promote(OMN-16041): omnibase_infra dev→main v0.38.6 — unstall the PyPI release (0.36.1 → 0.38.6)

.github/workflows/application-acl-postgres16-proof.yml

@@ -0,0 +1,64 @@
+# SPDX-FileCopyrightText: 2025 OmniNode.ai Inc.
+# SPDX-License-Identifier: MIT
+
+name: Application ACL PostgreSQL 16 Proof
+
+on:
+  pull_request:
+    branches: [main, dev, develop]
+    paths:
+      - ".github/workflows/application-acl-postgres16-proof.yml"
+      - "docker/application-acl-proof/**"
+      - "scripts/generate_application_database_acl.py"
+      - "scripts/ci/prove_application_database_acl.py"
+      - "src/omnibase_infra/validation/application_database_acl.py"
+      - "src/omnibase_infra/validation/enums/**"
+      - "src/omnibase_infra/validation/models/**"
+      - "src/omnibase_infra/validation/types/**"
+      - "tests/fixtures/application_database_acl/**"
+      - "tests/unit/validation/test_application_database_acl.py"
+      - "tests/ci/test_application_database_acl_contract.py"
+      - "tests/integration/test_application_acl_postgres16_proof.py"
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  rebuilt-postgres16-proof:
+    name: Rebuilt PostgreSQL 16 ACL and rollback proof
+    env:
+      COMPOSE_PROJECT_NAME: application-acl-proof-${{ github.run_id }}-${{ github.run_attempt }}
+    permissions:
+      contents: read
+    runs-on: >-
+      ${{
+        (github.event_name == 'pull_request' &&
+         github.event.pull_request.head.repo.full_name != github.repository)
+        && fromJSON(vars.OMNI_PUBLIC_PR_RUNS_ON_JSON || '["ubuntu-latest"]')
+        || fromJSON(vars.OMNI_DOCKER_CI_RUNS_ON_JSON || vars.OMNI_TRUSTED_CI_RUNS_ON_JSON || '["self-hosted","omnibase-ci"]')
+      }}
+    timeout-minutes: 30
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Verify Docker engine
+        run: docker info
+
+      - name: Rebuild and prove ACL matrix
+        run: >-
+          docker compose
+          -f docker/application-acl-proof/compose.yml
+          up --build --abort-on-container-exit --exit-code-from proof
+
+      - name: Tear down synthetic proof
+        if: always()
+        run: >-
+          docker compose
+          -f docker/application-acl-proof/compose.yml
+          down --volumes --remove-orphans

.github/workflows/artifact-reconciliation-webhook.yml

@@ -21,14 +21,22 @@ on:
   pull_request:
     types: [opened, synchronize, closed, reopened]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  # OMN-15730 / CodeRabbit: this job publishes a durable Kafka event with no
+  # reconciliation/replay path downstream. cancel-in-progress:true can kill
+  # the publish step mid-flight on a rapid-fire event sequence (e.g.
+  # synchronize immediately followed by closed), permanently dropping that
+  # lifecycle event. Do not cancel in-flight runs of this workflow.
+  cancel-in-progress: false
+
 jobs:
   publish-pr-webhook:
     name: Publish PR Webhook Event
     runs-on: >-
       ${{
-        ((github.event_name == 'pull_request' && github.base_ref == 'dev') ||
-         (github.event_name == 'pull_request' &&
-          github.event.pull_request.head.repo.full_name != github.repository))
+        (github.event_name == 'pull_request' &&
+         github.event.pull_request.head.repo.full_name != github.repository)
         && fromJSON(vars.OMNI_PUBLIC_PR_RUNS_ON_JSON || '["ubuntu-latest"]')
         || fromJSON(vars.OMNI_TRUSTED_CI_RUNS_ON_JSON || '["self-hosted","omnibase-ci"]')
       }}

.github/workflows/auto-merge.yml

@@ -58,6 +58,22 @@ permissions:
   contents: write
   pull-requests: write
 
+concurrency:
+  # OMN-15730 / CodeRabbit: check_suite runs do not populate
+  # github.event.pull_request, so the || github.ref fallback resolves to the
+  # default branch ref for EVERY check_suite-triggered run regardless of
+  # which PR's checks completed -- unrelated PRs' auto-merge attempts landed
+  # in one shared group and cancelled each other. Use the check_suite PR
+  # list explicitly before falling back to the run id.
+  group: >-
+    ${{ github.workflow }}-${{
+      github.event.pull_request.number ||
+      github.event.inputs.pr_number ||
+      (github.event.check_suite.pull_requests[0].number) ||
+      github.run_id
+    }}
+  cancel-in-progress: true
+
 jobs:
   auto-merge:
     timeout-minutes: 30
@@ -127,7 +143,7 @@ jobs:
 
       - name: Set up Python 3.12
         if: steps.resolve.outputs.skip != 'true' && steps.resolve.outputs.actor == 'jonahgabriel'
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: "3.12"
 

