chore(ci): every first-party ref runs the v9.0.0 composite

.github/workflows/cloudflare-pages-deploy.yml

@@ -192,7 +192,7 @@ jobs:
           ref: ${{ github.event.workflow_run.head_sha || github.ref }}
 
       - name: Setup pnpm + Node (+ install)
-        uses: hseshadr/ci/.github/actions/setup-pnpm@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0
+        uses: hseshadr/ci/.github/actions/setup-pnpm@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0
         with:
           package-json-file: ${{ inputs.package-json-file }}
           node-version: ${{ inputs.node-version }}
@@ -213,7 +213,7 @@ jobs:
         run: bash --noprofile --norc -euo pipefail -c "$TRUSTED_COMMAND"
 
       - name: Deploy to Cloudflare Pages
-        uses: hseshadr/ci/.github/actions/pages-deploy-dist@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0
+        uses: hseshadr/ci/.github/actions/pages-deploy-dist@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0
         with:
           project-name: ${{ inputs.project-name }}
           dist-dir: ${{ inputs.dist-dir }}

.github/workflows/frontend-gate.yml

@@ -88,7 +88,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup pnpm + Node (+ install)
-        uses: hseshadr/ci/.github/actions/setup-pnpm@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0
+        uses: hseshadr/ci/.github/actions/setup-pnpm@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0
         with:
           package-json-file: ${{ inputs.package-json-file }}
           node-version: ${{ inputs.node-version }}
@@ -99,7 +99,7 @@ jobs:
 
       - name: Setup Playwright (cached)
         if: ${{ inputs.install-playwright }}
-        uses: hseshadr/ci/.github/actions/setup-playwright@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0
+        uses: hseshadr/ci/.github/actions/setup-playwright@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0
         with:
           browsers: ${{ inputs.playwright-browsers }}
           working-directory: ${{ inputs.playwright-working-directory || inputs.working-directory }}

.github/workflows/python-gate.yml

@@ -79,7 +79,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Python + uv (+ sync)
-        uses: hseshadr/ci/.github/actions/setup-python-uv@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0
+        uses: hseshadr/ci/.github/actions/setup-python-uv@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0
         with:
           python-version: ${{ inputs.python-version }}
           sync-args: ${{ inputs.sync-args }}

.github/workflows/python-publish.yml

@@ -115,7 +115,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Python + uv (+ sync)
-        uses: hseshadr/ci/.github/actions/setup-python-uv@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0
+        uses: hseshadr/ci/.github/actions/setup-python-uv@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0
         with:
           python-version: ${{ inputs.python-version }}
           sync-args: ${{ inputs.sync-args }}

.github/workflows/security-audit.yml

@@ -107,7 +107,7 @@ jobs:
 
       # run-sync: false — we `uv export` the lock, not build a venv.
       - name: Setup Python + uv
-        uses: hseshadr/ci/.github/actions/setup-python-uv@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0
+        uses: hseshadr/ci/.github/actions/setup-python-uv@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0
         with:
           working-directory: ${{ inputs.python-working-directory }}
           run-sync: "false"
@@ -163,7 +163,7 @@ jobs:
       # install: false — `pnpm audit` reads the lockfile + queries the advisory DB
       # directly; no node_modules needed.
       - name: Setup pnpm + Node
-        uses: hseshadr/ci/.github/actions/setup-pnpm@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0
+        uses: hseshadr/ci/.github/actions/setup-pnpm@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0
         with:
           package-json-file: ${{ inputs.frontend-working-directory }}/package.json
           node-version: ${{ inputs.node-version }}

