Remove Docker Hub bootstrap from Workflow Lint

[Chris0Jeky]

Summary

• replace the Docker-based Actionlint bootstrap with bounded, checksum-pinned Actionlint 1.7.12 and Pyflakes 3.4.0 downloads
• preserve ShellCheck and Pyflakes lint semantics through explicit executable paths, offline Pyflakes installation, version checks, and verbose exact-head/workflow-count logging
• add fail-closed checksum/bootstrap contract tests and document the hosted verification gate
• record the repeated pre-checkout Docker Hub failure in the durable failure ledger

Verification

• full focused bootstrap contract: 7/7 passed with Actionlint 1.7.12, ShellCheck 0.11.0, and Pyflakes 3.4.0
• portable bootstrap/checksum subset: 5/5 passed with Windows Git Bash explicitly selected
• failure-ledger projection tests: 11/11 passed
• docs governance, golden-principles governance, GitHub-operations governance: passed
• Node syntax, Bash syntax, JSONL parse, and git diff hygiene: passed
• two independent final exact-head reviews and final Codex review: no remaining findings
• final Required CI run 30240141400: green, including both Windows/Ubuntu API lanes and E2E Smoke
• final CI Extended run 30240141381: green; Workflow Lint checked both checksums, 7/7 contracts, 32 workflows, zero errors, and no Docker bootstrap
• final CodeQL run 30240139556: all four language analyses green

Gate

This workflow change remains T4-class and requires designated maintainer/CODEOWNER review. The recorded exact-head automation at 3dac09dab46f67e9d42e6473335b352c66562c10 was green and its review findings were resolved, but its base evidence is now stale and must be refreshed. After the required human review and every current exact-head gate, merge execution follows the repository authority and canonical global pipeline; an authorized agent may perform the merge and must obtain fresh post-merge Workflow Lint proof.

Closes #1510

[Chris0Jeky]

@codex review exact head b44d938

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b44d938ff3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Chris0Jeky]

Exact-head adversarial review — b44d938ff3222069d3bf0fb33821f1583fbdcf64

I reviewed the complete 10-file diff and the full PR conversation/review state visible in the pre-post API snapshot. That snapshot contained only the exact-head Codex review request and no review submissions or inline threads. A bot review landed concurrently; I then read and triaged it as recorded below.

LOW — canonical staged-status docs already describe the hosted gate as outstanding after it passed

Locations: docs/STATUS.md (“Exact-head hosted Ubuntu proof ... remain required”) and docs/IMPLEMENTATION_MASTERPLAN.md (“Exact-head hosted Ubuntu proof is still required”). The PR Gate text has the same temporal claim.

Risk: CI Extended run 30239573804, associated with head b44d938, is complete and successful. Its Workflow Lint job 89893827604 checked out the PR synthetic merge 2e5d767 (base c3f9abaa + head b44d938) and logged both checksum successes, Actionlint 1.7.12, Pyflakes 3.4.0, ShellCheck 0.9.0, 7/7 contract checks, 32 discovered/linted workflows, and 0 errors. If this PR merges unchanged, Taskdeck's canonical status/masterplan will retain a gate state that live evidence has already superseded.

Fix: make the committed wording stable across gate transitions—for example, state that maintainer merge requires green final-head hosted Ubuntu evidence, rather than saying that evidence is presently missing. Refresh the PR Gate text after the final run without changing the branch.

Verification after the docs fix: rerun docs governance/failure-ledger projection checks and obtain fresh CI Extended Workflow Lint evidence on the new exact head.

Concurrent bot review triage

The bot's P1 claim that v1.7.12 uses linux_x86_64 is invalid. The official release asset is linux_amd64 with the pinned 8aca…3d8 digest, and the hosted job downloaded and executed it successfully. Evidence was posted in the thread, which is now resolved. Changing to x86_64 would introduce the 404 described by the bot.

Other review evidence

No other CRITICAL/HIGH/MEDIUM/LOW portability, process-semantics, false-positive-test, or fail-closed-boundary findings.

• Hosted Ubuntu 24.04 exercised the real download/checksum/extract/venv/version/test/lint path successfully.
• Local portable subset: 5/5 passed using explicit Windows Git Bash.
• verify-sha256.sh Bash syntax, Node syntax, and exact-base/head git diff --check: passed.
• Failure-ledger projection suite: 11/11 passed.
• Residual risk remains explicitly documented: runner-provided ShellCheck is not version-pinned. Missing/non-executable ShellCheck fails closed, and the external-linter fixture proves both ShellCheck and Pyflakes are actually invoked.

[Chris0Jeky]

Exact-head supply-chain/security review — b44d938ff3222069d3bf0fb33821f1583fbdcf64

Outcome: no additional CRITICAL/HIGH/MEDIUM/LOW supply-chain or security findings. This is a bounded security review; it does not clear or duplicate the existing LOW canonical-doc gate-state finding.

