fix(security): the self-fetch authenticates, and the ledger names 0.1.15

.github/workflows/private-security-bundle-free.yml

@@ -76,11 +76,20 @@ jobs:
         env:
           WORKFLOW_REPOSITORY: ${{ job.workflow_repository }}
           WORKFLOW_SHA: ${{ job.workflow_sha }}
+          FETCH_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
           source_root="$RUNNER_TEMP/private-security-bundle-source"
           git init --quiet "$source_root"
           git -C "$source_root" remote add origin "https://github.com/${WORKFLOW_REPOSITORY}.git"
+          # Authenticate the fetch with the ambient token. The repository is
+          # public, so anonymous worked -- until 2026-08-31, when GitHub's
+          # unauthenticated fetch path failed every consumer for 77 minutes
+          # (#77) while authenticated fetches of the same pin succeeded. The
+          # header lives in the temp repository's local config, never on the
+          # command line, and dies with $RUNNER_TEMP.
+          auth_header="AUTHORIZATION: basic $(printf 'x-access-token:%s' "$FETCH_TOKEN" | base64 -w0)"
+          git -C "$source_root" config http.extraheader "$auth_header"
           # Retry, and fall back to protocol v0.
           #
           # Measured on a fleet host: `git -c protocol.version=2 ls-remote`

CHANGELOG.md

@@ -7,6 +7,15 @@ The project follows Semantic Versioning.
 
 ## [Unreleased]
 
+## [0.1.15] - 2026-08-31
+
+- `docker-build.yml`: reusable BuildKit image build whose layer cache
+  outlives the runner (registry cache on ghcr by default, `gha` and `none`
+  backends), registered across the catalog with an infra example.
+- `security-bundle` (free): the called-workflow source fetch retries and
+  falls back to protocol v0, and evidence uploads only when the scan ran.
+- Dependabot pin-registry synchronization for the bumped action set.
+
 ## [0.1.14] - 2026-08-30
 
 - Enable Corepack's pnpm and Yarn shims before activating the caller-pinned