feat: adopt standards verification 1.7.0

.github/workflows/standards-drift.yml

@@ -11,7 +11,7 @@ permissions:
 
 jobs:
   drift:
-    uses: krav01/go-ci-standards/.github/workflows/standards-drift.yml@8925a43f25bf2af47ff3499a61946a0b07949f2b
+    uses: krav01/go-ci-standards/.github/workflows/standards-drift.yml@474ad9daa310517888f2da9168de6adaa78e2770
     with:
-      current_version: '1.6.0'
+      current_version: '1.7.0'
       fail_on_drift: false

.github/workflows/standards-integrity.yml

@@ -0,0 +1,62 @@
+name: Standards integrity
+
+on:
+  pull_request:
+    paths:
+      - '.standards.yml'
+      - '.github/workflows/**'
+  push:
+    branches: [main]
+    paths:
+      - '.standards.yml'
+      - '.github/workflows/**'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  integrity:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Start fast-path budget timer
+        run: echo "CI_BUDGET_STARTED=$(date +%s)" >> "$GITHUB_ENV"
+      - name: Verify standards metadata and immutable action pins
+        shell: bash
+        run: |
+          set -euo pipefail
+          version=$(awk '$1 == "version:" {print $2; exit}' .standards.yml)
+          source=$(awk '$1 == "public_ci_source:" {print $2; exit}' .standards.yml)
+          source_sha=${source##*@}
+          drift_sha=$(sed -n -E 's#.*standards-drift.yml@([0-9a-f]{40}).*#\1#p' .github/workflows/standards-drift.yml | head -n1)
+          drift_version=$(sed -n -E "s/.*current_version: '([^']+)'.*/\1/p" .github/workflows/standards-drift.yml | head -n1)
+
+          [[ "$source_sha" =~ ^[0-9a-f]{40}$ ]]
+          [[ "$drift_sha" == "$source_sha" ]]
+          [[ "$drift_version" == "$version" ]]
+
+          failed=0
+          while IFS= read -r workflow; do
+            while IFS= read -r target; do
+              [[ -z "$target" || "$target" == ./* || "$target" == docker://* ]] && continue
+              ref=${target##*@}
+              if [[ ! "$ref" =~ ^[0-9a-f]{40}$ ]]; then
+                echo "::error file=$workflow::Non-immutable action reference: $target"
+                failed=1
+              fi
+            done < <(sed -n -E 's/^[[:space:]]*-[[:space:]]*uses:[[:space:]]*([^[:space:]#]+).*/\1/p; s/^[[:space:]]*uses:[[:space:]]*([^[:space:]#]+).*/\1/p' "$workflow")
+          done < <(find .github/workflows -type f \( -name '*.yml' -o -name '*.yaml' \) -print)
+          [[ $failed -eq 0 ]]
+      - name: Check fast-path duration budget
+        if: always()
+        shell: bash
+        run: |
+          elapsed=$(( $(date +%s) - CI_BUDGET_STARTED ))
+          echo "Standards integrity duration: ${elapsed}s (budget: 300s)"
+          if (( elapsed > 300 )); then
+            echo "::warning title=CI duration budget exceeded::Fast standards path took ${elapsed}s; target is <=300s."
+          fi

.github/workflows/standards-upgrade.yml

@@ -21,18 +21,24 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: true
-      - name: Open forward-only standards upgrade PR
+      - name: Open validated forward-only standards upgrade PR
         shell: bash
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
 
           current=$(awk '$1 == "version:" {print $2; exit}' .standards.yml)
-          tag=$(gh api repos/krav01/go-ci-standards/releases/latest --jq .tag_name)
+          release=$(gh api repos/krav01/go-ci-standards/releases/latest)
+          tag=$(jq -r '.tag_name' <<<"$release")
+          draft=$(jq -r '.draft' <<<"$release")
+          prerelease=$(jq -r '.prerelease' <<<"$release")
           latest=${tag#v}
-          newest=$(printf '%s\n%s\n' "$current" "$latest" | sort -V | tail -n1)
 
