From 9556210b762d4b75c54a08f68a822212202aed0c Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 14 Oct 2026 13:30:35 +0000 Subject: [PATCH] CI: pin the estate audit to cicd-suite 376898b The estate audit was called at cicd-suite@main, so any change there ran here on the next push, unreviewed. cicd-suite #50 (merged 2026-10-14) makes the pinned thin caller the estate's way of consuming the audit: its README says to pin a full SHA, never @main, and this file is now its templates/estate-audit-caller.yml with the SHA filled in. The pin is 376898b, cicd-suite main and the #50 merge. It runs the same 24 gates as 4f54042, which every run here used until today: both pin the gate composites at 1aa6bfb, and actions/ is identical between the two. The difference is shape. The audit now reports five checks (governance, hygiene, manifests, languages, advisory), and a failing gate no longer hides the gates after it. None of these checks is required by a ruleset here, so the renamed checks need no ruleset change. The caller grants contents: read, the only permission the called workflow declares. actions.lock keeps the file as [], as for secret-scanner.yml: a cross-repository reusable call recorded in the lock fails at startup. actionlint is clean, the documentation guard and the 27 tests pass, and the 25 locally runnable gates at 1aa6bfb pass on this tree (manifest needs external validators). This PR's own run of the audit is the check on the new pin. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01MF5GeeBBDF6sUzr6pZTjWV --- .github/workflows/main-estate-audit.yml | 25 ++++++++++++++++++++----- 1 file changed, 20 insertions(+), 5 deletions(-) diff --git a/.github/workflows/main-estate-audit.yml b/.github/workflows/main-estate-audit.yml index 110a71b..041c21e 100644 --- a/.github/workflows/main-estate-audit.yml +++ b/.github/workflows/main-estate-audit.yml @@ -1,15 +1,30 @@ # SPDX-License-Identifier: MPL-2.0 -# This workflow is managed by gh actions-lock. +name: Central Estate CI/CD Audit -name: "🔴 GATE: Central Estate CI/CD Audit" +# Thin caller of the estate audit, which lives in hyperpolymath/cicd-suite as +# a reusable workflow and reports five component checks: governance, +# hygiene, manifests, languages, advisory. This is cicd-suite's +# templates/estate-audit-caller.yml. +# +# The pin is a full SHA on cicd-suite main, so upstream changes reach this +# repository only through a PR that moves it; that PR's own run of this audit +# is the check. cicd-suite's templates/track-estate-audit.yml can open those +# PRs weekly; it needs an AUTOMATION_TOKEN secret. +# +# actions.lock lists this file as [], like secret-scanner.yml. A +# cross-repository reusable-workflow call recorded in the lock startup-fails +# with zero jobs under sha_pinning_required (see the header of cicd-suite's +# main-estate-audit.yml). on: push: branches: [ "main" ] pull_request: branches: [ "main" ] - workflow_call: + +permissions: + contents: read jobs: - call-estate-audit: - uses: hyperpolymath/cicd-suite/.github/workflows/main-estate-audit.yml@main + estate: + uses: hyperpolymath/cicd-suite/.github/workflows/main-estate-audit.yml@376898bbe872226866ccbc7648d43123b8bb21b9 # cicd-suite main, #50