Repository navigation

feat(ci): CI Rewrite 1.2 with one engine, one SOT and five thin workflows - #544

Draft

djdomi wants to merge 230 commits into

current_devfrom

dev/ci-rewrite-1.2

Draft

feat(ci): CI Rewrite 1.2 with one engine, one SOT and five thin workflows#544
djdomi wants to merge 230 commits into
current_devfrom
dev/ci-rewrite-1.2

Commits on Sep 23, 2026
- feat(ci): add CI 2.0 engine skeleton, SOT manifest, and impact phase
  djdomi
  committed
  ff83f43
- feat(ci): add line-endings and full-SHA governance guards
  djdomi
  committed
  b1aec7c
- feat(ci): add dependabot<->SOT consistency guard
  djdomi
  committed
  2cd640e
- feat(ci): add orchestrator-only (AG-CI-023) guard
  djdomi
  committed
  dc599e9
- feat(ci): add build phase (all 5 configure variants)
  djdomi
  committed
  0856058
- feat(ci): add test phase (comfychair parse + per-variant make check)
  djdomi
  committed
  747949f
- feat(ci): add plan/matrix outputs and ci-engine selftest phase
  djdomi
  committed
  8224493
- feat(ci): add validate.yml running the engine self-test
  djdomi
  committed
  50e02ea
- fix(ci): orchestrator guard must match the - run: list-item form
  djdomi
  committed
  1ce9184
- feat(ci): carry per-variant apt/brew in the SOT and build matrix
  djdomi
  committed
  cc997b3
- feat(ci): add plan and build/test matrix jobs to validate.yml
  djdomi
  committed
  d901f24
- fix(ci): plan accepts an empty base; matrix self-test matches new format
  djdomi
  committed
  4bbea66
- fix(ci): the autogroup privilege single-test is Linux-only
  djdomi
  committed
  02e92a9
- fix(ci): silence intentional word-split SC2086 in validate.yml brew step
  djdomi
  committed
  591f48d
- feat(ci): add e2e phase and validate.yml e2e job
  djdomi
  committed
  432edbe
- feat(ci): add metadata phase with PR-title convention check
  djdomi
  committed
  fab8398
- feat(ci): complete metadata phase (tracking + changelog gate)
  djdomi
  committed
  e644ca2
- feat(ci): add package phase and release version-check guardrail
  djdomi
  committed
  60b676b
- feat(ci): add security.yml cutover-draft (codeql/osv/scorecard/fuzz)
  djdomi
  committed
  4ceb5a3
- feat(ci): add nightly.yml cutover-draft + container/publish phases
  djdomi
  committed
  240b5a4
- feat(ci): add gc phase (ghcr-cleanup fold) + housekeeping.yml draft
  djdomi
  committed
  edc971c
- feat(ci): add release.yml cutover-draft + multi-arch container/publish
  djdomi
  committed
  2d94b04
- ci(verify): centralize Redis+Samba pins in the SOT, fold the verify twin
  
  djdomi
  and
  claude
  committed
  349c966
- refactor(ci): drop legacy ghcr-cleanup, reproduced by ci.sh gc
  
  djdomi
  and
  claude
  committed
  a37afc2
- fix(ci): restore the redis --memory=2g cap in the ccache-redis verify
  
  djdomi
  and
  claude
  committed
  2786041
- ci(ci): add SOT ccache heartbeat tag and e2e heartbeat/control modes
  
  djdomi
  and
  claude
  committed
  5eac81f
- ci(ci): fold nightly-status report.sh into ci.sh report
  
  djdomi
  and
  claude
  committed
  b100efd
- ci(ci): complete housekeeping.yml (gc + heartbeat), drop master-heartbeat
  
  djdomi
  and
  claude
  committed
  b4df410
- ci(ci): fold failed-jobs filter into ci.sh, bound the full e2e in ci.sh
  
