Record the three releases the CHANGELOG skipped, and re-pin to ci-v3.2.1

.github/workflows/cloudflare-pages-deploy.yml

@@ -192,7 +192,7 @@ jobs:
           ref: ${{ github.event.workflow_run.head_sha || github.ref }}
 
       - name: Setup pnpm + Node (+ install)
-        uses: hseshadr/ci/.github/actions/setup-pnpm@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0
+        uses: hseshadr/ci/.github/actions/setup-pnpm@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1
         with:
           package-json-file: ${{ inputs.package-json-file }}
           node-version: ${{ inputs.node-version }}
@@ -213,7 +213,7 @@ jobs:
         run: bash --noprofile --norc -euo pipefail -c "$TRUSTED_COMMAND"
 
       - name: Deploy to Cloudflare Pages
-        uses: hseshadr/ci/.github/actions/pages-deploy-dist@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0
+        uses: hseshadr/ci/.github/actions/pages-deploy-dist@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1
         with:
           project-name: ${{ inputs.project-name }}
           dist-dir: ${{ inputs.dist-dir }}

.github/workflows/frontend-gate.yml

@@ -88,7 +88,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup pnpm + Node (+ install)
-        uses: hseshadr/ci/.github/actions/setup-pnpm@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0
+        uses: hseshadr/ci/.github/actions/setup-pnpm@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1
         with:
           package-json-file: ${{ inputs.package-json-file }}
           node-version: ${{ inputs.node-version }}
@@ -99,7 +99,7 @@ jobs:
 
       - name: Setup Playwright (cached)
         if: ${{ inputs.install-playwright }}
-        uses: hseshadr/ci/.github/actions/setup-playwright@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0
+        uses: hseshadr/ci/.github/actions/setup-playwright@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1
         with:
           browsers: ${{ inputs.playwright-browsers }}
           working-directory: ${{ inputs.playwright-working-directory || inputs.working-directory }}

.github/workflows/python-gate.yml

@@ -79,7 +79,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Python + uv (+ sync)
-        uses: hseshadr/ci/.github/actions/setup-python-uv@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0
+        uses: hseshadr/ci/.github/actions/setup-python-uv@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1
         with:
           python-version: ${{ inputs.python-version }}
           sync-args: ${{ inputs.sync-args }}

.github/workflows/python-publish.yml

@@ -115,7 +115,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Python + uv (+ sync)
-        uses: hseshadr/ci/.github/actions/setup-python-uv@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0
+        uses: hseshadr/ci/.github/actions/setup-python-uv@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1
         with:
           python-version: ${{ inputs.python-version }}
           sync-args: ${{ inputs.sync-args }}

.github/workflows/security-audit.yml

@@ -107,7 +107,7 @@ jobs:
 
       # run-sync: false — we `uv export` the lock, not build a venv.
       - name: Setup Python + uv
-        uses: hseshadr/ci/.github/actions/setup-python-uv@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0
+        uses: hseshadr/ci/.github/actions/setup-python-uv@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1
         with:
           working-directory: ${{ inputs.python-working-directory }}
           run-sync: "false"
@@ -163,7 +163,7 @@ jobs:
       # install: false — `pnpm audit` reads the lockfile + queries the advisory DB
       # directly; no node_modules needed.
       - name: Setup pnpm + Node
-        uses: hseshadr/ci/.github/actions/setup-pnpm@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0
+        uses: hseshadr/ci/.github/actions/setup-pnpm@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1
         with:
           package-json-file: ${{ inputs.frontend-working-directory }}/package.json
           node-version: ${{ inputs.node-version }}

.github/workflows/ts-publish.yml

@@ -141,7 +141,7 @@ jobs:
           registry-url: ${{ inputs.registry-url }}
 
       - name: Setup pnpm + Node (+ install)
-        uses: hseshadr/ci/.github/actions/setup-pnpm@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0
+        uses: hseshadr/ci/.github/actions/setup-pnpm@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1
         with:
           package-json-file: ${{ inputs.package-json-file }}
           node-version: ${{ inputs.node-version }}

CHANGELOG.md

@@ -6,13 +6,21 @@ All notable changes to the shared CI/CD templates. Each release is cut as an imm
 listed below. `tests/security-policy.sh` rejects a moving `@ci-vN` ref, first-party
 included.
 
