fix(ci): run exact-head gates on stacked pull requests

[seonghobae]

Closes #298.

Boundary

This Draft starts from protected main@e8109ec2a17de8bd6594487aa12c8c8a93cb2c03 and owns only .github/workflows/ci.yml plus src/workflowExactHead.test.ts. It is next-release CI evidence work and must remain Draft/unmerged while #118 owns the exact v0.6.0 source candidate.

Root cause

Two evidence gaps existed in the canonical CI contract:

1. Protected CI restricted pull_request to base branch main. Inkspan intentionally carries stacked Draft PRs whose bases are feature branches, so those PR heads did not receive the canonical repository CI matrix merely by opening or updating the PR.
2. Exact-head checkout was declarative only. Jobs configured actions/checkout with the immutable contributor head and disabled credential persistence, but did not independently compare the runtime checkout SHA with the expected event head before dependency setup or repository-code consumption.

Test-first lineage

Stacked-PR trigger

RED — e75a0035d753d8d58a9c04a8c254bf8914135e24

Production .github/workflows/ci.yml was unchanged. The new contract required push to remain main-only while pull_request accepted any base branch. Hosted CI 31655281195, build-and-test 94308284582, checked out that exact contributor head; frozen install and typecheck passed, the existing suite passed, and exactly the new workflow assertion failed.

GREEN — 3ea55387d8d7d88a80933b398abda78e42a4496b

The production change removed only branches: [main] beneath pull_request, preserving main-only push CI and the existing read-only, pinned exact-head matrix. Hosted CI 31655462144 succeeded on that exact head, including repository 100% owned-production coverage, library/package/demo, cross-engine browser evidence, and Office Python 3.11–3.14.

Runtime checkout attestation

RED — 85572a50d79a11c27c9171cc9180d7a53128bea0

The test-only change required all three canonical jobs to execute a runtime git rev-parse HEAD equality check against ${{ github.event.pull_request.head.sha || github.sha }} immediately after checkout. Hosted CI 31817640992, build-and-test 94823048656, checked out that exact SHA and passed frozen install/typecheck; 142/143 test files and 829/830 tests passed, with exactly the new runtime-attestation assertion failing.

GREEN — current exact head 58ef72706299eec1b5edfff22680785acc7b0cf6

Each canonical job now performs Verify exact checkout immediately after the immutable checkout and before setup/install or repository-code consumption. The step exports only the expected event SHA, derives the actual local head with git rev-parse HEAD, and fails unless the two are equal. No permission, network, credential, model, branch-protection, ruleset, release-identity, or persistence authority was added.

Hosted CI 31817916622 completed successfully on exact head 58ef72706299eec1b5edfff22680785acc7b0cf6. The build/test job 94823935459 passed the runtime checkout equality check, frozen install, typecheck, 143/143 test files and 830/830 tests, 100% statements/branches/functions/lines, library build, exact packed-package consumer verification, and demo build. The cross-engine Playwright job and Office Python 3.11–3.14 jobs also completed successfully and each passed the same runtime checkout equality step.

At this evidence generation, exact-head Security Scan and SAST Semgrep are still queued and therefore non-passing. Fresh formal reviews are 0 and unresolved inline review threads are 0. Any source-head movement invalidates the evidence above and requires a complete exact-head refetch.

Integration boundary

GitHub currently reports this PR mergeable, but it intentionally remains Draft. Live organization policy requires one qualifying independent approval, approval of the last push by someone other than the pusher, review-thread resolution, and all applicable central required workflows. Do not move protected main while #118 still owns exact v0.6.0 tag/publication/provenance/digest operational acceptance. After that release boundary closes, refetch the then-live protected tip, exact head, ancestry, rules, reviews/threads, and every applicable gate before any Ready/merge transition.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: e204dc1e-bbc8-4557-a283-14093d8f70b4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}