From 3984c39a104e560a330ca108c2689eb930c6aa90 Mon Sep 17 00:00:00 2001 From: Jon Langevin Date: Tue, 6 Oct 2026 18:27:35 -0400 Subject: [PATCH] ci: prepare bridge promotion on repaired predecessor --- .github/public-workflow-action-allowlist.json | 22 +- .github/public-workflow-authority.json | 147 +------ .../public-workflow-command-allowlist.json | 396 +++--------------- .../public-workflow-executable-allowlist.json | 12 +- .../public-workflow-presence-allowlist.json | 8 +- 5 files changed, 57 insertions(+), 528 deletions(-) diff --git a/.github/public-workflow-action-allowlist.json b/.github/public-workflow-action-allowlist.json index 6001a671..07a26e63 100644 --- a/.github/public-workflow-action-allowlist.json +++ b/.github/public-workflow-action-allowlist.json @@ -431,22 +431,6 @@ "state": "active", "rationale": "Pinned ko-build/setup-ko@d006021bd0c28d1ce33a07e7943d48b079944c8d for reviewed pre-release.yml automation." }, - { - "path": ".github/workflows/public-workflow-policy.yml", - "uses": "actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5", - "nodeSHA256": "8ddc920b847e5e03515a92d8be49290bd9039f458fffcdeea7ad0a30f48e15dc", - "contextSHA256": "b0ff9f7b4bc11ccbc2dd40df7973867b7a1ee237cf2d5bae95b0e6c3251ea233", - "state": "active", - "rationale": "Pinned actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 for reviewed public-workflow-policy.yml automation." - }, - { - "path": ".github/workflows/public-workflow-policy.yml", - "uses": "actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff", - "nodeSHA256": "3c2f0c49ba03bc87e0aeebcd40257f3285d9b3e4a0b79982f795d6bfd5117bf9", - "contextSHA256": "b0ff9f7b4bc11ccbc2dd40df7973867b7a1ee237cf2d5bae95b0e6c3251ea233", - "state": "active", - "rationale": "Pinned actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff for reviewed public-workflow-policy.yml automation." - }, { "path": ".github/workflows/release.yml", "uses": "actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10", @@ -676,7 +660,7 @@ "nodeSHA256": "8ddc920b847e5e03515a92d8be49290bd9039f458fffcdeea7ad0a30f48e15dc", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact action actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "staged", + "state": "active", "uses": "actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5" }, { @@ -684,7 +668,7 @@ "nodeSHA256": "65d08e860e0e0ba32c867339a375a514ee8887326bb4cff3543aec359932ac1a", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact action actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "staged", + "state": "active", "uses": "actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff" }, { @@ -692,7 +676,7 @@ "nodeSHA256": "a280f2ecccaed15b220dc27221b587c4285d6fad210ce7683db38a5eaa555cb4", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact action actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "staged", + "state": "active", "uses": "actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff" } ] diff --git a/.github/public-workflow-authority.json b/.github/public-workflow-authority.json index f1aae6ee..ee6436de 100644 --- a/.github/public-workflow-authority.json +++ b/.github/public-workflow-authority.json @@ -1,150 +1,5 @@ { "bundles": [ - { - "state": "active", - "files": [ - { - "path": ".github/workflows/policytool/go.mod", - "sha256": "0a2d135980310757f36e733161b94498b4e0a1b6ac8c6de8a799f542d6c9ddb8" - }, - { - "path": ".github/workflows/policytool/go.sum", - "sha256": "790ef858e5aeed12269a69e764ac69c02c3877678b0e7d9384ad3728b6e09f6c" - }, - { - "path": ".github/workflows/policytool/main.go", - "sha256": "8dba6ad341fa07644868fd43717aff162c4feae1694ee9a122ef4cd401214a00" - }, - { - "path": ".github/workflows/policytool/main_test.go", - "sha256": "a88f4ec70a2736e54bf887594da855fb6d25d2cecb35321cd5fa8a2455304212" - }, - { - "path": ".github/workflows/scripts/verify-public-workflow-branch-protection.sh", - "sha256": "0d48038f7e641f0a58ae2a0f9150d40f284619c2254951fb31066fbb121df304" - }, - { - "path": "scripts/check-public-workflow-policy.sh", - "sha256": "166d4c7f272b6e249abd5bd2efadb8034105cf62df3cff2200978c6e9fb6998c" - }, - { - "path": "scripts/fixtures/public-workflow-policy/lifecycle-future.yml", - "sha256": "de3bdf01a31d2a0d39a279a65258d47f0f504155065de720a1908a1b7a703103" - }, - { - "path": "scripts/fixtures/public-workflow-policy/lifecycle-old.yml", - "sha256": "6dc23984617b91711ff14a08e8d428d9dc47dc3c00f4efd703bf747fe7e6a122" - }, - { - "path": "scripts/fixtures/public-workflow-policy/pass-expression-and-deny-guard.yml", - "sha256": "6af7ce9692c0e3c3f4468927912db334bab659b36567703e27cd9d2c0957d908" - }, - { - "path": "scripts/fixtures/public-workflow-policy/pass-negative-guard.yml", - "sha256": "7af97a7da7d416064190ba39e6829148071714d39840dc7f354cab78fadc3665" - }, - { - "path": "scripts/fixtures/public-workflow-policy/pass.yml", - "sha256": "38ece391dcb2d2b84ba44121cd6bdcc2953a3822ab0e464224e0bb60199400e5" - }, - { - "path": "scripts/fixtures/public-workflow-policy/reject-builtin-wrapper.yml", - "sha256": "56fcfd4f7752e6b462471a78b329bbf6e8d978fa047c4bdbf9d09b25cc350be0" - }, - { - "path": "scripts/fixtures/public-workflow-policy/reject-command-analysis.yml", - "sha256": "589658280ae8623d932e691323b138c439a28fe27a79ea2859be7c00600b6820" - }, - { - "path": "scripts/fixtures/public-workflow-policy/reject-deny-pattern-execution.yml", - "sha256": "c8475ed82b6fb7ac4ec227f48becc4a148d7d3665a5fdfdbac19096cca7c2165" - }, - { - "path": "scripts/fixtures/public-workflow-policy/reject-dynamic-secrets.yml", - "sha256": "7900842a6adf772396eb4893925d26b71e1a4560053305031d7c4e15b3e2f5f8" - }, - { - "path": "scripts/fixtures/public-workflow-policy/reject-env-indirection.yml", - "sha256": "6b524ac4c498f45d68896676f75c8171033558a9a270f5158870ae36604218d7" - }, - { - "path": "scripts/fixtures/public-workflow-policy/reject-execution-context.yml", - "sha256": "50629e545d7fba12247f28a06e9632b52c3c8d63c01a2551fb8d9d7ac2a6e0b6" - }, - { - "path": "scripts/fixtures/public-workflow-policy/reject-global.yml", - "sha256": "43620c1094cf6a8223f4b35c18bf54a621e09b5f5922b835bd7e22a48f1f205d" - }, - { - "path": "scripts/fixtures/public-workflow-policy/reject-guard-suffix.yml", - "sha256": "4b5623b44d1dcef0198ce914a16a358180f65d733d5521863b4606178ea20823" - }, - { - "path": "scripts/fixtures/public-workflow-policy/reject-implicit-permissions.yml", - "sha256": "5606653732f73c8c9af42c28a72f5d2a43336fd0edbb25524832e98713e798a8" - }, - { - "path": "scripts/fixtures/public-workflow-policy/reject-legacy-github-token.yml", - "sha256": "595e24dcd363104586f7c973225cf6ba79606dfc1b9124ef383c668932e9fb5a" - }, - { - "path": "scripts/fixtures/public-workflow-policy/reject-missing-shell.yml", - "sha256": "58757a1e09107185710dd3a2c401d6a3691d1c11f4db7f41b8a4f8dde57d0574" - }, - { - "path": "scripts/fixtures/public-workflow-policy/reject-permissions.yml", - "sha256": "24ac3b5c02f97b7b3ec2e06f2d7c7c46035a17dda029ed8918c3e54d8e6933c4" - }, - { - "path": "scripts/fixtures/public-workflow-policy/reject-provider-uses.yml", - "sha256": "3f6a028a527a04b1bcddd087174b56b85916fc347da23cb86b76948b2a006f45" - }, - { - "path": "scripts/fixtures/public-workflow-policy/reject-runners.yml", - "sha256": "cbfec39b289dfcbee247f6fa5a415c01921ab02e03c63bd974df1322a6159050" - }, - { - "path": "scripts/fixtures/public-workflow-policy/reject-script-execution.yml", - "sha256": "6e57329ba154ee32a37c2c8227f75db5422d9fdf3487180f4f8d388891c04f62" - }, - { - "path": "scripts/fixtures/public-workflow-policy/reject-secret-syntax.yml", - "sha256": "3ef3fc0c94a53510069d63e58e7a7eef51de884d7446fe20476d60c4fa078648" - }, - { - "path": "scripts/fixtures/public-workflow-policy/reject-shell-inheritance.yml", - "sha256": "330bc5a511a1c14d6adadd7e7f19a1baacdf47b513a2382e7cfa060babc460e0" - }, - { - "path": "scripts/fixtures/public-workflow-policy/reject-shell.yml", - "sha256": "6dffd2756cf468c9bf4c268bfebfd1c4bfb96e81e30137a7dafbd0d39161df00" - }, - { - "path": "scripts/fixtures/public-workflow-policy/reject-statement-authority.yml", - "sha256": "2ae4ecdde184f102004b81cca0de0e345278c7ebc2aa0993f5a8ef47acf50e91" - }, - { - "path": "scripts/fixtures/public-workflow-policy/reject-unreviewed-uses.yml", - "sha256": "4e1a4f1d5c7b147af24dac04448617a77649e711366ab19701d6e878a1c0a274" - }, - { - "path": "scripts/fixtures/public-workflow-policy/reject-unsafe-programs.yml", - "sha256": "5c464126d992dc5305ca68c6ebb0f7086650d0e86dc56aee35ee0de40e6b1f96" - }, - { - "path": "scripts/fixtures/public-workflow-policy/reject-yaml-structure.yml", - "sha256": "e564fe3b6655a68c242038c98f480fe432ed840aa3325caab88e052343352402" - }, - { - "path": "scripts/fixtures/public-workflow-policy/reject.yml", - "sha256": "e98e5b29312f6541e6d71fc532943a055c9164923cd560710d47414ac80aecc1" - }, - { - "path": "scripts/test-check-public-workflow-policy.sh", - "sha256": "7d209bb35ff3a7a46b22f9a10a920eb30218c3403726d1dac72e0bffd1d914a4" - } - ] - }, { "files": [ { @@ -300,7 +155,7 @@ "sha256": "7d209bb35ff3a7a46b22f9a10a920eb30218c3403726d1dac72e0bffd1d914a4" } ], - "state": "staged" + "state": "active" } ], "version": 1 diff --git a/.github/public-workflow-command-allowlist.json b/.github/public-workflow-command-allowlist.json index 5385aed1..d5568c36 100644 --- a/.github/public-workflow-command-allowlist.json +++ b/.github/public-workflow-command-allowlist.json @@ -1295,302 +1295,6 @@ "state": "active", "rationale": "Exact reviewed tar statement for pre-release.yml automation." }, - { - "path": ".github/workflows/public-workflow-policy.yml", - "command": "$assignment", - "statementSHA256": "0e17e768c1484e9def2346c58a2c32d337d4c33d780f0ffc79504af0c40ecba7", - "contextSHA256": "b0ff9f7b4bc11ccbc2dd40df7973867b7a1ee237cf2d5bae95b0e6c3251ea233", - "state": "active", - "rationale": "Exact reviewed literal assignment for public-workflow-policy.yml