diff --git a/.github/public-workflow-action-allowlist.json b/.github/public-workflow-action-allowlist.json index 37de642e..c399b323 100644 --- a/.github/public-workflow-action-allowlist.json +++ b/.github/public-workflow-action-allowlist.json @@ -655,30 +655,6 @@ "state": "staged", "rationale": "Pinned action for reviewed credential-free contract wire validation." }, - { - "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", - "nodeSHA256": "8ddc920b847e5e03515a92d8be49290bd9039f458fffcdeea7ad0a30f48e15dc", - "path": ".github/workflows/public-workflow-policy.yml", - "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact action actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "active", - "uses": "actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5" - }, - { - "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", - "nodeSHA256": "65d08e860e0e0ba32c867339a375a514ee8887326bb4cff3543aec359932ac1a", - "path": ".github/workflows/public-workflow-policy.yml", - "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact action actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "active", - "uses": "actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff" - }, - { - "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", - "nodeSHA256": "a280f2ecccaed15b220dc27221b587c4285d6fad210ce7683db38a5eaa555cb4", - "path": ".github/workflows/public-workflow-policy.yml", - "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact action actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "active", - "uses": "actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff" - }, { "path": ".github/workflows/benchmark.yml", "uses": "actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10", @@ -740,7 +716,7 @@ "nodeSHA256": "8ddc920b847e5e03515a92d8be49290bd9039f458fffcdeea7ad0a30f48e15dc", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the exact approved Go1.27.2 canonical policy context. Existing executable/statement/action authority is preserved; adoption and promotion remain separate.", - "state": "staged", + "state": "active", "uses": "actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5" }, { @@ -748,7 +724,7 @@ "nodeSHA256": "d170cf6c1b95b868d42e4c7a91c661d8835d3ffd59d4c0ffc23dd3aec2ac8a20", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the exact approved Go1.27.2 canonical policy context. Existing executable/statement/action authority is preserved; adoption and promotion remain separate.", - "state": "staged", + "state": "active", "uses": "actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff" }, { @@ -756,7 +732,7 @@ "nodeSHA256": "c0b7090d0fe415fcaa265a9c715741653779117d033009a8cf99def40466ad9d", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the exact approved Go1.27.2 canonical policy context. Existing executable/statement/action authority is preserved; adoption and promotion remain separate.", - "state": "staged", + "state": "active", "uses": "actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff" } ] diff --git a/.github/public-workflow-authority.json b/.github/public-workflow-authority.json index 102dd628..8d3a57a4 100644 --- a/.github/public-workflow-authority.json +++ b/.github/public-workflow-authority.json @@ -1,162 +1,5 @@ { "bundles": [ - { - "files": [ - { - "path": ".github/workflows/policytool/adoptionguard/main.go", - "sha256": "7854ccaa9593bc5d64eb93db78ec1bdd6b36d61b545bada95df34ce542f2002a" - }, - { - "path": ".github/workflows/policytool/adoptionguard/main_test.go", - "sha256": "f4220c8924a6feb96d124c06032cdced62342fe39165f8a0e96f6b2b397e7f17" - }, - { - "path": ".github/workflows/policytool/adoptionguard/run.sh", - "sha256": "b5597c106885bdc9b1f7161f7c6a1635d92f5f9273c41ec799233d68d6dbf3e4" - }, - { - "path": ".github/workflows/policytool/go.mod", - "sha256": "0a2d135980310757f36e733161b94498b4e0a1b6ac8c6de8a799f542d6c9ddb8" - }, - { - "path": ".github/workflows/policytool/go.sum", - "sha256": "790ef858e5aeed12269a69e764ac69c02c3877678b0e7d9384ad3728b6e09f6c" - }, - { - "path": ".github/workflows/policytool/main.go", - "sha256": "8dba6ad341fa07644868fd43717aff162c4feae1694ee9a122ef4cd401214a00" - }, - { - "path": ".github/workflows/policytool/main_test.go", - "sha256": "a88f4ec70a2736e54bf887594da855fb6d25d2cecb35321cd5fa8a2455304212" - }, - { - "path": ".github/workflows/scripts/verify-public-workflow-branch-protection.sh", - "sha256": "0d48038f7e641f0a58ae2a0f9150d40f284619c2254951fb31066fbb121df304" - }, - { - "path": "scripts/check-public-workflow-policy.sh", - "sha256": "166d4c7f272b6e249abd5bd2efadb8034105cf62df3cff2200978c6e9fb6998c" - }, - { - "path": "scripts/fixtures/public-workflow-policy/lifecycle-future.yml", - "sha256": "de3bdf01a31d2a0d39a279a65258d47f0f504155065de720a1908a1b7a703103" - }, - { - "path": "scripts/fixtures/public-workflow-policy/lifecycle-old.yml", - "sha256": "6dc23984617b91711ff14a08e8d428d9dc47dc3c00f4efd703bf747fe7e6a122" - }, - { - "path": "scripts/fixtures/public-workflow-policy/pass-expression-and-deny-guard.yml", - "sha256": "6af7ce9692c0e3c3f4468927912db334bab659b36567703e27cd9d2c0957d908" - }, - { - "path": "scripts/fixtures/public-workflow-policy/pass-negative-guard.yml", - "sha256": "7af97a7da7d416064190ba39e6829148071714d39840dc7f354cab78fadc3665" - }, - { - "path": "scripts/fixtures/public-workflow-policy/pass.yml", - "sha256": "38ece391dcb2d2b84ba44121cd6bdcc2953a3822ab0e464224e0bb60199400e5" - }, - { - "path": "scripts/fixtures/public-workflow-policy/reject-builtin-wrapper.yml", - "sha256": "56fcfd4f7752e6b462471a78b329bbf6e8d978fa047c4bdbf9d09b25cc350be0" - }, - { - "path": "scripts/fixtures/public-workflow-policy/reject-command-analysis.yml", - "sha256": "589658280ae8623d932e691323b138c439a28fe27a79ea2859be7c00600b6820" - }, - { - "path": "scripts/fixtures/public-workflow-policy/reject-deny-pattern-execution.yml", - "sha256": "c8475ed82b6fb7ac4ec227f48becc4a148d7d3665a5fdfdbac19096cca7c2165" - }, - { - "path": "scripts/fixtures/public-workflow-policy/reject-dynamic-secrets.yml", - "sha256": "7900842a6adf772396eb4893925d26b71e1a4560053305031d7c4e15b3e2f5f8" - }, - { - "path": "scripts/fixtures/public-workflow-policy/reject-env-indirection.yml", - "sha256": "6b524ac4c498f45d68896676f75c8171033558a9a270f5158870ae36604218d7" - }, - { - "path": "scripts/fixtures/public-workflow-policy/reject-execution-context.yml", - "sha256": "50629e545d7fba12247f28a06e9632b52c3c8d63c01a2551fb8d9d7ac2a6e0b6" - }, - { - "path": "scripts/fixtures/public-workflow-policy/reject-global.yml", - "sha256": "43620c1094cf6a8223f4b35c18bf54a621e09b5f5922b835bd7e22a48f1f205d" - }, - { - "path": "scripts/fixtures/public-workflow-policy/reject-guard-suffix.yml", - "sha256": "4b5623b44d1dcef0198ce914a16a358180f65d733d5521863b4606178ea20823" - }, - { - "path": "scripts/fixtures/public-workflow-policy/reject-implicit-permissions.yml", - "sha256": "5606653732f73c8c9af42c28a72f5d2a43336fd0edbb25524832e98713e798a8" - }, - { - "path": "scripts/fixtures/public-workflow-policy/reject-legacy-github-token.yml", - "sha256": "595e24dcd363104586f7c973225cf6ba79606dfc1b9124ef383c668932e9fb5a" - }, - { - "path": "scripts/fixtures/public-workflow-policy/reject-missing-shell.yml", - "sha256": "58757a1e09107185710dd3a2c401d6a3691d1c11f4db7f41b8a4f8dde57d0574" - }, - { - "path": "scripts/fixtures/public-workflow-policy/reject-permissions.yml", - "sha256": "24ac3b5c02f97b7b3ec2e06f2d7c7c46035a17dda029ed8918c3e54d8e6933c4" - }, - { - "path": "scripts/fixtures/public-workflow-policy/reject-provider-uses.yml", - "sha256": "3f6a028a527a04b1bcddd087174b56b85916fc347da23cb86b76948b2a006f45" - }, - { - "path": "scripts/fixtures/public-workflow-policy/reject-runners.yml", - "sha256": "cbfec39b289dfcbee247f6fa5a415c01921ab02e03c63bd974df1322a6159050" - }, - { - "path": "scripts/fixtures/public-workflow-policy/reject-script-execution.yml", - "sha256": "6e57329ba154ee32a37c2c8227f75db5422d9fdf3487180f4f8d388891c04f62" - }, - { - "path": "scripts/fixtures/public-workflow-policy/reject-secret-syntax.yml", - "sha256": "3ef3fc0c94a53510069d63e58e7a7eef51de884d7446fe20476d60c4fa078648" - }, - { - "path": "scripts/fixtures/public-workflow-policy/reject-shell-inheritance.yml", - "sha256": "330bc5a511a1c14d6adadd7e7f19a1baacdf47b513a2382e7cfa060babc460e0" - }, - { - "path": "scripts/fixtures/public-workflow-policy/reject-shell.yml", - "sha256": "6dffd2756cf468c9bf4c268bfebfd1c4bfb96e81e30137a7dafbd0d39161df00" - }, - { - "path": "scripts/fixtures/public-workflow-policy/reject-statement-authority.yml", - "sha256": "2ae4ecdde184f102004b81cca0de0e345278c7ebc2aa0993f5a8ef47acf50e91" - }, - { - "path": "scripts/fixtures/public-workflow-policy/reject-unreviewed-uses.yml", - "sha256": "4e1a4f1d5c7b147af24dac04448617a77649e711366ab19701d6e878a1c0a274" - }, - { - "path": "scripts/fixtures/public-workflow-policy/reject-unsafe-programs.yml", - "sha256": "5c464126d992dc5305ca68c6ebb0f7086650d0e86dc56aee35ee0de40e6b1f96" - }, - { - "path": "scripts/fixtures/public-workflow-policy/reject-yaml-structure.yml", - "sha256": "e564fe3b6655a68c242038c98f480fe432ed840aa3325caab88e052343352402" - }, - { - "path": "scripts/fixtures/public-workflow-policy/reject.yml", - "sha256": "e98e5b29312f6541e6d71fc532943a055c9164923cd560710d47414ac80aecc1" - }, - { - "path": "scripts/test-check-public-workflow-policy.sh", - "sha256": "7d209bb35ff3a7a46b22f9a10a920eb30218c3403726d1dac72e0bffd1d914a4" - } - ], - "state": "active" - }, { "files": [ { @@ -312,7 +155,7 @@ "sha256": "7d209bb35ff3a7a46b22f9a10a920eb30218c3403726d1dac72e0bffd1d914a4" } ], - "state": "staged" + "state": "active" } ], "version": 1 diff --git a/.github/public-workflow-command-allowlist.json b/.github/public-workflow-command-allowlist.json index a2243a4a..9919f735 100644 --- a/.github/public-workflow-command-allowlist.json +++ b/.github/public-workflow-command-allowlist.json @@ -2431,406 +2431,6 @@ "state": "staged", "rationale": "Exact reviewed command for credential-free contract-consumer compatibility." }, - { - "command": "echo", - "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", - "path": ".github/workflows/public-workflow-policy.yml", - "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking echo to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "active", - "statementSHA256": "74d9799e73f5f1a79baf06bea87cd6ba525c897ee703e8decf3e763191e411c1" - }, - { - "command": "exit", - "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", - "path": ".github/workflows/public-workflow-policy.yml", - "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking exit to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "active", - "statementSHA256": "74d9799e73f5f1a79baf06bea87cd6ba525c897ee703e8decf3e763191e411c1" - }, - { - "command": "echo", - "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", - "path": ".github/workflows/public-workflow-policy.yml", - "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking echo to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "active", - "statementSHA256": "fe9e84eb32be5ac99349d7e60340785a6e5b3750dcecf795514c53ec76253516" - }, - { - "command": "exit", - "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", - "path": ".github/workflows/public-workflow-policy.yml", - "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking exit to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "active", - "statementSHA256": "fe9e84eb32be5ac99349d7e60340785a6e5b3750dcecf795514c53ec76253516" - }, - { - "command": "echo", - "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", - "path": ".github/workflows/public-workflow-policy.yml", - "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking echo to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "active", - "statementSHA256": "4ade2e44c08380b704763da57c411f70fc54eebcabf0abd0277746786def0bf8" - }, - { - "command": "exit", - "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", - "path": ".github/workflows/public-workflow-policy.yml", - "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking exit to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "active", - "statementSHA256": "4ade2e44c08380b704763da57c411f70fc54eebcabf0abd0277746786def0bf8" - }, - { - "command": "$assignment", - "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", - "path": ".github/workflows/public-workflow-policy.yml", - "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking $assignment to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "active", - "statementSHA256": "0e17e768c1484e9def2346c58a2c32d337d4c33d780f0ffc79504af0c40ecba7" - }, - { - "command": "mkdir", - "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", - "path": ".github/workflows/public-workflow-policy.yml", - "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking mkdir to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "active", - "statementSHA256": "42f84c05333b2c7011f332ebca981a05c457d59e7595b13dac5dee7f58429d60" - }, - { - "command": "git", - "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", - "path": ".github/workflows/public-workflow-policy.yml", - "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking git to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "active", - "statementSHA256": "9919b241412c88da2b0a86cbeaab201cc2323a2fd0c957e2f726ebc62b7282a6" - }, - { - "command": "git", - "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", - "path": ".github/workflows/public-workflow-policy.yml", - "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking git to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "active", - "statementSHA256": "0cf020cfd2b573841c37a0529d43d5b53f9b318028b28b3536b2f6aff30f02bc" - }, - { - "command": "$assignment", - "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", - "path": ".github/workflows/public-workflow-policy.yml", - "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking $assignment to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "active", - "statementSHA256": "66d1ee88edc672ead2282e1e159bc382cc6fad2c13a86c6ce585e0082a006b8d" - }, - { - "command": "git", - "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", - "path": ".github/workflows/public-workflow-policy.yml", - "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking git to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "active", - "statementSHA256": "66d1ee88edc672ead2282e1e159bc382cc6fad2c13a86c6ce585e0082a006b8d" - }, - { - "command": "echo", - "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", - "path": ".github/workflows/public-workflow-policy.yml", - "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking echo to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "active", - "statementSHA256": "ff503c4cc7be7d35246d5c16eca55f3af89544a6ad9ffc6bf0bb0cbe4a199d19" - }, - { - "command": "exit", - "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", - "path": ".github/workflows/public-workflow-policy.yml", - "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking exit to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "active", - "statementSHA256": "ff503c4cc7be7d35246d5c16eca55f3af89544a6ad9ffc6bf0bb0cbe4a199d19" - }, - { - "command": "git", - "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", - "path": ".github/workflows/public-workflow-policy.yml", - "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking git to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "active", - "statementSHA256": "465704dc91fedf6386416daaecdf25aceff4bb50fa5defae0958b0a30bdeb6d1" - }, - { - "command": "read", - "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", - "path": ".github/workflows/public-workflow-policy.yml", - "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking read to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "active", - "statementSHA256": "e9f5edd1eb6f1cf0981dee8cb41c339f3b29870174e740942a56d4076bd36887" - }, - { - "command": "echo", - "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", - "path": ".github/workflows/public-workflow-policy.yml", - "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking echo to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "active", - "statementSHA256": "e9f5edd1eb6f1cf0981dee8cb41c339f3b29870174e740942a56d4076bd36887" - }, - { - "command": "exit", - "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", - "path": ".github/workflows/public-workflow-policy.yml", - "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking exit to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "active", - "statementSHA256": "e9f5edd1eb6f1cf0981dee8cb41c339f3b29870174e740942a56d4076bd36887" - }, - { - "command": "git", - "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", - "path": ".github/workflows/public-workflow-policy.yml", - "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking git to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "active", - "statementSHA256": "3a50f487e92cd73a96ba4ae31eaa56980c1452ddb24bb37fce32cc2cf0f933e0" - }, - { - "command": "tar", - "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", - "path": ".github/workflows/public-workflow-policy.yml", - "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking tar to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "active", - "statementSHA256": "9e40419faa9458450eddc809e65c865dbf076b4dbd75f7e7cd3776aabdb7e1e0" - }, - { - "command": "echo", - "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", - "path": ".github/workflows/public-workflow-policy.yml", - "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking echo to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "active", - "statementSHA256": "9e40419faa9458450eddc809e65c865dbf076b4dbd75f7e7cd3776aabdb7e1e0" - }, - { - "command": "exit", - "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", - "path": ".github/workflows/public-workflow-policy.yml", - "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking exit to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "active", - "statementSHA256": "9e40419faa9458450eddc809e65c865dbf076b4dbd75f7e7cd3776aabdb7e1e0" - }, - { - "command": "read", - "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", - "path": ".github/workflows/public-workflow-policy.yml", - "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking read to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "active", - "statementSHA256": "3f1d57f7be1844759d7c250d516b66e11aa6e6da06ce6d2f0ad4182e4b9faf4b" - }, - { - "command": "echo", - "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", - "path": ".github/workflows/public-workflow-policy.yml", - "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking echo to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "active", - "statementSHA256": "3f1d57f7be1844759d7c250d516b66e11aa6e6da06ce6d2f0ad4182e4b9faf4b" - }, - { - "command": "exit", - "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", - "path": ".github/workflows/public-workflow-policy.yml", - "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking exit to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "active", - "statementSHA256": "3f1d57f7be1844759d7c250d516b66e11aa6e6da06ce6d2f0ad4182e4b9faf4b" - }, - { - "command": "tar", - "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", - "path": ".github/workflows/public-workflow-policy.yml", - "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking tar to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "active", - "statementSHA256": "2c7cd49dcf58abe45dabab11177f0c555401c94df4a264edd50b7a272e6304be" - }, - { - "command": "$assignment", - "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", - "path": ".github/workflows/public-workflow-policy.yml", - "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking $assignment to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "active", - "statementSHA256": "6af7f417e806699121e4d583e17b42321a812a4b8237364a263b970d48dc6132" - }, - { - "command": "find", - "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", - "path": ".github/workflows/public-workflow-policy.yml", - "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking find to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "active", - "statementSHA256": "6af7f417e806699121e4d583e17b42321a812a4b8237364a263b970d48dc6132" - }, - { - "command": "echo", - "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", - "path": ".github/workflows/public-workflow-policy.yml", - "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking echo to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "active", - "statementSHA256": "c7f1a421fa15eeab86ac50981d3a6b99248925a1dc7d62f2847e9a82efe2a4a1" - }, - { - "command": "exit", - "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", - "path": ".github/workflows/public-workflow-policy.yml", - "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking exit to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "active", - "statementSHA256": "c7f1a421fa15eeab86ac50981d3a6b99248925a1dc7d62f2847e9a82efe2a4a1" - }, - { - "command": "$assignment", - "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", - "path": ".github/workflows/public-workflow-policy.yml", - "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking $assignment to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "active", - "statementSHA256": "6e78bfd0781f308df8a82c819888f28647df16892ba5a7cef1571b725e102383" - }, - { - "command": "[", - "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", - "path": ".github/workflows/public-workflow-policy.yml", - "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking [ to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "active", - "statementSHA256": "e5888a15646c95e95768c301658269ab4880ac40a2aed5200133899101db0a56" - }, - { - "command": "$assignment", - "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", - "path": ".github/workflows/public-workflow-policy.yml", - "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking $assignment to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "active", - "statementSHA256": "e5888a15646c95e95768c301658269ab4880ac40a2aed5200133899101db0a56" - }, - { - "command": "echo", - "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", - "path": ".github/workflows/public-workflow-policy.yml", - "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking echo to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "active", - "statementSHA256": "e5888a15646c95e95768c301658269ab4880ac40a2aed5200133899101db0a56" - }, - { - "command": "exit", - "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", - "path": ".github/workflows/public-workflow-policy.yml", - "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking exit to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "active", - "statementSHA256": "e5888a15646c95e95768c301658269ab4880ac40a2aed5200133899101db0a56" - }, - { - "command": "echo", - "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", - "path": ".github/workflows/public-workflow-policy.yml", - "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking echo to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "active", - "statementSHA256": "7c133076e6ce17d413f1327ea6d975f452d350aba142430d9ad85847205e36b8" - }, - { - "command": "[", - "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", - "path": ".github/workflows/public-workflow-policy.yml", - "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking [ to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "active", - "statementSHA256": "5f8e07c6f716cb7da7802dc483fb1d72aed7f4a46b0fe6e2b79633123f4c775e" - }, - { - "command": "cd", - "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", - "path": ".github/workflows/public-workflow-policy.yml", - "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking cd to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "active", - "statementSHA256": "5f8e07c6f716cb7da7802dc483fb1d72aed7f4a46b0fe6e2b79633123f4c775e" - }, - { - "command": "check-public-workflow-policy.sh", - "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", - "path": ".github/workflows/public-workflow-policy.yml", - "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking check-public-workflow-policy.sh to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "active", - "statementSHA256": "5f8e07c6f716cb7da7802dc483fb1d72aed7f4a46b0fe6e2b79633123f4c775e" - }, - { - "command": "echo", - "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", - "path": ".github/workflows/public-workflow-policy.yml", - "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking echo to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "active", - "statementSHA256": "bfaa72e371a40394f5979f319f3ebffdb30a4d9ef19fafed77fd4ac12dc30ad2" - }, - { - "command": "exit", - "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", - "path": ".github/workflows/public-workflow-policy.yml", - "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking exit to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "active", - "statementSHA256": "1a21be8bb1dc4721d30cc1850ead617faa55ae9aebf416da4369668bdeaf0824" - }, - { - "command": "$assignment", - "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", - "path": ".github/workflows/public-workflow-policy.yml", - "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking $assignment to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "active", - "statementSHA256": "3c5b32a0f4bacbab25fd6ed87aa869b1646138cf8dac471840a36556c41bbf4d" - }, - { - "command": "cd", - "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", - "path": ".github/workflows/public-workflow-policy.yml", - "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking cd to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "active", - "statementSHA256": "3c5b32a0f4bacbab25fd6ed87aa869b1646138cf8dac471840a36556c41bbf4d" - }, - { - "command": "run.sh", - "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", - "path": ".github/workflows/public-workflow-policy.yml", - "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking run.sh to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "active", - "statementSHA256": "3c5b32a0f4bacbab25fd6ed87aa869b1646138cf8dac471840a36556c41bbf4d" - }, - { - "command": "[", - "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", - "path": ".github/workflows/public-workflow-policy.yml", - "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking [ to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "active", - "statementSHA256": "ce4c2d189d1b611bd2ed5a9e694a2a8353ee81f6a44d4e9c2961f1809c3dae67" - }, - { - "command": "echo", - "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", - "path": ".github/workflows/public-workflow-policy.yml", - "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking echo to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "active", - "statementSHA256": "ce4c2d189d1b611bd2ed5a9e694a2a8353ee81f6a44d4e9c2961f1809c3dae67" - }, - { - "command": "exit", - "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", - "path": ".github/workflows/public-workflow-policy.yml", - "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking exit