.github/workflows/ts-publish.yml

@@ -141,7 +141,7 @@ jobs:
           registry-url: ${{ inputs.registry-url }}
 
       - name: Setup pnpm + Node (+ install)
-        uses: hseshadr/ci/.github/actions/setup-pnpm@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0
+        uses: hseshadr/ci/.github/actions/setup-pnpm@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0
         with:
           package-json-file: ${{ inputs.package-json-file }}
           node-version: ${{ inputs.node-version }}

examples/almamesh/security-audit.yml

@@ -12,7 +12,7 @@ permissions:
   contents: read
 jobs:
   audit:
-    uses: hseshadr/ci/.github/workflows/security-audit.yml@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0
+    uses: hseshadr/ci/.github/workflows/security-audit.yml@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0
     with:
       run-python-audit: true
       python-working-directory: backend

examples/aml-filter/ci.yml

@@ -33,7 +33,7 @@ jobs:
     permissions:
       contents: read
       pull-requests: read
-    uses: hseshadr/ci/.github/workflows/secret-scan.yml@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0
+    uses: hseshadr/ci/.github/workflows/secret-scan.yml@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0
 
   frontend:
     runs-on: ubuntu-latest
@@ -42,7 +42,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-      - uses: hseshadr/ci/.github/actions/setup-pnpm@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0
+      - uses: hseshadr/ci/.github/actions/setup-pnpm@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0
         with:
           package-json-file: frontend/package.json
           node-version-file: frontend/.nvmrc
@@ -51,7 +51,7 @@ jobs:
       # Weights come from a GitHub RELEASE, not a package registry, so the fetch
       # needs GH_TOKEN. Job-level `env:` is what reaches a composite's steps —
       # the composite deliberately takes no secret input.
-      - uses: hseshadr/ci/.github/actions/restore-model-cache@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0
+      - uses: hseshadr/ci/.github/actions/restore-model-cache@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0
         env:
           GH_TOKEN: ${{ github.token }}
         with:
@@ -67,7 +67,7 @@ jobs:
             gh release download model-weights-v1 --repo "$GITHUB_REPOSITORY" --dir "$dir/onnx" --clobber \
               --pattern model_quantized.onnx
             node scripts/download-model.mjs
-      - uses: hseshadr/ci/.github/actions/setup-playwright@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0
+      - uses: hseshadr/ci/.github/actions/setup-playwright@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0
         with:
           working-directory: frontend
           cache-key: playwright-${{ runner.os }}-${{ hashFiles('frontend/pnpm-lock.yaml') }}

examples/aml-filter/deploy.yml

@@ -39,7 +39,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-      - uses: hseshadr/ci/.github/actions/setup-pnpm@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0
+      - uses: hseshadr/ci/.github/actions/setup-pnpm@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0
         with:
           package-json-file: frontend/package.json
           node-version-file: frontend/.nvmrc
@@ -105,7 +105,7 @@ jobs:
           fi
 
       # --- shared deploy half: identical wrangler step used by every Pages repo ---
-      - uses: hseshadr/ci/.github/actions/pages-deploy-dist@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0
+      - uses: hseshadr/ci/.github/actions/pages-deploy-dist@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0
         with:
           project-name: aml-filter
           dist-dir: frontend/app/dist

examples/aml-filter/security-audit.yml

@@ -8,10 +8,10 @@ permissions:
   contents: read
 jobs:
   audit:
-    uses: hseshadr/ci/.github/workflows/security-audit.yml@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0
+    uses: hseshadr/ci/.github/workflows/security-audit.yml@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0
     with:
       run-pnpm-audit: true
       frontend-working-directory: frontend
       pnpm-audit-level: low
   gitleaks:
-    uses: hseshadr/ci/.github/workflows/secret-scan.yml@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0
+    uses: hseshadr/ci/.github/workflows/secret-scan.yml@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0

examples/assay/publish.yml

@@ -59,7 +59,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Python + uv (+ sync)
-        uses: hseshadr/ci/.github/actions/setup-python-uv@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0
+        uses: hseshadr/ci/.github/actions/setup-python-uv@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0
         with:
           sync-args: "--frozen --all-extras"
 