automation." - }, - { - "path": ".github/workflows/public-workflow-policy.yml", - "command": "$assignment", - "statementSHA256": "66d1ee88edc672ead2282e1e159bc382cc6fad2c13a86c6ce585e0082a006b8d", - "contextSHA256": "b0ff9f7b4bc11ccbc2dd40df7973867b7a1ee237cf2d5bae95b0e6c3251ea233", - "state": "active", - "rationale": "Exact reviewed literal assignment for public-workflow-policy.yml automation." - }, - { - "path": ".github/workflows/public-workflow-policy.yml", - "command": "$assignment", - "statementSHA256": "6af7f417e806699121e4d583e17b42321a812a4b8237364a263b970d48dc6132", - "contextSHA256": "b0ff9f7b4bc11ccbc2dd40df7973867b7a1ee237cf2d5bae95b0e6c3251ea233", - "state": "active", - "rationale": "Exact reviewed literal assignment for public-workflow-policy.yml automation." - }, - { - "path": ".github/workflows/public-workflow-policy.yml", - "command": "$assignment", - "statementSHA256": "6e78bfd0781f308df8a82c819888f28647df16892ba5a7cef1571b725e102383", - "contextSHA256": "b0ff9f7b4bc11ccbc2dd40df7973867b7a1ee237cf2d5bae95b0e6c3251ea233", - "state": "active", - "rationale": "Exact reviewed literal assignment for public-workflow-policy.yml automation." - }, - { - "path": ".github/workflows/public-workflow-policy.yml", - "command": "$assignment", - "statementSHA256": "e5888a15646c95e95768c301658269ab4880ac40a2aed5200133899101db0a56", - "contextSHA256": "b0ff9f7b4bc11ccbc2dd40df7973867b7a1ee237cf2d5bae95b0e6c3251ea233", - "state": "active", - "rationale": "Exact reviewed literal assignment for public-workflow-policy.yml automation." - }, - { - "path": ".github/workflows/public-workflow-policy.yml", - "command": "[", - "statementSHA256": "5f8e07c6f716cb7da7802dc483fb1d72aed7f4a46b0fe6e2b79633123f4c775e", - "contextSHA256": "b0ff9f7b4bc11ccbc2dd40df7973867b7a1ee237cf2d5bae95b0e6c3251ea233", - "state": "active", - "rationale": "Selects the exact reviewed bootstrap or trusted policy path." - }, - { - "path": ".github/workflows/public-workflow-policy.yml", - "command": "[", - "statementSHA256": "e5888a15646c95e95768c301658269ab4880ac40a2aed5200133899101db0a56", - "contextSHA256": "b0ff9f7b4bc11ccbc2dd40df7973867b7a1ee237cf2d5bae95b0e6c3251ea233", - "state": "active", - "rationale": "Exact reviewed [ statement for public-workflow-policy.yml automation." - }, - { - "path": ".github/workflows/public-workflow-policy.yml", - "command": "cd", - "statementSHA256": "5f8e07c6f716cb7da7802dc483fb1d72aed7f4a46b0fe6e2b79633123f4c775e", - "contextSHA256": "b0ff9f7b4bc11ccbc2dd40df7973867b7a1ee237cf2d5bae95b0e6c3251ea233", - "state": "active", - "rationale": "Exact reviewed cd statement for public-workflow-policy.yml automation." - }, - { - "path": ".github/workflows/public-workflow-policy.yml", - "command": "check-public-workflow-policy.sh", - "statementSHA256": "5f8e07c6f716cb7da7802dc483fb1d72aed7f4a46b0fe6e2b79633123f4c775e", - "contextSHA256": "b0ff9f7b4bc11ccbc2dd40df7973867b7a1ee237cf2d5bae95b0e6c3251ea233", - "state": "active", - "rationale": "Run the trusted hash-bound policy wrapper against inert candidate data." - }, - { - "path": ".github/workflows/public-workflow-policy.yml", - "command": "echo", - "statementSHA256": "3f1d57f7be1844759d7c250d516b66e11aa6e6da06ce6d2f0ad4182e4b9faf4b", - "contextSHA256": "b0ff9f7b4bc11ccbc2dd40df7973867b7a1ee237cf2d5bae95b0e6c3251ea233", - "state": "active", - "rationale": "Exact reviewed echo statement for public-workflow-policy.yml automation." - }, - { - "path": ".github/workflows/public-workflow-policy.yml", - "command": "echo", - "statementSHA256": "4ade2e44c08380b704763da57c411f70fc54eebcabf0abd0277746786def0bf8", - "contextSHA256": "b0ff9f7b4bc11ccbc2dd40df7973867b7a1ee237cf2d5bae95b0e6c3251ea233", - "state": "active", - "rationale": "Exact reviewed echo statement for public-workflow-policy.yml automation." - }, - { - "path": ".github/workflows/public-workflow-policy.yml", - "command": "echo", - "statementSHA256": "7c133076e6ce17d413f1327ea6d975f452d350aba142430d9ad85847205e36b8", - "contextSHA256": "b0ff9f7b4bc11ccbc2dd40df7973867b7a1ee237cf2d5bae95b0e6c3251ea233", - "state": "active", - "rationale": "Exact reviewed echo statement for public-workflow-policy.yml automation." - }, - { - "path": ".github/workflows/public-workflow-policy.yml", - "command": "echo", - "statementSHA256": "9e40419faa9458450eddc809e65c865dbf076b4dbd75f7e7cd3776aabdb7e1e0", - "contextSHA256": "b0ff9f7b4bc11ccbc2dd40df7973867b7a1ee237cf2d5bae95b0e6c3251ea233", - "state": "active", - "rationale": "Exact reviewed echo statement for public-workflow-policy.yml automation." - }, - { - "path": ".github/workflows/public-workflow-policy.yml", - "command": "echo", - "statementSHA256": "c7f1a421fa15eeab86ac50981d3a6b99248925a1dc7d62f2847e9a82efe2a4a1", - "contextSHA256": "b0ff9f7b4bc11ccbc2dd40df7973867b7a1ee237cf2d5bae95b0e6c3251ea233", - "state": "active", - "rationale": "Exact reviewed echo statement for public-workflow-policy.yml