From a32f137ba594f535070d4aec7dd3757d997363d3 Mon Sep 17 00:00:00 2001 From: rldyourmnd Date: Mon, 7 Sep 2026 08:41:24 +0500 Subject: [PATCH 1/2] fix(gds): declare reusable workflow consumption contract Signed-off-by: rldyourmnd --- .gds/repository.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.gds/repository.yaml b/.gds/repository.yaml index 2b559ef..4bf02f9 100644 --- a/.gds/repository.yaml +++ b/.gds/repository.yaml @@ -57,7 +57,8 @@ agent: module: contract: "public" - consumption: ["git-submodule"] + # GitHub reusable workflows execute remotely; GDS models this as runtime-service. + consumption: ["git-submodule", "runtime-service"] compatibility: "commit-contract" pin_policy: "default-branch-commit" publication: {registry: "none", github_release: "required"} From 92aac3189be545076d1a97ae021e814b2af0d963 Mon Sep 17 00:00:00 2001 From: rldyourmnd Date: Mon, 7 Sep 2026 08:54:52 +0500 Subject: [PATCH 2/2] chore(gds): refresh consumption provenance and permission documentation Signed-off-by: rldyourmnd --- .gds/bundle.lock.yaml | 2 +- .github/workflows/docker-build.yml | 2 +- CHANGELOG.md | 5 +++++ 3 files changed, 7 insertions(+), 2 deletions(-) diff --git a/.gds/bundle.lock.yaml b/.gds/bundle.lock.yaml index 69debde..a815f51 100644 --- a/.gds/bundle.lock.yaml +++ b/.gds/bundle.lock.yaml @@ -10,7 +10,7 @@ bundle: attestation_identity_digest: "sha256:e1b787c63de916f750e2cbcbf664967669024e1062964515f612b2c826c9e10d" projection: - input_digest: "sha256:b74bcd47414083d18df37105bd9bd64bfdc7e9c7396d748cc1ac77a927e8cfa0" + input_digest: "sha256:2b4778d4f725f958775501f9ea0a01e005ff452f426b088c3b78b9164d61deeb" output_digest: "sha256:8e8a9aec59f3cb0c89cba52e37ab0015501f94aaa72d8e9dc3e03304c7244852" files: - path: ".gds/compiled-policy.json" diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml index 3e0179b..5e3ae8e 100644 --- a/.github/workflows/docker-build.yml +++ b/.github/workflows/docker-build.yml @@ -77,7 +77,7 @@ jobs: contents: read # ghcr.io push and the registry layer cache authenticate with the # ambient token; both write to the caller's own package namespace. - packages: write + packages: write # Push images and registry cache in the caller's package namespace. outputs: digest: ${{ steps.build.outputs.digest }} steps: diff --git a/CHANGELOG.md b/CHANGELOG.md index fde3127..3553891 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,11 @@ The project follows Semantic Versioning. ## [Unreleased] +- Declare both git-submodule and reusable-workflow consumption in the GDS + module contract. Refresh its projection using the existing stable bundle. +- Place the Docker publisher permission explanation inline so the pinned + pedantic audit recognizes it; workflow permissions and behavior are unchanged. + ## [0.1.16] - 2026-09-02 - `security-bundle` authenticates its exact called-workflow source fetch with