[CI] Keep workflow action-pin contracts coherent with Dependabot updates

[seonghobae]

2026-08-31 fresh control-plane revalidation

Protected main is still exact b84f0c94154043a3473939c01bb6471de5a129ae.

The dependency heads remain bot-owned Drafts. Fresh refetch confirms #259 is open/Draft/mergeable at exact a476dbe7733742aae15553ec1f5aed321ed1a2fb; #260 remains open/Draft/mergeable; and #262 remains open/Draft/mergeable at exact b043cdc837e8df05bfdfb15d8b11ce92c9202bc3 on the same protected base. Do not mutate these bot branches from this writer.

A stale statement from the 2026-08-21 snapshot must not be treated as current evidence: #262's exact-head commit-scoped inventory now contains no current failure, neutral, or conclusion-null check-run result, while coverage-evidence and opencode-review are terminal-success. It still contains conditional/auxiliary skipped runs, which are not promoted to success. More importantly, #262 is still Draft and its changed paths overlap active repository-owned workflow writers (.github/workflows/ci.yml with #242 and .github/workflows/release-acceptance.yml with #247), so it is not an execute-now merge/Ready lane. Its old CI run 32282163607 remains historical evidence only and must not be reported as the current exact-head gate state.

The 2026-08-21 #260/#261 check/run descriptions below are likewise historical snapshots unless freshly revalidated against their unchanged exact heads; their Draft state and protected-main dependency sequencing remain authoritative, but old run conclusions are not transferred into a current merge decision.

The product/root ordering is unchanged: resolve #233 through live review governance first, then let Dependabot refresh/rebase naturally as required, reacquire exact-final-head/current-base required workflows, and only then evaluate these dependency PRs for Ready/merge. Never copy a stale failed run, green verifier, skipped helper, predecessor result, or bot ownership into present-tense merge authority.

Defect observed on dependency automation — historical 2026-08-21 snapshot

Dependabot PR #259 (astral-sh/setup-uv 9.0.0 -> 10.0.1) was exact head a476dbe7733742aae15553ec1f5aed321ed1a2fb on protected base b84f0c94154043a3473939c01bb6471de5a129ae, Draft and mechanically mergeable. It changes the workflow action pin to full SHA 20cfd1bf945f4377ade1205e4dbc17946fc9a30d, while the executable regression contract in tests/test_release_acceptance_workflow.py still requires the previous v9 SHA c771a70e6277c0a99b617c7a806ffedaca235ff9.

The then-current exact-head CI run 32282136470 failed deterministically in test_release_acceptance_workflow_is_exact_head_least_privilege (1331 passed, 1 failed on Python 3.10); Release Acceptance 32282136484, SAST 32282136396, and Security Scan 32282136477 otherwise succeeded. That immutable run remains useful RCA evidence for the duplicated-pin mismatch, but it is not automatically a current gate conclusion after later workflow/check materialization.

This failure was introduced by #259 and is distinct from the protected-main 100%-branch-coverage/review blocker tracked by #233/#244.

Historical sibling dependency triage — do not promote to current gate truth

The 2026-08-21 snapshot recorded:

• build(deps-dev): bump uv-build from 0.12.3 to 0.12.5 #260 at exact 19f23e1713ea33d4751712678d1651a22367d8e1, Draft. CI 32282137171 then failed the inherited protected-main aggregate coverage gate while SAST 32282137148, Release Acceptance 32282137146, and Security Scan 32282137103 succeeded.
• build(deps): bump astral-sh/uv from 0.12.3 to 0.12.5 #261 at exact 85391a37c41a1b895f35178b3c484d2e539fff1c, Draft. CI 32282155742 then failed the same inherited coverage gate; Security Scan 32282155752 and SAST 32282155744 succeeded; Release Acceptance was absent from that commit-scoped inventory.
• build(deps): bump step-security/harden-runner from 2.20.1 to 2.21.0 #262 at exact b043cdc837e8df05bfdfb15d8b11ce92c9202bc3, Draft. CI 32282163607 then failed the inherited aggregate coverage gate while Security Scan 32282163631, SAST 32282163737, and Release Acceptance 32282163765 succeeded.

Those run conclusions are immutable historical RCA only. Current acceptance must be rebuilt from the exact unchanged/final head and then-live protected base/ruleset. In particular, #262 has since materialized newer exact-head check evidence as described in the 2026-08-31 section above.

Accordingly, #260/#261/#262 must not receive copied action-pin workarounds, synthetic churn, pointless failed-run reruns, or direct source edits from this writer. Reevaluate them after the protected-main coverage/review root integrates, then let Dependabot refresh/rebase normally as needed and reacquire each exact-final-head/current-base required workflow set before Ready/merge consideration.