@@ -121,7 +121,7 @@ jobs:
     permissions:
       id-token: write # OIDC — npm verifies this against the registered trusted publisher.
       contents: read
-    uses: hseshadr/ci/.github/workflows/ts-publish.yml@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0
+    uses: hseshadr/ci/.github/workflows/ts-publish.yml@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0
     with:
       working-directory: ts
       # assay has no ROOT package.json/lockfile — the TS package lives wholly in ts/.

examples/edge-proc/ci.yml

@@ -12,8 +12,8 @@ permissions:
   pull-requests: read
 jobs:
   gate:
-    uses: hseshadr/ci/.github/workflows/python-gate.yml@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0
+    uses: hseshadr/ci/.github/workflows/python-gate.yml@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0
     with:
       sync-args: "--frozen --all-extras"
   gitleaks:
-    uses: hseshadr/ci/.github/workflows/secret-scan.yml@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0
+    uses: hseshadr/ci/.github/workflows/secret-scan.yml@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0

examples/edge-proc/publish.yml

@@ -43,7 +43,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Python + uv (+ sync)
-        uses: hseshadr/ci/.github/actions/setup-python-uv@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0
+        uses: hseshadr/ci/.github/actions/setup-python-uv@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0
         with:
           sync-args: "--frozen --all-extras"
 

examples/edge-proc/security-audit.yml

@@ -8,6 +8,6 @@ permissions:
   contents: read
 jobs:
   audit:
-    uses: hseshadr/ci/.github/workflows/security-audit.yml@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0
+    uses: hseshadr/ci/.github/workflows/security-audit.yml@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0
     with:
       run-python-audit: true

examples/edge-reco/ci.yml

@@ -17,10 +17,10 @@ permissions:
   pull-requests: read
 jobs:
   gitleaks:
-    uses: hseshadr/ci/.github/workflows/secret-scan.yml@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0
+    uses: hseshadr/ci/.github/workflows/secret-scan.yml@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0
 
   quality:
-    uses: hseshadr/ci/.github/workflows/python-gate.yml@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0
+    uses: hseshadr/ci/.github/workflows/python-gate.yml@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0
     with:
       working-directory: backend
       sync-args: "--locked --group dev"
@@ -31,13 +31,13 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-      - uses: hseshadr/ci/.github/actions/setup-pnpm@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0
+      - uses: hseshadr/ci/.github/actions/setup-pnpm@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0
         with:
           package-json-file: frontend/package.json
           node-version-file: frontend/.nvmrc
           cache-dependency-path: frontend/pnpm-lock.yaml
           working-directory: frontend
-      - uses: hseshadr/ci/.github/actions/restore-model-cache@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0
+      - uses: hseshadr/ci/.github/actions/restore-model-cache@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0
         with:
           cache-path: frontend/app/public/models
           cache-key: model-weights-${{ runner.os }}-${{ hashFiles('frontend/app/scripts/download-model.mjs') }}
@@ -53,19 +53,19 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-      - uses: hseshadr/ci/.github/actions/setup-pnpm@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0
+      - uses: hseshadr/ci/.github/actions/setup-pnpm@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0
         with:
           package-json-file: frontend/package.json
           node-version-file: frontend/.nvmrc
           cache-dependency-path: frontend/pnpm-lock.yaml
           working-directory: frontend
-      - uses: hseshadr/ci/.github/actions/restore-model-cache@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0
+      - uses: hseshadr/ci/.github/actions/restore-model-cache@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0
         with:
           cache-path: frontend/app/public/models
           cache-key: model-weights-${{ runner.os }}-${{ hashFiles('frontend/app/scripts/download-model.mjs') }}
           fetch-command: node scripts/download-model.mjs
           working-directory: frontend/app
-      - uses: hseshadr/ci/.github/actions/setup-playwright@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0
+      - uses: hseshadr/ci/.github/actions/setup-playwright@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0
         with:
           working-directory: frontend
           cache-key: playwright-${{ runner.os }}-${{ hashFiles('frontend/pnpm-lock.yaml') }}

