chore(ci): rebuild & harden workflows - #18

Merged

tomtastisch merged 31 commits into

mainfrom

chore/ci-rebuild-hardened

Feb 10, 2026

Commits on Feb 9, 2026

phase1: normalize ci workflow orchestration
Tom Werner
committed
03b1084
phase2: confirm canonical version-policy PR check
Tom Werner
committed
3d4f58d
phase3: harden qodana gating and scoped excludes
Tom Werner
committed
27a63c7
phase4: enforce artifact contract for all required ci checks
Tom Werner
committed
0d88974
phase5: add sscc error ux and structured diagnostics
Tom Werner
committed
b7f2de5
phase6: keep current duplication boundaries for safety
Tom Werner
committed
d6e9ff0
phase4: include pack artifact in summary contract aggregation
Tom Werner
committed
31e4540
ci: make diag.json valid JSON and document CI DAG/contracts
Tom Werner
committed
f270da2
Update tools/ci/lib/result.sh

tomtastisch
and
Copilot
authored
9a1e618
fix(ci): apply computed PR labels and verify outcome
Tom Werner
committed
9ab6e35
phase1(ci): normalize orchestration shape in ci.yml without context changes
Tom Werner
committed
1eca61b
phase2(version-policy): no-change deconfliction (single canonical PR emitter confirmed)
Tom Werner
committed
0c33ba3
phase3(qodana): no-change on branch (contract already green, thresholds unchanged)
Tom Werner
committed
1e13d55
phase4(result): enforce fail-closed result schema validation for all checks
Tom Werner
committed
379ba8b
phase5(error-ux): resolve artifact deep-link via GitHub API with 9901 fallback
Tom Werner
committed
3ce53ef
phase6(ci): eliminate flaky GH API duplication with deterministic retry wrapper
Tom Werner
committed
f477731
phase7(verify): finalize evidence pack and DoD verification
Tom Werner
committed
3e41bac
phase6(ci): switch pr-labeling to single REST PUT label sync for deterministic API behavior
Tom Werner
committed
62a1e54

Navigation Menu

chore(ci): rebuild & harden workflows - #18

chore(ci): rebuild & harden workflows#18
tomtastisch merged 31 commits into
mainfrom
chore/ci-rebuild-hardened

Commits on Feb 9, 2026

phase1: normalize ci workflow orchestration

phase2: confirm canonical version-policy PR check

phase3: harden qodana gating and scoped excludes

phase4: enforce artifact contract for all required ci checks

phase5: add sscc error ux and structured diagnostics

phase6: keep current duplication boundaries for safety

phase4: include pack artifact in summary contract aggregation

ci: make diag.json valid JSON and document CI DAG/contracts

Update tools/ci/lib/result.sh

fix(ci): apply computed PR labels and verify outcome

phase1(ci): normalize orchestration shape in ci.yml without context changes

phase2(version-policy): no-change deconfliction (single canonical PR emitter confirmed)

phase3(qodana): no-change on branch (contract already green, thresholds unchanged)

phase4(result): enforce fail-closed result schema validation for all checks

phase5(error-ux): resolve artifact deep-link via GitHub API with 9901 fallback

phase6(ci): eliminate flaky GH API duplication with deterministic retry wrapper

phase7(verify): finalize evidence pack and DoD verification

phase6(ci): switch pr-labeling to single REST PUT label sync for deterministic API behavior

Commits on Feb 10, 2026

phase1(ci): remove redundant job name and permissions

chore: update FileTypeOptions

ci: fix version-policy artifact + fail-closed finalize

style: format FileTypeOptions

ci: fix result schema path (no more tools/tools)

ci: finalize before exit for fail-closed (no set +e)

ci: require+verify ci-versioning-svt artifact in version-policy

ci: use curl+python for version-policy artifact verify (no gh)

ci: fetch tags for versioning-svt (checkout hardening)

ci: shrink version-policy verify run block (preflight CI-SHELL-004)

chore(ci): replace gh api with curl+python

chore(ci): address review threads

ci(qodana): grant checks/pr write permissions for annotations