fix(compliance): track per-workflow version tags in stub checker

scripts/compliance-audit.sh

@@ -677,17 +677,20 @@ check_ci_concurrency() {
 }
 
 # ---------------------------------------------------------------------------
-# Check: Tier 1 centralized workflows must be thin caller stubs pinned to @v1
+# Check: Tier 1 centralized workflows must be thin caller stubs pinned to the
+# canonical version tag for their reusable.
 #
 # For each workflow that the org has centralized into a reusable workflow,
 # verify the downstream repo's copy is a stub that delegates via:
-#   uses: petry-projects/.github/.github/workflows/<reusable>.yml@v1
+#   uses: petry-projects/.github/.github/workflows/<reusable>.yml@<version>
 #
 # This prevents drift: a repo that copies the inline pre-centralization
-# version (or pins to @main, or pins to an older tag) is flagged so it
-# can be re-synced from the standard. The central .github repo itself is
+# version (or pins to @main, or pins to a non-canonical tag) is flagged so
+# it can be re-synced from the standard. The central .github repo itself is
 # exempt because it owns the reusables and may legitimately reference
 # its own workflows by @main during release prep.
+#
+# Array format: "workflow-filename:expected-reusable-basename:version-tag"
 # ---------------------------------------------------------------------------
 check_centralized_workflow_stubs() {
   local repo="$1"
@@ -696,16 +699,16 @@ check_centralized_workflow_stubs() {
   # own reusables by @main; skip the stub check for it.
   [ "$repo" = ".github" ] && return
 
-  # workflow-filename:expected-reusable-basename
+  # workflow-filename:expected-reusable-basename:version-tag
   local centralized=(
-    "dev-lead.yml:dev-lead-reusable"
-    "auto-rebase.yml:auto-rebase-reusable"
-    "dependency-audit.yml:dependency-audit-reusable"
-    "dependabot-automerge.yml:dependabot-automerge-reusable"
-    "dependabot-rebase.yml:dependabot-rebase-reusable"
-    "agent-shield.yml:agent-shield-reusable"
-    "feature-ideation.yml:feature-ideation-reusable"
-    "pr-review-mention.yml:pr-review-mention-reusable"
+    "dev-lead.yml:dev-lead-reusable:v1"
+    "auto-rebase.yml:auto-rebase-reusable:v1"
+    "dependency-audit.yml:dependency-audit-reusable:v1"
+    "dependabot-automerge.yml:dependabot-automerge-reusable:v1"
+    "dependabot-rebase.yml:dependabot-rebase-reusable:v1"
+    "agent-shield.yml:agent-shield-reusable:v1"
+    "feature-ideation.yml:feature-ideation-reusable:v1"
+    "pr-review-mention.yml:pr-review-mention-reusable:v2"
   )
 
   # List the repo's workflow directory once instead of probing each file.
@@ -714,9 +717,9 @@ check_centralized_workflow_stubs() {
   workflow_list=$(gh_api "repos/$ORG/$repo/contents/.github/workflows" --jq '.[].name' 2>/dev/null || echo "")
   [ -z "$workflow_list" ] && return
 
-  local entry wf reusable
+  local entry wf reusable version
   for entry in "${centralized[@]}"; do
-    IFS=':' read -r wf reusable <<< "$entry"
+    IFS=':' read -r wf reusable version <<< "$entry"
 
     # Skip workflows that don't exist in this repo. Required workflows are
     # checked separately by check_required_workflows; conditional ones
@@ -734,27 +737,27 @@ check_centralized_workflow_stubs() {
     [ -z "$decoded" ] && continue
 
     # Required pattern: a non-comment line whose `uses:` value is exactly
-    # petry-projects/.github/.github/workflows/<reusable>.yml@v1
+    # petry-projects/.github/.github/workflows/<reusable>.yml@<version>
     # Anchor to start-of-line + optional indent so a `# uses: ...` comment
     # cannot satisfy the check.
-    local expected="petry-projects/\\.github/\\.github/workflows/${reusable}\\.yml@v1"
+    local expected="petry-projects/\\.github/\\.github/workflows/${reusable}\\.yml@${version}"
 
     if echo "$decoded" | grep -qE "^[[:space:]]*uses:[[:space:]]*${expected}([[:space:]]|$)"; then
-      continue  # stub is correctly pinned to @v1 — compliant
+      continue  # stub is correctly pinned to the canonical version — compliant
     fi
 
     # Determine why it's non-compliant for a more actionable message.
     local why
     if echo "$decoded" | grep -qE "^[[:space:]]*uses:[[:space:]]*petry-projects/\\.github/\\.github/workflows/${reusable}\\.yml@"; then
-      why="references the reusable but is not pinned to \`@v1\` (org standard)"
+      why="references the reusable but is not pinned to \`@${version}\` (org standard)"
     elif echo "$decoded" | grep -qF "petry-projects/.github/.github/workflows/${reusable}"; then
       why="references the reusable but the \`uses:\` line does not match the canonical stub"
     else
       why="is an inline copy instead of a thin caller stub — re-sync from \`standards/workflows/${wf}\`"
     fi
 
     add_finding "$repo" "ci-workflows" "non-stub-$wf" "error" \
-      "Centralized workflow \`$wf\` $why. Replace with the canonical stub from \`standards/workflows/${wf}\` which delegates to \`petry-projects/.github/.github/workflows/${reusable}.yml@v1\`." \
+      "Centralized workflow \`$wf\` $why. Replace with the canonical stub from \`standards/workflows/${wf}\` which delegates to \`petry-projects/.github/.github/workflows/${reusable}.yml@${version}\`." \
       "standards/ci-standards.md#centralization-tiers"
   done
 }

standards/ci-standards.md

@@ -556,7 +556,7 @@ present as an org-level secret; no per-repo setup needed.
 
 **Compliance:** The compliance audit (`check_centralized_workflow_stubs`) verifies that
 repos have `pr-review-mention.yml` as a thin caller stub delegating to
-`petry-projects/.github/.github/workflows/pr-review-mention-reusable.yml@v1`.
+`petry-projects/.github/.github/workflows/pr-review-mention-reusable.yml@v2`.
 
 ---