examples/edge-reco/deploy.yml

@@ -32,7 +32,7 @@ jobs:
        github.event.workflow_run.conclusion == 'success' &&
        github.event.workflow_run.head_branch == 'main' &&
        github.event.workflow_run.head_repository.full_name == github.repository) }}
-    uses: hseshadr/ci/.github/workflows/cloudflare-pages-deploy.yml@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0
+    uses: hseshadr/ci/.github/workflows/cloudflare-pages-deploy.yml@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0
     with:
       project-name: edge-reco
       dist-dir: frontend/app/dist

examples/edge-reco/security-audit.yml

@@ -8,7 +8,7 @@ permissions:
   contents: read
 jobs:
   audit:
-    uses: hseshadr/ci/.github/workflows/security-audit.yml@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0
+    uses: hseshadr/ci/.github/workflows/security-audit.yml@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0
     with:
       run-python-audit: true
       run-pnpm-audit: true

examples/edgeproc-core/ci.yml

@@ -13,12 +13,12 @@ permissions:
   pull-requests: read
 jobs:
   gate:
-    uses: hseshadr/ci/.github/workflows/python-gate.yml@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0
+    uses: hseshadr/ci/.github/workflows/python-gate.yml@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0
     with:
       upload-coverage: true
     # Name the one secret the gate needs. `secrets: inherit` would forward every repo
     # secret — including PyPI/npm credentials — into a workflow that only wants Codecov.
     secrets:
       CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
   gitleaks:
-    uses: hseshadr/ci/.github/workflows/secret-scan.yml@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0
+    uses: hseshadr/ci/.github/workflows/secret-scan.yml@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0

examples/edgeproc-core/publish.yml

@@ -43,7 +43,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Python + uv (+ sync)
-        uses: hseshadr/ci/.github/actions/setup-python-uv@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0
+        uses: hseshadr/ci/.github/actions/setup-python-uv@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0
         with:
           sync-args: "--frozen --all-extras"
 

examples/edgeproc-core/security-audit.yml

@@ -8,6 +8,6 @@ permissions:
   contents: read
 jobs:
   audit:
-    uses: hseshadr/ci/.github/workflows/security-audit.yml@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0
+    uses: hseshadr/ci/.github/workflows/security-audit.yml@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0
     with:
       run-python-audit: true

examples/privacy-core/ci.yml

@@ -13,9 +13,9 @@ permissions:
   pull-requests: read
 jobs:
   gate:
-    uses: hseshadr/ci/.github/workflows/frontend-gate.yml@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0
+    uses: hseshadr/ci/.github/workflows/frontend-gate.yml@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0
     with:
       install-args: "--frozen-lockfile --config.dangerously-allow-all-builds=true"
       install-playwright: true
   gitleaks:
-    uses: hseshadr/ci/.github/workflows/secret-scan.yml@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0
+    uses: hseshadr/ci/.github/workflows/secret-scan.yml@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0

examples/privacy-core/publish.yml

@@ -37,7 +37,7 @@ jobs:
     permissions:
       id-token: write # OIDC — npm verifies this against the registered trusted publisher.
       contents: read
-    uses: hseshadr/ci/.github/workflows/ts-publish.yml@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0
+    uses: hseshadr/ci/.github/workflows/ts-publish.yml@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0
     with:
       working-directory: "."
       install-args: "--frozen-lockfile --config.dangerously-allow-all-builds=true"

examples/privacy-core/security-audit.yml

@@ -8,7 +8,7 @@ permissions:
   contents: read
 jobs:
   audit:
-    uses: hseshadr/ci/.github/workflows/security-audit.yml@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0
+    uses: hseshadr/ci/.github/workflows/security-audit.yml@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0
     with:
       run-pnpm-audit: true
       frontend-working-directory: "."