I inspected the complete 10-file PR diff and then refreshed all current conversation comments, review submissions, bot feedback, and inline threads before posting. The Codex P1 claiming the release asset should be named linux_x86_64 is invalid and its thread is resolved: the official v1.7.12 release metadata and the successful hosted download both prove that actionlint_1.7.12_linux_amd64.tar.gz is the published asset.

Evidence

• Digest provenance: GitHub's release API reports the Actionlint asset digest as sha256:8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8. GitHub's artifact-attestation API binds that same subject/digest to rhysd/actionlint's GitHub-hosted release workflow at tag v1.7.12, source commit 914e7df21a07ef503a81201c76d2b11c789d3fca. PyPI's 3.4.0 JSON metadata independently matches the committed wheel filename, direct files.pythonhosted.org URL, and SHA-256 f742a7dbd0d9cb9ea41e9a24a918996e8170c799fa528688d40dd582c8265f4f; the file is not yanked.
• Download/install safety: both downloads are HTTPS-only and time-bounded, and both must pass the repository checksum verifier before extraction or install. Actionlint extraction names only the actionlint member, then rejects a non-regular file or symlink before chmod/execution. Pyflakes installs the pinned wheel into an isolated venv with --no-deps --no-index, then rejects a non-regular, symlinked, or non-executable entry point. Exact version checks fail closed.
• Toolchain parity: Actionlint is invoked with explicit absolute ShellCheck and Pyflakes paths. The integration fixture proves both external analyzers actually run by requiring the SC2086 and Pyflakes undefined-name diagnostics; the malformed-workflow fixture requires Actionlint exit 1 and its expected diagnostic.
• Credential/secret boundary: the job grants only contents: read; checkout uses persist-credentials: false. Hosted logs show checkout removed its temporary Git credentials before the toolchain step. No secret is passed to either downloaded executable, and exact-head Gitleaks/CodeQL checks report success with no findings.
• Hosted proof: CI Extended run 30239573804 is associated with source head b44d938ff3222069d3bf0fb33821f1583fbdcf64. Workflow Lint job 89893827604 checked out synthetic merge 2e5d767d91f17538674223d0021efa8d9c1c2728, whose parents are exactly base c3f9abaa9f95870b10edd8a81b922c7af6f66986 and this PR head. It logged both checksum successes, Actionlint 1.7.12, Pyflakes 3.4.0, ShellCheck 0.9.0, 7/7 contract passes, 32 discovered workflows, and 0 lint errors. No Docker build/pull appears in the job log.
• Independent local checks: portable contract subset 5/5; Node and Bash syntax; failure-ledger projection 11/11; docs, golden-principles, and GitHub-operations governance; exact-base/head git diff --check. All passed, and the worktree remained clean.

Residual trust boundaries / not certified here

• Runner-provided ShellCheck remains version-drift risk, already disclosed in the canonical docs. Missing/non-executable ShellCheck fails closed, and the hosted fixture proves current behavior.
• PyPI marks this wheel as uploaded via Twine rather than Trusted Publishing and exposes no signature. The reviewed, repository-pinned SHA-256 therefore establishes exact bytes against PyPI's publication, not independently signed build identity. I do not classify that as a defect against this checksum-pinned repair.
• This review does not certify the overall merge gate. At the final check, one unrelated Required CI E2E job was still pending, and the existing LOW documentation finding still requires coordinator triage.

[Chris0Jeky]

Review-fix evidence for exact head 3dac09dab46f67e9d42e6473335b352c66562c10:

• LOW canonical-truth finding from the portability review: fixed in 3dac09da. STATUS and MASTERPLAN now record the completed exact-head-associated Ubuntu proof while keeping maintainer merge and post-merge proof explicitly pending.
• PR Gate wording is synchronized to the same conditional truth.
• Verification after the fix: portable bootstrap/checksum tests 5/5, failure-ledger projection 11/11, docs governance, Golden Principles, GitHub-operations governance, and git diff --check all passed.
• The concurrent Codex linux_x86_64 P1 remains classified invalid on official release metadata plus hosted download/checksum evidence; its resolved thread required no code change.

Fresh exact-head CI and reviews are pending. The T4 maintainer-only hold is unchanged.

[Chris0Jeky]

@codex review exact head 3dac09d

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Breezy!

Reviewed commit: 3dac09dab4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Chris0Jeky]

Final exact-head supply-chain/security re-review — 3dac09dab46f67e9d42e6473335b352c66562c10

Outcome: no CRITICAL/HIGH/MEDIUM/LOW supply-chain or security findings. The prior LOW canonical-truth finding is fixed by the docs-only commit 3dac09da.