  djdomi
  and
  claude
  committed
  61374d5
- test(ci): consolidate the three resolve tests into one
  
  djdomi
  and
  claude
  committed
  4356945
- refactor(ci): centralize GHCR package list and e2e tuning in the SOT
  
  djdomi
  and
  claude
  committed
  63dafe0
- refactor(ci): dedup verify image build-args, one owner for its local tag
  
  djdomi
  and
  claude
  committed
  e781829
- refactor(ci): move project-board config to GitHub Variables
  
  djdomi
  and
  claude
  committed
  bfeff4b
- ci(ci): fold OpenSSF baseline recheck into ci.sh scan, drop legacy
  
  djdomi
  and
  claude
  committed
  780ec92
- ci(ci): complete nightly.yml with a report job, gate the full e2e
  
  djdomi
  and
  claude
  committed
  17b052e
- refactor(ci): fold add-to-project PAT gate into ci.sh variables
  
  djdomi
  and
  claude
  committed
  8223431
- chore(ci): sync codeql + osv-scanner pins after dependabot bump (#552/#553)
  
  djdomi
  and
  claude
  committed
  94b9934
- feat(ci): action runner + SOT-only action pin guard
  
  djdomi
  and
  claude
  committed
  6c54b95
- wip(ci): action-pin centralization checkpoint before current_dev rebase
  
  djdomi
  and
  claude
  committed
  0d1f326
- feat(ci): zero-SHA-outside-SOT via native CLI tools, absorb+delete 7 legacy workflows
  
  djdomi
  and
  claude
  committed
  2f6fdd0
- feat(ci): replace action_pins with per-tool external_versions in SOT
  
  djdomi
  and
  claude
  committed
  39d077c
- feat(ci): absorb add-to-project.yml + labeler.yml into validate.yml's variables job
  
  djdomi
  and
  claude
  committed
  b1a930d
- feat(ci): absorb actionlint.yml into validate.yml's lint job
  
  djdomi
  and
  claude
  committed
  124abe3
- feat(ci): absorb e2e-image-build, changelog-update-on-release, release-drafter
  
  djdomi
  and
  claude
  committed
  3d91aa4
- fix(ci): actually commit the e2e-image/changelog/draft-release code
  
  djdomi
  and
  claude
  committed
  ab2ce62
- fix(ci): restore Trivy/SBOM/attestation lost when package-release.yml was deleted
  
  djdomi
  and
  claude
  committed
  c30de50
- fix(ci): guard the ci_main direct-execution check against nounset
  
  djdomi
  and
  claude
  committed
  3fd9c7b
- fix(ci): make OSV-Scanner treat this repo's lack of lockfiles as OK
  
  djdomi
  and
  claude
  committed
  f498804
- fix(ci): e2e-image PR ref, draft-release permission, changelog re-run
  
  djdomi
  and
  claude
  committed
  196e311
- fix(ci): exempt checkout bootstrap from the orchestrator guard, fix real hits
  
  djdomi
  and
  claude
  committed
  639b750
- fix(ci): drop invalid sarif-upload category param, fix ClusterFuzzLite platform
  
  djdomi
  and
  claude
  committed
  f678835
- fix(ci): set WORKSPACE/REPOSITORY for ClusterFuzzLite standalone mode
  
  djdomi
  and
  claude
  committed
  6d04bdd
- refactor(ci): delete install-*-deps wrappers, revoke attest-build-provenance
  
  djdomi
  and
  claude
  committed
  333e253
- fix(ci): move two more hardcoded apt lists out of workflow YAML into the SOT
  
  djdomi
  and
  claude
  committed
  dc63d05
- fix(ci): restore verify self-trigger and popt-fallback smoke test
  
  djdomi
  and
  claude
  committed
  8001b7c
- fix(ci): restore coverage and control-build job-summary reporting
  
  djdomi
  and
  claude
  committed
  0185bee
- fix(ci): restore OpenSSF baseline recheck's monthly cron
  
