From 11779be757698821781dcfca588c5a3a8323bf97 Mon Sep 17 00:00:00 2001
From: rldyourmnd <danil@nddev.it.com>
Date: Mon, 7 Sep 2026 11:04:35 +0500
Subject: [PATCH 1/2] ci: report CI and release failures as unassigned issues

Signed-off-by: rldyourmnd <danil@nddev.it.com>
---
 .github/workflows/ci-feedback-events.yml | 25 ++++++++++++++++++++++++
 CHANGELOG.md                             |  3 +++
 README.md                                |  8 ++++++++
 3 files changed, 36 insertions(+)
 create mode 100644 .github/workflows/ci-feedback-events.yml

diff --git a/.github/workflows/ci-feedback-events.yml b/.github/workflows/ci-feedback-events.yml
new file mode 100644
index 0000000..1c11fb7
--- /dev/null
+++ b/.github/workflows/ci-feedback-events.yml
@@ -0,0 +1,25 @@
+name: CI feedback
+
+on:
+  # Trusted publisher reads completed-run metadata only; source-run code and
+  # artifacts are never executed. Its code is fixed by the reviewed caller/ref.
+  workflow_run: # zizmor: ignore[dangerous-triggers]
+    workflows: ["ci", "codeql", "release"]
+    types: [completed]
+
+permissions: {}
+
+concurrency:
+  group: ci-feedback-events-${{ github.repository_id }}-${{ github.run_id }}
+  cancel-in-progress: false
+
+jobs:
+  feedback:
+    if: ${{ contains(fromJSON('["failure","timed_out","action_required","stale","startup_failure","cancelled"]'), github.event.workflow_run.conclusion) }}
+    permissions:
+      actions: read # Read exact completed run and job metadata.
+      issues: write # Publish bounded failure evidence in this repository.
+    uses: NDDev-OpenNetwork/github-actions/.github/workflows/ci-feedback.yml@a0dc5592333dcfdf2a3d239ed1f2b128899e5482  # commit:a0dc5592333dcfdf2a3d239ed1f2b128899e5482
+    with:
+      run-id: ${{ format('{0}', github.event.workflow_run.id) }}
+      run-attempt: ${{ format('{0}', github.event.workflow_run.run_attempt) }}
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1479e6d..6ad2148 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,9 @@ Versioning.
 
 ## [Unreleased]
 
+- Publish unsuccessful completed self-workflow attempts as unassigned,
+  repository-local CI evidence; preserve actual conclusions and exact attempts.
+
 ## [0.1.2] - 2026-08-26
 
 ### Changed
diff --git a/README.md b/README.md
index d37fe83..769580c 100644
--- a/README.md
+++ b/README.md
@@ -46,3 +46,11 @@ python3 scripts/cd_contract.py seal examples/plan.draft.json /tmp/plan.json
 python3 scripts/cd_contract.py validate-plan /tmp/plan.json
 python3 -m unittest discover -s tests -v
 ```
+
+
+## CI feedback
+
+The CI feedback workflow reports unsuccessful completed self-workflow attempts
+as unassigned issues in this repository. It uses a pinned publisher and records
+actual job conclusions and attempt identity without executing source-run code.
+Issue publication does not launch a repair agent or authorize deployment.

From 92108b7c6f8513f75ed725ed7c32bca6819124f8 Mon Sep 17 00:00:00 2001
From: rldyourmnd <danil@nddev.it.com>
Date: Mon, 7 Sep 2026 11:25:07 +0500
Subject: [PATCH 2/2] fix(ci): register feedback dependency in the complete
 module gate

Signed-off-by: rldyourmnd <danil@nddev.it.com>
---
 AGENTS.md           | 4 ++--
 catalog/actions.yml | 3 +++
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/AGENTS.md b/AGENTS.md
index 24d51a7..4b2064a 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -14,5 +14,5 @@ and an explicit previous state. Every state transition is validated and
 journal-ready. Keep adapters declarative and narrowly typed; do not accept
 free-form shell fragments or implicit `secrets: inherit`.
 
-Run `python3 -m unittest discover -s tests -v` and
-`python3 scripts/cd_contract.py validate-schema` after changes.
+Run `scripts/validate_module.sh` after changes. It includes unit/schema checks,
+workflow trust contracts, exact action registry validation and source scanning.
diff --git a/catalog/actions.yml b/catalog/actions.yml
index 4fa8687..6d1f8b8 100644
--- a/catalog/actions.yml
+++ b/catalog/actions.yml
@@ -29,3 +29,6 @@ actions:
   - name: NDDev-OpenNetwork/ci-workflows/.github/workflows/release-supply-chain.yml
     sha: "409817cf743e76383c84e30c72edf781d73b71a1"
     version: "0.1.11"
+  - name: NDDev-OpenNetwork/github-actions/.github/workflows/ci-feedback.yml
+    sha: "a0dc5592333dcfdf2a3d239ed1f2b128899e5482"
+    version: "commit:a0dc5592333dcfdf2a3d239ed1f2b128899e5482"