both git-submodule and reusable-workflow consumption in the GDS

... (truncated)

Commits

• a624689 Merge pull request #100 from NDDev-OpenNetwork/fix/security-evidence-log-fall...
• 8419bdf fix: retain security evidence when artifact delivery fails
• 3e70397 Merge pull request #99 from NDDev-OpenNetwork/fix/pin-the-fuzzing-base-image
• 4958996 fix(fuzz): pin the ClusterFuzzLite base image by digest
• 9231ee7 Merge pull request #98 from fix/private-security-check-identity-20260907
• b507bbf fix(security): preserve required check names in private-free migration
• bc9c791 Merge pull request #97 from NDDev-OpenNetwork/fix/ci-catalog-dependencies-202...
• ce17d74 fix(ci): preserve component identities while converging dependency pins
• 2f28c2a Merge pull request #96: advisory self-CI and catalog-only convergence
• da0ad7c chore(gds): refresh the advisory-context projection lock
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)