fix(autofix): fail closed on ambiguous workflow validation

[seonghobae]

Goal

Carry the still-valid trusted workflow-linting delta out of historical #1231 into one bounded canonical-owner successor.

RED → GREEN

• RED 98768d6b2a27631602ec2405d3d71a8f6d13d534: proves that expression-valued and non-boolean cancel-in-progress beside queue: max must fail closed.
• GREEN 822222ed4621d7a896b3dd59d25f4c728d60dd88: provisions checksum-pinned actionlint 1.7.12 and BSD-licensed shfmt 3.13.1 for every changed workflow, installs the bounded trusted linter, and accepts max queue only when cancellation is absent or literal YAML false.

Boundary

This successor carries only the linter/provisioning/dynamic-cancellation responsibility. It does not claim carryover of #1231's unrelated scheduler, SBOM, GPU, or dispatch changes. Historical #1231 remains open and its substantive thread remains unresolved until this successor has exact-head GREEN evidence.

Documentation

Updates CHANGELOG, APA-style doctoring, and docs/product-technical-gap-baseline.md. Status remains Proposed while current-head hosted Checks are non-terminal.

Verification

The branch is a normal three-commit descendant of protected main@78a4937c684a54ca8e415822c913742f41c6efc4; no force push or rebase was used. Runtime Quality run 34181640286 is GREEN on exact head 6d104003767e22aaa1f3415e6e49b16192a35b42: focused linter contracts 14 passed, full repository 3000 passed, 1 skipped, 21 subtests, 100% coverage, consolidated contracts 16 passed, compile and diff checks clean. Remaining exact-head security/CodeQL Checks and independent review are still authoritative merge gates.

Refs #1231.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Exact-head publication receipt: main@78a4937c684a54ca8e415822c913742f41c6efc4 → RED@98768d6b2a27631602ec2405d3d71a8f6d13d534 → implementation@822222ed4621d7a896b3dd59d25f4c728d60dd88, compare 2 ahead / 0 behind, six files, mergeable, Draft/Proposed, zero review threads. Python Security, Agent Review Runtime Quality CI, CodeQL PR, Security Scan, and SAST Semgrep were all created for the exact implementation head and are currently queued. No previous-head result is authoritative.

[seonghobae]

Exact-head Runtime Quality RCA and repair:

• predecessor head: 822222ed4621d7a896b3dd59d25f4c728d60dd88
• run/job: 34179916329 / 101916737625
• all 3,000 tests passed, coverage reached 100%, interrogate passed, and the consolidated workflow contract passed
• sole failure: git diff --check reported docs/product-technical-gap-baseline.md:3364: new blank line at EOF
• repaired head: 6d104003767e22aaa1f3415e6e49b16192a35b42
• change: normalize that file to one terminal newline only

The update is a normal fast-forward descendant; no force update, bypass, or predecessor Check transfer. Fresh exact-head Checks are authoritative.

[seonghobae]

Exact-head verification receipt: Runtime Quality run 34181640286, job 101921752440, succeeded on 6d104003767e22aaa1f3415e6e49b16192a35b42. It recorded focused workflow-linter contracts 14 passed, full repository 3000 passed, 1 skipped, 21 subtests, 100% coverage, consolidated workflow contracts 16 passed, and clean compile/diff checks. Security, SAST, Python Security, CodeQL, and independent review remain separate current-head gates; this receipt is not merge authorization.

[seonghobae]

Restack onto protected main@7fd571dbcdbae6acf29d8f4ee704d7ba6297e4db with non-force git merge --no-ff origin/main.

• previous head 6d104003767e22aaa1f3415e6e49b16192a35b42 remains an ancestor
• new head 2ed879ca377fed5ff814d527b803a99ccffbd39d
• conflicts: none (main only brought fix(codeql): keep a clean dispatch scan when status publish 403s #2028 CodeQL files)
• focused: PYTHONPATH=. python3 -m pytest tests/test_lint_github_workflows.py → 16 passed

Left Draft. Fresh exact-head checks required; predecessor evidence does not transfer.