chore(ci): compatible pin refresh + observability + attest

.github/workflows/audit.yml

@@ -34,7 +34,7 @@ jobs:
 
       - name: Upload reports
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: l9-audit-reports
           path: artifacts/

.github/workflows/baseline-ratchet-caller.yml

@@ -26,10 +26,10 @@ permissions:
 jobs:
   ratchet:
     name: Baseline Ratchet
-    uses: Quantum-L9/l9-ci-core/.github/workflows/baseline-ratchet.yml@d81a06ed821106a487df2e5ad06d93e347392af6
+    uses: Quantum-L9/l9-ci-core/.github/workflows/baseline-ratchet.yml@0d28395428426853c44825c4645c23ee8ace23b1
     with:
-      core-revision: d81a06ed821106a487df2e5ad06d93e347392af6
-      sdk-revision: 0779fca8238011f8abea551895f96584676e9d17
+      core-revision: 0d28395428426853c44825c4645c23ee8ace23b1
+      sdk-revision: b1a491414ed04bb18d665f8a8755de80947c8200
       python-version: "3.12"
       pytest-paths: tests
       test-quarantine-ledger: .l9/baselines/test-quarantine.yml

.github/workflows/docker-build.yml

@@ -140,7 +140,7 @@ jobs:
 
       - name: Attest Build Provenance
         if: github.event_name != 'pull_request'
-        uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0.0
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           subject-digest: ${{ steps.build.outputs.digest }}

.github/workflows/l9-analysis.yml

@@ -95,7 +95,7 @@ jobs:
       - id: sdk
         name: Provision immutable SDK
         if: steps.gov.outputs.enabled == 'true'
-        uses: Quantum-L9/l9-ci-core/.github/actions/provision-sdk@f88116503430aa18992b70d8d31063e34ff97ef1
+        uses: Quantum-L9/l9-ci-core/.github/actions/provision-sdk@0d28395428426853c44825c4645c23ee8ace23b1
 
       - name: Normalize provider report
         if: steps.gov.outputs.enabled == 'true'
@@ -156,7 +156,7 @@ jobs:
 
       - name: Upload analysis artifact set
         if: steps.gov.outputs.enabled == 'true'
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: ${{ steps.names.outputs.artifact-name }}
           path: |
@@ -170,7 +170,7 @@ jobs:
     name: Publish analysis (Core)
     needs: analyze
     if: needs.analyze.outputs.enabled == 'true'
-    uses: Quantum-L9/l9-ci-core/.github/workflows/publish-analysis.yml@f88116503430aa18992b70d8d31063e34ff97ef1
+    uses: Quantum-L9/l9-ci-core/.github/workflows/publish-analysis.yml@0d28395428426853c44825c4645c23ee8ace23b1
     permissions:
       actions: read
       checks: write

.github/workflows/supply-chain.yml

@@ -76,7 +76,7 @@ jobs:
           sarif_file: scorecard.sarif
 
       - name: Upload Scorecard Results as Artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: scorecard-results
           path: scorecard.sarif
@@ -122,7 +122,10 @@ jobs:
           fail-on-severity: high
           # dependency-review-action rejects specifying both allow-licenses and
           # deny-licenses. Keep the allow-list (stricter); deny-list is implied.
+          # SPDX AND compounds in allow-licenses do not match package Dual
+          # licenses and also break MIT matching (upload-artifact 7.0.1).
           allow-licenses: ${{ vars.ALLOWED_LICENSES || 'MIT, Apache-2.0, BSD-3-Clause, BSD-2-Clause, ISC' }}
+          allow-dependencies-licenses: pkg:pypi/structlog, pkg:pypi/prometheus-client
           comment-summary-in-pr: on-failure
 
 # ────────────────────────────────────────────────────────────────────────
@@ -217,7 +220,7 @@ jobs:
 
       - name: Upload License Report
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: license-report
           path: |

pyproject.toml

@@ -19,8 +19,8 @@ python-multipart = ">=0.0.9,<0.0.32"
 redis = "^7.4.0"
 apscheduler = "^3.10.0"
 httpx = "^0.28.0"
-structlog = "^25.5.0"
-prometheus-client = "^0.24.1"
+structlog = ">=25.5,<27.0"
+prometheus-client = ">=0.24.1,<0.27.0"
 numpy = "^2.4.3"
 openai = "^1.0.0"
 asyncpg = "^0.31.0"

requirements.txt

@@ -13,7 +13,7 @@ python-multipart>=0.0.9,<1.0.0
 redis>=7.4.0,<8.0.0
 apscheduler>=3.10.0,<4.0.0
 httpx>=0.28.0,<0.29.0
-structlog>=25.5.0,<26.0.0
+structlog>=25.5.0,<27.0.0
 prometheus-client>=0.24.1,<1.0.0
 numpy>=2.4.3,<3.0.0
 openai>=1.0.0,<2.0.0