-## Unreleased (on `main`, after ci-v3.0.0)
+## ci-v3.2.1 — 2026-08-04
 
-**No brick changed shape** — no input, output or permission moved, so no caller needs
-editing. One entry below changes brick *behaviour*: the publish-verification retry bound
-in `python-publish.yml` and `ts-publish.yml`. That one needs a re-pin to reach a consumer.
-Everything else is a guard, a test, or a fix to the copy-paste surface in `examples/`,
-which needs a re-copy.
+Commit `605e51cbc86f452b56edcf1c9660921da797cbfe`.
+
+**No brick changed shape** — no input, output or permission moved, so re-pinning from
+`ci-v3.2.0` is a drop-in. One entry, and it changes brick *behaviour*: the
+publish-verification retry bound in `python-publish.yml` and `ts-publish.yml`. **Re-pin
+only if you publish** through those workflows or copied one of the `examples/*/publish.yml`
+inline jobs; nothing else in this release reaches a consumer.
+
+**No composite behavior changed**, so the [release-commit
+bootstrap](./README.md#the-release-commit-bootstrap) gap does not apply to this release.
+All 41 first-party refs at this commit (9 in `.github/`, 32 in `examples/`) already name
+`ci-v3.2.0`, and every composite reached through them is byte-identical to the one in this
+tree.
 
 - **The publish-verification bound was too tight, and it failed a release that had
   genuinely succeeded.** The check itself is right and stays: ask the registry whether the
@@ -31,6 +39,42 @@ which needs a re-copy.
   serve and it still exits **1** after the full budget. The three `examples/*/publish.yml`
   inline copies carry the same bound, so the surface consumers copy does not ship the
   defect.
+
+## ci-v3.2.0 — 2026-08-03
+
+Commit `7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790`.
+
+**This is the release that made `ci-v3.1.0`'s `setup-uv` v9 upgrade actually run.** Its
+only change over `ci-v3.1.0` is the first-party re-pin: 41 refs across 23 files move from
+`ci-v3.0.0` to `ci-v3.1.0`, and nothing else — verify with
+
+```bash
+git diff ci-v3.1.0 ci-v3.2.0 | grep -E '^[+-]' | grep -vE '^(\+\+\+|---)' \
+  | grep -vE 'hseshadr/ci/'
+```
+
+which prints nothing. This is the `ci-v3.x` tag to pin if you are not taking `ci-v3.2.1`.
+
+## ci-v3.1.0 — 2026-08-03
+
+Commit `33c5e5fa421210e6cc91ea30cad708bce29a2407`.
+
+**Do not pin this tag — take `ci-v3.2.0` or newer.** This is the
+[release-commit bootstrap](./README.md#the-release-commit-bootstrap) in its worst shape:
+the composite in this tree runs `setup-uv` v9.0.0, but the tree's own first-party refs
+still name `ci-v3.0.0`, so a consumer pinning `ci-v3.1.0` executes the **v8.3.2**
+composite — the exact thing this release set out to fix. `ci-v3.2.0` is the re-pin.
+
+Everything below first shipped here, in the six PRs (#9–#14) between `ci-v3.0.0` and this
+commit. Apart from the `setup-uv` bump, none of it changes a brick's shape: each entry is
+a guard, a test, or a fix to the copy-paste surface in `examples/`, which needs a re-copy
+rather than a re-pin.
+
+- **`setup-python-uv` runs `astral-sh/setup-uv` v9.0.0** (behavior change). `ci-v3.0.0`'s
+  tree carried v8.3.2, so every consumer calling `python-gate`, `python-publish` or
+  `security-audit` executed v8.3.2 on its gate and publish path while its own `ci.yml`
+  ran v9.0.0 — a split nobody could see from either side. Reaches consumers at
+  `ci-v3.2.0`, per the note above.
 - **The drift detector caught its first new control, and the cause was partly this repo.**
   On 2026-08-02 the scheduled sweep went red: `30 … 29 allowlisted; 1 new`
   ([run 30739082151](https://github.com/hseshadr/ci/actions/runs/30739082151)); the day

examples/almamesh/security-audit.yml

@@ -12,7 +12,7 @@ permissions:
   contents: read
 jobs:
   audit:
-    uses: hseshadr/ci/.github/workflows/security-audit.yml@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0
+    uses: hseshadr/ci/.github/workflows/security-audit.yml@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1
     with:
       run-python-audit: true
       python-working-directory: backend

examples/aml-filter/ci.yml

@@ -33,7 +33,7 @@ jobs:
     permissions:
       contents: read
       pull-requests: read
-    uses: hseshadr/ci/.github/workflows/secret-scan.yml@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0
+    uses: hseshadr/ci/.github/workflows/secret-scan.yml@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1
 