I inspected the complete current 10-file diff and refreshed every current issue comment, inline review comment, review submission, and thread before posting. The only inline thread remains the resolved Codex linux_x86_64 false positive; official release metadata and both hosted runs prove the committed linux_amd64 asset is correct.

Final-head review evidence

• The supply-chain implementation is byte-for-byte unchanged from reviewed head b44d938ff3222069d3bf0fb33821f1583fbdcf64: the final commit changes only docs/STATUS.md and docs/IMPLEMENTATION_MASTERPLAN.md.
• The corrected canonical wording does not overclaim. “Exact-head-associated” accurately distinguishes GitHub's source-head association from checkout of a synthetic PR merge, and both docs explicitly retain the unshipped/T4 state, maintainer merge, fresh post-merge proof, and runner-ShellCheck drift boundary.
• The PR Gate remains conservative: it names the earlier code-head run and says final-head automation is required. Since that text was written, final-head CI Extended has passed; the PR body can be refreshed after all automation settles without changing the commit.
• CI Extended run 30240141381 is associated with source head 3dac09dab46f67e9d42e6473335b352c66562c10. Workflow Lint job 89895446347 checked out synthetic merge f7100e89c86671d9ec439fc6ecce21a0e9c62c82, whose parents are exactly base c3f9abaa9f95870b10edd8a81b922c7af6f66986 and this final head.
• That final-head job logged both checksum successes, Actionlint 1.7.12, Pyflakes 3.4.0, ShellCheck 0.9.0, 7/7 contract passes, 32 discovered workflows, and zero lint errors. No Docker build or pull appears in the log. Final-head Dependency Review, Gitleaks, OpenAPI Guardrail, and the overall CI Extended workflow also passed.
• Local final-head verification passed: supply-file identity check; portable bootstrap/checksum tests 5/5; Node and Bash syntax; failure-ledger projection 11/11; docs, Golden Principles, and GitHub-operations governance; exact-base/head git diff --check. The worktree remained clean.

Residual boundaries

• Runner-provided ShellCheck remains intentionally unpinned and explicitly disclosed; missing/non-executable tooling fails closed and the external-linter fixture proves current invocation.
• The checksum-pinned Pyflakes wheel remains a PyPI/TLS publication trust boundary without Trusted Publishing or an independent signature, as recorded in the prior security review.
• This is not merge authorization. The T4 maintainer-only hold and post-merge proof remain; overall Required CI was still running at the review snapshot.

[Chris0Jeky]

Final exact-head adversarial re-review — 3dac09dab46f67e9d42e6473335b352c66562c10

Outcome: no CRITICAL, HIGH, MEDIUM, or LOW findings. The prior LOW canonical-doc truth finding is resolved without a new overclaim.

I inspected the complete current 10-file PR diff, the exact b44d938…3dac09d fix delta, the PR body, issue #1510, and every current conversation comment, review submission, bot comment, and inline thread before posting. The only inline thread is resolved; its old linux_x86_64 P1 remains correctly invalidated by official release metadata and live hosted evidence. The final-head Codex bot review also reported no major issues.

Fix verification

• Commit 3dac09d changes only the two canonical status sentences in docs/STATUS.md and docs/IMPLEMENTATION_MASTERPLAN.md; it is DCO-signed.
• Both docs now accurately record the completed exact-head-associated Ubuntu proof and its concrete scope—both checksum successes, 7/7 contract checks, 32 workflows, zero errors, no Docker build—while explicitly retaining the T4 maintainer-merge and fresh post-merge-proof boundaries.
• The wording does not claim the change is merged, shipped, or post-merge-verified.
• The PR Gate separately preserves the final-head automation, maintainer-merge, and post-merge gates.

Independent evidence

• Portable bootstrap/checksum subset: 5/5 passed with explicit Windows Git Bash.
• Failure-ledger projection: 11/11 passed.
• Docs governance, Golden Principles governance, and GitHub-operations governance: passed.
• Node syntax, Bash syntax, exact-base/final-head git diff --check, and clean worktree check: passed.
• Final-head CI Extended run 30240141381: success.
• Final-head Workflow Lint job 89895446347: checked out synthetic merge f7100e89c86671d9ec439fc6ecce21a0e9c62c82 from source head 3dac09d; both checksums passed; Actionlint 1.7.12, Pyflakes 3.4.0, and ShellCheck 0.9.0 were logged; 7/7 contract tests passed; 32 workflows were discovered and linted with 0 errors.

Residual gates

• Runner-provided ShellCheck version drift and PyPI wheel provenance remain the already-disclosed residual trust boundaries; neither is worsened by the docs-only fix.
• This review does not authorize merge. Required CI was still completing at the last refresh, and maintainer merge plus post-merge Workflow Lint proof remain mandatory.