automation." - }, - { - "path": ".github/workflows/public-workflow-policy.yml", - "command": "echo", - "statementSHA256": "e5888a15646c95e95768c301658269ab4880ac40a2aed5200133899101db0a56", - "contextSHA256": "b0ff9f7b4bc11ccbc2dd40df7973867b7a1ee237cf2d5bae95b0e6c3251ea233", - "state": "active", - "rationale": "Exact reviewed echo statement for public-workflow-policy.yml automation." - }, - { - "path": ".github/workflows/public-workflow-policy.yml", - "command": "echo", - "statementSHA256": "e9f5edd1eb6f1cf0981dee8cb41c339f3b29870174e740942a56d4076bd36887", - "contextSHA256": "b0ff9f7b4bc11ccbc2dd40df7973867b7a1ee237cf2d5bae95b0e6c3251ea233", - "state": "active", - "rationale": "Exact reviewed echo statement for public-workflow-policy.yml automation." - }, - { - "path": ".github/workflows/public-workflow-policy.yml", - "command": "echo", - "statementSHA256": "fe9e84eb32be5ac99349d7e60340785a6e5b3750dcecf795514c53ec76253516", - "contextSHA256": "b0ff9f7b4bc11ccbc2dd40df7973867b7a1ee237cf2d5bae95b0e6c3251ea233", - "state": "active", - "rationale": "Exact reviewed echo statement for public-workflow-policy.yml automation." - }, - { - "path": ".github/workflows/public-workflow-policy.yml", - "command": "echo", - "statementSHA256": "ff503c4cc7be7d35246d5c16eca55f3af89544a6ad9ffc6bf0bb0cbe4a199d19", - "contextSHA256": "b0ff9f7b4bc11ccbc2dd40df7973867b7a1ee237cf2d5bae95b0e6c3251ea233", - "state": "active", - "rationale": "Exact reviewed echo statement for public-workflow-policy.yml automation." - }, - { - "path": ".github/workflows/public-workflow-policy.yml", - "command": "exit", - "statementSHA256": "3f1d57f7be1844759d7c250d516b66e11aa6e6da06ce6d2f0ad4182e4b9faf4b", - "contextSHA256": "b0ff9f7b4bc11ccbc2dd40df7973867b7a1ee237cf2d5bae95b0e6c3251ea233", - "state": "active", - "rationale": "Exact reviewed exit statement for public-workflow-policy.yml automation." - }, - { - "path": ".github/workflows/public-workflow-policy.yml", - "command": "exit", - "statementSHA256": "4ade2e44c08380b704763da57c411f70fc54eebcabf0abd0277746786def0bf8", - "contextSHA256": "b0ff9f7b4bc11ccbc2dd40df7973867b7a1ee237cf2d5bae95b0e6c3251ea233", - "state": "active", - "rationale": "Exact reviewed exit statement for public-workflow-policy.yml automation." - }, - { - "path": ".github/workflows/public-workflow-policy.yml", - "command": "exit", - "statementSHA256": "9e40419faa9458450eddc809e65c865dbf076b4dbd75f7e7cd3776aabdb7e1e0", - "contextSHA256": "b0ff9f7b4bc11ccbc2dd40df7973867b7a1ee237cf2d5bae95b0e6c3251ea233", - "state": "active", - "rationale": "Exact reviewed exit statement for public-workflow-policy.yml automation." - }, - { - "path": ".github/workflows/public-workflow-policy.yml", - "command": "exit", - "statementSHA256": "c7f1a421fa15eeab86ac50981d3a6b99248925a1dc7d62f2847e9a82efe2a4a1", - "contextSHA256": "b0ff9f7b4bc11ccbc2dd40df7973867b7a1ee237cf2d5bae95b0e6c3251ea233", - "state": "active", - "rationale": "Exact reviewed exit statement for public-workflow-policy.yml automation." - }, - { - "path": ".github/workflows/public-workflow-policy.yml", - "command": "exit", - "statementSHA256": "e5888a15646c95e95768c301658269ab4880ac40a2aed5200133899101db0a56", - "contextSHA256": "b0ff9f7b4bc11ccbc2dd40df7973867b7a1ee237cf2d5bae95b0e6c3251ea233", - "state": "active", - "rationale": "Exact reviewed exit statement for public-workflow-policy.yml automation." - }, - { - "path": ".github/workflows/public-workflow-policy.yml", - "command": "exit", - "statementSHA256": "e9f5edd1eb6f1cf0981dee8cb41c339f3b29870174e740942a56d4076bd36887", - "contextSHA256": "b0ff9f7b4bc11ccbc2dd40df7973867b7a1ee237cf2d5bae95b0e6c3251ea233", - "state": "active", - "rationale": "Exact reviewed exit statement for public-workflow-policy.yml automation." - }, - { - "path": ".github/workflows/public-workflow-policy.yml", - "command": "exit", - "statementSHA256": "fe9e84eb32be5ac99349d7e60340785a6e5b3750dcecf795514c53ec76253516", - "contextSHA256": "b0ff9f7b4bc11ccbc2dd40df7973867b7a1ee237cf2d5bae95b0e6c3251ea233", - "state": "active", - "rationale": "Exact reviewed exit statement for public-workflow-policy.yml automation." - }, - { - "path": ".github/workflows/public-workflow-policy.yml", - "command": "exit", - "statementSHA256": "ff503c4cc7be7d35246d5c16eca55f3af89544a6ad9ffc6bf0bb0cbe4a199d19", - "contextSHA256": "b0ff9f7b4bc11ccbc2dd40df7973867b7a1ee237cf2d5bae95b0e6c3251ea233", - "state": "active", - "rationale": "Exact reviewed exit statement for public-workflow-policy.yml automation." - }, - { - "path": ".github/workflows/public-workflow-policy.yml", - "command": "find", - "statementSHA256": "6af7f417e806699121e4d583e17b42321a812a4b8237364a263b970d48dc6132", - "contextSHA256": "b0ff9f7b4bc11ccbc2dd40df7973867b7a1ee237cf2d5bae95b0e6c3251ea233", - "state": "active", - "rationale": "Exact reviewed find statement for public-workflow-policy.yml