.github/workflows/auto-tag-on-merge.yml

@@ -38,12 +38,15 @@ jobs:
        startsWith(github.event.pull_request.title, 'chore: release') ||
        startsWith(github.event.pull_request.title, 'chore(release)'))
     timeout-minutes: 15
-    # OMNI_RUNNER_SELECTOR_V1 — a lightweight git tag + workflow dispatch; run on
-    # the public/GitHub-hosted pool so it is not blocked by self-hosted fleet
-    # saturation (this is the pool the prior reusable already used for
-    # pull_request events).
+    # A merged PR from a fork remains on GitHub-hosted compute. Releases from
+    # this repository use the trusted CI selector.
     runs-on: >-
-      ${{ fromJSON(vars.OMNI_PUBLIC_PR_RUNS_ON_JSON || '["ubuntu-latest"]') }}
+      ${{
+        (github.event_name == 'pull_request' &&
+         github.event.pull_request.head.repo.full_name != github.repository)
+        && fromJSON(vars.OMNI_PUBLIC_PR_RUNS_ON_JSON || '["ubuntu-latest"]')
+        || fromJSON(vars.OMNI_TRUSTED_CI_RUNS_ON_JSON || '["self-hosted","omnibase-ci"]')
+      }}
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:

.github/workflows/baselines-scheduler.yml

@@ -47,7 +47,7 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: ${{ env.PYTHON_VERSION }}
 

.github/workflows/build-and-push-migrate-image.yml

@@ -54,7 +54,7 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Set up Python for AWS CLI
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: "3.12"
 

.github/workflows/build-and-push-runtime.yml

@@ -103,7 +103,7 @@ jobs:
           fi
 
       - name: Set up Python for AWS CLI
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: ${{ env.PYTHON_VERSION }}
 
@@ -192,6 +192,26 @@ jobs:
           severity: 'CRITICAL,HIGH'
           version: 'v0.69.3'
 
+      # OMN-15676: prove the required config files are actually IN the image
+      # before it can be pushed. Three incidents (grants fixture, routing_tiers,
+      # runner_fleet) shipped images whose repo tree was perfectly correct and
+      # whose runtime boot-crashed on a missing /app/config file. The registry
+      # this reads is src/omnibase_infra/runtime/required_image_config_paths.py;
+      # it runs `test -f` INSIDE the built image, not against the checkout, and
+      # fails closed on a probe that cannot run.
+      - name: Assert required config paths exist in the built image (OMN-15676)
+        run: |
+          set -euo pipefail
+          # OMN-15860: this step's python3 is the bare interpreter set up by
+          # "Setup Python for AWS CLI" above -- no uv/dependency-install
+          # infrastructure exists anywhere else in this job. required_image_config_paths.py
+          # (imported by the script below) imports pydantic; without this install
+          # every run since OMN-15676 added that import has crashed here with
+          # ModuleNotFoundError, before the image is ever pushed to ECR.
+          python3 -m pip install --quiet "pydantic>=2.11.7,<3.0.0"
+          python3 scripts/ci/assert_image_config_paths.py \
+            --image "${{ steps.meta.outputs.image_repo }}:${{ github.sha }}"
+
       - name: Push image to Amazon ECR
         if: success()
         shell: bash

.github/workflows/build-workspace-candidate-runtime.yml

@@ -59,9 +59,10 @@ jobs:
     permissions:
       id-token: write
       contents: read
-    # OMNI_RUNNER_SELECTOR_V1 — trusted Docker job on self-hosted omnibase-ci.
-    runs-on: >-
-      ${{ fromJSON(vars.OMNI_TRUSTED_CI_RUNS_ON_JSON || '["self-hosted","omnibase-ci"]') }}
+    # OMN-14974: use clean cloud egress for ECR. The .201 self-hosted Docker
+    # daemon is a proven-unreliable push lane (the clean-main runtime workflow
+    # moved off it in OMN-13747 for the same EOF/stalled-upload failure mode).
+    runs-on: ubuntu-latest
     timeout-minutes: 75
 
     outputs:
@@ -89,7 +90,7 @@ jobs:
           driver: docker
 
       - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ env.PYTHON_VERSION }}
 
@@ -147,7 +148,7 @@ jobs:
           cat workspace/sibling-vcs-provenance.json
 
       - name: Set up Python for AWS CLI
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ env.PYTHON_VERSION }}
 
@@ -287,6 +288,18 @@ jobs:
           [ "$PC" = "stability-candidate" ] || { echo "::error::promotion_class label must be stability-candidate"; exit 1; }
           [ "$NL" = "true" ] || { echo "::error::non_main_lineage label must be true"; exit 1; }
 
+      # OMN-15676: prove the required config files are actually IN the candidate
+      # image before it can be pushed and pinned. The onex-dev runtime digest is
+      # pinned from exactly this workflow's output (e.g. omninode_infra#802), so
+      # this is the step that stops a missing COPY from reaching the cluster.
+      # Reads src/omnibase_infra/runtime/required_image_config_paths.py and runs
+      # `test -f` INSIDE the built image; fails closed if the probe cannot run.
+      - name: Assert required config paths exist in the built image (OMN-15676)
+        run: |
+          set -euo pipefail
+          python3 scripts/ci/assert_image_config_paths.py \
+            --image "${{ steps.meta.outputs.image_repo }}:${{ steps.meta.outputs.candidate_tag }}"
+
       - name: Push candidate image to Amazon ECR
         if: success()
         shell: bash