  djdomi
  and
  claude
  committed
  efe860d
- fix(ci): wire the sanitizer build variant into nightly, was unreachable
  
  djdomi
  and
  claude
  committed
  ec1231e
- fix(ci): re-label/re-board a PR on reopen or ready_for_review too
  
  djdomi
  and
  claude
  committed
  203b857
- fix(ci): fix a real regression I introduced -- ci_cmd_build always failed for non-popt-fallback variants
  
  djdomi
  and
  claude
  committed
  b89a099
- fix(ci): restore popt vendor-tree CVE-fingerprint checks
  
  djdomi
  and
  claude
  committed
  38f478b
- fix(ci): restore ClusterFuzzLite's PR path-filter, was running on every PR
  
  djdomi
  and
  claude
  committed
  eae8bd1
- fix(ci): restore manual retry paths for changelog insert + draft release
  
  djdomi
  and
  claude
  committed
  85aa388
- fix(ci): implement real Scorecard JSON->SARIF conversion, resolving the open question
  
  djdomi
  and
  claude
  committed
  d02cf24
Commits on Sep 24, 2026
- fix(ci): scorecard job never had a GitHub token, hung 6h on rate limits
  
  djdomi
  and
  claude
  committed
  3cc4a88
- docs(ci): fix CONTRIBUTING.md's stale repo-layout and rule reference
  
  djdomi
  and
  claude
  committed
  661a3b8
- docs(ci): fix SECURITY.md's stale workflow refs and false attestation claim
  
  djdomi
  and
  claude
  committed
  68c507e
- docs(ci): fix doc/docker.md's stale workflow refs, restore buildtools manual republish
  
  djdomi
  and
  claude
  committed
  93fee28
- fix(ci): pin the release tag to the built commit, not the default branch
  
  djdomi
  and
  claude
  committed
  f4ac5f4
- docs(ci): full rewrite of doc/ci-workflows.md for the 5-workflow architecture
  
  djdomi
  and
  claude
  committed
  7757fb1
- docs(ci): fix dangling workflow-name references across test/e2e*/
  
  djdomi
  and
  claude
  committed
  678f8cf
- docs(ci): fix dangling workflow refs in fs-jail-security-checklist.md, compatibility-policy.md
  
  djdomi
  and
  claude
  committed
  6bb124f
- docs(ci): fix dangling workflow refs in composite-action descriptions, labeler.yml
  
  djdomi
  and
  claude
  committed
  39073d7
- docs(ci): fix stale present-tense CI-timeout claim in support-upstream doc
  
  djdomi
  and
  claude
  committed
  7465bcc
- fix(ci): enforce AG-GH-002 project-board sub-check, close AG-GH-013 gap
  
  djdomi
  and
  claude
  committed
  eeb1b83
- fix(ci): authenticate the two raw git pushes and the release publish
  
  djdomi
  and
  claude
  committed
  dbf55bd
- fix(ci): board check page-limit bug, AG-CODE-001 comment fixes
  
  djdomi
  and
  claude
  committed
  35f1d39
- feat(ci): add a stable required-check gate for validate.yml
  
  djdomi
  and
  claude
  committed
  755316f
- fix(ci): gate label-event hole, restore draft leniency, SOT board defaults
  
  djdomi
  and
  claude
  committed
  de03c58
- feat(docker): complete OCI provenance labels on release images
  
  djdomi
  and
  claude
  committed
  8c065e2
- fix(ci): push the changelog update with the PAT, not github.token
  
  djdomi
  and
  claude
  committed
  4878f97
- refactor(ci): absorb run-e2e.sh's orchestration logic into ci.sh
  
  djdomi
  and
  claude
  committed
  eb05a16
- refactor(ci): absorb run-bidirectional-e2e.sh into ci.sh
  
  djdomi
  and
  claude
  committed
  d19ef16
- delete: remove the two absorbed e2e orchestrator scripts
  