automation." - }, - { - "path": ".github/workflows/public-workflow-policy.yml", - "command": "git", - "statementSHA256": "0cf020cfd2b573841c37a0529d43d5b53f9b318028b28b3536b2f6aff30f02bc", - "contextSHA256": "b0ff9f7b4bc11ccbc2dd40df7973867b7a1ee237cf2d5bae95b0e6c3251ea233", - "state": "active", - "rationale": "Exact reviewed git statement for public-workflow-policy.yml automation." - }, - { - "path": ".github/workflows/public-workflow-policy.yml", - "command": "git", - "statementSHA256": "3a50f487e92cd73a96ba4ae31eaa56980c1452ddb24bb37fce32cc2cf0f933e0", - "contextSHA256": "b0ff9f7b4bc11ccbc2dd40df7973867b7a1ee237cf2d5bae95b0e6c3251ea233", - "state": "active", - "rationale": "Exact reviewed git statement for public-workflow-policy.yml automation." - }, - { - "path": ".github/workflows/public-workflow-policy.yml", - "command": "git", - "statementSHA256": "465704dc91fedf6386416daaecdf25aceff4bb50fa5defae0958b0a30bdeb6d1", - "contextSHA256": "b0ff9f7b4bc11ccbc2dd40df7973867b7a1ee237cf2d5bae95b0e6c3251ea233", - "state": "active", - "rationale": "Exact reviewed git statement for public-workflow-policy.yml automation." - }, - { - "path": ".github/workflows/public-workflow-policy.yml", - "command": "git", - "statementSHA256": "66d1ee88edc672ead2282e1e159bc382cc6fad2c13a86c6ce585e0082a006b8d", - "contextSHA256": "b0ff9f7b4bc11ccbc2dd40df7973867b7a1ee237cf2d5bae95b0e6c3251ea233", - "state": "active", - "rationale": "Exact reviewed git statement for public-workflow-policy.yml automation." - }, - { - "path": ".github/workflows/public-workflow-policy.yml", - "command": "git", - "statementSHA256": "9919b241412c88da2b0a86cbeaab201cc2323a2fd0c957e2f726ebc62b7282a6", - "contextSHA256": "b0ff9f7b4bc11ccbc2dd40df7973867b7a1ee237cf2d5bae95b0e6c3251ea233", - "state": "active", - "rationale": "Exact reviewed git statement for public-workflow-policy.yml automation." - }, - { - "path": ".github/workflows/public-workflow-policy.yml", - "command": "mkdir", - "statementSHA256": "42f84c05333b2c7011f332ebca981a05c457d59e7595b13dac5dee7f58429d60", - "contextSHA256": "b0ff9f7b4bc11ccbc2dd40df7973867b7a1ee237cf2d5bae95b0e6c3251ea233", - "state": "active", - "rationale": "Exact reviewed mkdir statement for public-workflow-policy.yml automation." - }, - { - "path": ".github/workflows/public-workflow-policy.yml", - "command": "read", - "statementSHA256": "3f1d57f7be1844759d7c250d516b66e11aa6e6da06ce6d2f0ad4182e4b9faf4b", - "contextSHA256": "b0ff9f7b4bc11ccbc2dd40df7973867b7a1ee237cf2d5bae95b0e6c3251ea233", - "state": "active", - "rationale": "Exact reviewed read statement for public-workflow-policy.yml automation." - }, - { - "path": ".github/workflows/public-workflow-policy.yml", - "command": "read", - "statementSHA256": "e9f5edd1eb6f1cf0981dee8cb41c339f3b29870174e740942a56d4076bd36887", - "contextSHA256": "b0ff9f7b4bc11ccbc2dd40df7973867b7a1ee237cf2d5bae95b0e6c3251ea233", - "state": "active", - "rationale": "Exact reviewed read statement for public-workflow-policy.yml automation." - }, - { - "path": ".github/workflows/public-workflow-policy.yml", - "command": "tar", - "statementSHA256": "2c7cd49dcf58abe45dabab11177f0c555401c94df4a264edd50b7a272e6304be", - "contextSHA256": "b0ff9f7b4bc11ccbc2dd40df7973867b7a1ee237cf2d5bae95b0e6c3251ea233", - "state": "active", - "rationale": "Exact reviewed tar statement for public-workflow-policy.yml automation." - }, - { - "path": ".github/workflows/public-workflow-policy.yml", - "command": "tar", - "statementSHA256": "9e40419faa9458450eddc809e65c865dbf076b4dbd75f7e7cd3776aabdb7e1e0", - "contextSHA256": "b0ff9f7b4bc11ccbc2dd40df7973867b7a1ee237cf2d5bae95b0e6c3251ea233", - "state": "active", - "rationale": "Exact reviewed tar statement for public-workflow-policy.yml automation." - }, { "path": ".github/workflows/release.yml", "command": "$assignment", @@ -2732,7 +2436,7 @@ "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking echo to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "staged", + "state": "active", "statementSHA256": "74d9799e73f5f1a79baf06bea87cd6ba525c897ee703e8decf3e763191e411c1" }, { @@ -2740,7 +2444,7 @@ "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking exit to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "staged", + "state": "active", "statementSHA256": "74d9799e73f5f1a79baf06bea87cd6ba525c897ee703e8decf3e763191e411c1" }, { @@ -2748,7 +2452,7 @@ "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking echo to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "staged", + "state": "active", "statementSHA256": "fe9e84eb32be5ac99349d7e60340785a6e5b3750dcecf795514c53ec76253516" }, { @@ -2756,7 +2460,7 @@ "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking exit to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "staged", + "state": "active", "statementSHA256": "fe9e84eb32be5ac99349d7e60340785a6e5b3750dcecf795514c53ec76253516" }, { @@ -2764,7 +2468,7 @@ "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking echo