Your platform team maintains a security-scanning process used by 40 repositories. Last week they fixed a critical bug in the scanning logic. They report that after they merged the fix into their shared definition and published a new tag, all 40 consuming repositories immediately used the fixed logic on their next run — no per-repo edits were required. Which mechanism must the 40 repositories be using to consume the shared process?