to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "active", - "statementSHA256": "ce4c2d189d1b611bd2ed5a9e694a2a8353ee81f6a44d4e9c2961f1809c3dae67" - }, - { - "command": "printf", - "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", - "path": ".github/workflows/public-workflow-policy.yml", - "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking printf to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "active", - "statementSHA256": "8c3c075c644d214a76a7406f14d62fa50a4cdc8b07b231da74ef3cffdc86a4e9" - }, - { - "command": "cd", - "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", - "path": ".github/workflows/public-workflow-policy.yml", - "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking cd to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "active", - "statementSHA256": "824ebf5395f4ccfdbd481e20116fb3c166c01f3bdda7490b1229ce795e1dff20" - }, - { - "command": "check-public-workflow-policy.sh", - "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", - "path": ".github/workflows/public-workflow-policy.yml", - "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact shell statement invoking check-public-workflow-policy.sh to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "state": "active", - "statementSHA256": "89a1f75b6db0c513cc68634a7b1e7983e88d121f09db4dbfe7aaa6edd1e9978c" - }, { "path": ".github/workflows/benchmark.yml", "command": "cd", @@ -3060,7 +2660,7 @@ "contextSHA256": "d804de818453d79cf9b6434ea2780dac8a4434b4dd32bd9d46be17620fc25066", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the exact approved Go1.27.2 canonical policy context. Existing executable/statement/action authority is preserved; adoption and promotion remain separate.", - "state": "staged", + "state": "active", "statementSHA256": "74d9799e73f5f1a79baf06bea87cd6ba525c897ee703e8decf3e763191e411c1" }, { @@ -3068,7 +2668,7 @@ "contextSHA256": "d804de818453d79cf9b6434ea2780dac8a4434b4dd32bd9d46be17620fc25066", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the exact approved Go1.27.2 canonical policy context. Existing executable/statement/action authority is preserved; adoption and promotion remain separate.", - "state": "staged", + "state": "active", "statementSHA256": "74d9799e73f5f1a79baf06bea87cd6ba525c897ee703e8decf3e763191e411c1" }, { @@ -3076,7 +2676,7 @@ "contextSHA256": "d804de818453d79cf9b6434ea2780dac8a4434b4dd32bd9d46be17620fc25066", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the exact approved Go1.27.2 canonical policy context. Existing executable/statement/action authority is preserved; adoption and promotion remain separate.", - "state": "staged", + "state": "active", "statementSHA256": "fe9e84eb32be5ac99349d7e60340785a6e5b3750dcecf795514c53ec76253516" }, { @@ -3084,7 +2684,7 @@ "contextSHA256": "d804de818453d79cf9b6434ea2780dac8a4434b4dd32bd9d46be17620fc25066", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the exact approved Go1.27.2 canonical policy context. Existing executable/statement/action authority is preserved; adoption and promotion remain separate.", - "state": "staged", + "state": "active", "statementSHA256": "fe9e84eb32be5ac99349d7e60340785a6e5b3750dcecf795514c53ec76253516" }, { @@ -3092,7 +2692,7 @@ "contextSHA256": "d804de818453d79cf9b6434ea2780dac8a4434b4dd32bd9d46be17620fc25066", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the exact approved Go1.27.2 canonical policy context. Existing executable/statement/action authority is preserved; adoption and promotion remain separate.", - "state": "staged", + "state": "active", "statementSHA256": "4ade2e44c08380b704763da57c411f70fc54eebcabf0abd0277746786def0bf8" }, { @@ -3100,7 +2700,7 @@ "contextSHA256": "d804de818453d79cf9b6434ea2780dac8a4434b4dd32bd9d46be17620fc25066", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the exact approved Go1.27.2 canonical policy context. Existing executable/statement/action authority is preserved; adoption and promotion remain separate.", - "state": "staged", + "state": "active", "statementSHA256": "4ade2e44c08380b704763da57c411f70fc54eebcabf0abd0277746786def0bf8" }, { @@ -3108,7 +2708,7 @@ "contextSHA256": "d804de818453d79cf9b6434ea2780dac8a4434b4dd32bd9d46be17620fc25066", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the exact approved Go1.27.2 canonical policy context. Existing executable/statement/action authority is preserved; adoption and promotion remain separate.", - "state": "staged", + "state": "active", "statementSHA256": "0e17e768c1484e9def2346c58a2c32d337d4c33d780f0ffc79504af0c40ecba7" }, { @@ -3116,7 +2716,7 @@ "contextSHA256": "d804de818453d79cf9b6434ea2780dac8a4434b4dd32bd9d46be17620fc25066", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the exact approved Go1.27.2 canonical policy context. Existing executable/statement/action authority is preserved; adoption and promotion remain separate.", - "state": "staged", + "state": "active", "statementSHA256": "42f84c05333b2c7011f332ebca981a05c457d59e7595b13dac5dee7f58429d60" }, { @@ -3124,7 +2724,7 @@ "contextSHA256": "d804de818453d79cf9b6434ea2780dac8a4434b4dd32bd9d46be17620fc25066", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the exact approved Go1.27.2 canonical policy context. Existing executable/statement/action authority is preserved; adoption and promotion remain separate.", - "state": "staged", + "state": "active", "statementSHA256": "9919b241412c88da2b0a86cbeaab201cc2323a2fd0c957e2f726ebc62b7282a6" }, { @@ -3132,7 +2732,7 @@ "contextSHA256": "d804de818453d79cf9b6434ea2780dac8a4434b4dd32bd9d46be17620fc25066", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the exact approved Go1.27.2 canonical policy context. Existing executable/statement/action authority is preserved; adoption and promotion remain separate.", - "state": "staged", + "state": "active", "statementSHA256": "0cf020cfd2b573841c37a0529d43d5b53f9b318028b28b3536b2f6aff30f02bc" }, { @@ -3140,7 +2740,7 @@ "contextSHA256": "d804de818453d79cf9b6434ea2780dac8a4434b4dd32bd9d46be17620fc25066", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the exact approved Go1.27.2 canonical policy context. Existing executable/statement/action authority is preserved; adoption and promotion remain separate.", - "state": "staged", + "state": "active", "statementSHA256": "66d1ee88edc672ead2282e1e159bc382cc6fad2c13a86c6ce585e0082a006b8d" }, { @@ -3148,7 +2748,7 @@ "contextSHA256": "d804de818453d79cf9b6434ea2780dac8a4434b4dd32bd9d46be17620fc25066", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the exact approved Go1.27.2 canonical policy context. Existing executable/statement/action authority is preserved; adoption and promotion remain separate.", - "state": "staged", + "state": "active", "statementSHA256": "66d1ee88edc672ead2282e1e159bc382cc6fad2c13a86c6ce585e0082a006b8d" }, { @@ -3156,7 +2756,7 @@ "contextSHA256": "d804de818453d79cf9b6434ea2780dac8a4434b4dd32bd9d46be17620fc25066", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the exact approved Go1.27.2 canonical policy context. Existing executable/statement/action authority is preserved; adoption and promotion remain separate.", - "state": "staged", + "state": "active", "statementSHA256": "ff503c4cc7be7d35246d5c16eca55f3af89544a6ad9ffc6bf0bb0cbe4a199d19" }, { @@ -3164,7 +2764,7 @@ "contextSHA256": "d804de818453d79cf9b6434ea2780dac8a4434b4dd32bd9d46be17620fc25066", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the exact approved Go1.27.2 canonical policy context. Existing executable/statement/action authority is preserved; adoption and promotion remain separate.", - "state": "staged", + "state": "active", "statementSHA256": "ff503c4cc7be7d35246d5c16eca55f3af89544a6ad9ffc6bf0bb0cbe4a199d19" }, { @@ -3172,7 +2772,7 @@ "contextSHA256": "d804de818453d79cf9b6434ea2780dac8a4434b4dd32bd9d46be17620fc25066", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the exact approved Go1.27.2 canonical policy context. Existing executable/statement/action authority is preserved; adoption and promotion remain separate.", - "state": "staged", + "state": "active", "statementSHA256": "465704dc91fedf6386416daaecdf25aceff4bb50fa5defae0958b0a30bdeb6d1" }, { @@ -3180,7 +2780,7 @@ "contextSHA256": "d804de818453d79cf9b6434ea2780dac8a4434b4dd32bd9d46be17620fc25066", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the exact approved Go1.27.2 canonical policy context. Existing executable/statement/action authority is preserved; adoption and promotion remain separate.", - "state": "staged", + "state": "active", "statementSHA256": "e9f5edd1eb6f1cf0981dee8cb41c339f3b29870174e740942a56d4076bd36887" }, { @@ -3188,7 +2788,7 @@ "contextSHA256": "d804de818453d79cf9b6434ea2780dac8a4434b4dd32bd9d46be17620fc25066", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the exact approved Go1.27.2 canonical policy context. Existing executable/statement/action authority is preserved; adoption and promotion remain separate.", - "state": "staged", + "state": "active", "statementSHA256": "e9f5edd1eb6f1cf0981dee8cb41c339f3b29870174e740942a56d4076bd36887" }, { @@ -3196,7 +2796,7 @@ "contextSHA256": "d804de818453d79cf9b6434ea2780dac8a4434b4dd32bd9d46be17620fc25066", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the exact approved Go1.27.2 canonical policy context. Existing executable/statement/action authority is preserved; adoption and promotion remain separate.", - "state": "staged", + "state": "active", "statementSHA256": "e9f5edd1eb6f1cf0981dee8cb41c339f3b29870174e740942a56d4076bd36887" }, { @@ -3204,7 +2804,7 @@ "contextSHA256": "d804de818453d79cf9b6434ea2780dac8a4434b4dd32bd9d46be17620fc25066", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the exact approved Go1.27.2 canonical policy context. Existing executable/statement/action authority is preserved; adoption and promotion remain separate.", - "state": "staged", + "state": "active", "statementSHA256": "3a50f487e92cd73a96ba4ae31eaa56980c1452ddb24bb37fce32cc2cf0f933e0" }, { @@ -3212,7 +2812,7 @@ "contextSHA256": "d804de818453d79cf9b6434ea2780dac8a4434b4dd32bd9d46be17620fc25066", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the exact approved Go1.27.2 canonical policy context. Existing executable/statement/action authority is preserved; adoption and promotion remain separate.", - "state": "staged", + "state": "active", "statementSHA256": "9e40419faa9458450eddc809e65c865dbf076b4dbd75f7e7cd3776aabdb7e1e0" }, { @@ -3220,7 +2820,7 @@ "contextSHA256": "d804de818453d79cf9b6434ea2780dac8a4434b4dd32bd9d46be17620fc25066", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the exact approved Go1.27.2 canonical policy context. Existing executable/statement/action authority is preserved; adoption and promotion remain separate.", - "state": "staged", + "state": "active", "statementSHA256": "9e40419faa9458450eddc809e65c865dbf076b4dbd75f7e7cd3776aabdb7e1e0" }, { @@ -3228,7 +2828,7 @@ "contextSHA256": "d804de818453d79cf9b6434ea2780dac8a4434b4dd32bd9d46be17620fc25066", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the exact approved Go1.27.2 canonical policy context. Existing executable/statement/action authority is preserved; adoption and promotion remain separate.", - "state": "staged", + "state": "active", "statementSHA256": "9e40419faa9458450eddc809e65c865dbf076b4dbd75f7e7cd3776aabdb7e1e0" }, { @@ -3236,7 +2836,7 @@ "contextSHA256": "d804de818453d79cf9b6434ea2780dac8a4434b4dd32bd9d46be17620fc25066", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the exact approved Go1.27.2 canonical policy context. Existing executable/statement/action authority is preserved; adoption and promotion remain separate.", - "state": "staged", + "state": "active", "statementSHA256": "3f1d57f7be1844759d7c250d516b66e11aa6e6da06ce6d2f0ad4182e4b9faf4b" }, { @@ -3244,7 +2844,7 @@ "contextSHA256": "d804de818453d79cf9b6434ea2780dac8a4434b4dd32bd9d46be17620fc25066", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the exact approved Go1.27.2 canonical policy context. Existing executable/statement/action authority is preserved; adoption and promotion remain separate.", - "state": "staged", + "state": "active", "statementSHA256": "3f1d57f7be1844759d7c250d516b66e11aa6e6da06ce6d2f0ad4182e4b9faf4b" }, { @@ -3252,7 +2852,7 @@ "contextSHA256": "d804de818453d79cf9b6434ea2780dac8a4434b4dd32bd9d46be17620fc25066", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the exact approved Go1.27.2 canonical policy context. Existing executable/statement/action authority is preserved; adoption and promotion remain separate.", - "state": "staged", + "state": "active", "statementSHA256": "3f1d57f7be1844759d7c250d516b66e11aa6e6da06ce6d2f0ad4182e4b9faf4b" }, { @@ -3260,7 +2860,7 @@ "contextSHA256": "d804de818453d79cf9b6434ea2780dac8a4434b4dd32bd9d46be17620fc25066", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the exact approved Go1.27.2 canonical policy context. Existing executable/statement/action authority is preserved; adoption and promotion remain separate.", - "state": "staged", + "state": "active", "statementSHA256": "2c7cd49dcf58abe45dabab11177f0c555401c94df4a264edd50b7a272e6304be" }, { @@ -3268,7 +2868,7 @@ "contextSHA256": "d804de818453d79cf9b6434ea2780dac8a4434b4dd32bd9d46be17620fc25066", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the exact approved Go1.27.2 canonical policy context. Existing executable/statement/action authority is preserved; adoption and promotion remain separate.", - "state": "staged", + "state": "active", "statementSHA256": "6af7f417e806699121e4d583e17b42321a812a4b8237364a263b970d48dc6132" }, { @@ -3276,7 +2876,7 @@ "contextSHA256": "d804de818453d79cf9b6434ea2780dac8a4434b4dd32bd9d46be17620fc25066", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the