chore: adopt shared CI 0.10.0

.github/workflows/README.md

@@ -7,8 +7,8 @@ against a pinned submodule revision.
 
 Reusable workflows are sourced from
 [`NDDev-it-com/nddev-ci-workflows`](https://github.com/NDDev-it-com/nddev-ci-workflows)
-release `0.8.1`, pinned to commit
-`8b8e3ea6321c912b68eec831c2072a0173203433`.
+release `0.10.0`, pinned to commit
+`eb7bd953dc9741e559cb9e357c2d36c9b4de5a88`.
 
 ## Workflows
 

.github/workflows/actionlint.yml

@@ -19,4 +19,4 @@ jobs:
     name: actionlint
     permissions:
       contents: read
-    uses: NDDev-it-com/nddev-ci-workflows/.github/workflows/actionlint.yml@8b8e3ea6321c912b68eec831c2072a0173203433 # 0.8.1
+    uses: NDDev-it-com/nddev-ci-workflows/.github/workflows/actionlint.yml@eb7bd953dc9741e559cb9e357c2d36c9b4de5a88 # 0.10.0

.github/workflows/codeql.yml

@@ -21,7 +21,7 @@ jobs:
       contents: read
       security-events: write # Publish CodeQL analysis to code scanning.
       actions: read # Read workflow metadata for the actions language.
-    uses: NDDev-it-com/nddev-ci-workflows/.github/workflows/public-codeql.yml@8b8e3ea6321c912b68eec831c2072a0173203433 # 0.8.1
+    uses: NDDev-it-com/nddev-ci-workflows/.github/workflows/public-codeql.yml@eb7bd953dc9741e559cb9e357c2d36c9b4de5a88 # 0.10.0
     with:
       languages: '["actions"]'
       queries: security-and-quality

.github/workflows/dependency-review.yml

@@ -16,4 +16,4 @@ jobs:
     permissions:
       contents: read
       pull-requests: write # Comment when dependency policy rejects a change.
-    uses: NDDev-it-com/nddev-ci-workflows/.github/workflows/public-dependency-review.yml@8b8e3ea6321c912b68eec831c2072a0173203433 # 0.8.1
+    uses: NDDev-it-com/nddev-ci-workflows/.github/workflows/public-dependency-review.yml@eb7bd953dc9741e559cb9e357c2d36c9b4de5a88 # 0.10.0

.github/workflows/release.yml

@@ -240,7 +240,7 @@ jobs:
       id-token: write # Exchange workflow identity for attestations.
       attestations: write # Publish provenance and SBOM attestations.
       artifact-metadata: write # Record the actions/attest artifact storage entry (required at v4.1.1).
-    uses: NDDev-it-com/nddev-ci-workflows/.github/workflows/release-supply-chain.yml@8b8e3ea6321c912b68eec831c2072a0173203433 # 0.8.1
+    uses: NDDev-it-com/nddev-ci-workflows/.github/workflows/release-supply-chain.yml@eb7bd953dc9741e559cb9e357c2d36c9b4de5a88 # 0.10.0
     with:
       version: ${{ github.ref_name }}
       package_name: nddev-zcode-app

.github/workflows/scorecard.yml

@@ -19,4 +19,4 @@ jobs:
       contents: read
       actions: read # Inspect workflow metadata for Scorecard checks.
       id-token: write # Obtain OIDC identity for the Scorecard artifact.
-    uses: NDDev-it-com/nddev-ci-workflows/.github/workflows/public-scorecard-json.yml@8b8e3ea6321c912b68eec831c2072a0173203433 # 0.8.1
+    uses: NDDev-it-com/nddev-ci-workflows/.github/workflows/public-scorecard-json.yml@eb7bd953dc9741e559cb9e357c2d36c9b4de5a88 # 0.10.0

.github/workflows/secret-scan.yml

@@ -16,4 +16,4 @@ concurrency:
 jobs:
   secret-scan:
     name: Secret scan
-    uses: NDDev-it-com/nddev-ci-workflows/.github/workflows/secret-scan.yml@8b8e3ea6321c912b68eec831c2072a0173203433 # 0.8.1
+    uses: NDDev-it-com/nddev-ci-workflows/.github/workflows/secret-scan.yml@eb7bd953dc9741e559cb9e357c2d36c9b4de5a88 # 0.10.0

.github/workflows/zizmor.yml

@@ -21,7 +21,7 @@ jobs:
     permissions:
       contents: read
       security-events: write # Publish workflow-analysis results to code scanning.
-    uses: NDDev-it-com/nddev-ci-workflows/.github/workflows/zizmor-sarif.yml@8b8e3ea6321c912b68eec831c2072a0173203433 # 0.8.1
+    uses: NDDev-it-com/nddev-ci-workflows/.github/workflows/zizmor-sarif.yml@eb7bd953dc9741e559cb9e357c2d36c9b4de5a88 # 0.10.0
     with:
       persona: pedantic
       min_severity: low