release-certification.yml

name: Release Certification

on:
  workflow_dispatch:
    inputs:
      mode:
        description: Certification mode.
        required: true
        default: nightly
        type: choice
        options:
          - pr
          - nightly
          - release-candidate
      extended-gates:
        description: Run extended interop soak in addition to smoke/performance evidence.
        required: true
        default: false
        type: boolean
      previous-summary-path:
        description: Optional local path to a candidate-bound migrate-v1 release-history v2 summary; candidate-release-id is required when set.
        required: false
        default: ''
        type: string
      require-history:
        description: Fail release-candidate certification when no previous summary is available.
        required: true
        default: false
        type: boolean
      write-history:
        description: Write sanitized current summaries under build/release-certification-history.
        required: true
        default: false
        type: boolean
      history-label:
        description: Optional release or git-ref label for write-history output.
        required: false
        default: ''
        type: string
      waiver-file-path:
        description: Optional local path to a structured release waiver JSON file.
        required: false
        default: ''
        type: string
      stable-readiness-summary-path:
        description: Optional local path to a candidate-bound Stable readiness v2 summary; candidate-release-id is required when set.
        required: false
        default: ''
        type: string
      candidate-release-id:
        description: Stable promotion candidate releaseId; required with previous-summary-path, any Stable readiness summary, or required Stable readiness.
        required: false
        default: ''
        type: string
      require-stable-readiness:
        description: Fail certification when Stable 1.0 readiness is missing or failing.
        required: true
        default: false
        type: boolean
      stable-vulnerability-run-id:
        description: Exact successful protected evaluate-promotion workflow run containing the encrypted vulnerability-ledger successor.
        required: false
        default: ''
        type: string
      stable-vulnerability-run-attempt:
        description: Exact protected evaluate-promotion workflow run attempt.
        required: false
        default: ''
        type: string
      stable-vulnerability-artifact-name:
        description: Exact encrypted protected-successor Actions artifact name.
        required: false
        default: ''
        type: string
      stable-vulnerability-artifact-digest:
        description: Exact sha256 digest reported by Actions for the encrypted protected-successor artifact.
        required: false
        default: ''
        type: string
      stable-dependency-vulnerability-run-id:
        description: Exact successful protected PR-290 verify-publication workflow run.
        required: false
        default: ''
        type: string
      stable-dependency-vulnerability-run-attempt:
        description: Exact protected PR-290 verify-publication run attempt.
        required: false
        default: ''
        type: string
      stable-dependency-vulnerability-artifact-name:
        description: Exact final authenticated PR-290 promotion artifact name.
        required: false
        default: ''
        type: string
      stable-dependency-vulnerability-artifact-digest:
        description: Exact Actions sha256 digest for the final PR-290 promotion artifact.
        required: false
        default: ''
        type: string
      stable-supply-chain-run-id:
        description: Exact successful protected PR-289 evaluate-promotion workflow run.
        required: false
        default: ''
        type: string
      stable-supply-chain-run-attempt:
        description: Exact protected PR-289 evaluate-promotion run attempt.
        required: false
        default: ''
        type: string
      stable-supply-chain-artifact-name:
        description: Exact authenticated PR-289 comparison artifact name.
        required: false
        default: ''
        type: string
      stable-supply-chain-artifact-digest:
        description: Exact Actions sha256 digest for the PR-289 comparison artifact.
        required: false
        default: ''
        type: string
      dependency-vulnerability-stage:
        description: Pre-publication candidate validation or explicit final post-publication certification.
        required: true
        default: pre-publication
        type: choice
        options:
          - pre-publication
          - post-publication
  schedule:
    - cron: '47 5 * * *'
  push:
    branches: [ 'release/**' ]
    tags: [ 'v*' ]

