#1368 fix(feature-ideation): source tooling from the reusable's own commit (#839)

Fixes #839. Clears canary blocker #825 (feature-ideation ring1→stable, REGRESSION) once a channel carries this commit.

What broke

feature-ideation-reusable.yml checks out its own scripts into .feature-ideation-tooling at inputs.tooling_ref, which defaulted to the floating v1 tag. v1 (6432e9ae, a rename-only patch of the 2026-05-13 d3d768da) has no scripts/feature-ideation-requirements.txt. Every feature-ideation/v1-* channel now runs pip install … -r .feature-ideation-tooling/scripts/feature-ideation-requirements.txt. No caller stub sets tooling_ref, so every consumer has failed at Install Python jsonschema since 2026-10-09 (TalkTerm, markets, broodly, incubator on 10-09 and 10-16; .github, TalkTerm and bmad-bgreat-suite in #825's window).

ref	sha	pip step	requirements file
feature-ideation/v1-next	43ec2a1f	yes	— (tooling comes from v1)
feature-ideation/v1-ring0 / v1-ring1	bc27529e	yes	—
feature-ideation/v1-stable	364427f6	yes	—
v1 (old tooling_ref default)	6432e9ae	—	missing

Fix

• tooling_ref now defaults to '', and both tooling checkouts use ${{ inputs.tooling_ref || job.workflow_sha }}. The scripts, schema and requirements file then come from the same commit as the reusable the caller pinned, so the channel moves the reusable and its tooling together (the channel-skew rule in #736, applied to the tooling checkout).

• Why job.workflow_sha, not github.job_workflow_sha: github.job_workflow_sha is empty at step level. With an empty ref, actions/checkout silently checks out main. A probe pinned a reusable at a different commit from its caller (run 39688303975; probe branch since deleted):

  GH_JWS=[]                                        # github.job_workflow_sha
  GH_WSHA=[d95847c53e94d4a314f87dd85844b03345744c0c]  # caller commit
  JOB_WREF=[combsmith/.github/.github/workflows/probe-839-reusable.yml@8fb1a135…]
  JOB_WSHA=[8fb1a13584847b872304e1fd4b3d27533ddf98ee]  # reusable's pinned commit ✓
  OIDC job_workflow_sha = 8fb1a13584847b872304e1fd4b3d27533ddf98ee
  

• ci.yml: actionlint 1.7.7 doesn't know job.workflow_sha yet, so this adds an ignore next to the existing job_workflow_sha one.

Regression guard

New test/workflows/feature-ideation/tooling-ref.bats (6 tests, run by Feature Ideation Tests). It fails if:

• the tooling_ref default is anything but empty;
• any .feature-ideation-tooling checkout uses a ref other than inputs.tooling_ref || job.workflow_sha, or a repository other than combsmith/.github;
• the reusable references github.job_workflow_sha;
• any .feature-ideation-tooling/… file the reusable reads is missing from the same commit (the #839 failure itself);
• the canonical stub or this repo's own caller forwards tooling_ref.

Against origin/main's reusable, the default and checkout-ref tests fail as expected. Locally the full feature-ideation suite passes 150/150, and yamllint and actionlint (the CI ignore set) are clean.

Consumer verification: not possible before the channel moves

Every consumer stub pins @feature-ideation/v1-stable and forwards no tooling_ref, and the fix lives inside the reusable. So no consumer runs this code until the canary-rollout cuts a channel tag at a commit that contains it. I did not move any tags. The first v1-next/ring0 run after the next cut is the end-to-end check: Gather Project Signals → Install Python jsonschema should pass, and the checkout log should show the channel commit instead of refs/heads/main.

Related

• .github#1213 ("[Phase 4] Release the reusable feature-ideation change via its channel tag") waits on this. Releasing a channel before this lands ships the same broken pip step.
• Follow-up, not fixed here: auto-rebase-reusable.yml, persona-mention-reusable.yml, pr-auto-review-reusable.yml and pr-review-mention-reusable.yml use github.job_workflow_sha for their own tooling checkouts. Live runs show it is empty there too, so they check out main instead of their pinned channel commit (TalkTerm auto-rebase 39534038888 and pr-auto-review 39534665548 both fetch +refs/heads/main). They don't fail today, but they bypass the canary rings.

🤖 Generated with Claude Code

Problem

See the linked issue.

Risk

Medium — changes GitHub Actions workflow behavior, which is exercised only post-merge; verify via the affected workflow runs.

Test plan

Tests added/updated: test/workflows/feature-ideation/tooling-ref.bats. Verification: bash scripts/dev-lead-lint.sh (shellcheck --severity=warning) ran pre-commit; the bats suite runs in CI.

Rollback

Revert this PR. No non-revertible side effects (no tags, migrations, or external state).

Monitoring

Watch the affected workflow run(s) in the Actions tab and this PR's Lint check for regressions.