From 1dcaa049b09c9ae1dfa391fa7912a30cedb29399 Mon Sep 17 00:00:00 2001 From: Jon Langevin Date: Sun, 4 Oct 2026 19:07:41 -0400 Subject: [PATCH] ci: stage frozen Go27 bridge authority Bind the independently reviewed five-file bridge without adopting executable code. Preserve existing active and unrelated staged contexts; adoption and promotion remain separate changes. --- .github/public-workflow-action-allowlist.json | 24 ++ .github/public-workflow-authority.json | 161 ++++++- .../public-workflow-command-allowlist.json | 400 ++++++++++++++++++ .../public-workflow-executable-allowlist.json | 16 + .../public-workflow-presence-allowlist.json | 6 + 5 files changed, 605 insertions(+), 2 deletions(-) diff --git a/.github/public-workflow-action-allowlist.json b/.github/public-workflow-action-allowlist.json index e142ed40..6001a671 100644 --- a/.github/public-workflow-action-allowlist.json +++ b/.github/public-workflow-action-allowlist.json @@ -670,5 +670,29 @@ "contextSHA256": "5416093bc5a985f34af5326bd3a7484154084a7911ca6a8384d00b7a34cd2ff4", "state": "staged", "rationale": "Pinned action for reviewed credential-free contract wire validation." + }, + { + "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", + "nodeSHA256": "8ddc920b847e5e03515a92d8be49290bd9039f458fffcdeea7ad0a30f48e15dc", + "path": ".github/workflows/public-workflow-policy.yml", + "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact action actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", + "state": "staged", + "uses": "actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5" + }, + { + "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", + "nodeSHA256": "65d08e860e0e0ba32c867339a375a514ee8887326bb4cff3543aec359932ac1a", + "path": ".github/workflows/public-workflow-policy.yml", + "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact action actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", + "state": "staged", + "uses": "actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff" + }, + { + "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", + "nodeSHA256": "a280f2ecccaed15b220dc27221b587c4285d6fad210ce7683db38a5eaa555cb4", + "path": ".github/workflows/public-workflow-policy.yml", + "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact action actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", + "state": "staged", + "uses": "actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff" } ] diff --git a/.github/public-workflow-authority.json b/.github/public-workflow-authority.json index db969706..f1aae6ee 100644 --- a/.github/public-workflow-authority.json +++ b/.github/public-workflow-authority.json @@ -1,5 +1,4 @@ { - "version": 1, "bundles": [ { "state": "active", @@ -145,6 +144,164 @@ "sha256": "7d209bb35ff3a7a46b22f9a10a920eb30218c3403726d1dac72e0bffd1d914a4" } ] + }, + { + "files": [ + { + "path": ".github/workflows/policytool/adoptionguard/main.go", + "sha256": "7854ccaa9593bc5d64eb93db78ec1bdd6b36d61b545bada95df34ce542f2002a" + }, + { + "path": ".github/workflows/policytool/adoptionguard/main_test.go", + "sha256": "f4220c8924a6feb96d124c06032cdced62342fe39165f8a0e96f6b2b397e7f17" + }, + { + "path": ".github/workflows/policytool/adoptionguard/run.sh", + "sha256": "b5597c106885bdc9b1f7161f7c6a1635d92f5f9273c41ec799233d68d6dbf3e4" + }, + { + "path": ".github/workflows/policytool/go.mod", + "sha256": "0a2d135980310757f36e733161b94498b4e0a1b6ac8c6de8a799f542d6c9ddb8" + }, + { + "path": ".github/workflows/policytool/go.sum", + "sha256": "790ef858e5aeed12269a69e764ac69c02c3877678b0e7d9384ad3728b6e09f6c" + }, + { + "path": ".github/workflows/policytool/main.go", + "sha256": "8dba6ad341fa07644868fd43717aff162c4feae1694ee9a122ef4cd401214a00" + }, + { + "path": ".github/workflows/policytool/main_test.go", + "sha256": "a88f4ec70a2736e54bf887594da855fb6d25d2cecb35321cd5fa8a2455304212" + }, + { + "path": ".github/workflows/scripts/verify-public-workflow-branch-protection.sh", + "sha256": "0d48038f7e641f0a58ae2a0f9150d40f284619c2254951fb31066fbb121df304" + }, + { + "path": "scripts/check-public-workflow-policy.sh", + "sha256": "166d4c7f272b6e249abd5bd2efadb8034105cf62df3cff2200978c6e9fb6998c" + }, + { + "path": "scripts/fixtures/public-workflow-policy/lifecycle-future.yml", + "sha256": "de3bdf01a31d2a0d39a279a65258d47f0f504155065de720a1908a1b7a703103" + }, + { + "path": "scripts/fixtures/public-workflow-policy/lifecycle-old.yml", + "sha256": "6dc23984617b91711ff14a08e8d428d9dc47dc3c00f4efd703bf747fe7e6a122" + }, + { + "path": "scripts/fixtures/public-workflow-policy/pass-expression-and-deny-guard.yml", + "sha256": "6af7ce9692c0e3c3f4468927912db334bab659b36567703e27cd9d2c0957d908" + }, + { + "path": "scripts/fixtures/public-workflow-policy/pass-negative-guard.yml", + "sha256": "7af97a7da7d416064190ba39e6829148071714d39840dc7f354cab78fadc3665" + }, + { + "path": "scripts/fixtures/public-workflow-policy/pass.yml", + "sha256": "38ece391dcb2d2b84ba44121cd6bdcc2953a3822ab0e464224e0bb60199400e5" + }, + { + "path": "scripts/fixtures/public-workflow-policy/reject-builtin-wrapper.yml", + "sha256": "56fcfd4f7752e6b462471a78b329bbf6e8d978fa047c4bdbf9d09b25cc350be0" + }, + { + "path": "scripts/fixtures/public-workflow-policy/reject-command-analysis.yml", + "sha256": "589658280ae8623d932e691323b138c439a28fe27a79ea2859be7c00600b6820" + }, + { + "path": "scripts/fixtures/public-workflow-policy/reject-deny-pattern-execution.yml", + "sha256": "c8475ed82b6fb7ac4ec227f48becc4a148d7d3665a5fdfdbac19096cca7c2165" + }, + { + "path": "scripts/fixtures/public-workflow-policy/reject-dynamic-secrets.yml", + "sha256": "7900842a6adf772396eb4893925d26b71e1a4560053305031d7c4e15b3e2f5f8" + }, + { + "path": "scripts/fixtures/public-workflow-policy/reject-env-indirection.yml", + "sha256": "6b524ac4c498f45d68896676f75c8171033558a9a270f5158870ae36604218d7" + }, + { + "path": "scripts/fixtures/public-workflow-policy/reject-execution-context.yml", + "sha256": "50629e545d7fba12247f28a06e9632b52c3c8d63c01a2551fb8d9d7ac2a6e0b6" + }, + { + "path": "scripts/fixtures/public-workflow-policy/reject-global.yml", + "sha256": "43620c1094cf6a8223f4b35c18bf54a621e09b5f5922b835bd7e22a48f1f205d" + }, + { + "path": "scripts/fixtures/public-workflow-policy/reject-guard-suffix.yml", + "sha256": "4b5623b44d1dcef0198ce914a16a358180f65d733d5521863b4606178ea20823" + }, + { + "path": "scripts/fixtures/public-workflow-policy/reject-implicit-permissions.yml", + "sha256": "5606653732f73c8c9af42c28a72f5d2a43336fd0edbb25524832e98713e798a8" + }, + { + "path": "scripts/fixtures/public-workflow-policy/reject-legacy-github-token.yml", + "sha256": "595e24dcd363104586f7c973225cf6ba79606dfc1b9124ef383c668932e9fb5a" + }, + { + "path": "scripts/fixtures/public-workflow-policy/reject-missing-shell.yml", + "sha256": "58757a1e09107185710dd3a2c401d6a3691d1c11f4db7f41b8a4f8dde57d0574" + }, + { + "path": "scripts/fixtures/public-workflow-policy/reject-permissions.yml", + "sha256": "24ac3b5c02f97b7b3ec2e06f2d7c7c46035a17dda029ed8918c3e54d8e6933c4" + }, + { + "path": "scripts/fixtures/public-workflow-policy/reject-provider-uses.yml", + "sha256": "3f6a028a527a04b1bcddd087174b56b85916fc347da23cb86b76948b2a006f45" + }, + { + "path": "scripts/fixtures/public-workflow-policy/reject-runners.yml", + "sha256": "cbfec39b289dfcbee247f6fa5a415c01921ab02e03c63bd974df1322a6159050" + }, + { + "path": "scripts/fixtures/public-workflow-policy/reject-script-execution.yml", + "sha256": "6e57329ba154ee32a37c2c8227f75db5422d9fdf3487180f4f8d388891c04f62" + }, + { + "path": "scripts/fixtures/public-workflow-policy/reject-secret-syntax.yml", + "sha256": "3ef3fc0c94a53510069d63e58e7a7eef51de884d7446fe20476d60c4fa078648" + }, + { + "path": "scripts/fixtures/public-workflow-policy/reject-shell-inheritance.yml", + "sha256": "330bc5a511a1c14d6adadd7e7f19a1baacdf47b513a2382e7cfa060babc460e0" + }, + { + "path": "scripts/fixtures/public-workflow-policy/reject-shell.yml", + "sha256": "6dffd2756cf468c9bf4c268bfebfd1c4bfb96e81e30137a7dafbd0d39161df00" + }, + { + "path": "scripts/fixtures/public-workflow-policy/reject-statement-authority.yml", + "sha256": "2ae4ecdde184f102004b81cca0de0e345278c7ebc2aa0993f5a8ef47acf50e91" + }, + { + "path": "scripts/fixtures/public-workflow-policy/reject-unreviewed-uses.yml", + "sha256": "4e1a4f1d5c7b147af24dac04448617a77649e711366ab19701d6e878a1c0a274" + }, + { + "path": "scripts/fixtures/public-workflow-policy/reject-unsafe-programs.yml", + "sha256": "5c464126d992dc5305ca68c6ebb0f7086650d0e86dc56aee35ee0de40e6b1f96" + }, + { + "path": "scripts/fixtures/public-workflow-policy/reject-yaml-structure.yml", + "sha256": "e564fe3b6655a68c242038c98f480fe432ed840aa3325caab88e052343352402" + }, + { + "path": "scripts/fixtures/public-workflow-policy/reject.yml", + "sha256": "e98e5b29312f6541e6d71fc532943a055c9164923cd560710d47414ac80aecc1" + }, + { + "path": "scripts/test-check-public-workflow-policy.sh", + "sha256": "7d209bb35ff3a7a46b22f9a10a920eb30218c3403726d1dac72e0bffd1d914a4" + } + ], + "state": "staged" } - ] + ], + "version": 