fix(ci): maintain workflow dependencies through canonical provenance

.gds/bundle.lock.yaml

@@ -5,14 +5,14 @@ bundle:
   version: "0.8.0-dev"
   release_sequence: 0
   channel: "development"
-  source_tree_digest: "sha256:27c680c6d2fa6dbdb297d8902b19bccd2e9114449d0494fd4866df78b149631e"
-  digest: "sha256:71191a1e73172a41ffb3a1d1c17a97306d9fd7cc488a9d023f29513e5329c097"
+  source_tree_digest: "sha256:14e3b6a5e784f371cbdd35b9cae16751d187312bddadc65f7a8a2dc4fd9229ff"
+  digest: "sha256:13511083d417c02909b0c2c749b9f854326d80d878de0bd1c04a8a2564516df7"
 
 projection:
-  input_digest: "sha256:66e0e6e6b2788574f5a52479e921db822414f730671be57ed68aa96836aa7ac7"
-  output_digest: "sha256:9a70d43a686d9e18925ed01d4e078b4d21a31a7600486e28ce06b92da4347479"
+  input_digest: "sha256:e72c1044b1575802633810e196ff230c0fcdad2e9aedce8931dcf9d659a86c44"
+  output_digest: "sha256:19e6a3ce782a399ada46509398ad1aae99c9404405049a83aa284b780eec9acc"
   files:
     - path: ".gds/compiled-policy.json"
       digest: "sha256:807282f820294914e1c7e6ad1bf27c54a799d56305c58630254ab50ab286f379"
     - path: ".github/workflows/gds-ci.yml"
-      digest: "sha256:f164762300a774d716fcee22720a25c42c8c3fb142bf6546286b34170b1cdc89"
+      digest: "sha256:91d5089db35ac77e3863844f2d2133f5e3cd30a9b82aecff28d048c84b932950"

.gds/repository.yaml

@@ -81,7 +81,7 @@ ci:
   build_command: "go build -trimpath ./core/cmd/gds"
   test_command: "go test ./..."
   timeout_minutes: 30
-  workflow_ref: "NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@409817cf743e76383c84e30c72edf781d73b71a1"
+  workflow_ref: "NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@706233fdc953d4281389c0fd5f8c1a007e19a1f5"
   # A public repository, so GitHub-hosted runners are unmetered and a fork's
   # pull request cannot reach anything of ours. Self-hosted hardware here would
   # turn a fork PR into remote code execution on it.

.github/dependabot.yml

@@ -40,27 +40,12 @@ updates:
     labels:
       - dependencies
       - ci
-    # Every `ci-workflows` reusable pin is withheld, because a Dependabot commit
-    # that moves one is unmergeable by construction for two independent reasons.
-    #
-    # `generate_required_checks.py` derives the required status-check contexts
-    # offline from `requirements/required-check-facts.json`, a cache of upstream
-    # job names keyed by exact commit. A moved pin misses that cache and the
-    # generator fails closed; refreshing it needs a fetch Dependabot never makes.
-    #
-    # The `go-ci.yml` pin additionally appears only in `gds-ci.yml`, a
-    # bundle-locked projection under `generated_projection_edit: forbidden`.
-    # Rewriting it there detaches the projection from `.gds/bundle.lock.yaml`
-    # and every check fails `GDS_CONTEXT_PROJECTION_DIGEST_MISMATCH`, however
-    # good the new ref is. Its canonical home is `ci.workflow_ref` in
-    # `.gds/repository.yaml`, and moving it is an anchor edit plus a signed
-    # regeneration.
-    #
-    # So the family is bumped by hand: move the pin, run
-    # `scripts/refresh_required_check_facts.py`, commit both. Upstream movement
-    # is surfaced by `scripts/report_workflow_ref_drift.py` instead of by a bot.
+    # The Go caller is generated. Update ci.workflow_ref in .gds/repository.yaml
+    # and regenerate through gds generate repository --plan/--apply; editing the
+    # output alone breaks its bundle provenance. Other workflow pins remain
+    # visible as Dependabot proposals and retain ordinary review.
     ignore:
-      - dependency-name: "example-org/ci-workflows/*"
+      - dependency-name: "NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml"
     groups:
       github-actions:
         applies-to: version-updates