permissions: {}

jobs:
  certify-nonpromotion:
    if: >-
      github.event_name != 'push'
      && github.event.inputs.mode != 'release-candidate'
    concurrency:
      group: release-certification-nonpromotion-${{ github.run_id }}-${{ github.run_attempt }}
      cancel-in-progress: false
    runs-on: ubuntu-latest
    timeout-minutes: 150
    permissions:
      contents: read
      actions: read
    env:
      CERT_MODE: ${{ github.event_name == 'push' && 'release-candidate' || github.event.inputs.mode || 'nightly' }}
      RUN_EXTENDED_GATES: ${{ github.event.inputs['extended-gates'] || 'false' }}
      PREVIOUS_SUMMARY_PATH: ${{ github.event.inputs['previous-summary-path'] || '' }}
      REQUIRE_HISTORY: ${{ github.event.inputs['require-history'] || 'false' }}
      WRITE_HISTORY: ${{ github.event.inputs['write-history'] || 'false' }}
      HISTORY_LABEL: ${{ github.event.inputs['history-label'] || '' }}
      WAIVER_FILE_PATH: ${{ github.event.inputs['waiver-file-path'] || '' }}
      STABLE_READINESS_SUMMARY_PATH: ${{ github.event.inputs['stable-readiness-summary-path'] || '' }}
      CANDIDATE_RELEASE_ID: ${{ github.event.inputs['candidate-release-id'] || '' }}
      REQUIRE_STABLE_READINESS: ${{ github.event.inputs['require-stable-readiness'] || 'false' }}
      STABLE_VULNERABILITY_RUN_ID: ${{ github.event.inputs['stable-vulnerability-run-id'] || vars.STABLE_VULNERABILITY_PROMOTION_RUN_ID || '' }}
      STABLE_VULNERABILITY_RUN_ATTEMPT: ${{ github.event.inputs['stable-vulnerability-run-attempt'] || vars.STABLE_VULNERABILITY_PROMOTION_RUN_ATTEMPT || '' }}
      STABLE_VULNERABILITY_ARTIFACT_NAME: ${{ github.event.inputs['stable-vulnerability-artifact-name'] || vars.STABLE_VULNERABILITY_PROMOTION_ARTIFACT_NAME || '' }}
      STABLE_VULNERABILITY_ARTIFACT_DIGEST: ${{ github.event.inputs['stable-vulnerability-artifact-digest'] || vars.STABLE_VULNERABILITY_PROMOTION_ARTIFACT_DIGEST || '' }}
      STABLE_DEPENDENCY_VULNERABILITY_RUN_ID: ${{ github.event.inputs['stable-dependency-vulnerability-run-id'] || vars.STABLE_DEPENDENCY_VULNERABILITY_PROMOTION_RUN_ID || '' }}
      STABLE_DEPENDENCY_VULNERABILITY_RUN_ATTEMPT: ${{ github.event.inputs['stable-dependency-vulnerability-run-attempt'] || vars.STABLE_DEPENDENCY_VULNERABILITY_PROMOTION_RUN_ATTEMPT || '' }}
      STABLE_DEPENDENCY_VULNERABILITY_ARTIFACT_NAME: ${{ github.event.inputs['stable-dependency-vulnerability-artifact-name'] || vars.STABLE_DEPENDENCY_VULNERABILITY_PROMOTION_ARTIFACT_NAME || '' }}
      STABLE_DEPENDENCY_VULNERABILITY_ARTIFACT_DIGEST: ${{ github.event.inputs['stable-dependency-vulnerability-artifact-digest'] || vars.STABLE_DEPENDENCY_VULNERABILITY_PROMOTION_ARTIFACT_DIGEST || '' }}
      STABLE_SUPPLY_CHAIN_RUN_ID: ${{ github.event.inputs['stable-supply-chain-run-id'] || vars.STABLE_SUPPLY_CHAIN_PROMOTION_RUN_ID || '' }}
      STABLE_SUPPLY_CHAIN_RUN_ATTEMPT: ${{ github.event.inputs['stable-supply-chain-run-attempt'] || vars.STABLE_SUPPLY_CHAIN_PROMOTION_RUN_ATTEMPT || '' }}
      STABLE_SUPPLY_CHAIN_ARTIFACT_NAME: ${{ github.event.inputs['stable-supply-chain-artifact-name'] || vars.STABLE_SUPPLY_CHAIN_PROMOTION_ARTIFACT_NAME || '' }}
      STABLE_SUPPLY_CHAIN_ARTIFACT_DIGEST: ${{ github.event.inputs['stable-supply-chain-artifact-digest'] || vars.STABLE_SUPPLY_CHAIN_PROMOTION_ARTIFACT_DIGEST || '' }}
      DEPENDENCY_VULNERABILITY_STAGE: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs['dependency-vulnerability-stage'] || 'pre-publication' }}

    steps: &certification-steps
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Set up Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: '3.14.7'

      - name: Set up JDK 25
        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
        with:
          java-version: '25'
          distribution: 'temurin'

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0

      - name: Install Gradle properties
        uses: ./.github/actions/setup-gradle-properties

      - name: Authenticate exact Stable vulnerability promotion producer
        if: env.CERT_MODE == 'release-candidate'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          if [[ ! "$STABLE_VULNERABILITY_RUN_ID" =~ ^[1-9][0-9]*$ \
                || ! "$STABLE_VULNERABILITY_RUN_ATTEMPT" =~ ^[1-9][0-9]*$ \
                || ! "$STABLE_VULNERABILITY_ARTIFACT_NAME" =~ ^[A-Za-z0-9][A-Za-z0-9._-]{0,255}$ \
                || ! "$STABLE_VULNERABILITY_ARTIFACT_DIGEST" =~ ^sha256:[0-9a-f]{64}$ ]]; then
            echo "::error::Release-candidate certification requires exact protected Stable vulnerability producer coordinates."
            exit 2
          fi
          producer="$(gh api \
            "repos/$GITHUB_REPOSITORY/actions/runs/$STABLE_VULNERABILITY_RUN_ID/attempts/$STABLE_VULNERABILITY_RUN_ATTEMPT")"
          jq -e \
            --arg run_id "$STABLE_VULNERABILITY_RUN_ID" \
            --arg attempt "$STABLE_VULNERABILITY_RUN_ATTEMPT" \
            --arg commit "$GITHUB_SHA" '
              (.id | tostring) == $run_id
              and .event == "workflow_dispatch"
              and .conclusion == "success"
              and (.run_attempt | tostring) == $attempt
              and .path == ".github/workflows/stable-1.0-vulnerability-intake.yml"
              and .head_sha == $commit
              and .head_repository.full_name == "crypta-network/cryptad"' \
            <<< "$producer" >/dev/null
          artifacts="$(gh api --paginate --slurp \
            "repos/$GITHUB_REPOSITORY/actions/runs/$STABLE_VULNERABILITY_RUN_ID/artifacts?per_page=100" \
            --jq '[.[].artifacts[] | select(.name == env.STABLE_VULNERABILITY_ARTIFACT_NAME)]')"
          test "$(jq 'length' <<< "$artifacts")" = 1
          jq -e \
            --arg name "$STABLE_VULNERABILITY_ARTIFACT_NAME" \
            --arg digest "$STABLE_VULNERABILITY_ARTIFACT_DIGEST" '
              .[0].expired == false
              and .[0].name == $name
              and .[0].digest == $digest' \
            <<< "$artifacts" >/dev/null