1 } diff --git a/.github/public-workflow-command-allowlist.json b/.github/public-workflow-command-allowlist.json index ef98bc3a..5385aed1 100644 --- a/.github/public-workflow-command-allowlist.json +++ b/.github/public-workflow-command-allowlist.json @@ -2726,5 +2726,405 @@ "contextSHA256": "5416093bc5a985f34af5326bd3a7484154084a7911ca6a8384d00b7a34cd2ff4", "state": "staged", "rationale": "Exact reviewed command for credential-free contract-consumer compatibility." + }, + { + "command": "echo", + "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", + "path": ".github/workflows/public-workflow-policy.yml", + "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking echo to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", + "state": "staged", + "statementSHA256": "74d9799e73f5f1a79baf06bea87cd6ba525c897ee703e8decf3e763191e411c1" + }, + { + "command": "exit", + "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", + "path": ".github/workflows/public-workflow-policy.yml", + "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking exit to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", + "state": "staged", + "statementSHA256": "74d9799e73f5f1a79baf06bea87cd6ba525c897ee703e8decf3e763191e411c1" + }, + { + "command": "echo", + "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", + "path": ".github/workflows/public-workflow-policy.yml", + "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking echo to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", + "state": "staged", + "statementSHA256": "fe9e84eb32be5ac99349d7e60340785a6e5b3750dcecf795514c53ec76253516" + }, + { + "command": "exit", + "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", + "path": ".github/workflows/public-workflow-policy.yml", + "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking exit to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", + "state": "staged", + "statementSHA256": "fe9e84eb32be5ac99349d7e60340785a6e5b3750dcecf795514c53ec76253516" + }, + { + "command": "echo", + "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", + "path": ".github/workflows/public-workflow-policy.yml", + "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking echo to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", + "state": "staged", + "statementSHA256": "4ade2e44c08380b704763da57c411f70fc54eebcabf0abd0277746786def0bf8" + }, + { + "command": "exit", + "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", + "path": ".github/workflows/public-workflow-policy.yml", + "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking exit to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", + "state": "staged", + "statementSHA256": "4ade2e44c08380b704763da57c411f70fc54eebcabf0abd0277746786def0bf8" + }, + { + "command": "$assignment", + "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", + "path": ".github/workflows/public-workflow-policy.yml", + "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking $assignment to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", + "state": "staged", + "statementSHA256": "0e17e768c1484e9def2346c58a2c32d337d4c33d780f0ffc79504af0c40ecba7" + }, + { + "command": "mkdir", + "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", + "path": ".github/workflows/public-workflow-policy.yml", + "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking mkdir to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", + "state": "staged", + "statementSHA256": "42f84c05333b2c7011f332ebca981a05c457d59e7595b13dac5dee7f58429d60" + }, + { + "command": "git", + "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", + "path": ".github/workflows/public-workflow-policy.yml", + "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking git to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", + "state": "staged", + "statementSHA256": "9919b241412c88da2b0a86cbeaab201cc2323a2fd0c957e2f726ebc62b7282a6" + }, + { + "command": "git", + "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", + "path": ".github/workflows/public-workflow-policy.yml", + "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking git