Repository navigation
Canary: repoint go-template to the .github-hosted actions and workflows #238
Description
🤖 Generated by the Agentic Engineer
Evidence
#165 chose go-template as the first consumer because every new Go repository starts from it. Its five catalogue callers now use canonical .github references for aggregation, releases, template synchronization, TODO scanning and shell-pipeline validation. Its CI deliberately keeps a trivial aggregator and does not call validate-go-project.yaml; the Go and signed-fix criterion therefore needs a qualifying consumer in #239. Its Dependabot group matches devantler-tech/*, which also covers devantler-tech/.github, so its update config needs no change. The native clean and controlled-negative template adoptions in #269 additionally exercise an actual canonical action.
Hypothesis
If go-template builds and releases green on the .github-hosted copies, the rest of the portfolio can follow with a mechanical change per repository.
Success signal
go-template's CI, release and deploy run green on SHA-pinneddevantler-tech/.github/actions/<name>anddevantler-tech/.github/.github/workflows/<file>references.- The next Dependabot update PR for those references proposes a
.githubrelease with a correct# vX.Y.Zcomment.
Acceptance criteria
- Every
devantler-tech/actionsreference ingo-templatepoints at the.github-hosted equivalent, SHA-pinned with its version comment. - A pull request exercising
validate-go-project.yamlpasses, including its signed auto-fix path. - The result, and any change the rest of the rollout needs, is recorded here before Repoint the remaining consumers from actions to .github #239 starts.
Current evidence — 2026-10-04
The complete, immutable metadata census at go-template 49a2a9bc380a241ce6a70735a17b2e8874ee6a36 reads all seven workflow files. Its five catalogue callers use canonical .github references with full SHA pins and version comments: four at 18b1389c9e48c50da4769897258662cc78975b79 (v2.5.13), plus the shell-pipeline scaffold validator at 4ddc63e74ffba23c243bde73755786fae56bef9e (v4.8.1). No frozen Actions caller remains in those files. The canary result and rollout adjustments were recorded here on 2026-09-29, before the broader rollout. The subsequent Dependabot proposal is also recorded and merged.
KSail #7478 is merged at d6a72e0df608d11c2ee3964bd7f9c0b328b8252f. GitHub resolves its shared Go workflow to canonical .github bd0035dd8f41fcf1459b878882b8897443f8dc59 (v4.9.4). The merged caller is identical to the reviewed job: the main/allowlist trigger, permissions, secrets and apply-signed-fixes: false are preserved; the default-branch scan and test arguments are omitted. The invoked defaults are scan=true, test=true, maintenance=false.
The actual canonical main Test and Vulnerability Scan both pass at that merged commit despite go=false and govulncheck=false. The full native main run is successful. This provides canonical-source default-branch execution proof with omitted arguments; the template adoptions in #269 also exercise actual canonical actions.
Completion — 2026-10-04
The controlled consumer proof observed the read-only rejection, verified signed formatting corrections and complete 12-job successor validation. Native run metadata records both canonical workflow revisions. Normal consumer checks passed at the same final commit. The disposable PR is closed without merge, and its owned remote branch was conditionally deleted with absence verified. Nothing temporary reached main. The permanent README repair is merged in #348.
