From bb23c544287747c9f3004cc437a69a52f756641d Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Thu, 23 Jul 2026 22:11:56 +0000
Subject: [PATCH] chore(sync): synced file(s) with cplieger/ci

---
 .github/workflows/ci.yaml       | 2 +-
 .github/workflows/codeql.yml    | 2 +-
 .github/workflows/coverage.yml  | 2 +-
 .github/workflows/release.yaml  | 2 +-
 .github/workflows/scorecard.yml | 2 +-
 .github/workflows/security.yml  | 2 +-
 6 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 513c06e..e721c04 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -33,4 +33,4 @@ concurrency:
 
 jobs:
   ci:
-    uses: cplieger/ci/.github/workflows/ci.yaml@488c3bec7dfc26d834c31983f48a6b19c5250b98 # v2
+    uses: cplieger/ci/.github/workflows/ci.yaml@9750308b9b2d6007ad1767c97de39088997be14e # v2
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 084776f..41a5273 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -16,4 +16,4 @@ jobs:
       security-events: write
       contents: read
       actions: read
-    uses: cplieger/ci/.github/workflows/codeql.yaml@488c3bec7dfc26d834c31983f48a6b19c5250b98 # v2
+    uses: cplieger/ci/.github/workflows/codeql.yaml@9750308b9b2d6007ad1767c97de39088997be14e # v2
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 4de24e6..b088fe1 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -27,4 +27,4 @@ jobs:
     # NOTE: pin this @SHA to the ci release tag that first contains
     # coverage.yaml when cutting that tag (see ci.md "Updating and propagating").
     # Renovate then tracks the `# v2` comment and bumps the digest thereafter.
-    uses: cplieger/ci/.github/workflows/coverage.yaml@488c3bec7dfc26d834c31983f48a6b19c5250b98 # v2
+    uses: cplieger/ci/.github/workflows/coverage.yaml@9750308b9b2d6007ad1767c97de39088997be14e # v2
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 08f397d..bc7171e 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -63,7 +63,7 @@ jobs:
       id-token: write
       attestations: write
       security-events: write
-    uses: cplieger/ci/.github/workflows/release.yaml@488c3bec7dfc26d834c31983f48a6b19c5250b98 # v2
+    uses: cplieger/ci/.github/workflows/release.yaml@9750308b9b2d6007ad1767c97de39088997be14e # v2
     # Forward only the two Docker Hub publish credentials the reusable pipeline
     # actually declares and consumes, rather than `secrets: inherit` (which
     # exposes every repo secret to the reusable-workflow trust boundary). Both
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index b5c15f1..4f64b6b 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -38,7 +38,7 @@ jobs:
           persist-credentials: false
 
       - name: Run analysis
-        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
         with:
           results_file: results.sarif
           results_format: sarif
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 407ccf4..efd4c46 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -22,4 +22,4 @@ jobs:
     permissions:
       contents: read
       security-events: write
-    uses: cplieger/ci/.github/workflows/security-scan.yaml@488c3bec7dfc26d834c31983f48a6b19c5250b98 # v2
+    uses: cplieger/ci/.github/workflows/security-scan.yaml@9750308b9b2d6007ad1767c97de39088997be14e # v2