[Chris0Jeky]

Current-main reconciliation is published at exact head f7d2f0aba7abb4cd55fcf5c6c47ba181a2bf867f.

Conflict resolution preserved both independent delivery records in docs/STATUS.md and docs/IMPLEMENTATION_MASTERPLAN.md, and unioned the append-only failure-ledger rows before regenerating the Markdown projection from JSONL. The signed merge commit is f7d2f0ab.

Exact-head local evidence:

• portable Actionlint bootstrap contract: 5/5
• failure-ledger renderer/synchronization: 11/11
• docs governance: passed
• Golden Principles: passed
• GitHub operations governance: passed
• git diff --check origin/main...HEAD: passed
• DCO: all 4 PR commits, including the merge, carry Signed-off-by

The full 7-check external-linter suite was not rerun locally because it requires provisioned Actionlint, ShellCheck, and Pyflakes paths; the fresh hosted Workflow Lint job remains the authoritative full bootstrap/linter proof and is now pending on this head.

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🎉

Reviewed commit: f7d2f0aba7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Chris0Jeky]

Fresh exact-head adversarial review — f7d2f0aba7abb4cd55fcf5c6c47ba181a2bf867f

Outcome: no CRITICAL, HIGH, MEDIUM, or LOW code, documentation, or merge-resolution findings. This is a read-only review; it does not authorize a merge.

I read the linked issue #1510, PR body, all 9 top-level conversation comments, all 3 review submissions/inline comments, and the sole review thread before reviewing the exact 397ba9d2368a7c5e7eb2daf31e1e43640b3ca144...f7d2f0aba7abb4cd55fcf5c6c47ba181a2bf867f diff with surrounding workflow/test context. The only inline report remains the resolved, correctly-invalidated linux_x86_64 false positive.

• f7d2f0ab is the signed merge of the reviewed workflow branch with current main; all four PR-range commits, including that merge, carry Signed-off-by trailers, and exact-range git diff --check passes.
• I independently inspected the four conflict surfaces. The resolution retains both independent #1512/#1518 and staged #1510 delivery records in the canonical docs, preserves the append-only JSONL rows, and keeps the regenerated Markdown projection aligned. Exact-head Required CI Docs Governance is green.
• The direct bootstrap remains fail-closed: bounded HTTPS download, checksum verification before extract/install, regular-file/symlink checks, exact tool versions, offline/no-dependency Pyflakes install, and explicit ShellCheck/Pyflakes paths. The external-linter fixtures exercise Actionlint, ShellCheck, and Pyflakes rather than only static workflow text.
• Exact-head CI Extended run 30268206419 is successful. Its Workflow Lint job completed checkout, toolchain install, the seven bootstrap-contract checks, and repository lint successfully; final-head CodeQL and DCO checks are also green.

Residual gates / risk

• Required CI run 30268206407 is still in progress at this review snapshot (the Windows/Ubuntu API-integration and unit-test lanes are not final). Earlier 3dac09d evidence is superseded and must not be used as a merge gate.
• Runner-provided ShellCheck version drift and checksum-pinned PyPI-wheel provenance remain the documented trust boundaries.
• T4 maintainer merge and fresh post-merge Workflow Lint proof remain required.

[Chris0Jeky]

Post-main reconciliation and current-head evidence

Signed merge 9547d1f002b8cb84fe232ca1f737b85e2cb078d3 incorporates current main 88eb6776ffd0ccaa5a6c87a88cbba31588dc9390. The delivery-entry and ledger changes merged mechanically without conflict; the JSONL ledger projection was rendered again and has no unstaged drift.

Current-tree verification:

• Actionlint bootstrap contract: 7/7 passed using Actionlint 1.7.12, ShellCheck 0.11.0, and Pyflakes 3.4.0; the malformed-workflow, corrupt-checksum, explicit ShellCheck, and explicit Pyflakes fixtures all fail as expected.
• bash -n scripts/ci/verify-sha256.sh and node --check scripts/ci/actionlint-bootstrap.test.mjs: passed.
• failure-ledger renderer tests: 11/11 passed; docs governance and golden-principles governance: passed; merge-base diff check: passed.
• I attempted the full repository Actionlint invocation with the Windows-compatible local tool equivalents. It produced no output for more than 100 seconds and was stopped with its single temporary orphan process. That local platform mismatch is not claimed as a lint pass; current-head CI Extended is the authoritative full Workflow Lint proof.

Hosted Required CI, CI Extended, CodeQL, and a fresh review are now required for this head. This workflow PR remains maintainer-merge only.

@codex review exact head 9547d1f002b8cb84fe232ca1f737b85e2cb078d3, please.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. You're on a roll.

Reviewed commit: 9547d1f002

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".