      - name: Download exact encrypted Stable vulnerability promotion successor
        if: env.CERT_MODE == 'release-candidate'
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          github-token: ${{ github.token }}
          run-id: ${{ env.STABLE_VULNERABILITY_RUN_ID }}
          name: ${{ env.STABLE_VULNERABILITY_ARTIFACT_NAME }}
          path: ${{ runner.temp }}/stable-vulnerability-promotion-input

      - name: Authenticate exact Stable dependency-vulnerability promotion producer
        if: env.CERT_MODE == 'release-candidate' && env.DEPENDENCY_VULNERABILITY_STAGE == 'post-publication'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          if [[ ! "$STABLE_DEPENDENCY_VULNERABILITY_RUN_ID" =~ ^[1-9][0-9]*$ \
                || ! "$STABLE_DEPENDENCY_VULNERABILITY_RUN_ATTEMPT" =~ ^[1-9][0-9]*$ \
                || ! "$STABLE_DEPENDENCY_VULNERABILITY_ARTIFACT_NAME" =~ ^[A-Za-z0-9][A-Za-z0-9._-]{0,255}$ \
                || ! "$STABLE_DEPENDENCY_VULNERABILITY_ARTIFACT_DIGEST" =~ ^sha256:[0-9a-f]{64}$ ]]; then
            echo "::error::Post-activation release certification requires exact protected PR-290 producer coordinates."
            exit 2
          fi
          producer="$(gh api \
            "repos/$GITHUB_REPOSITORY/actions/runs/$STABLE_DEPENDENCY_VULNERABILITY_RUN_ID/attempts/$STABLE_DEPENDENCY_VULNERABILITY_RUN_ATTEMPT")"
          jq -e \
            --arg run_id "$STABLE_DEPENDENCY_VULNERABILITY_RUN_ID" \
            --arg attempt "$STABLE_DEPENDENCY_VULNERABILITY_RUN_ATTEMPT" \
            --arg commit "$GITHUB_SHA" '
              (.id | tostring) == $run_id
              and .event == "workflow_dispatch"
              and .conclusion == "success"
              and (.run_attempt | tostring) == $attempt
              and .path == ".github/workflows/stable-1.0-dependency-vulnerability-publication.yml"
              and .head_sha == $commit
              and .head_repository.full_name == "crypta-network/cryptad"' \
            <<< "$producer" >/dev/null
          artifacts="$(gh api --paginate --slurp \
            "repos/$GITHUB_REPOSITORY/actions/runs/$STABLE_DEPENDENCY_VULNERABILITY_RUN_ID/artifacts?per_page=100" \
            --jq '[.[].artifacts[] | select(.name == env.STABLE_DEPENDENCY_VULNERABILITY_ARTIFACT_NAME)]')"
          test "$(jq 'length' <<< "$artifacts")" = 1
          jq -e \
            --arg name "$STABLE_DEPENDENCY_VULNERABILITY_ARTIFACT_NAME" \
            --arg digest "$STABLE_DEPENDENCY_VULNERABILITY_ARTIFACT_DIGEST" '
              .[0].expired == false
              and .[0].name == $name
              and .[0].digest == $digest' \
            <<< "$artifacts" >/dev/null

      - name: Download exact authenticated Stable dependency-vulnerability promotion
        if: env.CERT_MODE == 'release-candidate' && env.DEPENDENCY_VULNERABILITY_STAGE == 'post-publication'
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          github-token: ${{ github.token }}
          run-id: ${{ env.STABLE_DEPENDENCY_VULNERABILITY_RUN_ID }}
          name: ${{ env.STABLE_DEPENDENCY_VULNERABILITY_ARTIFACT_NAME }}
          path: ${{ runner.temp }}/stable-dependency-vulnerability-promotion-input

