From 32a40cd1ddb11729228a77ef31757543b0830765 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 5 Oct 2026 07:43:55 +0000
Subject: [PATCH 1/5] build(deps): bump
 github.com/santhosh-tekuri/jsonschema/v6

Bumps [github.com/santhosh-tekuri/jsonschema/v6](https://github.com/santhosh-tekuri/jsonschema) from 6.0.2 to 6.0.3.
- [Release notes](https://github.com/santhosh-tekuri/jsonschema/releases)
- [Commits](https://github.com/santhosh-tekuri/jsonschema/compare/v6.0.2...v6.0.3)

---
updated-dependencies:
- dependency-name: github.com/santhosh-tekuri/jsonschema/v6
  dependency-version: 6.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index 0e7958ce..00acaed8 100644
--- a/go.mod
+++ b/go.mod
@@ -39,7 +39,7 @@ require (
 	github.com/prometheus/client_model v0.6.2
 	github.com/redis/go-redis/v9 v9.21.0
 	github.com/rhysd/actionlint v1.7.12
-	github.com/santhosh-tekuri/jsonschema/v6 v6.0.2
+	github.com/santhosh-tekuri/jsonschema/v6 v6.0.3
 	github.com/stretchr/testify v1.11.1
 	github.com/stripe/stripe-go/v82 v82.5.1
 	github.com/tliron/glsp v0.2.2
diff --git a/go.sum b/go.sum
index a71a2978..852f4613 100644
--- a/go.sum
+++ b/go.sum
@@ -579,8 +579,8 @@ github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk=
 github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc=
-github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 h1:KRzFb2m7YtdldCEkzs6KqmJw4nqEVZGK7IN2kJkjTuQ=
-github.com/santhosh-tekuri/jsonschema/v6 v6.0.2/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.3 h1:1EYB5IzjZawrrnELUi78f9fPu57HuXjmddZPjrls/28=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.3/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
 github.com/sasha-s/go-deadlock v0.3.9 h1:fiaT9rB7g5sr5ddNZvlwheclN9IP86eFW9WgqlEQV+w=
 github.com/sasha-s/go-deadlock v0.3.9/go.mod h1:KuZj51ZFmx42q/mPaYbRk0P1xcwe697zsJKE03vD4/Y=
 github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529 h1:nn5Wsu0esKSJiIVhscUtVbo7ada43DJhG55ua/hjS5I=

From c61019acbd6138c9330960d1aa97301955922e7b Mon Sep 17 00:00:00 2001
From: Jon Langevin <codingsloth@pm.me>
Date: Mon, 5 Oct 2026 15:57:51 -0400
Subject: [PATCH 2/5] test: supply event routes to policy fetch fixtures

---
 scripts/test-check-public-workflow-policy.sh | 34 ++++++++++++++++++++
 1 file changed, 34 insertions(+)

diff --git a/scripts/test-check-public-workflow-policy.sh b/scripts/test-check-public-workflow-policy.sh
index a0b878b0..0eb5b172 100755
--- a/scripts/test-check-public-workflow-policy.sh
+++ b/scripts/test-check-public-workflow-policy.sh
@@ -1524,6 +1524,9 @@ run_candidate_fetch() {
   (
     cd "${workdir}"
     PATH="${fake_bin}:$PATH" \
+      EVENT_NAME="${FAKE_EVENT_NAME-pull_request_target}" \
+      BASE_REF="${FAKE_BASE_REF-main}" \
+      EVENT_REF="${FAKE_EVENT_REF-refs/heads/main}" \
       CANDIDATE_REPOSITORY="${repository}" \
       CANDIDATE_SHA="${sha}" \
       GIT_ASKPASS=/bin/false \
@@ -1558,6 +1561,37 @@ fi
 grep -Fq -- "-tvf candidate.tar" "${candidate_fetch_good}/tar.log"
 grep -Fq -- "--extract --file=candidate.tar --directory=candidate --no-same-owner --no-same-permissions" "${candidate_fetch_good}/tar.log"
 
