ci: point shared CI pins at gainratio/ci (same SHA)

.dagger/tests/test_public_contracts.py

@@ -211,12 +211,12 @@ def test_should_pin_both_reusable_modules_to_one_exact_central_commit() -> None:
     assert config["dependencies"] == [
         {
             "name": "foundation",
-            "source": f"github.com/hseshadr/ci/modules/portfolio-foundation@{CENTRAL_SHA}",
+            "source": f"github.com/gainratio/ci/modules/portfolio-foundation@{CENTRAL_SHA}",
             "pin": CENTRAL_SHA,
         },
         {
             "name": "python-package",
-            "source": f"github.com/hseshadr/ci/modules/python-package@{CENTRAL_SHA}",
+            "source": f"github.com/gainratio/ci/modules/python-package@{CENTRAL_SHA}",
             "pin": CENTRAL_SHA,
         },
     ]

.github/workflows/dependabot-repin.yml

@@ -13,7 +13,7 @@
 # - Executes no code from the pull request: the checkout is the base commit, so the
 #   Dagger module and scripts/repin_locked_tools.py are the reviewed versions. The tool
 #   fetches only uv.lock and two text files of the head, as text, through the REST API.
-# - Fleet policy shape (hseshadr/ci fleet_policy.py): checkout then Dagger, no run step.
+# - Fleet policy shape (gainratio/ci fleet_policy.py): checkout then Dagger, no run step.
 #   Event values reach Dagger only through the step environment, never pasted in args.
 # - Commits through createCommitOnBranch bound to the head SHA, so a concurrent
 #   Dependabot push wins, then cancels CI on the superseded commit (Dagger function

.github/workflows/publish.yml

@@ -23,8 +23,8 @@ jobs:
     steps:
       # `head_branch == default_branch` above is satisfied by a dispatch on a
       # TAG named `main`, so it cannot bind the candidate to main on its own.
-      # Before any artifact is touched, the central hseshadr/ci lineage function
-      # (pinned at a literal commit, hseshadr/ci#49) proves from GitHub's run
+      # Before any artifact is touched, the central gainratio/ci lineage function
+      # (pinned at a literal commit, gainratio/ci#49) proves from GitHub's run
       # records that the triggering run is a successful dispatch of
       # release-candidate.yml here for exactly HEAD_SHA, and that main contains
       # HEAD_SHA. Event values reach the action's bash only as quoted env vars.
@@ -36,7 +36,7 @@ jobs:
         with:
           version: "0.21.8"
           verb: call
-          module: github.com/hseshadr/ci/modules/portfolio-foundation@a88866232e679b6353d2b75bceb01969be739f67
+          module: github.com/gainratio/ci/modules/portfolio-foundation@a88866232e679b6353d2b75bceb01969be739f67
           args: release-lineage --github-token=env:GH_TOKEN --repository="$GITHUB_REPOSITORY" --run-id="$RUN_ID" --head-sha="$HEAD_SHA" --publish-run-id="$GITHUB_RUN_ID"
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:

dagger.json

@@ -13,12 +13,12 @@
   "dependencies": [
     {
       "name": "foundation",
-      "source": "github.com/hseshadr/ci/modules/portfolio-foundation@a88866232e679b6353d2b75bceb01969be739f67",
+      "source": "github.com/gainratio/ci/modules/portfolio-foundation@a88866232e679b6353d2b75bceb01969be739f67",
       "pin": "a88866232e679b6353d2b75bceb01969be739f67"
     },
     {
       "name": "python-package",
-      "source": "github.com/hseshadr/ci/modules/python-package@a88866232e679b6353d2b75bceb01969be739f67",
+      "source": "github.com/gainratio/ci/modules/python-package@a88866232e679b6353d2b75bceb01969be739f67",
       "pin": "a88866232e679b6353d2b75bceb01969be739f67"
     }
   ],

docs/OPERATIONS.md

@@ -301,7 +301,7 @@ triggers `publish.yml` from protected default-branch code. That source-free OIDC
 invokes the central lineage proof, pinned artifact download, and official PyPI publish actions
 against the exact triggering run; it has no checkout, shell, dependency install, build backend, or
 project code execution. The lineage proof is `portfolio-foundation`'s `release-lineage`, pinned at a
-literal `hseshadr/ci` commit. It runs first and fails unless GitHub's run records show a successful
+literal `gainratio/ci` commit. It runs first and fails unless GitHub's run records show a successful
 `release-candidate.yml` dispatch here for exactly the candidate SHA, and that `main` contains it: the
 job's `head_branch` check alone also passes for a dispatch on a tag named `main`. The manual dispatch
 is the fresh publication authorization.

tests/test_workflow_security.py

@@ -271,8 +271,8 @@ def test_should_keep_oidc_publisher_source_free_and_shell_free() -> None:
     assert settings.get("attestations") is True
 
 
-#: The central lineage proof (hseshadr/ci#49), pinned at a literal hseshadr/ci commit.
-LINEAGE_MODULE = re.compile(r"^github\.com/hseshadr/ci/modules/portfolio-foundation@[0-9a-f]{40}$")
+#: The central lineage proof (gainratio/ci#49), pinned at a literal gainratio/ci commit.
+LINEAGE_MODULE = re.compile(r"^github\.com/gainratio/ci/modules/portfolio-foundation@[0-9a-f]{40}$")
 #: Exact args: every value is a quoted env var bound to the triggering run, so a
 #: hard-coded run id or SHA cannot make the proof about a different run.
 LINEAGE_ARGS = (