to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", + "state": "staged", + "statementSHA256": "0cf020cfd2b573841c37a0529d43d5b53f9b318028b28b3536b2f6aff30f02bc" + }, + { + "command": "$assignment", + "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", + "path": ".github/workflows/public-workflow-policy.yml", + "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking $assignment to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", + "state": "staged", + "statementSHA256": "66d1ee88edc672ead2282e1e159bc382cc6fad2c13a86c6ce585e0082a006b8d" + }, + { + "command": "git", + "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", + "path": ".github/workflows/public-workflow-policy.yml", + "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking git to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", + "state": "staged", + "statementSHA256": "66d1ee88edc672ead2282e1e159bc382cc6fad2c13a86c6ce585e0082a006b8d" + }, + { + "command": "echo", + "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", + "path": ".github/workflows/public-workflow-policy.yml", + "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking echo to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", + "state": "staged", + "statementSHA256": "ff503c4cc7be7d35246d5c16eca55f3af89544a6ad9ffc6bf0bb0cbe4a199d19" + }, + { + "command": "exit", + "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", + "path": ".github/workflows/public-workflow-policy.yml", + "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking exit to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", + "state": "staged", + "statementSHA256": "ff503c4cc7be7d35246d5c16eca55f3af89544a6ad9ffc6bf0bb0cbe4a199d19" + }, + { + "command": "git", + "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", + "path": ".github/workflows/public-workflow-policy.yml", + "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking git to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", + "state": "staged", + "statementSHA256": "465704dc91fedf6386416daaecdf25aceff4bb50fa5defae0958b0a30bdeb6d1" + }, + { + "command": "read", + "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", + "path": ".github/workflows/public-workflow-policy.yml", + "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking read to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", + "state": "staged", + "statementSHA256": "e9f5edd1eb6f1cf0981dee8cb41c339f3b29870174e740942a56d4076bd36887" + }, + { + "command": "echo", + "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", + "path": ".github/workflows/public-workflow-policy.yml", + "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking echo to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", + "state": "staged", + "statementSHA256": "e9f5edd1eb6f1cf0981dee8cb41c339f3b29870174e740942a56d4076bd36887" + }, + { + "command": "exit", + "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", + "path": ".github/workflows/public-workflow-policy.yml", + "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking exit to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", + "state": "staged", + "statementSHA256": "e9f5edd1eb6f1cf0981dee8cb41c339f3b29870174e740942a56d4076bd36887" + }, + { + "command": "git", + "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", + "path": ".github/workflows/public-workflow-policy.yml", + "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking git to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", + "state": "staged", + "statementSHA256": "3a50f487e92cd73a96ba4ae31eaa56980c1452ddb24bb37fce32cc2cf0f933e0" + }, + { + "command": "tar", + "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", + "path": ".github/workflows/public-workflow-policy.yml", + "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking tar to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", + "state": "staged", + "statementSHA256": "9e40419faa9458450eddc809e65c865dbf076b4dbd75f7e7cd3776aabdb7e1e0" + }, + { + "command": "echo", + "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", + "path": ".github/workflows/public-workflow-policy.yml", + "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking echo to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", + "state": "staged", + "statementSHA256": "9e40419faa9458450eddc809e65c865dbf076b4dbd75f7e7cd3776aabdb7e1e0" + }, + { + "command": "exit", + "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", + "path": ".github/workflows/public-workflow-policy.yml", + "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking exit to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", + "state": "staged", + "statementSHA256": "9e40419faa9458450eddc809e65c865dbf076b4dbd75f7e7cd3776aabdb7e1e0" + }, + { + "command": "read", + "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", + "path": ".github/workflows/public-workflow-policy.yml", + "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking read to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", + "state": "staged", + "statementSHA256": "3f1d57f7be1844759d7c250d516b66e11aa6e6da06ce6d2f0ad4182e4b9faf4b" + }, + { + "command": "echo", + "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", + "path": ".github/workflows/public-workflow-policy.yml", + "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking echo to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", + "state": "staged", + "statementSHA256": "3f1d57f7be1844759d7c250d516b66e11aa6e6da06ce6d2f0ad4182e4b9faf4b" + }, + { + "command": "exit", + "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", + "path": ".github/workflows/public-workflow-policy.yml", + "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking exit to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", + "state": "staged", + "statementSHA256": "3f1d57f7be1844759d7c250d516b66e11aa6e6da06ce6d2f0ad4182e4b9faf4b" + }, + { + "command": "tar", + "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", + "path": ".github/workflows/public-workflow-policy.yml", + "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking tar to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", + "state": "staged", + "statementSHA256": "2c7cd49dcf58abe45dabab11177f0c555401c94df4a264edd50b7a272e6304be" + }, + { + "command": "$assignment", + "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", + "path": ".github/workflows/public-workflow-policy.yml", + "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking $assignment to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", + "state": "staged", + "statementSHA256": "6af7f417e806699121e4d583e17b42321a812a4b8237364a263b970d48dc6132" + }, + { + "command": "find", + "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", + "path": ".github/workflows/public-workflow-policy.yml", + "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking find to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", + "state": "staged", + "statementSHA256": "6af7f417e806699121e4d583e17b42321a812a4b8237364a263b970d48dc6132" + }, + { + "command": "echo", + "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", + "path": ".github/workflows/public-workflow-policy.yml", + "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking echo to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", + "state": "staged", + "statementSHA256": "c7f1a421fa15eeab86ac50981d3a6b99248925a1dc7d62f2847e9a82efe2a4a1" + }, + { + "command": "exit", + "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", + "path": ".github/workflows/public-workflow-policy.yml", + "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking exit to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", + "state": "staged", + "statementSHA256": "c7f1a421fa15eeab86ac50981d3a6b99248925a1dc7d62f2847e9a82efe2a4a1" + }, + { + "command": "$assignment", + "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", + "path": ".github/workflows/public-workflow-policy.yml", + "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking $assignment to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", + "state": "staged", + "statementSHA256": "6e78bfd0781f308df8a82c819888f28647df16892ba5a7cef1571b725e102383" + }, + { + "command": "[", + "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", + "path": ".github/workflows/public-workflow-policy.yml", + "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking [ to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", + "state": "staged", + "statementSHA256": "e5888a15646c95e95768c301658269ab4880ac40a2aed5200133899101db0a56" + }, + { + "command": "$assignment", + "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", + "path": ".github/workflows/public-workflow-policy.yml", + "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking $assignment to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", + "state": "staged", + "statementSHA256": "e5888a15646c95e95768c301658269ab4880ac40a2aed5200133899101db0a56" + }, + { + "command": "echo", + "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", + "path": ".github/workflows/public-workflow-policy.yml", + "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking echo to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", + "state": "staged", + "statementSHA256": "e5888a15646c95e95768c301658269ab4880ac40a2aed5200133899101db0a56" + }, + { + "command": "exit", + "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", + "path": ".github/workflows/public-workflow-policy.yml", + "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking exit to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", + "state": "staged", + "statementSHA256": "e5888a15646c95e95768c301658269ab4880ac40a2aed5200133899101db0a56" + }, + { + "command": "echo", + "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", + "path": ".github/workflows/public-workflow-policy.yml", + "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking echo to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", + "state": "staged", + "statementSHA256": "7c133076e6ce17d413f1327ea6d975f452d350aba142430d9ad85847205e36b8" + }, + { + "command": "[", + "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", + "path": ".github/workflows/public-workflow-policy.yml", + "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking [ to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", + "state": "staged", + "statementSHA256": "5f8e07c6f716cb7da7802dc483fb1d72aed7f4a46b0fe6e2b79633123f4c775e" + }, + { + "command": "cd", + "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", + "path": ".github/workflows/public-workflow-policy.yml", + "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking cd to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", + "state": "staged", + "statementSHA256": "5f8e07c6f716cb7da7802dc483fb1d72aed7f4a46b0fe6e2b79633123f4c775e" + }, + { + "command": "check-public-workflow-policy.sh", + "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", + "path": ".github/workflows/public-workflow-policy.yml", + "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking check-public-workflow-policy.sh to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", + "state": "staged", + "statementSHA256": "5f8e07c6f716cb7da7802dc483fb1d72aed7f4a46b0fe6e2b79633123f4c775e" + }, + { + "command": "echo", + "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", + "path": ".github/workflows/public-workflow-policy.yml", + "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking echo to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", + "state": "staged", + "statementSHA256": "bfaa72e371a40394f5979f319f3ebffdb30a4d9ef19fafed77fd4ac12dc30ad2" + }, + { + "command": "exit", + "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", + "path": ".github/workflows/public-workflow-policy.yml", + "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking exit to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", + "state": "staged", + "statementSHA256": "1a21be8bb1dc4721d30cc1850ead617faa55ae9aebf416da4369668bdeaf0824" + }, + { + "command": "$assignment", + "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", + "path": ".github/workflows/public-workflow-policy.yml", + "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking $assignment to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", + "state": "staged", + "statementSHA256": "3c5b32a0f4bacbab25fd6ed87aa869b1646138cf8dac471840a36556c41bbf4d" + }, + { + "command": "cd", + "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", + "path": ".github/workflows/public-workflow-policy.yml", + "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking cd to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", + "state": "staged", + "statementSHA256": "3c5b32a0f4bacbab25fd6ed87aa869b1646138cf8dac471840a36556c41bbf4d" + }, + { + "command": "run.sh", + "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", + "path": ".github/workflows/public-workflow-policy.yml", + "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking run.sh