      - name: Authenticate exact Stable supply-chain promotion producer
        if: env.CERT_MODE == 'release-candidate' && env.DEPENDENCY_VULNERABILITY_STAGE == 'post-publication'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          if [[ ! "$STABLE_SUPPLY_CHAIN_RUN_ID" =~ ^[1-9][0-9]*$ \
                || ! "$STABLE_SUPPLY_CHAIN_RUN_ATTEMPT" =~ ^[1-9][0-9]*$ \
                || ! "$STABLE_SUPPLY_CHAIN_ARTIFACT_NAME" =~ ^[A-Za-z0-9][A-Za-z0-9._-]{0,255}$ \
                || ! "$STABLE_SUPPLY_CHAIN_ARTIFACT_DIGEST" =~ ^sha256:[0-9a-f]{64}$ ]]; then
            echo "::error::Final PR-290 certification requires exact protected PR-289 producer coordinates."
            exit 2
          fi
          producer="$(gh api \
            "repos/$GITHUB_REPOSITORY/actions/runs/$STABLE_SUPPLY_CHAIN_RUN_ID/attempts/$STABLE_SUPPLY_CHAIN_RUN_ATTEMPT")"
          jq -e \
            --arg run_id "$STABLE_SUPPLY_CHAIN_RUN_ID" \
            --arg attempt "$STABLE_SUPPLY_CHAIN_RUN_ATTEMPT" \
            --arg commit "$GITHUB_SHA" '
              (.id | tostring) == $run_id
              and .event == "workflow_dispatch"
              and .conclusion == "success"
              and (.run_attempt | tostring) == $attempt
              and .path == ".github/workflows/stable-1.0-supply-chain.yml"
              and .head_sha == $commit
              and .head_repository.full_name == "crypta-network/cryptad"' \
            <<< "$producer" >/dev/null
          artifacts="$(gh api --paginate --slurp \
            "repos/$GITHUB_REPOSITORY/actions/runs/$STABLE_SUPPLY_CHAIN_RUN_ID/artifacts?per_page=100" \
            --jq '[.[].artifacts[] | select(.name == env.STABLE_SUPPLY_CHAIN_ARTIFACT_NAME)]')"
          test "$(jq 'length' <<< "$artifacts")" = 1
          jq -e \
            --arg name "$STABLE_SUPPLY_CHAIN_ARTIFACT_NAME" \
            --arg digest "$STABLE_SUPPLY_CHAIN_ARTIFACT_DIGEST" '
              .[0].expired == false
              and .[0].name == $name
              and .[0].digest == $digest' \
            <<< "$artifacts" >/dev/null

      - name: Download exact authenticated Stable supply-chain promotion
        if: env.CERT_MODE == 'release-candidate' && env.DEPENDENCY_VULNERABILITY_STAGE == 'post-publication'
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          github-token: ${{ github.token }}
          run-id: ${{ env.STABLE_SUPPLY_CHAIN_RUN_ID }}
          name: ${{ env.STABLE_SUPPLY_CHAIN_ARTIFACT_NAME }}
          path: ${{ runner.temp }}/stable-supply-chain-promotion-input

      - name: Run release certification self-tests
        run: python3 tools/release-certification/certify.py self-test all

      - name: Run Hyphanet interop smoke
        continue-on-error: true
        env:
          GITHUB_TOKEN: ${{ github.token }}
          INTEROP_MODE: smoke
        run: tools/interop/run-hyphanet-interop-smoke.sh

      - name: Run extended Hyphanet interop
        if: env.RUN_EXTENDED_GATES == 'true'
        continue-on-error: true
        env:
          INTEROP_MODE: extended
          INTEROP_ENABLE_USK_SUBSCRIBE_SOAK: '1'
          INTEROP_ENABLE_PERSISTENT_REPLAY: '1'
          INTEROP_ENABLE_OPENNET: '0'
          INTEROP_SOAK_DURATION_SECONDS: '900'
          INTEROP_SOAK_POLL_INTERVAL_SECONDS: '15'
          INTEROP_EXTENDED_TIMEOUT_SECONDS: '3600'
          INTEROP_OUT_DIR: build/interop-extended
          INTEROP_TIMEOUT_SECONDS: '3600'
          INTEROP_SKIP_BUILD: '1'
        run: tools/interop/run-hyphanet-interop-smoke.sh

      - name: Run performance smoke
        continue-on-error: true
        env:
          PERF_MODE: smoke
          PERF_OUT_DIR: build/perf-smoke
          PERF_TIMEOUT_SECONDS: '900'
          PERF_SKIP_BUILD: '1'
        run: tools/perf/run-performance-smoke.sh