to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "staged", + "state": "active", "statementSHA256": "4ade2e44c08380b704763da57c411f70fc54eebcabf0abd0277746786def0bf8" }, { @@ -2772,7 +2476,7 @@ "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking exit to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "staged", + "state": "active", "statementSHA256": "4ade2e44c08380b704763da57c411f70fc54eebcabf0abd0277746786def0bf8" }, { @@ -2780,7 +2484,7 @@ "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking $assignment to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "staged", + "state": "active", "statementSHA256": "0e17e768c1484e9def2346c58a2c32d337d4c33d780f0ffc79504af0c40ecba7" }, { @@ -2788,7 +2492,7 @@ "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking mkdir to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "staged", + "state": "active", "statementSHA256": "42f84c05333b2c7011f332ebca981a05c457d59e7595b13dac5dee7f58429d60" }, { @@ -2796,7 +2500,7 @@ "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking git to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "staged", + "state": "active", "statementSHA256": "9919b241412c88da2b0a86cbeaab201cc2323a2fd0c957e2f726ebc62b7282a6" }, { @@ -2804,7 +2508,7 @@ "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking git to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "staged", + "state": "active", "statementSHA256": "0cf020cfd2b573841c37a0529d43d5b53f9b318028b28b3536b2f6aff30f02bc" }, { @@ -2812,7 +2516,7 @@ "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking $assignment to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "staged", + "state": "active", "statementSHA256": "66d1ee88edc672ead2282e1e159bc382cc6fad2c13a86c6ce585e0082a006b8d" }, { @@ -2820,7 +2524,7 @@ "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking git to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "staged", + "state": "active", "statementSHA256": "66d1ee88edc672ead2282e1e159bc382cc6fad2c13a86c6ce585e0082a006b8d" }, { @@ -2828,7 +2532,7 @@ "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking echo to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "staged", + "state": "active", "statementSHA256": "ff503c4cc7be7d35246d5c16eca55f3af89544a6ad9ffc6bf0bb0cbe4a199d19" }, { @@ -2836,7 +2540,7 @@ "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking exit to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "staged", + "state": "active", "statementSHA256": "ff503c4cc7be7d35246d5c16eca55f3af89544a6ad9ffc6bf0bb0cbe4a199d19" }, { @@ -2844,7 +2548,7 @@ "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking git to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "staged", + "state": "active", "statementSHA256": "465704dc91fedf6386416daaecdf25aceff4bb50fa5defae0958b0a30bdeb6d1" }, { @@ -2852,7 +2556,7 @@ "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking read to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "staged", + "state": "active", "statementSHA256": "e9f5edd1eb6f1cf0981dee8cb41c339f3b29870174e740942a56d4076bd36887" }, { @@ -2860,7 +2564,7 @@ "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking echo to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "staged", + "state": "active", "statementSHA256": "e9f5edd1eb6f1cf0981dee8cb41c339f3b29870174e740942a56d4076bd36887" }, { @@ -2868,7 +2572,7 @@ "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking exit to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "staged", + "state": "active", "statementSHA256": "e9f5edd1eb6f1cf0981dee8cb41c339f3b29870174e740942a56d4076bd36887" }, { @@ -2876,7 +2580,7 @@ "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking git to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "staged", + "state": "active", "statementSHA256": "3a50f487e92cd73a96ba4ae31eaa56980c1452ddb24bb37fce32cc2cf0f933e0" }, { @@ -2884,7 +2588,7 @@ "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking tar to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "staged", + "state": "active", "statementSHA256": "9e40419faa9458450eddc809e65c865dbf076b4dbd75f7e7cd3776aabdb7e1e0" }, { @@ -2892,7 +2596,7 @@ "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking echo to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "staged", + "state": "active", "statementSHA256": "9e40419faa9458450eddc809e65c865dbf076b4dbd75f7e7cd3776aabdb7e1e0" }, { @@ -2900,7 +2604,7 @@ "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking exit to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "staged", + "state": "active", "statementSHA256": "9e40419faa9458450eddc809e65c865dbf076b4dbd75f7e7cd3776aabdb7e1e0" }, { @@ -2908,7 +2612,7 @@ "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking read to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "staged", + "state": "active", "statementSHA256": "3f1d57f7be1844759d7c250d516b66e11aa6e6da06ce6d2f0ad4182e4b9faf4b" }, { @@ -2916,7 +2620,7 @@ "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking echo to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "staged", + "state": "active", "statementSHA256": "3f1d57f7be1844759d7c250d516b66e11aa6e6da06ce6d2f0ad4182e4b9faf4b" }, { @@ -2924,7 +2628,7 @@ "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking exit to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "staged", + "state": "active", "statementSHA256": "3f1d57f7be1844759d7c250d516b66e11aa6e6da06ce6d2f0ad4182e4b9faf4b" }, { @@ -2932,7 +2636,7 @@ "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking tar to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "staged", + "state": "active", "statementSHA256": "2c7cd49dcf58abe45dabab11177f0c555401c94df4a264edd50b7a272e6304be" }, { @@ -2940,7 +2644,7 @@ "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking $assignment to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "staged", + "state": "active", "statementSHA256": "6af7f417e806699121e4d583e17b42321a812a4b8237364a263b970d48dc6132" }, { @@ -2948,7 +2652,7 @@ "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking find to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "staged", + "state": "active", "statementSHA256": "6af7f417e806699121e4d583e17b42321a812a4b8237364a263b970d48dc6132" }, { @@ -2956,7 +2660,7 @@ "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking echo to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "staged", + "state": "active", "statementSHA256": "c7f1a421fa15eeab86ac50981d3a6b99248925a1dc7d62f2847e9a82efe2a4a1" }, { @@ -2964,7 +2668,7 @@ "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking exit to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "staged", + "state": "active", "statementSHA256": "c7f1a421fa15eeab86ac50981d3a6b99248925a1dc7d62f2847e9a82efe2a4a1" }, { @@ -2972,7 +2676,7 @@ "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking $assignment to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "staged", + "state": "active", "statementSHA256": "6e78bfd0781f308df8a82c819888f28647df16892ba5a7cef1571b725e102383" }, { @@ -2980,7 +2684,7 @@ "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking [ to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "staged", + "state": "active", "statementSHA256": "e5888a15646c95e95768c301658269ab4880ac40a2aed5200133899101db0a56" }, { @@ -2988,7 +2692,7 @@ "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking $assignment to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "staged", + "state": "active", "statementSHA256": "e5888a15646c95e95768c301658269ab4880ac40a2aed5200133899101db0a56" }, { @@ -2996,7 +2700,7 @@ "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking echo to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "staged", + "state": "active", "statementSHA256": "e5888a15646c95e95768c301658269ab4880ac40a2aed5200133899101db0a56" }, { @@ -3004,7 +2708,7 @@ "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking exit to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "staged", + "state": "active", "statementSHA256": "e5888a15646c95e95768c301658269ab4880ac40a2aed5200133899101db0a56" }, { @@ -3012,7 +2716,7 @@ "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking echo to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "staged", + "state": "active", "statementSHA256": "7c133076e6ce17d413f1327ea6d975f452d350aba142430d9ad85847205e36b8" }, { @@ -3020,7 +2724,7 @@ "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking [ to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "staged", + "state": "active", "statementSHA256": "5f8e07c6f716cb7da7802dc483fb1d72aed7f4a46b0fe6e2b79633123f4c775e" }, { @@ -3028,7 +2732,7 @@ "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking cd to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "staged", + "state": "active", "statementSHA256": "5f8e07c6f716cb7da7802dc483fb1d72aed7f4a46b0fe6e2b79633123f4c775e" }, { @@ -3036,7 +2740,7 @@ "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking check-public-workflow-policy.sh to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "staged", + "state": "active", "statementSHA256": "5f8e07c6f716cb7da7802dc483fb1d72aed7f4a46b0fe6e2b79633123f4c775e" }, { @@ -3044,7 +2748,7 @@ "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking echo to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "staged", + "state": "active", "statementSHA256": "bfaa72e371a40394f5979f319f3ebffdb30a4d9ef19fafed77fd4ac12dc30ad2" }, { @@ -3052,7 +2756,7 @@ "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking exit to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "staged", + "state": "active", "statementSHA256": "1a21be8bb1dc4721d30cc1850ead617faa55ae9aebf416da4369668bdeaf0824" }, { @@ -3060,7 +2764,7 @@ "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking $assignment