+candidate_fetch_push="${tmp_dir}/candidate-fetch-push"
+FAKE_EVENT_NAME=push FAKE_BASE_REF= \
+  run_candidate_fetch "${candidate_fetch_push}" example/repo "${candidate_sha}" "${fake_archive}"
+test -f "${candidate_fetch_push}/candidate/.github/workflows/inert.yml"
+
+for invalid_route in \
+  'pull-request|pull_request|main|refs/heads/main' \
+  'other-base|pull_request_target|develop|refs/heads/main' \
+  'other-ref|pull_request_target|main|refs/heads/develop' \
+  'push-base|push|main|refs/heads/main' \
+  'push-ref|push||refs/heads/develop'; do
+  IFS='|' read -r label event_name base_ref event_ref <<<"${invalid_route}"
+  route_workdir="${tmp_dir}/candidate-route-${label}"
+  set +e
+  route_output="$(FAKE_EVENT_NAME="${event_name}" FAKE_BASE_REF="${base_ref}" \
+    FAKE_EVENT_REF="${event_ref}" \
+    run_candidate_fetch "${route_workdir}" example/repo "${candidate_sha}" "${fake_archive}" 2>&1)"
+  route_status=$?
+  set -e
+  if [[ "${route_status}" -eq 0 ]] || ! grep -Fq -- \
+    "public workflow policy accepts only push or pull_request_target for main" <<<"${route_output}"; then
+    echo "candidate fetch accepted invalid event route ${label}" >&2
+    printf '%s\n' "${route_output}" >&2
+    exit 1
+  fi
+  if [[ -e "${route_workdir}/git.log" || -e "${route_workdir}/tar.log" ]]; then
+    echo "candidate fetch invoked Git or tar before rejecting event route ${label}" >&2
+    exit 1
+  fi
+done
+
 for invalid_candidate in \
   'bad-repository|example/repo?token=leak|0123456789012345678901234567890123456789' \
   'short-sha|example/repo|0123456789'; do

From f71d379874bf37eb06e03071da4d2c37b1cda12f Mon Sep 17 00:00:00 2001
From: Jon Langevin <codingsloth@pm.me>
Date: Mon, 5 Oct 2026 16:01:12 -0400
Subject: [PATCH 3/5] test: compress conformance fixture archives at best speed

---
 cmd/wfctl/plugin_conformance_test.go | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/cmd/wfctl/plugin_conformance_test.go b/cmd/wfctl/plugin_conformance_test.go
index 9301b22c..494dffca 100644
--- a/cmd/wfctl/plugin_conformance_test.go
+++ b/cmd/wfctl/plugin_conformance_test.go
@@ -425,7 +425,11 @@ func writeTarGzFromDir(t *testing.T, srcDir, dest string) {
 		t.Fatalf("create archive: %v", err)
 	}
 	defer f.Close()
-	gw := gzip.NewWriter(f)
+	// Fixture compression need not spend the full race-test budget on release binaries.
+	gw, err := gzip.NewWriterLevel(f, gzip.BestSpeed)
+	if err != nil {
+		t.Fatalf("create fixture gzip writer: %v", err)
+	}
 	defer gw.Close()
 	tw := tar.NewWriter(gw)
 	defer tw.Close()
@@ -474,7 +478,11 @@ func writeTarGzFiles(t *testing.T, dest string, files map[string]string) {
 		t.Fatalf("create archive: %v", err)
 	}
 	defer f.Close()
-	gw := gzip.NewWriter(f)
+	// Preserve real gzip archives while avoiding expensive default-level fixture compression.
+	gw, err := gzip.NewWriterLevel(f, gzip.BestSpeed)
+	if err != nil {
+		t.Fatalf("create fixture gzip writer: %v", err)
+	}
 	defer gw.Close()
 	tw := tar.NewWriter(gw)
 	defer tw.Close()

From 26291cb2d496852231005ae7acbda8b8d1b7f592 Mon Sep 17 00:00:00 2001
From: Jon Langevin <codingsloth@pm.me>
Date: Mon, 5 Oct 2026 16:02:06 -0400
Subject: [PATCH 4/5] build(deps): synchronize example module checksums