      - name: Generate release certification report
        env:
          GH_TOKEN: ${{ github.token }}
          CRYPTAD_STABLE_VULNERABILITY_ANCHOR_READ_TOKEN: ${{ env.CERT_MODE == 'release-candidate' && secrets.CRYPTAD_STABLE_VULNERABILITY_ANCHOR_READ_TOKEN || '' }}
          CRYPTAD_CERT_MODE: ${{ env.CERT_MODE }}
          CRYPTAD_STABLE_VULNERABILITY_HANDOFF_KEY_BASE64: ${{ env.CERT_MODE == 'release-candidate' && secrets.CRYPTAD_STABLE_VULNERABILITY_HANDOFF_KEY_BASE64 || '' }}
          CRYPTAD_STABLE_DEPENDENCY_VULNERABILITY_ANCHOR_READ_TOKEN: ${{ env.CERT_MODE == 'release-candidate' && env.DEPENDENCY_VULNERABILITY_STAGE == 'post-publication' && secrets.CRYPTAD_STABLE_DEPENDENCY_VULNERABILITY_ANCHOR_READ_TOKEN || '' }}
          CRYPTAD_STABLE_DEPENDENCY_INTELLIGENCE_LINEAGE_READ_TOKEN: ${{ env.CERT_MODE == 'release-candidate' && env.DEPENDENCY_VULNERABILITY_STAGE == 'post-publication' && secrets.CRYPTAD_STABLE_DEPENDENCY_INTELLIGENCE_LINEAGE_READ_TOKEN || '' }}
          CRYPTAD_STABLE_DEPENDENCY_VULNERABILITY_HANDOFF_KEY_BASE64: ${{ env.CERT_MODE == 'release-candidate' && env.DEPENDENCY_VULNERABILITY_STAGE == 'post-publication' && secrets.CRYPTAD_STABLE_DEPENDENCY_VULNERABILITY_HANDOFF_KEY_BASE64 || '' }}
          CRYPTAD_STABLE_SUPPLY_CHAIN_HANDOFF_KEY_BASE64: ${{ env.CERT_MODE == 'release-candidate' && env.DEPENDENCY_VULNERABILITY_STAGE == 'post-publication' && secrets.CRYPTAD_STABLE_SUPPLY_CHAIN_HANDOFF_KEY_BASE64 || '' }}
          CRYPTAD_APP_SIGNING_KEY_ID: ${{ secrets.CRYPTAD_APP_SIGNING_KEY_ID }}
          CRYPTAD_APP_SIGNING_PRIVATE_KEY_BASE64: ${{ secrets.CRYPTAD_APP_SIGNING_PRIVATE_KEY_BASE64 }}
          CRYPTAD_APP_SIGNING_PUBLIC_KEY_BASE64: ${{ secrets.CRYPTAD_APP_SIGNING_PUBLIC_KEY_BASE64 }}
          CRYPTAD_APP_SIGNING_PRIVATE_KEY_FILE: ${{ secrets.CRYPTAD_APP_SIGNING_PRIVATE_KEY_FILE }}
          CRYPTAD_APP_SIGNING_PUBLIC_KEY_FILE: ${{ secrets.CRYPTAD_APP_SIGNING_PUBLIC_KEY_FILE }}
          CRYPTAD_APP_REVIEWER_KEY_ID: ${{ secrets.CRYPTAD_APP_REVIEWER_KEY_ID }}
          CRYPTAD_APP_REVIEWER_PRIVATE_KEY_BASE64: ${{ secrets.CRYPTAD_APP_REVIEWER_PRIVATE_KEY_BASE64 }}
          CRYPTAD_APP_REVIEWER_PUBLIC_KEY_BASE64: ${{ secrets.CRYPTAD_APP_REVIEWER_PUBLIC_KEY_BASE64 }}
          CRYPTAD_APP_REVIEWER_PRIVATE_KEY_FILE: ${{ secrets.CRYPTAD_APP_REVIEWER_PRIVATE_KEY_FILE }}
          CRYPTAD_APP_REVIEWER_PUBLIC_KEY_FILE: ${{ secrets.CRYPTAD_APP_REVIEWER_PUBLIC_KEY_FILE }}
          CRYPTAD_APP_REVIEW_POLICY_ID: ${{ secrets.CRYPTAD_APP_REVIEW_POLICY_ID }}
          CRYPTAD_APP_REVIEW_POLICY_VERSION: ${{ secrets.CRYPTAD_APP_REVIEW_POLICY_VERSION }}
        run: |
          release_version="$(./gradlew -q printVersion)"
          if [[ ! "$release_version" =~ ^[1-9][0-9]*$ ]]; then
            echo "::error::Expected a positive integer project version from ./gradlew -q printVersion, got '$release_version'."
            exit 2
          fi
          candidate_identity_bound=false
          if [[ "$CERT_MODE" == "release-candidate" ]]; then
            if [[ -n "$CANDIDATE_RELEASE_ID" ]]; then
              release_id="$CANDIDATE_RELEASE_ID"
              candidate_identity_bound=true
            elif [[ "$GITHUB_EVENT_NAME" == push \
                  && ( "$GITHUB_REF" == "refs/heads/release/$release_version" \
                    || "$GITHUB_REF" == "refs/tags/v$release_version" ) ]]; then
              release_id="cryptad-candidate-$release_version"
              candidate_identity_bound=true
            else
              echo "candidate-release-id is required for manually dispatched release-candidate vulnerability governance; automatic runs require the exact release/<build> branch or v<build> tag." >&2
              exit 2
            fi
          else
            release_id="${CANDIDATE_RELEASE_ID:-ci-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}}"
            if [[ -n "$CANDIDATE_RELEASE_ID" ]]; then
              candidate_identity_bound=true
            fi
          fi
          if [[ "$REQUIRE_STABLE_READINESS" == "true" \
                && "$candidate_identity_bound" != true ]]; then
            echo "candidate-release-id is required when require-stable-readiness is true." >&2
            exit 2
          fi
          if [[ -n "$STABLE_READINESS_SUMMARY_PATH" \
                && "$candidate_identity_bound" != true ]]; then