+          [[ "$draft" == "false" && "$prerelease" == "false" ]] || { echo "Latest release is not stable" >&2; exit 1; }
+          [[ "$tag" == "v$latest" && -n "$latest" ]] || { echo "Invalid release tag: $tag" >&2; exit 1; }
+
+          newest=$(printf '%s\n%s\n' "$current" "$latest" | sort -V | tail -n1)
           if [[ "$newest" != "$latest" || "$current" == "$latest" ]]; then
             echo "No forward standards upgrade: current=$current latest=$latest"
             exit 0
@@ -50,6 +56,12 @@ jobs:
             exit 1
           fi
 
+          [[ "$public_sha" =~ ^[0-9a-f]{40}$ ]] || { echo "Resolved release SHA is invalid" >&2; exit 1; }
+          gh api "repos/krav01/go-ci-standards/commits/$public_sha" >/dev/null
+          published_version=$(gh api "repos/krav01/go-ci-standards/contents/VERSION?ref=$public_sha" --jq .content | tr -d '\n' | base64 --decode | tr -d '[:space:]')
+          [[ "$published_version" == "$latest" ]] || { echo "Release tag/SHA VERSION mismatch: tag=$latest file=$published_version" >&2; exit 1; }
+          gh api "repos/krav01/go-ci-standards/contents/.github/workflows/standards-drift.yml?ref=$public_sha" >/dev/null
+
           branch="chore/standards-$latest"
           if [[ $(gh pr list --state open --head "$branch" --json number --jq 'length') -gt 0 ]]; then
             echo "Upgrade PR already exists for $branch"
@@ -61,10 +73,22 @@ jobs:
           sed -i -E "s#(uses: krav01/go-ci-standards/.github/workflows/standards-drift.yml@)[0-9a-f]{40}#\\1$public_sha#" .github/workflows/standards-drift.yml
           sed -i -E "s/current_version: '[^']+'/current_version: '$latest'/" .github/workflows/standards-drift.yml
 
+          changed=$(git diff --name-only)
+          expected=$(printf '%s\n' '.github/workflows/standards-drift.yml' '.standards.yml')
+          if [[ "$(printf '%s\n' "$changed" | sort)" != "$(printf '%s\n' "$expected" | sort)" ]]; then
+            echo "Unexpected files in automated standards upgrade:" >&2
+            printf '%s\n' "$changed" >&2
+            exit 1
+          fi
+
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
           git checkout -b "$branch"
           git add .standards.yml .github/workflows/standards-drift.yml
           git commit -m "chore: adopt development standards $latest"
           git push origin "$branch"
-          gh pr create --base main --head "$branch" --title "chore: adopt development standards $latest" --body "Automated forward-only standards upgrade to $latest. Public workflow pin: $public_sha. Review and CI are still required; this workflow never auto-merges."
+          gh pr create \
+            --base main \
+            --head "$branch" \
+            --title "chore: adopt development standards $latest" \
+            --body "Automated forward-only standards upgrade to $latest. Verified release workflow pin: $public_sha. Only .standards.yml and standards-drift.yml were changed. Review and CI are still required; this workflow never auto-merges."

.standards.yml

@@ -1,14 +1,17 @@
-version: 1.6.0
+version: 1.7.0
 maturity: high-load-critical
 source: krav01/dev-standards
-public_ci_source: krav01/go-ci-standards@8925a43f25bf2af47ff3499a61946a0b07949f2b
+public_ci_source: krav01/go-ci-standards@474ad9daa310517888f2da9168de6adaa78e2770
 
 controls:
   reusable_ci: false
   standards_drift: true
   standards_auto_upgrade: true
   standards_fast_path: true
   immutable_action_pins: true
+  action_pin_scanner: true
+  release_sha_verification: true
+  ci_duration_budgets: true
   lint: true
   vulncheck: true
   race: true
@@ -29,6 +32,7 @@ controls:
   memory_hotspots: true
   verification_cache: true
   known_traps: true
+  impact_planner: v2
 
 exceptions:
   - control: reusable_ci