exact approved Go1.27.2 canonical policy context. Existing executable/statement/action authority is preserved; adoption and promotion remain separate.", - "state": "staged", + "state": "active", "statementSHA256": "6af7f417e806699121e4d583e17b42321a812a4b8237364a263b970d48dc6132" }, { @@ -3284,7 +2884,7 @@ "contextSHA256": "d804de818453d79cf9b6434ea2780dac8a4434b4dd32bd9d46be17620fc25066", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the exact approved Go1.27.2 canonical policy context. Existing executable/statement/action authority is preserved; adoption and promotion remain separate.", - "state": "staged", + "state": "active", "statementSHA256": "c7f1a421fa15eeab86ac50981d3a6b99248925a1dc7d62f2847e9a82efe2a4a1" }, { @@ -3292,7 +2892,7 @@ "contextSHA256": "d804de818453d79cf9b6434ea2780dac8a4434b4dd32bd9d46be17620fc25066", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the exact approved Go1.27.2 canonical policy context. Existing executable/statement/action authority is preserved; adoption and promotion remain separate.", - "state": "staged", + "state": "active", "statementSHA256": "c7f1a421fa15eeab86ac50981d3a6b99248925a1dc7d62f2847e9a82efe2a4a1" }, { @@ -3300,7 +2900,7 @@ "contextSHA256": "d804de818453d79cf9b6434ea2780dac8a4434b4dd32bd9d46be17620fc25066", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the exact approved Go1.27.2 canonical policy context. Existing executable/statement/action authority is preserved; adoption and promotion remain separate.", - "state": "staged", + "state": "active", "statementSHA256": "6e78bfd0781f308df8a82c819888f28647df16892ba5a7cef1571b725e102383" }, { @@ -3308,7 +2908,7 @@ "contextSHA256": "d804de818453d79cf9b6434ea2780dac8a4434b4dd32bd9d46be17620fc25066", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the exact approved Go1.27.2 canonical policy context. Existing executable/statement/action authority is preserved; adoption and promotion remain separate.", - "state": "staged", + "state": "active", "statementSHA256": "e5888a15646c95e95768c301658269ab4880ac40a2aed5200133899101db0a56" }, { @@ -3316,7 +2916,7 @@ "contextSHA256": "d804de818453d79cf9b6434ea2780dac8a4434b4dd32bd9d46be17620fc25066", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the exact approved Go1.27.2 canonical policy context. Existing executable/statement/action authority is preserved; adoption and promotion remain separate.", - "state": "staged", + "state": "active", "statementSHA256": "e5888a15646c95e95768c301658269ab4880ac40a2aed5200133899101db0a56" }, { @@ -3324,7 +2924,7 @@ "contextSHA256": "d804de818453d79cf9b6434ea2780dac8a4434b4dd32bd9d46be17620fc25066", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the exact approved Go1.27.2 canonical policy context. Existing executable/statement/action authority is preserved; adoption and promotion remain separate.", - "state": "staged", + "state": "active", "statementSHA256": "e5888a15646c95e95768c301658269ab4880ac40a2aed5200133899101db0a56" }, { @@ -3332,7 +2932,7 @@ "contextSHA256": "d804de818453d79cf9b6434ea2780dac8a4434b4dd32bd9d46be17620fc25066", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the exact approved Go1.27.2 canonical policy context. Existing executable/statement/action authority is preserved; adoption and promotion remain separate.", - "state": "staged", + "state": "active", "statementSHA256": "e5888a15646c95e95768c301658269ab4880ac40a2aed5200133899101db0a56" }, { @@ -3340,7 +2940,7 @@ "contextSHA256": "d804de818453d79cf9b6434ea2780dac8a4434b4dd32bd9d46be17620fc25066", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the exact approved Go1.27.2 canonical policy context. Existing executable/statement/action authority is preserved; adoption and promotion remain separate.", - "state": "staged", + "state": "active", "statementSHA256": "7c133076e6ce17d413f1327ea6d975f452d350aba142430d9ad85847205e36b8" }, { @@ -3348,7 +2948,7 @@ "contextSHA256": "d804de818453d79cf9b6434ea2780dac8a4434b4dd32bd9d46be17620fc25066", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the exact approved Go1.27.2 canonical policy context. Existing executable/statement/action authority is preserved; adoption and promotion remain separate.", - "state": "staged", + "state": "active", "statementSHA256": "5f8e07c6f716cb7da7802dc483fb1d72aed7f4a46b0fe6e2b79633123f4c775e" }, { @@ -3356,7 +2956,7 @@ "contextSHA256": "d804de818453d79cf9b6434ea2780dac8a4434b4dd32bd9d46be17620fc25066", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the exact approved Go1.27.2 canonical policy context. Existing executable/statement/action authority is preserved; adoption and promotion remain separate.", - "state": "staged", + "state": "active", "statementSHA256": "5f8e07c6f716cb7da7802dc483fb1d72aed7f4a46b0fe6e2b79633123f4c775e" }, { @@ -3364,7 +2964,7 @@ "contextSHA256": "d804de818453d79cf9b6434ea2780dac8a4434b4dd32bd9d46be17620fc25066", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the exact approved Go1.27.2 canonical policy context. Existing executable/statement/action authority is preserved; adoption and promotion remain separate.", - "state": "staged", + "state": "active", "statementSHA256": "5f8e07c6f716cb7da7802dc483fb1d72aed7f4a46b0fe6e2b79633123f4c775e" }, { @@ -3372,7 +2972,7 @@ "contextSHA256": "d804de818453d79cf9b6434ea2780dac8a4434b4dd32bd9d46be17620fc25066", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the exact approved Go1.27.2 canonical policy context. Existing executable/statement/action authority is preserved; adoption and promotion remain separate.", - "state": "staged", + "state": "active", "statementSHA256": "bfaa72e371a40394f5979f319f3ebffdb30a4d9ef19fafed77fd4ac12dc30ad2" }, { @@ -3380,7 +2980,7 @@ "contextSHA256": "d804de818453d79cf9b6434ea2780dac8a4434b4dd32bd9d46be17620fc25066", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the exact approved Go1.27.2 canonical policy context. Existing executable/statement/action authority is preserved; adoption and promotion remain separate.", - "state": "staged", + "state": "active", "statementSHA256": "1a21be8bb1dc4721d30cc1850ead617faa55ae9aebf416da4369668bdeaf0824" }, { @@ -3388,7 +2988,7 @@ "contextSHA256": "d804de818453d79cf9b6434ea2780dac8a4434b4dd32bd9d46be17620fc25066", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the exact approved Go1.27.2 canonical policy context. Existing executable/statement/action authority is preserved; adoption and promotion remain separate.", - "state": "staged", + "state": "active", "statementSHA256": "3c5b32a0f4bacbab25fd6ed87aa869b1646138cf8dac471840a36556c41bbf4d" }, { @@ -3396,7 +2996,7 @@ "contextSHA256": "d804de818453d79cf9b6434ea2780dac8a4434b4dd32bd9d46be17620fc25066", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the exact approved Go1.27.2 canonical policy context. Existing