            echo "candidate-release-id is required when stable-readiness-summary-path is supplied." >&2
            exit 2
          fi
          if [[ -n "$PREVIOUS_SUMMARY_PATH" \
                && "$candidate_identity_bound" != true ]]; then
            echo "candidate-release-id is required when previous-summary-path is supplied." >&2
            exit 2
          fi
          require_vulnerability=false
          stable_vulnerability=""
          if [[ "$CERT_MODE" == "release-candidate" ]]; then
            require_vulnerability=true
            downloaded="$RUNNER_TEMP/stable-vulnerability-promotion-input"
            mapfile -t downloaded_entries < <(find "$downloaded" -mindepth 1 -printf '%P\n' | LC_ALL=C sort)
            expected_downloaded=(
              next-binding.json
              sealed-successor
              sealed-successor/stable-1.0-protected-handoff.enc
              sealed-successor/stable-1.0-protected-handoff.json
            )
            test "${downloaded_entries[*]}" = "${expected_downloaded[*]}"
            while IFS= read -r candidate; do
              test ! -L "$candidate"
              test "$(stat -c %h "$candidate")" = 1
            done < <(find "$downloaded" -type f -print)
            binding="$downloaded/next-binding.json"
            jq -e \
              --arg run_id "$STABLE_VULNERABILITY_RUN_ID" \
              --arg run_attempt "$STABLE_VULNERABILITY_RUN_ATTEMPT" \
              --arg artifact_name "$STABLE_VULNERABILITY_ARTIFACT_NAME" \
              --arg release_id "$release_id" \
              --arg build_version "$release_version" \
              --arg commit "$GITHUB_SHA" '
                .schemaVersion == "1"
                and .kind == "stable-1.0-vulnerability-successor-binding"
                and .artifactKind == "stable-vulnerability-protected-successor"
                and .repositoryIdentity == "github.com/crypta-network/cryptad"
                and .producerWorkflow == ".github/workflows/stable-1.0-vulnerability-intake.yml"
                and .workflowCommit == $commit
                and .runId == $run_id
                and .runAttempt == $run_attempt
                and .operation == "evaluate-promotion"
                and .releaseId == $release_id
                and .buildVersion == $build_version
                and .caseOpaqueId == "ledger-wide"
                and .artifactName == $artifact_name' \
              "$binding" >/dev/null
            external_root="$RUNNER_TEMP/stable-vulnerability-summary-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT"
            opened="$RUNNER_TEMP/stable-vulnerability-opened-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT"
            rm -rf "$external_root" "$opened"
            python3 tools/release-certification/protected/stable_backport_protected_handoff.py open \
              --bundle "$downloaded/sealed-successor" \
              --out "$opened" \
              --binding "$binding" \
              --key-env CRYPTAD_STABLE_VULNERABILITY_HANDOFF_KEY_BASE64
            summary_name=stable-1.0-vulnerability-summary.json
            source="$opened/$summary_name"
            if [[ -L "$source" || ! -f "$source" \
                  || "$(stat -c %h "$source")" -ne 1 \
                  || "$(stat -c %s "$source")" -le 0 \
                  || "$(stat -c %s "$source")" -gt 4194304 ]]; then
              echo "::error::Authenticated Stable vulnerability summary is missing, linked, or oversized."
              exit 1
            fi
            install -d -m 700 "$external_root" "$external_root/sealed-successor"
            install -m 600 "$source" "$external_root/$summary_name"
            install -m 600 "$binding" \
              "$external_root/stable-1.0-vulnerability-successor-binding.json"
            install -m 600 "$downloaded/sealed-successor/stable-1.0-protected-handoff.enc" \
              "$external_root/sealed-successor/stable-1.0-protected-handoff.enc"
            install -m 600 "$downloaded/sealed-successor/stable-1.0-protected-handoff.json" \
              "$external_root/sealed-successor/stable-1.0-protected-handoff.json"
            PRODUCER_ARTIFACT_DIGEST="$STABLE_VULNERABILITY_ARTIFACT_DIGEST" \
              VULNERABILITY_HANDOFF_ROOT="$external_root" python3 - <<'PY'
          import hashlib
          import json
          import os
          from pathlib import Path