Metadata
Metadata
Assignees
Labels
Type
Fields
Priority
Projects
- Status
Activity
feat!: import the devantler-tech/actions catalogue (#243)
chore: agent-claim #238 nonce=568ee726e40a9dee8b2c17407dca72d0
devantler commentedon Sep 29, 2026
Canary result, 2026-09-29. go-template now runs on the catalogue hosted here: devantler-tech/go-template#330 (tracked as devantler-tech/go-template#329) merged at
9acda3e7.devantler-tech/actionsreference repointed, SHA-pinned with its version commentdevantler-tech/.github@74c66a21# v2.5.0: theaggregate-job-checksaction, pluscreate-release,template-syncandscan-for-todo-commentsas reusable workflows.CI - Required Checksran the hosted composite action on the pull request and passed.main. At9acda3e7, bothRelease(run 36642267057) andTODOs(run 36642267032) succeeded.validate-go-project.yaml, including its signed auto-fix pathci.yamla trivial aggregator), so this criterion needs the first consumer in #239 that does call them..githubrelease with a correct version comment.githubrelease after v2.5.0. go-template'sdevantler-tech/*group already covers this repository.Notes for #239:
create-releaseandaggregate-job-checksare byte-identical toactions@df7fd4f, andtemplate-syncandscan-for-todo-commentsdiffer only in comments, step names and internal paths. Callers pass the same inputs and secrets.platform-tenant-templateis next in Repoint the remaining consumers from actions to .github #239's order, and it also unblocks Tenant .templatesyncignore can never receive new entries, so template-side exclusions do not reach existing tenants platform-tenant-template#171.devantler commentedon Oct 2, 2026
The previously pending updater criterion is now satisfied: go-template #339 merged a Dependabot update to catalogue
18b1389c9e48c50da4769897258662cc78975b79, with thev2.5.13version comment. The current consumer workflow retains it. Complete indexed search found no legacy reference in that consumer, with a positive catalogue-reference control.Native checks and runs at that consumer head pass, including the merged scaffold pilot. They do not execute shared Go validation or signed autofix: the template deliberately contains neither caller. The signed publisher work in #380/#281 supplies implementation evidence, but does not turn these template checks into consumer execution proof.
Blocker: record actual shared Go validation and signed-autofix execution in a qualifying consumer under #239 before closing the remaining canary criterion. No longer wait for a first Dependabot proposal.
devantler commentedon Oct 3, 2026
A fresh qualifying-consumer check does not yet close the remaining canonical Go-validation criterion. KSail run 37148161354 executed its signed golangci-lint fix job successfully (job 111279249719), and the resulting commit has a valid GitHub signature. However, the native run metadata binds that job to the frozen
devantler-tech/actionsapply-signed-fixes workflow at78ce1aca1e4736f4c4fe24975b085938805421f7, not the canonical catalogue. The overall predecessor run was cancelled when the formatting commit advanced the PR.That is actual signed-autofix execution evidence, but it cannot satisfy the canonical-source canary gate. Keep this issue open. Under #239, migrate a qualifying consumer’s shared Go validation and signed-fix references together, then require complete successor-head CI and a real signed-fix result at the canonical revision. This round’s scanner adoption proves a separate canonical reusable workflow and is not substituted for that missing Go proof.
devantler commentedon Oct 4, 2026
Signed-fix canary feasibility — 2026-10-04
The native KSail run37193023784 completed all 42 jobs and actually executed canonical Go tests and vulnerability scanning. Its canonical Go caller bd0035d invokes signer 18b1389; the nested signer is independently pinned. All fix jobs skipped because apply-signed-fixes is false. This does not satisfy the remaining criterion.
A controlled go-template proof is feasible without changing normal ci.yaml, adding a required writer, reading credentials or expanding access: its existing release run37132918827, at current observed main49a2a9bc380a241ce6a70735a17b2e8874ee6a36, successfully executed its existing App-token step. By contrast, KSail still receives a legacy required Go writer, so opting a second writer in there would create competition.
Use a disposable, same-repository draft PR with a dedicated branch-restricted proof caller. First require a read-only formatting failure with an unchanged head and no signing step. Then opt in and require an actual formatting-only App commit whose signature, parent and complete successor-head validation are verified natively. Leave a harmless Go comment after formatting so successor change detection still runs Go. Close the proof PR and conditionally remove only its owned branch; keep immutable run evidence here. Nothing temporary should reach main.
Record both caller and nested signer SHAs. This older canonical signer can prove the signing criterion, but cannot certify the newer staging/promotion safeguards. Blocker: the controlled positive signed-fix path and successful successor-head validation have not yet been executed.
devantler commentedon Oct 4, 2026
The remaining controlled consumer proof is in go-template issue345 and its disposable draft PR346. The read-only run detected the deliberate formatting change and left the branch unchanged. Its unrelated existing README lint defect now has a separate repair in PR348.
The opt-in phase is run37203969279. The correction and complete successor validation remain pending; this issue stays open until those results and temporary-branch cleanup are verified.