Root-cause sequence for #259

1. Integrate test(recovery): cover stale evidence registry cleanup #233 only after the independent-review/control-plane prerequisite tracked in [Governance] Prove the independent review path on a current pg-llm-batch head #244 is genuinely satisfied.
2. After protected main contains the weak-reference coverage repair, freshly inventory every workflow/test writer on the exact action-pin contract surface.
3. If writer-safe, repair the repository-owned duplicated action-pin contract on a separate explicit non-default branch from then-current protected main, with a purpose-built RED proving workflow/pin-contract drift and a narrow GREEN that preserves immutable full-SHA authority.
4. Integrate that repository-owned repair through normal governance.
5. Let Dependabot refresh/rebase build(deps): bump astral-sh/setup-uv from 9.0.0 to 10.0.1 #259 normally; do not mutate the bot branch from a competing writer.
6. Require a fresh unchanged build(deps): bump astral-sh/setup-uv from 9.0.0 to 10.0.1 #259 head with all exact-head/current-base workflows terminal-success, zero valid findings/threads, and any then-required qualifying non-author approval before merge.

A direct edit to the Dependabot branch would entangle dependency automation ownership with a repository contract repair and is rejected while a separate root-cause repair is feasible.

Commercial-readiness gap

Mirroring trusted action SHAs directly inside tests makes security dependency updates mechanically incomplete unless the updater also knows every mirrored assertion. That creates avoidable broken automation, slows security patch uptake, and makes action provenance harder to audit consistently.

Bounded acceptance target

After the protected-main coverage/review root (#233/#244) is integrated and this surface is writer-safe:

• retain immutable full-commit-SHA pins for third-party Actions; do not weaken to tags, branches, prefixes, or syntactic-only 40-hex checks;
• establish one reviewable source of truth for approved action identity/version metadata, or another equally strong mechanism consumed coherently by workflows and executable regression contracts;
• make Dependabot-compatible updates change authoritative pin evidence and executable contracts coherently, or fail with a purpose-built validation that identifies every required companion update;
• preserve least-privilege workflow permissions, exact PR-head checkout, persist-credentials: false, current toolchain constraints, StepSecurity hardening, reproducible release evidence, and all existing security gates;
• add regression coverage proving an action-pin update cannot silently leave workflow and acceptance contract out of sync;
• preserve supported Python including 3.14, 100% public-docstring coverage, exact 100% owned production statement/branch coverage, lock freshness, package/container builds, SAST, Security Scan, Release Acceptance, and then-live SBOM/provenance/review gates; and
• document rollback/security-emergency handling only through the canonical documentation owner and without external-certification claims.

Do not repair this by weakening exact-pin assertions, bypassing CI, rerunning an unchanged known-failing head, mutating an active Dependabot branch from a competing writer, or copying central .github workarounds into this repository.

Refs #259, #260, #261, #262, #233, #242, #244, #247.

[seonghobae]

Fresh writer-safety refresh: the intended workflow/maintenance surface is not currently free. Protected main remains exact b84f0c94154043a3473939c01bb6471de5a129ae; Draft Dependabot #259 remains unchanged at exact a476dbe7733742aae15553ec1f5aed321ed1a2fb with the known release-acceptance pin-contract failure. Independently, no-PR branch agent/consolidate-maintenance-updates still exists and a fresh compare against exact protected main is diverged, 7 commits ahead / 188 behind, with merge base 463e81d6283b81bcb65819eb6c5756499e83e6a9. Its changed paths include .github/workflows/ci.yml, CHANGELOG.md, both Dockerfiles, pyproject.toml, and uv.lock; there is still no open PR whose head is agent/consolidate-maintenance-updates.

Therefore step 3 in this issue's root-cause sequence is not executable now: do not create a competing repository-owned action-pin/maintenance branch merely because #259 itself is bot-owned. Treat the no-PR consolidated maintenance ref as active-writer evidence on the overlapping CI/package surface until a future fresh comparison/reconciliation proves it inert or its owning lane reaches a PR. #259 remains Draft and must not be edited or rerun merely to manufacture evidence. After #233/#244 unblock, re-inventory this retained ref and all action-pin tests/workflows before choosing the smallest owning repair.

[seonghobae]

Fresh exact-head revalidation (2026-09-01 KST): #259 is still open/Draft at unchanged bot-owned head a476dbe7733742aae15553ec1f5aed321ed1a2fb on protected main@b84f0c94154043a3473939c01bb6471de5a129ae; the branch ref itself still resolves to that exact head.