          root = Path(os.environ["VULNERABILITY_HANDOFF_ROOT"])
          summary = json.loads(
              (root / "stable-1.0-vulnerability-summary.json").read_text(encoding="utf-8")
          )
          binding_raw = (
              root / "stable-1.0-vulnerability-successor-binding.json"
          ).read_bytes()
          summary_raw = (root / "stable-1.0-vulnerability-summary.json").read_bytes()
          digest = lambda raw: "sha256:" + hashlib.sha256(raw).hexdigest()
          provenance = {
              "schemaVersion": 1,
              "kind": "stable-1.0-vulnerability-summary-provenance",
              "producerArtifactDigest": os.environ["PRODUCER_ARTIFACT_DIGEST"],
              "successorBindingFileDigest": digest(binding_raw),
              "summaryFileDigest": digest(summary_raw),
              "summaryDigest": summary["summaryDigest"],
          }
          canonical = json.dumps(
              provenance,
              ensure_ascii=False,
              sort_keys=True,
              separators=(",", ":"),
              allow_nan=False,
          ).encode("utf-8")
          provenance["provenanceDigest"] = digest(canonical)
          (root / "stable-1.0-vulnerability-summary-provenance.json").write_text(
              json.dumps(provenance, indent=2, sort_keys=True) + "\n",
              encoding="utf-8",
          )
          PY
            current_tip_environment="$RUNNER_TEMP/stable-vulnerability-current-tip.env"
            : > "$current_tip_environment"
            genesis_digest="$(jq -er .ledgerDigest \
              tools/release-certification/stable-1.0-vulnerability-ledger-genesis.json)"
            python3 tools/release-certification/protected/stable_vulnerability_actions_tip.py \
              verify-promotion \
              --repository "$GITHUB_REPOSITORY" \
              --expected-run-id "$STABLE_VULNERABILITY_RUN_ID" \
              --expected-run-attempt "$STABLE_VULNERABILITY_RUN_ATTEMPT" \
              --expected-artifact-name "$STABLE_VULNERABILITY_ARTIFACT_NAME" \
              --expected-artifact-digest "$STABLE_VULNERABILITY_ARTIFACT_DIGEST" \
              --genesis-ledger-digest "$genesis_digest" \
              --binding "$external_root/stable-1.0-vulnerability-successor-binding.json" \
              --provenance "$external_root/stable-1.0-vulnerability-summary-provenance.json" \
              --environment-file "$current_tip_environment"
            set -a
            source "$current_tip_environment"
            set +a
            mapfile -t external_entries < <(find "$external_root" -mindepth 1 -printf '%P\n' | LC_ALL=C sort)
            expected_external=(
              sealed-successor
              sealed-successor/stable-1.0-protected-handoff.enc
              sealed-successor/stable-1.0-protected-handoff.json
              stable-1.0-vulnerability-successor-binding.json
              stable-1.0-vulnerability-summary-provenance.json
              stable-1.0-vulnerability-summary.json
            )
            test "${external_entries[*]}" = "${expected_external[*]}"
            rm -rf "$opened"
            export CRYPTAD_STABLE_VULNERABILITY_SUMMARY_ROOT="$external_root"
            stable_vulnerability="$external_root/$summary_name"
          fi
          require_supply_chain=false
          stable_supply_chain=""
          if [[ "$CERT_MODE" == "release-candidate" && "$DEPENDENCY_VULNERABILITY_STAGE" == "post-publication" ]]; then
            require_supply_chain=true
            downloaded_supply="$RUNNER_TEMP/stable-supply-chain-promotion-input"
            expected_supply_name="stable-1.0-supply-chain-$release_id-comparison"
            if [[ "$STABLE_SUPPLY_CHAIN_ARTIFACT_NAME" != "$expected_supply_name" \
                  || -n "$(find "$downloaded_supply" -type l -print -quit)" \
                  || -n "$(find "$downloaded_supply" -mindepth 1 ! -type f ! -type d -print -quit)" \
                  || -n "$(find "$downloaded_supply" -type f -links +1 -print -quit)" \
                  || "$(find "$downloaded_supply" -type f | wc -l)" -gt 128 \
                  || "$(du -sb "$downloaded_supply" | cut -f1)" -gt 268435456 ]]; then
              echo "::error::Authenticated PR-289 promotion artifact is unsafe or differs from the exact candidate."
              exit 1
            fi
            supply_source="$downloaded_supply/stable-1.0-supply-chain-summary.json"
            supply_manifest="$downloaded_supply/manifest.json"
            for subject in "$supply_source" "$supply_manifest"; do
              if [[ -L "$subject" || ! -f "$subject" \
                    || "$(stat -c %h "$subject")" -ne 1 \
                    || "$(stat -c %s "$subject")" -le 0 \
                    || "$(stat -c %s "$subject")" -gt 4194304 ]]; then
                echo "::error::Authenticated PR-289 promotion artifact lacks a bounded canonical subject."
                exit 1
              fi
              gh attestation verify "$subject" \
                --repo "$GITHUB_REPOSITORY" \
                --signer-workflow "crypta-network/cryptad/.github/workflows/stable-1.0-supply-chain.yml" \
                --source-digest "$GITHUB_SHA" \
                --deny-self-hosted-runners >/dev/null
            done
            jq -e \
              --arg release "$release_id" \
              --arg build "$release_version" \
              --arg commit "$GITHUB_SHA" '
                .release.id == $release
                and .release.version == $build
                and .policies.candidateSourceCommit == $commit
                and .policies.candidateSourceRef == ("commit:" + $commit)
                and .requirements.stableSupplyChain == true
                and .commands["stable-supply-chain"].mode == "evaluate-promotion"' \
              "$supply_manifest" >/dev/null
            jq -e \
              --arg release "$release_id" \
              --argjson build "$release_version" \
              --arg commit "$GITHUB_SHA" '
                .kind == "stable-1.0-supply-chain-promotion-summary"
                and .releaseId == $release
                and .buildVersion == $build
                and .sourceCommit == $commit
                and .sourceRef == ("commit:" + $commit)
                and .mode == "evaluate-promotion"
                and .status == "pass"
                and .promotionReady == true
                and .blockers == []
                and .waivers == []
                and .redaction.status == "pass"
                and .redaction.sideEffectsPerformed == false' \
              "$supply_source" >/dev/null
            supply_root="$RUNNER_TEMP/stable-supply-chain-summary-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT"
            rm -rf "$supply_root"
            install -d -m 700 "$supply_root"
            stable_supply_chain="$supply_root/stable-1.0-supply-chain-summary.json"
            supply_provenance="$supply_root/stable-1.0-supply-chain-summary-provenance.json"
            install -m 600 "$supply_source" "$stable_supply_chain"
            SUPPLY_CHAIN_SUMMARY="$stable_supply_chain" \
              SUPPLY_CHAIN_PROVENANCE="$supply_provenance" \
              SUPPLY_CHAIN_RELEASE_ID="$release_id" \
              SUPPLY_CHAIN_BUILD_VERSION="$release_version" \
              python3 - <<'PY'
          import base64
          import binascii
          import hashlib
          import json
          import os
          from pathlib import Path
          import sys