to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "staged", + "state": "active", "statementSHA256": "3c5b32a0f4bacbab25fd6ed87aa869b1646138cf8dac471840a36556c41bbf4d" }, { @@ -3068,7 +2772,7 @@ "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking cd to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "staged", + "state": "active", "statementSHA256": "3c5b32a0f4bacbab25fd6ed87aa869b1646138cf8dac471840a36556c41bbf4d" }, { @@ -3076,7 +2780,7 @@ "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking run.sh to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "staged", + "state": "active", "statementSHA256": "3c5b32a0f4bacbab25fd6ed87aa869b1646138cf8dac471840a36556c41bbf4d" }, { @@ -3084,7 +2788,7 @@ "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking [ to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "staged", + "state": "active", "statementSHA256": "ce4c2d189d1b611bd2ed5a9e694a2a8353ee81f6a44d4e9c2961f1809c3dae67" }, { @@ -3092,7 +2796,7 @@ "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking echo to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "staged", + "state": "active", "statementSHA256": "ce4c2d189d1b611bd2ed5a9e694a2a8353ee81f6a44d4e9c2961f1809c3dae67" }, { @@ -3100,7 +2804,7 @@ "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking exit to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "staged", + "state": "active", "statementSHA256": "ce4c2d189d1b611bd2ed5a9e694a2a8353ee81f6a44d4e9c2961f1809c3dae67" }, { @@ -3108,7 +2812,7 @@ "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking printf to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "staged", + "state": "active", "statementSHA256": "8c3c075c644d214a76a7406f14d62fa50a4cdc8b07b231da74ef3cffdc86a4e9" }, { @@ -3116,7 +2820,7 @@ "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking cd to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "staged", + "state": "active", "statementSHA256": "824ebf5395f4ccfdbd481e20116fb3c166c01f3bdda7490b1229ce795e1dff20" }, { @@ -3124,7 +2828,7 @@ "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking check-public-workflow-policy.sh to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "staged", + "state": "active", "statementSHA256": "89a1f75b6db0c513cc68634a7b1e7983e88d121f09db4dbfe7aaa6edd1e9978c" } ] diff --git a/.github/public-workflow-executable-allowlist.json b/.github/public-workflow-executable-allowlist.json index 8cfb6177..730c520a 100644 --- a/.github/public-workflow-executable-allowlist.json +++ b/.github/public-workflow-executable-allowlist.json @@ -15,14 +15,6 @@ "sha256": "166d4c7f272b6e249abd5bd2efadb8034105cf62df3cff2200978c6e9fb6998c", "rationale": "Enforces the credential-free public workflow boundary in CI." }, - { - "path": "scripts/check-public-workflow-policy.sh", - "workflowPath": ".github/workflows/public-workflow-policy.yml", - "contextSHA256": "b0ff9f7b4bc11ccbc2dd40df7973867b7a1ee237cf2d5bae95b0e6c3251ea233", - "state": "active", - "sha256": "166d4c7f272b6e249abd5bd2efadb8034105cf62df3cff2200978c6e9fb6998c", - "rationale": "Runs the trusted policy wrapper against inert candidate workflow data." - }, { "path": "scripts/test-check-public-workflow-policy.sh", "workflowPath": ".github/workflows/ci.yml", @@ -92,7 +84,7 @@ "path": "scripts/check-public-workflow-policy.sh", "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact repository executable scripts/check-public-workflow-policy.sh to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", "sha256": "166d4c7f272b6e249abd5bd2efadb8034105cf62df3cff2200978c6e9fb6998c", - "state": "staged", + "state": "active", "workflowPath": ".github/workflows/public-workflow-policy.yml" }, { @@ -100,7 +92,7 @@ "path": ".github/workflows/policytool/adoptionguard/run.sh", "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact repository executable .github/workflows/policytool/adoptionguard/run.sh to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", "sha256": "b5597c106885bdc9b1f7161f7c6a1635d92f5f9273c41ec799233d68d6dbf3e4", - "state": "staged", + "state": "active", "workflowPath": ".github/workflows/public-workflow-policy.yml" } ] diff --git a/.github/public-workflow-presence-allowlist.json b/.github/public-workflow-presence-allowlist.json index b4bf294b..f389c271 100644 --- a/.github/public-workflow-presence-allowlist.json +++ b/.github/public-workflow-presence-allowlist.json @@ -53,12 +53,6 @@ "state": "active", "presence": "present" }, - { - "path": ".github/workflows/public-workflow-policy.yml", - "contextSHA256": "b0ff9f7b4bc11ccbc2dd40df7973867b7a1ee237cf2d5bae95b0e6c3251ea233", - "state": "active", - "presence": "present" - }, { "path": ".github/workflows/release.yml", "contextSHA256": "7e6b8738cb89f1af132d306880423405b06b7eb3e71bb0cb65b627c88fbf95f3", @@ -120,7 +114,7 @@ { "path": ".github/workflows/public-workflow-policy.yml", "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", - "state": "staged", + "state": "active", "presence": "present" } ]