---
 example/go.mod | 2 +-
 example/go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/example/go.mod b/example/go.mod
index 62d1b487..aa0cfcdc 100644
--- a/example/go.mod
+++ b/example/go.mod
@@ -148,7 +148,7 @@ require (
 	github.com/reugn/go-quartz v0.15.2 // indirect
 	github.com/robfig/cron/v3 v3.0.1 // indirect
 	github.com/ryanuber/go-glob v1.0.0 // indirect
-	github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 // indirect
+	github.com/santhosh-tekuri/jsonschema/v6 v6.0.3 // indirect
 	github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529 // indirect
 	github.com/spf13/pflag v1.0.10 // indirect
 	github.com/tidwall/btree v1.8.1 // indirect
diff --git a/example/go.sum b/example/go.sum
index 3e0ec393..22223f9f 100644
--- a/example/go.sum
+++ b/example/go.sum
@@ -479,8 +479,8 @@ github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0t
 github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
 github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk=
 github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc=
-github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 h1:KRzFb2m7YtdldCEkzs6KqmJw4nqEVZGK7IN2kJkjTuQ=
-github.com/santhosh-tekuri/jsonschema/v6 v6.0.2/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.3 h1:1EYB5IzjZawrrnELUi78f9fPu57HuXjmddZPjrls/28=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.3/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
 github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529 h1:nn5Wsu0esKSJiIVhscUtVbo7ada43DJhG55ua/hjS5I=
 github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529/go.mod h1:DxrIzT+xaE7yg65j358z/aeFdxmN0P9QXhEzd20vsDc=
 github.com/shirou/gopsutil/v4 v4.26.5 h1:RPcBXkpz7kOj9PqGFQOlBPZHsyaPvPVQc098y9RmCNM=

From 16cc7f5adfa9541419b8866d3a04a49638d0ec1d Mon Sep 17 00:00:00 2001
From: Jon Langevin <codingsloth@pm.me>
Date: Mon, 5 Oct 2026 16:15:56 -0400
Subject: [PATCH 5/5] test: preserve pinned policy harness pending governed
 repair

---
 scripts/test-check-public-workflow-policy.sh | 34 --------------------
 1 file changed, 34 deletions(-)

diff --git a/scripts/test-check-public-workflow-policy.sh b/scripts/test-check-public-workflow-policy.sh
index 0eb5b172..a0b878b0 100755
--- a/scripts/test-check-public-workflow-policy.sh
+++ b/scripts/test-check-public-workflow-policy.sh
@@ -1524,9 +1524,6 @@ run_candidate_fetch() {
   (
     cd "${workdir}"
     PATH="${fake_bin}:$PATH" \
-      EVENT_NAME="${FAKE_EVENT_NAME-pull_request_target}" \
-      BASE_REF="${FAKE_BASE_REF-main}" \
-      EVENT_REF="${FAKE_EVENT_REF-refs/heads/main}" \
       CANDIDATE_REPOSITORY="${repository}" \
       CANDIDATE_SHA="${sha}" \
       GIT_ASKPASS=/bin/false \
@@ -1561,37 +1558,6 @@ fi
 grep -Fq -- "-tvf candidate.tar" "${candidate_fetch_good}/tar.log"
 grep -Fq -- "--extract --file=candidate.tar --directory=candidate --no-same-owner --no-same-permissions" "${candidate_fetch_good}/tar.log"
 
-candidate_fetch_push="${tmp_dir}/candidate-fetch-push"
-FAKE_EVENT_NAME=push FAKE_BASE_REF= \
-  run_candidate_fetch "${candidate_fetch_push}" example/repo "${candidate_sha}" "${fake_archive}"
-test -f "${candidate_fetch_push}/candidate/.github/workflows/inert.yml"
-
-for invalid_route in \
-  'pull-request|pull_request|main|refs/heads/main' \
-  'other-base|pull_request_target|develop|refs/heads/main' \
-  'other-ref|pull_request_target|main|refs/heads/develop' \
-  'push-base|push|main|refs/heads/main' \
-  'push-ref|push||refs/heads/develop'; do
-  IFS='|' read -r label event_name base_ref event_ref <<<"${invalid_route}"
-  route_workdir="${tmp_dir}/candidate-route-${label}"
-  set +e
-  route_output="$(FAKE_EVENT_NAME="${event_name}" FAKE_BASE_REF="${base_ref}" \
-    FAKE_EVENT_REF="${event_ref}" \
-    run_candidate_fetch "${route_workdir}" example/repo "${candidate_sha}" "${fake_archive}" 2>&1)"
-  route_status=$?
-  set -e
-  if [[ "${route_status}" -eq 0 ]] || ! grep -Fq -- \
-    "public workflow policy accepts only push or pull_request_target for main" <<<"${route_output}"; then
-    echo "candidate fetch accepted invalid event route ${label}" >&2
-    printf '%s\n' "${route_output}" >&2
-    exit 1
-  fi
-  if [[ -e "${route_workdir}/git.log" || -e "${route_workdir}/tar.log" ]]; then
-    echo "candidate fetch invoked Git or tar before rejecting event route ${label}" >&2
-    exit 1
-  fi
-done
-
 for invalid_candidate in \
   'bad-repository|example/repo?token=leak|0123456789012345678901234567890123456789' \
   'short-sha|example/repo|0123456789'; do