  djdomi
  and
  claude
  committed
  826f9c2
- feat(ci): restore the tag-push release trigger (POL-RELEASE-05/07)
  
  djdomi
  and
  claude
  committed
  635980f
- fix(ci): restore validate.yml's concurrency group
  
  djdomi
  and
  claude
  committed
  5ca18b0
Commits on Sep 30, 2026
- refactor(ci): own the GHCR login in ci.sh, delete ghcr-login action
  
  djdomi
  and
  claude
  committed
  ac44b3a
- refactor(ci): run Harden Runner from ci.sh, delete the last composite action
  
  djdomi
  and
  claude
  committed
  eee035f
- refactor(ci): make the SOT the only owner of the project board identity
  
  djdomi
  and
  claude
  committed
  11c7604
- refactor(ci): rewrite GHCR gc from its invariants; SOT reads fail closed
  
  djdomi
  and
  claude
  committed
  c97f8d2
- refactor(ci): one e2e harness in ci.sh; delete the e2e/e2e-full duplicate
  
  djdomi
  and
  claude
  committed
  c339651
Commits on Oct 1, 2026
- refactor(ci): one owner per execution capability; SOT is the sole pin owner
  
  djdomi
  and
  claude
  committed
  3bdc781
- Merge current_dev into dev/ci-rewrite-1.2
  
  djdomi
  and
  claude
  committed
  0ff7796
- refactor(ci): one owner for building the tree; every make is gated
  
  djdomi
  and
  claude
  committed
  c443cce
- fix(packaging): rpm.spec comments no longer expand a second setup
  
  djdomi
  and
  claude
  committed
  655908b
- feat(ci): ci.sh owns every SOT pin update; tools always sha256-checked
  
  djdomi
  and
  claude
  committed
  2a774a5
- docs(ci): sot-update dispatch needs the workflows on master
  
  djdomi
  and
  claude
  committed
  ee32107
- fix(ci): remove fail-open masking from guards, checks and publish
  
  djdomi
  and
  claude
  committed
  797e359
- refactor(ci): one owner each for dry-run, board add and release assets
  
  djdomi
  and
  claude
  committed
  55daf2a
- fix(ci): OSV scans the SOT tools again and gates PRs on new vulns
  
  djdomi
  and
  claude
  committed
  f5b126e
- feat(ci): restore build-provenance attestation in ci.sh via cosign
  
  djdomi
  and
  claude
  committed
  5f7c34a
- fix(ci): OSV gate NotRun on a base without SOT; log attestation proof
  
  djdomi
  and
  claude
  committed
  c1d9a02
- chore(deps): refresh every SOT pin to its newest release
  
  djdomi
  and
  claude
  committed
  3478929
- fix(ci): send the SARIF upload body as a file, not an argument
  
  djdomi
  and
  claude
  committed
  68fd599
- fix(ci): every impact phase gates a real job; SOT changes test all
  
  djdomi
  and
  claude
  committed
  04c1a52
- refactor(ci): fuzz build logic moves from build.sh into ci.sh
  
  djdomi
  and
  claude
  committed
  a7ebd74
- fix(ci): one download owner; a failed fetch names its URL
  
  djdomi
  and
  claude
  committed
  1c18aab
- feat(ci): compile cache and report artifacts via transport-only actions
  
  djdomi
  and
  claude
  committed
  f1dea69
- fix(ci): retry downloads without curl --retry-all-errors
  
  djdomi
  and
  claude
  committed
  0ba323e
- refactor(ci): ci.sh owns release identity and image names
  
  djdomi
  and
  claude
  committed
  6d5bb78
- refactor(ci): plan is the one content-run filter in validate
  
  djdomi
  and
  claude
  committed
  dcbd4d2
- refactor(ci): ci.sh reads event and runner values itself
  
  djdomi
  and
  claude
  committed
  0202a94
- refactor(ci): the nightly tag is SOT data
  
