Resolve reusable workflow package versions from their release commit at runtime

Merged
UN
6d ago
+400-27

Reusable workflow callers previously had to update both a workflow SHA and a package-version input. Resolve the exact package release from the reusable workflow's own commit so a Dependabot SHA update selects both together, without adding a GitHub App or stored credentials.

Both workflows bind GitHub's documented job.workflow_sha through step env:. The proposed github.job_workflow_sha is not a documented context property; job_workflow_sha is an OIDC claim. See GitHub job context.

Public git ls-remote --tags reads the package repository's release refs without authentication or API pagination. Lightweight tags match directly; annotated tags match their peeled commit. Versions must satisfy N.N.N or N.N.N-N. Lookup failures, unavailable workflow identity, and multiple release versions on the same commit fail closed. These job context properties are unavailable on GitHub Enterprise Server.

Before: the release job stamped workflow files and required a newly configured app token to push them. After: release.yml is restored to its main-branch behavior and reusable workflows resolve release tags at runtime. If no tag matches, a nonempty deprecated input supplies a validated exact-version fallback with a warning; absent input fails with release-SHA pinning instructions. A tag/input mismatch warns and uses the tag. Exact installation and installed-version verification remain enforced. Inputs stay in environment variables and are never interpolated into shell source or warnings.

Caller templates omit the deprecated input. README retains the daily github-actions Dependabot configuration and documents release SHA/tag-comment pins and runtime behavior.

Validation:

  • Actual resolver/install scripts executed through bash with a synthetic git ls-remote seam: 36/36 contracts pass, including pm test --run --progress.
  • Behavior-only reverts, tests unchanged: restoring embedded selection in sync fails 16/16 scenarios; restoring embedded selection in closeout fails 16/16; restoring release stamping/app minting fails the release contract. All mutations restored, contracts pass again. Proofs are recorded on the feature item.
  • Read-only live resolver against the current released commit resolves 2026.10.16 from public tags.
  • env HOME=$(mktemp -d) GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_NOSYSTEM=1 npm run release:check and bun run release:check both pass 738/738 tests, zero failures/skips/cancellations/TODOs, exact 100/100/100/100 coverage across 13 authored modules, zero duplication, privacy, production audit (zero vulnerabilities), pack dry run, changelog and attestation gates at unchanged thresholds. Changelog regenerated and checked after final tracker writes.

PM: pm-github-znig, pm-github-ygye. The app setup item is superseded and left open for orchestrator cancellation. Both items remain unclosed. Tracker records and append-only histories accompany the code.

No release was dispatched. A hosted consumer run of the reusable workflows is separate from the bash contracts and package gates.