From fe8587cca53beab87d5c75029566432e7a05a78e Mon Sep 17 00:00:00 2001 From: rldyourmnd Date: Mon, 21 Sep 2026 03:41:01 +0500 Subject: [PATCH 1/5] chore(ci): converge ci-workflows pins on 0.1.24 Previous pins in this repository: ci-feedback-events.yml 9f100310; codeql.yml 9eb9e070; gds-ci.yml 9eb9e070. A fleet audit found eight distinct ci-workflows pins in use across the estate, from 0.1.11 (88 commits behind main) to 0.1.21. 0.1.24 is the convergence target rather than 0.1.23 because 0.1.23 could not be one. Vendoring left five `uses:` pointing at `./actions/...`, which in a called workflow resolves against the caller's workspace instead of ci-workflows, so every cross-repository caller failed at job setup. ci-feedback.yml had carried that defect since 0.1.21 and only surfaced on 2026-09-20 because its job fires solely on a failed conclusion. 0.1.24 names and pins the repository for all five. Input contracts were diffed across every reusable this repository calls for the whole 0.1.16..0.1.24 range: no input was removed and none became required, so this is a pin move with no caller change. Signed-off-by: rldyourmnd Co-Authored-By: Claude Opus 5 --- .github/workflows/ci-feedback-events.yml | 2 +- .github/workflows/codeql.yml | 2 +- .github/workflows/gds-ci.yml | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci-feedback-events.yml b/.github/workflows/ci-feedback-events.yml index 0616c98..45581ee 100644 --- a/.github/workflows/ci-feedback-events.yml +++ b/.github/workflows/ci-feedback-events.yml @@ -19,7 +19,7 @@ jobs: permissions: actions: read # Read exact completed run and job metadata. issues: write # Publish bounded failure evidence in this repository. - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/ci-feedback.yml@9f100310e1cdda6e387353671b3a57e6f5897098 # commit:9f100310e1cdda6e387353671b3a57e6f5897098 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/ci-feedback.yml@37a827f921f62353664fc4bcd872f05b65efe71a # 0.1.24 with: run-id: ${{ format('{0}', github.event.workflow_run.id) }} run-attempt: ${{ format('{0}', github.event.workflow_run.run_attempt) }} diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 4dee195..61b4c88 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -31,7 +31,7 @@ jobs: actions: read contents: read security-events: write - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml@9eb9e070ae87b0fc3bdbd2cbed5afe3b92f7e2c7 # commit:9eb9e070ae87b0fc3bdbd2cbed5afe3b92f7e2c7 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml@37a827f921f62353664fc4bcd872f05b65efe71a # 0.1.24 with: # Public repository: `pull_request` runs untrusted fork code. Name the # hosted runner explicitly — the reusable's default belongs to the pinned diff --git a/.github/workflows/gds-ci.yml b/.github/workflows/gds-ci.yml index 277cf32..8fdf285 100644 --- a/.github/workflows/gds-ci.yml +++ b/.github/workflows/gds-ci.yml @@ -34,7 +34,7 @@ jobs: name: GDS fast permissions: contents: read - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@9eb9e070ae87b0fc3bdbd2cbed5afe3b92f7e2c7 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@37a827f921f62353664fc4bcd872f05b65efe71a # 0.1.24 with: fetch_depth: 0 # Public hosted CI uses GitHub's service cache; the pinned reusable @@ -54,7 +54,7 @@ jobs: needs: fast permissions: contents: read - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@9eb9e070ae87b0fc3bdbd2cbed5afe3b92f7e2c7 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@37a827f921f62353664fc4bcd872f05b65efe71a # 0.1.24 with: fetch_depth: 0 cache: true From 51422683e1a432da96c8b902c826f9f528e38910 Mon Sep 17 00:00:00 2001 From: rldyourmnd Date: Mon, 21 Sep 2026 04:06:24 +0500 Subject: [PATCH 2/5] fix(ci): move the gds-ci workflow pin to its canonical input `.github/workflows/gds-ci.yml` is a bundle-locked projection; the convergence commit edited it by hand, which desynced the generated output digest and tripped GDS_CONTEXT_PROJECTION_DIGEST_MISMATCH in the assurance, cli and context test lanes. The pin lives in `.gds/repository.yaml` `ci.workflow_ref`; point it at the published 0.1.24 commit there. Signed-off-by: rldyourmnd --- .gds/repository.