   frontend:
     runs-on: ubuntu-latest
@@ -42,7 +42,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-      - uses: hseshadr/ci/.github/actions/setup-pnpm@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0
+      - uses: hseshadr/ci/.github/actions/setup-pnpm@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1
         with:
           package-json-file: frontend/package.json
           node-version-file: frontend/.nvmrc
@@ -51,7 +51,7 @@ jobs:
       # Weights come from a GitHub RELEASE, not a package registry, so the fetch
       # needs GH_TOKEN. Job-level `env:` is what reaches a composite's steps —
       # the composite deliberately takes no secret input.
-      - uses: hseshadr/ci/.github/actions/restore-model-cache@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0
+      - uses: hseshadr/ci/.github/actions/restore-model-cache@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1
         env:
           GH_TOKEN: ${{ github.token }}
         with:
@@ -67,7 +67,7 @@ jobs:
             gh release download model-weights-v1 --repo "$GITHUB_REPOSITORY" --dir "$dir/onnx" --clobber \
               --pattern model_quantized.onnx
             node scripts/download-model.mjs
-      - uses: hseshadr/ci/.github/actions/setup-playwright@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0
+      - uses: hseshadr/ci/.github/actions/setup-playwright@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1
         with:
           working-directory: frontend
           cache-key: playwright-${{ runner.os }}-${{ hashFiles('frontend/pnpm-lock.yaml') }}

examples/aml-filter/deploy.yml

@@ -39,7 +39,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-      - uses: hseshadr/ci/.github/actions/setup-pnpm@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0
+      - uses: hseshadr/ci/.github/actions/setup-pnpm@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1
         with:
           package-json-file: frontend/package.json
           node-version-file: frontend/.nvmrc
@@ -105,7 +105,7 @@ jobs:
           fi
 
       # --- shared deploy half: identical wrangler step used by every Pages repo ---
-      - uses: hseshadr/ci/.github/actions/pages-deploy-dist@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0
+      - uses: hseshadr/ci/.github/actions/pages-deploy-dist@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1
         with:
           project-name: aml-filter
           dist-dir: frontend/app/dist

examples/aml-filter/security-audit.yml

@@ -8,10 +8,10 @@ permissions:
   contents: read
 jobs:
   audit:
-    uses: hseshadr/ci/.github/workflows/security-audit.yml@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0
+    uses: hseshadr/ci/.github/workflows/security-audit.yml@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1
     with:
       run-pnpm-audit: true
       frontend-working-directory: frontend
       pnpm-audit-level: low
   gitleaks:
-    uses: hseshadr/ci/.github/workflows/secret-scan.yml@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0
+    uses: hseshadr/ci/.github/workflows/secret-scan.yml@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1

examples/assay/publish.yml

@@ -59,7 +59,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Python + uv (+ sync)
-        uses: hseshadr/ci/.github/actions/setup-python-uv@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0
+        uses: hseshadr/ci/.github/actions/setup-python-uv@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1
         with:
           sync-args: "--frozen --all-extras"
 
@@ -141,7 +141,7 @@ jobs:
     permissions:
       id-token: write # OIDC — npm verifies this against the registered trusted publisher.
       contents: read
-    uses: hseshadr/ci/.github/workflows/ts-publish.yml@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0
+    uses: hseshadr/ci/.github/workflows/ts-publish.yml@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1
     with:
       working-directory: ts
       # assay has no ROOT package.json/lockfile — the TS package lives wholly in ts/.

examples/edge-proc/ci.yml

@@ -12,8 +12,8 @@ permissions:
   pull-requests: read
 jobs:
   gate:
-    uses: hseshadr/ci/.github/workflows/python-gate.yml@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0
+    uses: hseshadr/ci/.github/workflows/python-gate.yml@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1
     with:
       sync-args: "--frozen --all-extras"
   gitleaks:
-    uses: hseshadr/ci/.github/workflows/secret-scan.yml@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0
+    uses: hseshadr/ci/.github/workflows/secret-scan.yml@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1

examples/edge-proc/publish.yml

@@ -43,7 +43,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Python + uv (+ sync)
-        uses: hseshadr/ci/.github/actions/setup-python-uv@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0
+        uses: hseshadr/ci/.github/actions/setup-python-uv@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1
         with:
           sync-args: "--frozen --all-extras"
 

examples/edge-proc/security-audit.yml

@@ -8,6 +8,6 @@ permissions:
   contents: read
 jobs:
   audit:
-    uses: hseshadr/ci/.github/workflows/security-audit.yml@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0
+    uses: hseshadr/ci/.github/workflows/security-audit.yml@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1
     with:
       run-python-audit: true