.github/workflows/ci-feedback-events.yml

@@ -19,7 +19,7 @@ jobs:
     permissions:
       actions: read # Read exact completed run and job metadata.
       issues: write # Publish bounded failure evidence in this repository.
-    uses: NDDev-OpenNetwork/github-actions/.github/workflows/ci-feedback.yml@a0dc5592333dcfdf2a3d239ed1f2b128899e5482  # commit:a0dc5592333dcfdf2a3d239ed1f2b128899e5482
+    uses: NDDev-OpenNetwork/github-actions/.github/workflows/ci-feedback.yml@a8fd623d86582ec13c434f7cd124ea6b8170dd5e  # commit:a8fd623d86582ec13c434f7cd124ea6b8170dd5e
     with:
       run-id: ${{ format('{0}', github.event.workflow_run.id) }}
       run-attempt: ${{ format('{0}', github.event.workflow_run.run_attempt) }}

.github/workflows/codeql.yml

@@ -31,7 +31,7 @@ jobs:
       actions: read
       contents: read
       security-events: write
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml@409817cf743e76383c84e30c72edf781d73b71a1 # 0.1.11
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml@706233fdc953d4281389c0fd5f8c1a007e19a1f5 # 0.1.15
     with:
       # Public repository: `pull_request` runs untrusted fork code. Name the
       # hosted runner explicitly — the reusable's default belongs to the pinned

.github/workflows/gds-ci.yml

@@ -1,9 +1,9 @@
 # GENERATED FILE - DO NOT EDIT DIRECTLY
 # generator: gds
 # bundle: 0.8.0-dev
-# source-tree-digest: sha256:27c680c6d2fa6dbdb297d8902b19bccd2e9114449d0494fd4866df78b149631e
-# input-digest: sha256:66e0e6e6b2788574f5a52479e921db822414f730671be57ed68aa96836aa7ac7
-# output-digest: sha256:4a875d4ed62fe6b2d279515f9a19274e159ae8ed58f3a1a0843c60a49f663886
+# source-tree-digest: sha256:14e3b6a5e784f371cbdd35b9cae16751d187312bddadc65f7a8a2dc4fd9229ff
+# input-digest: sha256:e72c1044b1575802633810e196ff230c0fcdad2e9aedce8931dcf9d659a86c44
+# output-digest: sha256:a911ec3d1d5728bbe37fec78e04cc8452b9dbb1e8b394d0b8cace067804eff9a
 # edit-source:
 #   - .gds/repository.yaml
 #   - policies/base/repository-default.yaml
@@ -34,7 +34,7 @@ jobs:
     name: GDS fast
     permissions:
       contents: read
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@409817cf743e76383c84e30c72edf781d73b71a1
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@706233fdc953d4281389c0fd5f8c1a007e19a1f5
     with:
       fetch_depth: 0
       # Public hosted CI uses GitHub's service cache; the pinned reusable
@@ -54,7 +54,7 @@ jobs:
     needs: fast
     permissions:
       contents: read
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@409817cf743e76383c84e30c72edf781d73b71a1
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@706233fdc953d4281389c0fd5f8c1a007e19a1f5
     with:
       fetch_depth: 0
       cache: true

CHANGELOG.md

@@ -5,6 +5,10 @@ Versioning.
 
 ## [Unreleased]
 
+- Update workflow dependencies through the canonical Go caller anchor and
+  regenerated provenance. Exclude that generated dependency from direct
+  Dependabot rewrites while retaining other workflow update proposals.
+
 - Select continuous development for the GDS repository itself and document
   explicit ruleset removal plus cautious readback after ambiguous write errors.
   Generic policy defaults remain opt-in for other consumers.

tests/golden/projections/control-plane/.claude/CLAUDE.md

@@ -3,7 +3,7 @@ GENERATED FILE - DO NOT EDIT DIRECTLY
 generator: gds
 bundle: 0.8.0-dev
 source-tree-digest: sha256:0000000000000000000000000000000000000000000000000000000000000001
-input-digest: sha256:a0d8d237e113629cdf67cf248e3010dfb024ec97d3c692824258f99a66d77421
+input-digest: sha256:1d6bdbba745ef7f1d231358b76744f6bb87db8dd9af238905b9a6baab01d51a8
 output-digest: sha256:88cb57297d8d713287872a8afaca8d42f7146ecf7a091e4996e65eee8f962665
 edit-source:
   - .gds/repository.yaml

