feat(runtime): unify reusable workflow pins

Author: 0xPlayerOne

.github/scripts/sync-template.sh

@@ -371,7 +371,7 @@ done
 
 # Reusable workflow callers must use a literal repository/ref. Render the
 # selected runtime repository while leaving custom workflows untouched.
-for file in .github/workflows/ci.yml .github/workflows/test.yml; do
+for file in .github/workflows/ci.yml .github/workflows/test.yml .github/workflows/security.yml .github/workflows/codeql.yml; do
   [ -f "$file" ] || continue
   if grep -q '0xPlayerOne/code-foundry' "$file"; then
     changed=$((changed + 1))

.github/workflows/ci.yml

@@ -13,5 +13,8 @@ permissions:
 jobs:
   ci:
     name: CI
-    uses: 0xPlayerOne/code-foundry/.github/workflows/reusable-ci.yml@v0.7.0
+    uses: 0xPlayerOne/code-foundry/.github/workflows/reusable-ci.yml@v0.14.0
+    with:
+      runtime-repository: 0xPlayerOne/code-foundry
+      runtime-ref: v0.14.0
     secrets: inherit

.github/workflows/codeql.yml

@@ -18,5 +18,8 @@ permissions:
 jobs:
   codeql:
     name: CodeQL
-    uses: 0xPlayerOne/code-foundry/.github/workflows/reusable-codeql.yml@v0.12.0
+    uses: 0xPlayerOne/code-foundry/.github/workflows/reusable-codeql.yml@v0.14.0
+    with:
+      runtime-repository: 0xPlayerOne/code-foundry
+      runtime-ref: v0.14.0
     secrets: inherit

.github/workflows/reusable-ci.yml

@@ -12,7 +12,7 @@ on:
         description: Code Foundry runtime tag or ref.
         required: false
         type: string
-        default: v0.7.0
+        default: v0.14.0
 
 permissions:
   contents: read

.github/workflows/reusable-codeql.yml

@@ -12,7 +12,7 @@ on:
         description: Code Foundry runtime tag or ref.
         required: false
         type: string
-        default: v0.11.0
+        default: v0.14.0
 
 permissions:
   actions: read

.github/workflows/reusable-security.yml

@@ -12,7 +12,7 @@ on:
         description: Code Foundry runtime tag or ref.
         required: false
         type: string
-        default: v0.9.0
+        default: v0.14.0
 
 permissions:
   contents: read

.github/workflows/reusable-test.yml

@@ -12,7 +12,7 @@ on:
         description: Code Foundry runtime tag or ref.
         required: false
         type: string
-        default: v0.7.0
+        default: v0.14.0
 
 permissions:
   contents: read

.github/workflows/security.yml

@@ -13,5 +13,8 @@ permissions:
 jobs:
   security:
     name: Security
-    uses: 0xPlayerOne/code-foundry/.github/workflows/reusable-security.yml@v0.10.0
+    uses: 0xPlayerOne/code-foundry/.github/workflows/reusable-security.yml@v0.14.0
+    with:
+      runtime-repository: 0xPlayerOne/code-foundry
+      runtime-ref: v0.14.0
     secrets: inherit

.github/workflows/test.yml

@@ -13,5 +13,8 @@ permissions:
 jobs:
   test:
     name: Test
-    uses: 0xPlayerOne/code-foundry/.github/workflows/reusable-test.yml@v0.8.0
+    uses: 0xPlayerOne/code-foundry/.github/workflows/reusable-test.yml@v0.14.0
+    with:
+      runtime-repository: 0xPlayerOne/code-foundry
+      runtime-ref: v0.14.0
     secrets: inherit