to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", + "state": "staged", + "statementSHA256": "3c5b32a0f4bacbab25fd6ed87aa869b1646138cf8dac471840a36556c41bbf4d" + }, + { + "command": "[", + "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", + "path": ".github/workflows/public-workflow-policy.yml", + "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking [ to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", + "state": "staged", + "statementSHA256": "ce4c2d189d1b611bd2ed5a9e694a2a8353ee81f6a44d4e9c2961f1809c3dae67" + }, + { + "command": "echo", + "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", + "path": ".github/workflows/public-workflow-policy.yml", + "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking echo to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", + "state": "staged", + "statementSHA256": "ce4c2d189d1b611bd2ed5a9e694a2a8353ee81f6a44d4e9c2961f1809c3dae67" + }, + { + "command": "exit", + "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", + "path": ".github/workflows/public-workflow-policy.yml", + "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking exit to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", + "state": "staged", + "statementSHA256": "ce4c2d189d1b611bd2ed5a9e694a2a8353ee81f6a44d4e9c2961f1809c3dae67" + }, + { + "command": "printf", + "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", + "path": ".github/workflows/public-workflow-policy.yml", + "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking printf to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", + "state": "staged", + "statementSHA256": "8c3c075c644d214a76a7406f14d62fa50a4cdc8b07b231da74ef3cffdc86a4e9" + }, + { + "command": "cd", + "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", + "path": ".github/workflows/public-workflow-policy.yml", + "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking cd to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", + "state": "staged", + "statementSHA256": "824ebf5395f4ccfdbd481e20116fb3c166c01f3bdda7490b1229ce795e1dff20" + }, + { + "command": "check-public-workflow-policy.sh", + "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", + "path": ".github/workflows/public-workflow-policy.yml", + "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking check-public-workflow-policy.sh to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", + "state": "staged", + "statementSHA256": "89a1f75b6db0c513cc68634a7b1e7983e88d121f09db4dbfe7aaa6edd1e9978c" } ] diff --git a/.github/public-workflow-executable-allowlist.json b/.github/public-workflow-executable-allowlist.json index ab3cabc2..8cfb6177 100644 --- a/.github/public-workflow-executable-allowlist.json +++ b/.github/public-workflow-executable-allowlist.json @@ -86,5 +86,21 @@ "state": "staged", "sha256": "47c43498b33e4ab9f410e2eeff5eb124cd953fe657d81fbcd004133a41408c3c", "rationale": "Exercises hermetic contract selection, provenance, runtime parity, and real local loading." + }, + { + "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", + "path": "scripts/check-public-workflow-policy.sh", + "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact repository executable scripts/check-public-workflow-policy.sh to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", + "sha256": "166d4c7f272b6e249abd5bd2efadb8034105cf62df3cff2200978c6e9fb6998c", + "state": "staged", + "workflowPath": ".github/workflows/public-workflow-policy.yml" + }, + { + "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", + "path": ".github/workflows/policytool/adoptionguard/run.sh", + "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact repository executable .github/workflows/policytool/adoptionguard/run.sh to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", + "sha256": "b5597c106885bdc9b1f7161f7c6a1635d92f5f9273c41ec799233d68d6dbf3e4", + "state": "staged", + "workflowPath": ".github/workflows/public-workflow-policy.yml" } ] diff --git a/.github/public-workflow-presence-allowlist.json b/.github/public-workflow-presence-allowlist.json index 60db2a7e..b4bf294b 100644 --- a/.github/public-workflow-presence-allowlist.json +++ b/.github/public-workflow-presence-allowlist.json @@ -116,5 +116,11 @@ "contextSHA256": "5416093bc5a985f34af5326bd3a7484154084a7911ca6a8384d00b7a34cd2ff4", "state": "staged", "presence": "present" + }, + { + "path": ".github/workflows/public-workflow-policy.yml", + "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", + "state": "staged", + "presence": "present" } ]