tests/golden/projections/control-plane/.gds/bundle.lock.yaml

@@ -9,14 +9,14 @@ bundle:
   digest: "sha256:620a284abd424fa8e2d34d77447d2435f300b6c3c69016f447fbe479b5db655f"
 
 projection:
-  input_digest: "sha256:a0d8d237e113629cdf67cf248e3010dfb024ec97d3c692824258f99a66d77421"
-  output_digest: "sha256:e64d18089f87b0d26f43e652e10a932573b79294f4c759ac4f921e3fe5437210"
+  input_digest: "sha256:1d6bdbba745ef7f1d231358b76744f6bb87db8dd9af238905b9a6baab01d51a8"
+  output_digest: "sha256:e908b4adc5bdd3b1083958a9dad4732811919e74da23bb862d4a152ecb490151"
   files:
     - path: ".claude/CLAUDE.md"
-      digest: "sha256:c20c42cda0f0ab9fecc75bb7fd979c93549d661fb4c23e6cd8caa1ffda6a2151"
+      digest: "sha256:6c13e455efb696aa54024defeeb3700d70683e759014f9d749cf16b6b54b28a9"
     - path: ".gds/compiled-policy.json"
       digest: "sha256:24850d3c840160a5bef16753424da983b1e220984e2457fd22ee03ed278f1f1b"
     - path: ".github/workflows/gds-ci.yml"
-      digest: "sha256:42d30be16850c301efbf04d94d9982105a0b1669a85e9abb479c6d8ff5b0a0c2"
+      digest: "sha256:320e4436a13c228c5260695cda0aa528e9757534b3b0336e2283e262124be1dc"
     - path: "AGENTS.md"
-      digest: "sha256:8629ac16dcf62182a0c23c03ad9f57a367ee43e4677700c1c56b97996fc0c108"
+      digest: "sha256:4814e714012fbeadcaada7d9121e4363f16c32e702e8949ee05eea26dde8e9d9"

tests/golden/projections/control-plane/.github/workflows/gds-ci.yml

@@ -2,8 +2,8 @@
 # generator: gds
 # bundle: 0.8.0-dev
 # source-tree-digest: sha256:0000000000000000000000000000000000000000000000000000000000000001
-# input-digest: sha256:a0d8d237e113629cdf67cf248e3010dfb024ec97d3c692824258f99a66d77421
-# output-digest: sha256:4a875d4ed62fe6b2d279515f9a19274e159ae8ed58f3a1a0843c60a49f663886
+# input-digest: sha256:1d6bdbba745ef7f1d231358b76744f6bb87db8dd9af238905b9a6baab01d51a8
+# output-digest: sha256:a911ec3d1d5728bbe37fec78e04cc8452b9dbb1e8b394d0b8cace067804eff9a
 # edit-source:
 #   - .gds/repository.yaml
 #   - policies/base/repository-default.yaml
@@ -33,7 +33,7 @@ jobs:
     name: GDS fast
     permissions:
       contents: read
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@409817cf743e76383c84e30c72edf781d73b71a1
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@706233fdc953d4281389c0fd5f8c1a007e19a1f5
     with:
       fetch_depth: 0
       # Public hosted CI uses GitHub's service cache; the pinned reusable
@@ -53,7 +53,7 @@ jobs:
     needs: fast
     permissions:
       contents: read
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@409817cf743e76383c84e30c72edf781d73b71a1
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@706233fdc953d4281389c0fd5f8c1a007e19a1f5
     with:
       fetch_depth: 0
       cache: true

tests/golden/projections/control-plane/AGENTS.md

@@ -3,7 +3,7 @@ GENERATED FILE - DO NOT EDIT DIRECTLY
 generator: gds
 bundle: 0.8.0-dev
 source-tree-digest: sha256:0000000000000000000000000000000000000000000000000000000000000001
-input-digest: sha256:a0d8d237e113629cdf67cf248e3010dfb024ec97d3c692824258f99a66d77421
+input-digest: sha256:1d6bdbba745ef7f1d231358b76744f6bb87db8dd9af238905b9a6baab01d51a8
 output-digest: sha256:e068119ce6b21b80367eaaeefdb3821e19e8cc2cb9d6613fe020c547ef0892d8
 edit-source:
   - .gds/repository.yaml