  djdomi
  and
  claude
  committed
  69ab65c
- fix(ci): no metadata-event runs, concurrency split by event
  
  djdomi
  and
  claude
  committed
  f046f5a
- feat(ci): comment-format guard; PR path labels are SOT data
  
  djdomi
  and
  claude
  committed
  ed87de8
- fix(ci): release packages are an artifact again; checklist refs
  
  djdomi
  and
  claude
  committed
  3376e30
- refactor(ci): the release container inventory is SOT data
  
  djdomi
  and
  claude
  committed
  f5cf0e0
- refactor(ci): the verify container starts once for all checks
  
  djdomi
  and
  claude
  committed
  66a9f8a
- fix(ci): shellcheck every CI-owned shell file
  
  djdomi
  and
  claude
  committed
  e3ed2e3
- fix(ci): ClusterFuzzLite installs autoconf instead of compiling it
  
  djdomi
  and
  claude
  committed
  fc3812e
- fix(ci): apt retry finishes a dpkg run the timeout cut off
  
  djdomi
  and
  claude
  committed
  e822f0a
- fix(ci): SARIF upload names its failure, retries transient ones
  
  djdomi
  and
  claude
  committed
  cd2af70
- refactor(ci): ci.sh routes scheduled jobs; crons are SOT data
  
  djdomi
  and
  claude
  committed
  b072143
- refactor(ci): CodeQL and ClusterFuzzLite settings are SOT data
  
  djdomi
  and
  claude
  committed
  115bdb9
- fix(ci): a failed housekeeping route is reported, not silent
  
  djdomi
  and
  claude
  committed
  6239cca
- docs(ci): ci-workflows.md matches the current workflows
  
  djdomi
  and
  claude
  committed
  e7eed34
- fix(ci): the changelog PAT reaches only a run that inserts notes
  
  djdomi
  and
  claude
  committed
  e48676b
- fix(ci): OpenSSF recheck reports tool failures, not NotMet
  
  djdomi
  and
  claude
  committed
  68f1def
- fix(ci): gh lookups fail closed; draft release nameref bug
  
  djdomi
  and
  claude
  committed
  ce474fd
- docs(ci): harden-runner arm64 NotRun is a tier limit
  
  djdomi
  and
  claude
  committed
  dcc2313
- refactor(ci): route alone decides whether security scans run
  
  djdomi
  and
  claude
  committed
  b17cb5f
- refactor(ci): one owner for the protected-ref publish policy
  
  djdomi
  and
  claude
  committed
  d770ff1
- refactor(ci): plan classifies its diff through ci.sh impact
  
  djdomi
  and
  claude
  committed
  9b62736
- docs(ci): distcc-ng-e2e is still pushed by master's old workflows
  
  djdomi
  and
  claude
  committed
  0898c41
- refactor(ci): the PR title checker reads AG-GH-014 from AGENTS.md
  
  djdomi
  and
  claude
  committed
  e7d7853
- fix(ci): restore legacy job timeouts; drop stale legacy references
  
  djdomi
  and
  claude
  committed
  7589a03
- fix(ci): a failed control build fails its job again
  
  djdomi
  and
  claude
  committed
  d5422b7
- fix(ci): failed lookups inside arguments and tests fail closed
  
  djdomi
  and
  claude
  committed
  dd4a8a9
- fix(ci): array reads keep their command's exit status
  
  djdomi
  and
  claude
  committed
  184179d
- fix(ci): the last two awk loops keep their exit status
  
  djdomi
  and
  claude
  committed
  051c324
- docs: stable rule IDs in the files this PR touches
  
  djdomi
  and
  claude
  committed
  7a85689
- fix(packaging): rpm.spec commented directives no longer expand
  
  djdomi
  and
  claude
  committed
  97710ef
- docs(support-upstream): rpm.spec comment macros are live upstream
  