Because the head has not moved, the commit-scoped inventory can now be read as current exact-head evidence rather than only historical RCA. It contains 32 check runs. The CI run 32282136470 remains non-passing on this exact head: Unit tests (Python 3.10), Unit tests (Python 3.12), Unit tests (Python 3.14), and Coverage, docstrings, lint, and package are all terminal failure. The same inventory also contains a CodeQL neutral, which is likewise non-passing evidence under the repository acceptance contract. coverage-evidence and the opencode-review status verifier are terminal-success, but they do not supersede the failing CI jobs or convert the Draft to Ready.

The established duplicated action-pin contract remains the applicable RCA unless a future changed head disproves it: #259 updates astral-sh/setup-uv to the v10.0.1 immutable SHA while the executable release-acceptance assertion retained the previous v9 identity. Do not rerun or mutate this unchanged Dependabot branch merely to manufacture newer timestamps. The repair sequence in this issue remains correct: integrate the #233 root only through live governance, then, when the workflow/test surface is writer-safe, fix the repository-owned pin contract through its own explicit non-default branch and let Dependabot refresh/rebase normally.

This comment corrects only the current-evidence classification; it does not promote old run logs beyond the unchanged exact commit they belong to and does not change the existing dependency/writer ordering.

[seonghobae]

Fresh #259 dependency-lane correction — 2026-09-01 KST

Protected pg base is still exact b84f0c94154043a3473939c01bb6471de5a129ae. Dependabot #259 remains open/Draft/mechanically mergeable on unchanged exact head a476dbe7733742aae15553ec1f5aed321ed1a2fb and still changes two workflow-facing files for the astral-sh/setup-uv v10.0.1 update. The bot branch remains owned by Dependabot and must not be edited from this loop.

Fresh commit-scoped inventory on that exact head now contains 32 check runs and no current failure conclusion. In particular, coverage-evidence and opencode-review are terminal success; auxiliary publish-manual-pr-evidence-status is skipped and is not promoted to success. This means CI run 32282136470 and its action-pin assertion failure remain useful immutable RCA for why the update originally broke the duplicated contract, but they are not the present-tense exact-head gate state.

This does not make #259 Ready/mergeable under acquisition policy. It is still Draft, still based on pre-#233 protected main, and its workflow surface remains subject to active repository-owned writer/dependency ordering. The safe sequence stays: resolve #233 through live review governance, refetch all overlapping workflow writers on then-current protected main, repair any still-valid repository-owned pin-contract coupling on its own explicit branch only if writer-safe, then allow Dependabot to refresh/rebase naturally and reacquire exact-final-head/current-base gates.

Do not rerun or mutate the unchanged bot head merely to reproduce the historical failure, and do not reinterpret green verifier checks as authority to bypass Draft/writer/dependency constraints.

[seonghobae]

Fresh exact-head correction — 2026-09-01 KST.

Protected main remains exact b84f0c94154043a3473939c01bb6471de5a129ae. Dependabot #259 remains open/Draft/mergeable at unchanged exact bot-owned head a476dbe7733742aae15553ec1f5aed321ed1a2fb against that base; this writer has not mutated the bot branch.

A fresh commit-scoped workflow-run read materially corrects the current issue-body qualification. The unchanged exact head still has CI run 32282136470 terminal failure; Release Acceptance 32282136484, SAST Semgrep 32282136396, and Security Scan 32282136477 are terminal success. The failed CI job inventory is still exact-head bound and includes Unit tests (Python 3.10), Unit tests (Python 3.12), and Coverage, docstrings, lint, and package failures after successful Checkout, Verify exact source head, Set up Python, Set up uv, and locked-dependency installation. Therefore the old CI failure is not merely predecessor/historical evidence at this unchanged head.

A separate check-runs endpoint currently returns 32 checks without a visible failure conclusion and includes green coverage-evidence/opencode-review; that narrower surface must not be used to erase the still-terminal failed exact-head CI workflow. Under the repository evidence contract, verifier/check success cannot supersede an unchanged failed required workflow run without a materially distinct successful rerun/replacement whose source identity and policy authority are proven.

The RCA remains the repository-owned duplicated action-pin contract: #259 updates astral-sh/setup-uv to the v10.0.1 full SHA while the executable release-acceptance contract still encodes the previous v9 identity. Do not patch the Dependabot head directly, weaken the immutable-pin assertion, or treat the green verifier as repair. Resolve the repository-owned contract coherently on a writer-safe post-#233 lane, then let Dependabot refresh/rebase and reacquire all exact-final-head/current-base gates.