examples/edge-reco/ci.yml

@@ -17,10 +17,10 @@ permissions:
   pull-requests: read
 jobs:
   gitleaks:
-    uses: hseshadr/ci/.github/workflows/secret-scan.yml@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0
+    uses: hseshadr/ci/.github/workflows/secret-scan.yml@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1
 
   quality:
-    uses: hseshadr/ci/.github/workflows/python-gate.yml@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0
+    uses: hseshadr/ci/.github/workflows/python-gate.yml@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1
     with:
       working-directory: backend
       sync-args: "--locked --group dev"
@@ -31,13 +31,13 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-      - uses: hseshadr/ci/.github/actions/setup-pnpm@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0
+      - uses: hseshadr/ci/.github/actions/setup-pnpm@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1
         with:
           package-json-file: frontend/package.json
           node-version-file: frontend/.nvmrc
           cache-dependency-path: frontend/pnpm-lock.yaml
           working-directory: frontend
-      - uses: hseshadr/ci/.github/actions/restore-model-cache@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0
+      - uses: hseshadr/ci/.github/actions/restore-model-cache@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1
         with:
           cache-path: frontend/app/public/models
           cache-key: model-weights-${{ runner.os }}-${{ hashFiles('frontend/app/scripts/download-model.mjs') }}
@@ -53,19 +53,19 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-      - uses: hseshadr/ci/.github/actions/setup-pnpm@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0
+      - uses: hseshadr/ci/.github/actions/setup-pnpm@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1
         with:
           package-json-file: frontend/package.json
           node-version-file: frontend/.nvmrc
           cache-dependency-path: frontend/pnpm-lock.yaml
           working-directory: frontend
-      - uses: hseshadr/ci/.github/actions/restore-model-cache@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0
+      - uses: hseshadr/ci/.github/actions/restore-model-cache@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1
         with:
           cache-path: frontend/app/public/models
           cache-key: model-weights-${{ runner.os }}-${{ hashFiles('frontend/app/scripts/download-model.mjs') }}
           fetch-command: node scripts/download-model.mjs
           working-directory: frontend/app
-      - uses: hseshadr/ci/.github/actions/setup-playwright@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0
+      - uses: hseshadr/ci/.github/actions/setup-playwright@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1
         with:
           working-directory: frontend
           cache-key: playwright-${{ runner.os }}-${{ hashFiles('frontend/pnpm-lock.yaml') }}

examples/edge-reco/deploy.yml

@@ -32,7 +32,7 @@ jobs:
        github.event.workflow_run.conclusion == 'success' &&
        github.event.workflow_run.head_branch == 'main' &&
        github.event.workflow_run.head_repository.full_name == github.repository) }}
-    uses: hseshadr/ci/.github/workflows/cloudflare-pages-deploy.yml@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0
+    uses: hseshadr/ci/.github/workflows/cloudflare-pages-deploy.yml@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1
     with:
       project-name: edge-reco
       dist-dir: frontend/app/dist

examples/edge-reco/security-audit.yml

@@ -8,7 +8,7 @@ permissions:
   contents: read
 jobs:
   audit:
-    uses: hseshadr/ci/.github/workflows/security-audit.yml@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0
+    uses: hseshadr/ci/.github/workflows/security-audit.yml@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1
     with:
       run-python-audit: true
       run-pnpm-audit: true

examples/edgeproc-core/ci.yml

@@ -13,12 +13,12 @@ permissions:
   pull-requests: read
 jobs:
   gate:
-    uses: hseshadr/ci/.github/workflows/python-gate.yml@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0
+    uses: hseshadr/ci/.github/workflows/python-gate.yml@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1
     with:
       upload-coverage: true
     # Name the one secret the gate needs. `secrets: inherit` would forward every repo
     # secret — including PyPI/npm credentials — into a workflow that only wants Codecov.
     secrets:
       CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
   gitleaks:
-    uses: hseshadr/ci/.github/workflows/secret-scan.yml@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0
+    uses: hseshadr/ci/.github/workflows/secret-scan.yml@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1

examples/edgeproc-core/publish.yml

@@ -43,7 +43,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Python + uv (+ sync)
-        uses: hseshadr/ci/.github/actions/setup-python-uv@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0
+        uses: hseshadr/ci/.github/actions/setup-python-uv@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1
         with:
           sync-args: "--frozen --all-extras"
 

examples/edgeproc-core/security-audit.yml

@@ -8,6 +8,6 @@ permissions:
   contents: read
 jobs:
   audit:
-    uses: hseshadr/ci/.github/workflows/security-audit.yml@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0
+    uses: hseshadr/ci/.github/workflows/security-audit.yml@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1
     with:
       run-python-audit: true