  djdomi
  and
  claude
  committed
  8783920
- test(ci): every ci.bats stub carries its own What/Why comment
  
  djdomi
  and
  claude
  committed
  de9f239
- docs(changelog): record CI Rewrite 1.2 and the rpm.spec fixes
  
  djdomi
  and
  claude
  committed
  2d84a3d
- fix(packaging): clear three rpmbuild warnings of the package job
  
  djdomi
  and
  claude
  committed
  00335ea
- docs(support-upstream): one rpm.spec build-warnings entry
  
  djdomi
  and
  claude
  committed
  16f32a5
Commits on Oct 2, 2026
- test: testdistcc.py comments in AG-CODE-001 form; no c-build.yml
  
  djdomi
  and
  claude
  committed
  0f198d1
- docs(governance): AG-GH-002 and AG-GH-014 name the current owners
  
  djdomi
  and
  claude
  committed
  8040030
- docs(compat): record the accepted unversioned-Obsoletes warning
  
  djdomi
  and
  claude
  committed
  50f724a
- refactor(ci): one owner per duplicated ci.sh mechanism
  
  djdomi
  and
  claude
  committed
  d6f5d2f
- fix(ci): ban ShellCheck suppressions; no exit-code reinterpretation
  
  djdomi
  and
  claude
  committed
  680b203
- docs(packaging): drop the Alpine initd ShellCheck suppressions
  
  djdomi
  and
  claude
  committed
  7d37820
- fix(ci): close the remaining audit findings in ci.sh
  
  djdomi
  and
  claude
  committed
  036bd3f
- test(ci): prove dispatch and phase wiring by behaviour
  
  djdomi
  and
  claude
  committed
  c311ae4
- fix(ci): check every command result set -e cannot
  
  djdomi
  and
  claude
  committed
  18f792c
- docs(ci): record AG-INT-006 and the author-neutral metadata checks
  
  djdomi
  and
  claude
  committed
  cdfadd7
- test(ci): one helper per repeated ci.bats fixture or stub
  
  djdomi
  and
  claude
  committed
  18a1cb2
- refactor(ci): one Debian base pin in the SOT
  
  djdomi
  and
  claude
  committed
  d0c4c16
- test(ci): _pass, so every ci.bats stub has a commented owner
  
  djdomi
  and
  claude
  committed
  ebf88c0
- docs(checklist): add VER-CI for CI engine and guard changes
  
  djdomi
  and
  claude
  committed
  60b0f95
- fix(ci): check every command substitution and file write
  djdomi
  committed
  4527c34
- test(ci): every ci.bats test and stub carries its own What/Why
  djdomi
  committed
  6b8f8b5
- docs(ci): ci.sh comments state reasons, not history
  djdomi
  committed
  ad16121
- Merge current_dev into dev/ci-rewrite-1.2
  djdomi
  committed
  2633c0b
- fix(ci): the SOT writer replaces the manifest by rename
  djdomi
  committed
  78f3209
- fix(ci): guards that find nothing to check fail closed
  djdomi
  committed
  bf2f855
- test(ci): wiring, dispatch and error-id checks prove their red path
  djdomi
  committed
  e2f1c85
- test(ci): four ci.bats Why lines no longer copy ci.sh
  djdomi
  committed
  3140c70
- fix(ci): a build attestation without id-token fails off fork PRs
  djdomi
  committed
  de1427f
- fix(ci): every image build full-upgrades its base first
  djdomi
  committed
  143db11
- fix(ci): ci.sh writes the CFL entry, every job is bounded, fetch fails closed
  djdomi
  committed
  7f5e2a3
- fix(ci): actionlint is a pinned SOT tool; drop the unreachable fork branch
  djdomi
  committed
  643b8ec
Commits on Oct 7, 2026
Commits on Oct 8, 2026

Commits

Commits on Sep 23, 2026

Commits on Sep 24, 2026

Commits on Sep 30, 2026

Commits on Oct 1, 2026