ci: publish CI and release failure evidence

.github/workflows/ci-feedback-events.yml

@@ -0,0 +1,25 @@
+name: CI feedback
+
+on:
+  # Trusted publisher reads completed-run metadata only; source-run code and
+  # artifacts are never executed. Its code is fixed by the reviewed caller/ref.
+  workflow_run: # zizmor: ignore[dangerous-triggers]
+    workflows: ["ci", "codeql", "release"]
+    types: [completed]
+
+permissions: {}
+
+concurrency:
+  group: ci-feedback-events-${{ github.repository_id }}-${{ github.run_id }}
+  cancel-in-progress: false
+
+jobs:
+  feedback:
+    if: ${{ contains(fromJSON('["failure","timed_out","action_required","stale","startup_failure","cancelled"]'), github.event.workflow_run.conclusion) }}
+    permissions:
+      actions: read # Read exact completed run and job metadata.
+      issues: write # Publish bounded failure evidence in this repository.
+    uses: NDDev-OpenNetwork/github-actions/.github/workflows/ci-feedback.yml@a0dc5592333dcfdf2a3d239ed1f2b128899e5482  # commit:a0dc5592333dcfdf2a3d239ed1f2b128899e5482
+    with:
+      run-id: ${{ format('{0}', github.event.workflow_run.id) }}
+      run-attempt: ${{ format('{0}', github.event.workflow_run.run_attempt) }}

AGENTS.md

@@ -14,5 +14,5 @@ and an explicit previous state. Every state transition is validated and
 journal-ready. Keep adapters declarative and narrowly typed; do not accept
 free-form shell fragments or implicit `secrets: inherit`.
 
-Run `python3 -m unittest discover -s tests -v` and
-`python3 scripts/cd_contract.py validate-schema` after changes.
+Run `scripts/validate_module.sh` after changes. It includes unit/schema checks,
+workflow trust contracts, exact action registry validation and source scanning.

CHANGELOG.md

@@ -5,6 +5,9 @@ Versioning.
 
 ## [Unreleased]
 
+- Publish unsuccessful completed self-workflow attempts as unassigned,
+  repository-local CI evidence; preserve actual conclusions and exact attempts.
+
 ## [0.1.2] - 2026-08-26
 
 ### Changed

README.md

@@ -46,3 +46,11 @@ python3 scripts/cd_contract.py seal examples/plan.draft.json /tmp/plan.json
 python3 scripts/cd_contract.py validate-plan /tmp/plan.json
 python3 -m unittest discover -s tests -v
 ```
+
+
+## CI feedback
+
+The CI feedback workflow reports unsuccessful completed self-workflow attempts
+as unassigned issues in this repository. It uses a pinned publisher and records
+actual job conclusions and attempt identity without executing source-run code.
+Issue publication does not launch a repair agent or authorize deployment.

catalog/actions.yml

@@ -29,3 +29,6 @@ actions:
   - name: NDDev-OpenNetwork/ci-workflows/.github/workflows/release-supply-chain.yml
     sha: "409817cf743e76383c84e30c72edf781d73b71a1"
     version: "0.1.11"
+  - name: NDDev-OpenNetwork/github-actions/.github/workflows/ci-feedback.yml
+    sha: "a0dc5592333dcfdf2a3d239ed1f2b128899e5482"
+    version: "commit:a0dc5592333dcfdf2a3d239ed1f2b128899e5482"