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.gds/repository.yaml b/.gds/repository.yaml index 2184137..f64a805 100644 --- a/.gds/repository.yaml +++ b/.gds/repository.yaml @@ -81,7 +81,7 @@ ci: build_command: "go build -trimpath ./core/cmd/gds" test_command: "go test ./..." timeout_minutes: 30 - workflow_ref: "NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@9eb9e070ae87b0fc3bdbd2cbed5afe3b92f7e2c7" + workflow_ref: "NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@37a827f921f62353664fc4bcd872f05b65efe71a" # A public repository, so GitHub-hosted runners are unmetered and a fork's # pull request cannot reach anything of ours. Self-hosted hardware here would # turn a fork PR into remote code execution on it. From 79d98b557f4b2566711d3768ff22868051527fce Mon Sep 17 00:00:00 2001 From: rldyourmnd Date: Mon, 21 Sep 2026 04:09:57 +0500 Subject: [PATCH 3/5] chore(projections): regenerate gds-ci for the 0.1.24 pin MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Regenerated by `gds generate repository` (plan_01M30H68RZ6D5V50ZNDRKH2J1S, op_01M30H6G0YFSTW0DQYAYBC5T3X, verify succeeded) after the canonical input moved. The hand-edited `# 0.1.24` comments drop out — the emitted `uses:` is the canonical form the lock proves. Signed-off-by: rldyourmnd --- .gds/bundle.lock.yaml | 10 +++++----- .github/workflows/gds-ci.yml | 10 +++++----- 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.gds/bundle.lock.yaml b/.gds/bundle.lock.yaml index 2c83804..f1bbe15 100644 --- a/.gds/bundle.lock.yaml +++ b/.gds/bundle.lock.yaml @@ -4,14 +4,14 @@ schema_version: 1 bundle: version: "0.9.7-dev" release_sequence: 0 - source_tree_digest: "sha256:17341c00e8252e7d0cd59eebc1fcecaf28301796285a2ae632da75c8932532d0" - digest: "sha256:2e8396d66b4365235b9a262a3f9fe66cd727d410ee121cb4e6a218c5e4a49719" + source_tree_digest: "sha256:fe02c4580c0096f44bee9a34ddfba300a60e63825a4e95f31ccc5bb15dc71874" + digest: "sha256:b1eb23b12eaa04e622fbe81f873aca00815c85d154d28f1e8faa7e21b11c0052" projection: - input_digest: "sha256:4b96ba6416faa4ce8f3ecf4642f142dfabb1a4fb65d8a34962bb00b94296700d" - output_digest: "sha256:3c98bb2cbe91041ea84b336ebc48f361409c7d796795affd6a0b4d27ff28e843" + input_digest: "sha256:7b89757f969d6a784ddf171c26f0ce346290d5358cb3d1a38cec0f8e2b6e8d00" + output_digest: "sha256:f45b937412136b0e07ca680f9d4a3e9c2c1d50b1b1d50c443a1876920f9fbda2" files: - path: ".gds/compiled-policy.json" digest: "sha256:9f498788bdc34e52a0ab793c536e0e6a7b360c2e1a20446cbf03ed51986cdc6f" - path: ".github/workflows/gds-ci.yml" - digest: "sha256:8fb50e6d5ea61d144d10c38f555a034646968d5537b811de4412f00cc5a958e3" + digest: "sha256:1ed96da28022277030c59cd799b647f267e437ca717406bdf2891b88bceeba82" diff --git a/.github/workflows/gds-ci.yml b/.github/workflows/gds-ci.yml index 8fdf285..2a31908 100644 --- a/.github/workflows/gds-ci.yml +++ b/.github/workflows/gds-ci.yml @@ -1,9 +1,9 @@ # GENERATED FILE - DO NOT EDIT DIRECTLY # generator: gds # bundle: 0.9.7-dev -# source-tree-digest: sha256:17341c00e8252e7d0cd59eebc1fcecaf28301796285a2ae632da75c8932532d0 -# input-digest: sha256:4b96ba6416faa4ce8f3ecf4642f142dfabb1a4fb65d8a34962bb00b94296700d -# output-digest: sha256:b9bf3d0c64c0fb371596e7d090e82e62aebbfde91929115fc15fb28644e4fd38 +# source-tree-digest: sha256:fe02c4580c0096f44bee9a34ddfba300a60e63825a4e95f31ccc5bb15dc71874 +# input-digest: sha256:7b89757f969d6a784ddf171c26f0ce346290d5358cb3d1a38cec0f8e2b6e8d00 +# output-digest: sha256:34152d66b8aec3c2352b91347df0196dc94749ccb4cf4c5357ccef1373217d71 # edit-source: # - .gds/repository.yaml # - policies/base/repository-default.yaml @@ -34,7 +34,7 @@ jobs: name: GDS fast permissions: contents: read - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@37a827f921f62353664fc4bcd872f05b65efe71a # 0.1.24 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@37a827f921f62353664fc4bcd872f05b65efe71a with: fetch_depth: 0 # Public hosted CI uses GitHub's service cache; the pinned reusable @@ -54,7 +54,7 @@ jobs: needs: fast permissions: contents: read - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@37a827f921f62353664fc4bcd872f05b65efe71a # 0.1.24 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@37a827f921f62353664fc4bcd872f05b65efe71a with: fetch_depth: 0 cache: true From 42c602141d576e2ab52ac445ce80ec5cc5b2f21c Mon Sep 17 00:00:00 2001 From: rldyourmnd Date: Mon, 21 Sep 2026 04:11:23 +0500 Subject: [PATCH 4/5] test(golden): restamp control-plane projection fixture for 0.1.24 The golden fixture asserts generated output for the declared `ci.workflow_ref`; advancing it moves the input and output digests. Regenerated through GDS_UPDATE_GOLDEN=1, the fixture's only write path. Signed-off-by: rldyourmnd --- .../golden/projections/control-plane/.claude/CLAUDE.md | 2 +- .../projections/control-plane/.gds/bundle.lock.yaml | 10 +++++----- .../control-plane/.github/workflows/gds-ci.yml | 8 ++++---- tests/golden/projections/control-plane/AGENTS.md | 2 +- 4 files changed, 11 insertions(+), 11 deletions(-) diff --git a/tests/golden/projections/control-plane/.claude/CLAUDE.md b/tests/golden/projections/control-plane/.claude/CLAUDE.md index 7d3b258..7744078 100644 --- a/tests/golden/projections/control-plane/.claude/CLAUDE.md +++ b/tests/golden/projections/control-plane/.claude/CLAUDE.md @@ -3,7 +3,7 @@ GENERATED FILE - DO NOT EDIT DIRECTLY generator: gds bundle: 0.9.7-dev source-tree-digest: sha256:0000000000000000000000000000000000000000000000000000000000000001 -input-digest: sha256:4eefca123b3b75f390ee5794f5ba1ec518777a267aeb5bce7bc0bf4fd9fe21f8 +input-digest: sha256:48b0c21cd064d41f2cab44bd6d3e90ede9b6ce13225cfdbed48e879f76938de5 output-digest: sha256:88cb57297d8d713287872a8afaca8d42f7146ecf7a091e4996e65eee8f962665 edit-source: - .gds/repository.yaml diff --git a/tests/golden/projections/control-plane/.gds/bundle.lock.yaml b/tests/golden/projections/control-plane/.gds/bundle.lock.yaml index 3ffa6db..a681a53 100644 --- a/tests/golden/projections/control-plane/.gds/bundle.lock.yaml +++ b/tests/golden/projections/control-plane/.gds/bundle.lock.yaml @@ -8,14 +8,14 @@ bundle: digest: "sha256:fe686e5956e8cd0e9904ebdbf70a5abd14998e3ae04993781fcb93e48a09e6ab" projection: - input_digest: "sha256:4eefca123b3b75f390ee5794f5ba1ec518777a267aeb5bce7bc0bf4fd9fe21f8" - output_digest: "sha256:cd1bc0444d6f250dda92bf1d498c354c0319a3713c40f74349bb493f7a35c54f" + input_digest: "sha256:48b0c21cd064d41f2cab44bd6d3e90ede9b6ce13225cfdbed48e879f76938de5" + output_digest: "sha256:50c6c720957993d85558daf56607fd6820f3905320aa1ceffffa6f8165632af7" files: - path: ".claude/CLAUDE.md" - digest: "sha256:44191b6f7a597c0257fda7cc4b813ecc21810d4d8b03d0ecdee985b4cbffe729" + digest: "sha256:8d08803273369641ef0a9bdcc30dfdde53ebe56ccc29f15a2fcae7721101a0cd" - path: ".gds/compiled-policy.json" digest: "sha256:f86f7e2eb77664de1960f9dd25835b4e7341ce02378803df34372c50c94c86fb" - path: ".github/workflows/gds-ci.yml" - digest: "sha256:a751158efad9987a1524e7f85436d39af07a1fd94f8308013b46ff4ab053e657" + digest: "sha256:00d0d9e580d5c6a390a37927a8565872de4f72894b6c67c5be87033c5b4aebde" - path: "AGENTS.md" - digest: "sha256:9553b54acaa8f11027433ef79c339c1c14e90877a1a402bf8be7ed65dbdcedac" + digest: "sha256:e0d0005904383162ea4e51b9e127a917263a38234eba8fa761251bcfd6ba38a4" diff --git a/tests/golden/projections/control-plane/.github/workflows/gds-ci.yml b/tests/golden/projections/control-plane/.github/workflows/gds-ci.yml index 05f9726..5b7811a 100644 --- a/tests/golden/projections/control-plane/.github/workflows/gds-ci.yml +++ b/tests/golden/projections/control-plane/.github/workflows/gds-ci.yml @@ -2,8 +2,8 @@ # generator: gds # bundle: 0.9.7-dev # source-tree-digest: sha256:0000000000000000000000000000000000000000000000000000000000000001 -# input-digest: sha256:4eefca123b3b75f390ee5794f5ba1ec518777a267aeb5bce7bc0bf4fd9fe21f8 -# output-digest: sha256:b9bf3d0c64c0fb371596e7d090e82e62aebbfde91929115fc15fb28644e4fd38 +# input-digest: sha256:48b0c21cd064d41f2cab44bd6d3e90ede9b6ce13225cfdbed48e879f76938de5 +# output-digest: sha256:34152d66b8aec3c2352b91347df0196dc94749ccb4cf4c5357ccef1373217d71 # edit-source: # - .gds/repository.yaml # - policies/base/repository-default.yaml @@ -33,7 +33,7 @@ jobs: name: GDS fast permissions: contents: read - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@9eb9e070ae87b0fc3bdbd2cbed5afe3b92f7e2c7 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@37a827f921f62353664fc4bcd872f05b65efe71a with: fetch_depth: 0 # Public hosted CI uses GitHub's service cache; the pinned reusable @@ -53,7 +53,7 @@ jobs: needs: fast permissions: contents: read - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@9eb9e070ae87b0fc3bdbd2cbed5afe3b92f7e2c7 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@37a827f921f62353664fc4bcd872f05b65efe71a with: fetch_depth: 0 cache: true diff --git a/tests/golden/projections/control-plane/AGENTS.md b/tests/golden/projections/control-plane/AGENTS.md index c231431..abf4c1a 100644 --- a/tests/golden/projections/control-plane/AGENTS.md +++ b/tests/golden/projections/control-plane/AGENTS.md @@ -3,7 +3,7 @@ GENERATED FILE - DO NOT EDIT DIRECTLY generator: gds bundle: 0.9.7-dev source-tree-digest: sha256:0000000000000000000000000000000000000000000000000000000000000001 -input-digest: sha256:4eefca123b3b75f390ee5794f5ba1ec518777a267aeb5bce7bc0bf4fd9fe21f8 +input-digest: sha256:48b0c21cd064d41f2cab44bd6d3e90ede9b6ce13225cfdbed48e879f76938de5 output-digest: sha256:c9674389b139e2ea844844d3e0bb9227a1528f4a5af9347e5dd43c563f8e1bd4 edit-source: - .gds/repository.yaml From b31af97443c631c19dfa573fdfa303670ba15140 Mon Sep 17 00:00:00 2001 From: Danil Silantyev Date: Mon, 21 Sep 2026 04:22:51 +0500 Subject: [PATCH 5/5] fix(ci): restore commit-pin comment on the ci-feedback caller The caller contract asserts the comment restates the pinned SHA (# commit:), not the release tag. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> --- .github/workflows/ci-feedback-events.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci-feedback-events.yml b/.github/workflows/ci-feedback-events.yml index 45581ee..84e6287 100644 --- a/.github/workflows/ci-feedback-events.yml +++ b/.github/workflows/ci-feedback-events.yml @@ -19,7 +19,7 @@ jobs: permissions: actions: read # Read exact completed run and job metadata. issues: write # Publish bounded failure evidence in this repository. - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/ci-feedback.yml@37a827f921f62353664fc4bcd872f05b65efe71a # 0.1.24 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/ci-feedback.yml@37a827f921f62353664fc4bcd872f05b65efe71a # commit:37a827f921f62353664fc4bcd872f05b65efe71a with: run-id: ${{ format('{0}', github.event.workflow_run.id) }} run-attempt: ${{ format('{0}', github.event.workflow_run.run_attempt) }}