.github/workflows/call-occ-companion-effect.yml

@@ -55,12 +55,15 @@
 # OMN-14941 PR merges (the SHA does not exist yet), so `@dev` is the only
 # viable resolvable pin today.
 #
-# SEQUENCING: this pin resolves only AFTER the omniclaude OMN-14941 PR (adding
-# call-occ-companion-effect-reusable.yml) merges to omniclaude dev. Until
-# then, this workflow fails at parse ("workflow was not found") and the
-# tests/ci/test_workflow_uses_refs_resolve.py gate is RED on this repo —
-# merge the omniclaude PR first. That gate enforces the ordering
-# mechanically instead of by convention.
+# SEQUENCING (SATISFIED — OMN-15248): this pin resolved only AFTER the
+# omniclaude OMN-14941 PR (adding call-occ-companion-effect-reusable.yml)
+# merged to omniclaude dev. That merge has happened — verified 2026-07-27:
+# `gh api repos/OmniNode-ai/omniclaude/contents/.github/workflows/call-occ-companion-effect-reusable.yml?ref=dev`
+# -> 200, blob c540d981 (autobind sibling -> 5f8f64e4). The resolution gate
+# (tests/integration/ci/test_workflow_uses_refs_resolve_live.py, live half;
+# tests/ci/test_workflow_uses_refs_resolve.py, static half) is therefore
+# expected GREEN. A red there now means a pin genuinely broke — re-pin it;
+# there is no standing red-authorization for this workflow.
 #
 # RE-PIN FOLLOW-UP (OMN-14812-style): once the reusable promotes to omniclaude
 # main, re-pin this `uses:` to `@main` or a main SHA so the caller no longer

.github/workflows/call-reject-skip.yml

@@ -30,5 +30,5 @@ permissions:
 
 jobs:
   call-reject-skip-token:
-    uses: OmniNode-ai/omniclaude/.github/workflows/reject-deploy-gate-skip.yml@ff230264ac3300d7ced43564dc921f44558110fe
+    uses: OmniNode-ai/omniclaude/.github/workflows/reject-deploy-gate-skip.yml@80de61fd1fee04abdeb6918e7f91cf820717e6a8
     secrets: inherit

.github/workflows/canonical-inference-gate.yml

@@ -53,12 +53,8 @@ jobs:
     # OMNI_RUNNER_SELECTOR_V1 - trusted CI defaults to self-hosted omnibase-ci; public forks default to ubuntu-latest.
     runs-on: >-
       ${{
-        (github.event_name == 'pull_request' && github.base_ref == 'dev')
-        && fromJSON(vars.OMNI_PUBLIC_PR_RUNS_ON_JSON || '["ubuntu-latest"]')
-        || (
         (github.event_name == 'pull_request' &&
          github.event.pull_request.head.repo.full_name != github.repository)
-        )
         && fromJSON(vars.OMNI_PUBLIC_PR_RUNS_ON_JSON || '["ubuntu-latest"]')
         || fromJSON(vars.OMNI_TRUSTED_CI_RUNS_ON_JSON || '["self-hosted","omnibase-ci"]')
       }}

.github/workflows/check-env-reads-gate.yml

@@ -47,9 +47,8 @@ jobs:
     # OMNI_RUNNER_SELECTOR_V1 - trusted CI defaults to self-hosted omnibase-ci; public forks default to ubuntu-latest.
     runs-on: >-
       ${{
-        ((github.event_name == 'pull_request' && github.base_ref == 'dev') ||
-         (github.event_name == 'pull_request' &&
-          github.event.pull_request.head.repo.full_name != github.repository))
+        (github.event_name == 'pull_request' &&
+         github.event.pull_request.head.repo.full_name != github.repository)
         && fromJSON(vars.OMNI_PUBLIC_PR_RUNS_ON_JSON || '["ubuntu-latest"]')
         || fromJSON(vars.OMNI_TRUSTED_CI_RUNS_ON_JSON || '["self-hosted","omnibase-ci"]')
       }}

.github/workflows/check-handshake.yml

@@ -19,9 +19,8 @@ jobs:
     # OMNI_RUNNER_SELECTOR_V1 — trusted CI defaults to self-hosted omnibase-ci; public forks default to ubuntu-latest
     runs-on: >-
       ${{
-        ((github.event_name == 'pull_request' && github.base_ref == 'dev') ||
-         (github.event_name == 'pull_request' &&
-          github.event.pull_request.head.repo.full_name != github.repository))
+        (github.event_name == 'pull_request' &&
+         github.event.pull_request.head.repo.full_name != github.repository)
         && fromJSON(vars.OMNI_PUBLIC_PR_RUNS_ON_JSON || '["ubuntu-latest"]')
         || fromJSON(vars.OMNI_TRUSTED_CI_RUNS_ON_JSON || '["self-hosted","omnibase-ci"]')
       }}