executable/statement/action authority is preserved; adoption and promotion remain separate.", - "state": "staged", + "state": "active", "statementSHA256": "3c5b32a0f4bacbab25fd6ed87aa869b1646138cf8dac471840a36556c41bbf4d" }, { @@ -3404,7 +3004,7 @@ "contextSHA256": "d804de818453d79cf9b6434ea2780dac8a4434b4dd32bd9d46be17620fc25066", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the exact approved Go1.27.2 canonical policy context. Existing executable/statement/action authority is preserved; adoption and promotion remain separate.", - "state": "staged", + "state": "active", "statementSHA256": "3c5b32a0f4bacbab25fd6ed87aa869b1646138cf8dac471840a36556c41bbf4d" }, { @@ -3412,7 +3012,7 @@ "contextSHA256": "d804de818453d79cf9b6434ea2780dac8a4434b4dd32bd9d46be17620fc25066", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the exact approved Go1.27.2 canonical policy context. Existing executable/statement/action authority is preserved; adoption and promotion remain separate.", - "state": "staged", + "state": "active", "statementSHA256": "ce4c2d189d1b611bd2ed5a9e694a2a8353ee81f6a44d4e9c2961f1809c3dae67" }, { @@ -3420,7 +3020,7 @@ "contextSHA256": "d804de818453d79cf9b6434ea2780dac8a4434b4dd32bd9d46be17620fc25066", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the exact approved Go1.27.2 canonical policy context. Existing executable/statement/action authority is preserved; adoption and promotion remain separate.", - "state": "staged", + "state": "active", "statementSHA256": "ce4c2d189d1b611bd2ed5a9e694a2a8353ee81f6a44d4e9c2961f1809c3dae67" }, { @@ -3428,7 +3028,7 @@ "contextSHA256": "d804de818453d79cf9b6434ea2780dac8a4434b4dd32bd9d46be17620fc25066", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the exact approved Go1.27.2 canonical policy context. Existing executable/statement/action authority is preserved; adoption and promotion remain separate.", - "state": "staged", + "state": "active", "statementSHA256": "ce4c2d189d1b611bd2ed5a9e694a2a8353ee81f6a44d4e9c2961f1809c3dae67" }, { @@ -3436,7 +3036,7 @@ "contextSHA256": "d804de818453d79cf9b6434ea2780dac8a4434b4dd32bd9d46be17620fc25066", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the exact approved Go1.27.2 canonical policy context. Existing executable/statement/action authority is preserved; adoption and promotion remain separate.", - "state": "staged", + "state": "active", "statementSHA256": "8c3c075c644d214a76a7406f14d62fa50a4cdc8b07b231da74ef3cffdc86a4e9" }, { @@ -3444,7 +3044,7 @@ "contextSHA256": "d804de818453d79cf9b6434ea2780dac8a4434b4dd32bd9d46be17620fc25066", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the exact approved Go1.27.2 canonical policy context. Existing executable/statement/action authority is preserved; adoption and promotion remain separate.", - "state": "staged", + "state": "active", "statementSHA256": "824ebf5395f4ccfdbd481e20116fb3c166c01f3bdda7490b1229ce795e1dff20" }, { @@ -3452,7 +3052,7 @@ "contextSHA256": "d804de818453d79cf9b6434ea2780dac8a4434b4dd32bd9d46be17620fc25066", "path": ".github/workflows/public-workflow-policy.yml", "rationale": "Stage the exact approved Go1.27.2 canonical policy context. Existing executable/statement/action authority is preserved; adoption and promotion remain separate.", - "state": "staged", + "state": "active", "statementSHA256": "89a1f75b6db0c513cc68634a7b1e7983e88d121f09db4dbfe7aaa6edd1e9978c" } ] diff --git a/.github/public-workflow-executable-allowlist.json b/.github/public-workflow-executable-allowlist.json index 51335d28..b54c30b0 100644 --- a/.github/public-workflow-executable-allowlist.json +++ b/.github/public-workflow-executable-allowlist.json @@ -79,28 +79,12 @@ "sha256": "47c43498b33e4ab9f410e2eeff5eb124cd953fe657d81fbcd004133a41408c3c", "rationale": "Exercises hermetic contract selection, provenance, runtime parity, and real local loading." }, - { - "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", - "path": "scripts/check-public-workflow-policy.sh", - "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact repository executable scripts/check-public-workflow-policy.sh to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "sha256": "166d4c7f272b6e249abd5bd2efadb8034105cf62df3cff2200978c6e9fb6998c", - "state": "active", - "workflowPath": ".github/workflows/public-workflow-policy.yml" - }, - { - "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", - "path": ".github/workflows/policytool/adoptionguard/run.sh", - "rationale": "Stage the public-workflow Go 1.27.1 bridge frozen at 667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e: bind only this exact repository executable .github/workflows/policytool/adoptionguard/run.sh to the parser-derived hashes and workflow context. Adoption and promotion remain separate; no secret or provider authority is added.", - "sha256": "b5597c106885bdc9b1f7161f7c6a1635d92f5f9273c41ec799233d68d6dbf3e4", - "state": "active", - "workflowPath": ".github/workflows/public-workflow-policy.yml" - }, { "contextSHA256": "d804de818453d79cf9b6434ea2780dac8a4434b4dd32bd9d46be17620fc25066", "path": "scripts/check-public-workflow-policy.sh", "rationale": "Stage the exact approved Go1.27.2 canonical policy context. Existing executable/statement/action authority is preserved; adoption and promotion remain separate.", "sha256": "166d4c7f272b6e249abd5bd2efadb8034105cf62df3cff2200978c6e9fb6998c", - "state": "staged", + "state": "active", "workflowPath": ".github/workflows/public-workflow-policy.yml" }, { @@ -108,7 +92,7 @@ "path": ".github/workflows/policytool/adoptionguard/run.sh", "rationale": "Stage the exact approved Go1.27.2 canonical policy context. Existing executable/statement/action authority is preserved; adoption and promotion remain separate.", "sha256": "b5597c106885bdc9b1f7161f7c6a1635d92f5f9273c41ec799233d68d6dbf3e4", - "state": "staged", + "state": "active", "workflowPath": ".github/workflows/public-workflow-policy.yml" } ] diff --git a/.github/public-workflow-presence-allowlist.json b/.github/public-workflow-presence-allowlist.json index 5482922f..bd45d7c9 100644 --- a/.github/public-workflow-presence-allowlist.json +++ b/.github/public-workflow-presence-allowlist.json @@ -111,12 +111,6 @@ "state": "staged", "presence": "present" }, - { - "path": ".github/workflows/public-workflow-policy.yml", - "contextSHA256": "5e3ee7768ef2d57b0c1e15e6b27b1efbb892454db4b762cfc56806e7985248af", - "state": "active", - "presence": "present" - }, { "path": ".github/workflows/benchmark.yml", "contextSHA256": "0095a1d437ba5a9b5ddad0c3de98e4c911e9c96bfbdf7ad2e0a0187ef69c24b7", @@ -126,7 +120,7 @@ { "path": ".github/workflows/public-workflow-policy.yml", "contextSHA256": "d804de818453d79cf9b6434ea2780dac8a4434b4dd32bd9d46be17620fc25066", - "state": "staged", + "state": "active", "presence": "present" } ]