          sys.path.insert(0, "tools/release-certification")
          from cryptad_certification.engines.release_certification_core import (
              STABLE_SUPPLY_CHAIN_HANDOFF_KEY_ENV,
              stable_supply_chain_handoff_authentication_tag,
          )

          summary = Path(os.environ["SUPPLY_CHAIN_SUMMARY"])
          provenance = Path(os.environ["SUPPLY_CHAIN_PROVENANCE"])
          summary_digest = "sha256:" + hashlib.sha256(summary.read_bytes()).hexdigest()
          handoff = {
              "schemaVersion": 1,
              "kind": "stable-1.0-supply-chain-promotion-handoff",
              "repository": os.environ["GITHUB_REPOSITORY"],
              "workflow": (
                  os.environ["GITHUB_REPOSITORY"]
                  + "/.github/workflows/stable-1.0-supply-chain.yml@"
                  + os.environ["GITHUB_SHA"]
              ),
              "workflowCommit": os.environ["GITHUB_SHA"],
              "runId": os.environ["STABLE_SUPPLY_CHAIN_RUN_ID"],
              "runAttempt": os.environ["STABLE_SUPPLY_CHAIN_RUN_ATTEMPT"],
              "operation": "compare-evaluate",
              "releaseId": os.environ["SUPPLY_CHAIN_RELEASE_ID"],
              "buildVersion": os.environ["SUPPLY_CHAIN_BUILD_VERSION"],
              "sourceCommit": os.environ["GITHUB_SHA"],
              "artifactName": os.environ["STABLE_SUPPLY_CHAIN_ARTIFACT_NAME"],
              "producerArtifactDigest": os.environ[
                  "STABLE_SUPPLY_CHAIN_ARTIFACT_DIGEST"
              ],
              "summaryFileName": "stable-1.0-supply-chain-summary.json",
              "summaryByteDigest": summary_digest,
              "attestationSubjectDigest": summary_digest,
              "attestationVerified": True,
              "denySelfHostedRunners": True,
              "authenticationStatus": "pass",
              "authenticationAlgorithm": "hmac-sha256",
              "authenticationTag": "pending",
          }
          encoded = os.environ.get(STABLE_SUPPLY_CHAIN_HANDOFF_KEY_ENV, "")
          try:
              key = base64.b64decode(encoded, validate=True)
          except (ValueError, binascii.Error) as error:
              raise SystemExit("Stable supply-chain handoff key is invalid") from error
          if len(key) != 32 or base64.b64encode(key).decode("ascii") != encoded:
              raise SystemExit("Stable supply-chain handoff key is invalid")
          handoff["authenticationTag"] = (
              stable_supply_chain_handoff_authentication_tag(handoff, key)
          )
          provenance.write_text(
              json.dumps(handoff, ensure_ascii=False, indent=2, sort_keys=True) + "\n",
              encoding="utf-8",
          )
          PY
            chmod 0600 "$supply_provenance"
          fi
          require_dependency_vulnerability=false
          stable_dependency_vulnerability=""
          if [[ "$CERT_MODE" == "release-candidate" && "$DEPENDENCY_VULNERABILITY_STAGE" == "post-publication" ]]; then
            require_dependency_vulnerability=true
            dependency_root="$RUNNER_TEMP/stable-dependency-vulnerability-promotion-input"
            mapfile -t dependency_entries < <(find "$dependency_root" -mindepth 1 -printf '%P\n' | LC_ALL=C sort)
            expected_dependency_entries=(
              stable-1.0-dependency-vulnerability-promotion-summary.json
              stable-1.0-dependency-vulnerability-source-status.json
              stable-1.0-dependency-vulnerability-summary-provenance.json
            )
            test "${dependency_entries[*]}" = "${expected_dependency_entries[*]}"
            while IFS= read -r candidate; do
              test ! -L "$candidate"
              test "$(stat -c %h "$candidate")" = 1
              test "$(stat -c %s "$candidate")" -gt 0
              test "$(stat -c %s "$candidate")" -le 4194304
            done < <(find "$dependency_root" -type f -print)
            dependency_summary="$dependency_root/stable-1.0-dependency-vulnerability-promotion-summary.json"
            ledger_digest="$(jq -er '.ledgerDigest | select(test("^sha256:[0-9a-f]{64}$"))' "$dependency_summary")"
            ledger_edition="$(jq -er '.ledgerEdition | select(type == "number" and . >= 1 and floor == .)' "$dependency_summary")"
            valid_until="$(jq -er '.validUntil | select(type == "string")' "$dependency_summary")"
            python3 tools/release-certification/protected/stable_dependency_vulnerability_actions_tip.py verify-current \
              --repository "$GITHUB_REPOSITORY" \
              --expected-ledger-digest "$ledger_digest" \
              --expected-ledger-edition "$ledger_edition"
            export CRYPTAD_STABLE_DEPENDENCY_VULNERABILITY_CURRENT_TIP_LEDGER_DIGEST="$ledger_digest"
            export CRYPTAD_STABLE_DEPENDENCY_VULNERABILITY_CURRENT_TIP_LEDGER_EDITION="$ledger_edition"
            stable_dependency_vulnerability="$dependency_summary"
          fi
          interop_smoke=""
          interop_extended=""
          performance_smoke=""
          if [[ -f "build/interop-smoke/summary.json" ]]; then
            interop_smoke="build/interop-smoke/summary.json"
          fi
          if [[ -f "build/interop-extended/summary.json" ]]; then
            interop_extended="build/interop-extended/summary.json"
          fi
          if [[ -f "build/perf-smoke/summary.json" ]]; then
            performance_smoke="build/perf-smoke/summary.json"
          fi
          manifest="$RUNNER_TEMP/release-certification-manifest.json"
          jq -n \
            --arg release_id "$release_id" \
            --arg release_version "$release_version" \
            --arg profile "$CERT_MODE" \
            --arg interop_smoke "$interop_smoke" \
            --arg interop_extended "$interop_extended" \
            --arg performance_smoke "$performance_smoke" \
            --arg release_history "$PREVIOUS_SUMMARY_PATH" \
            --arg waiver_file "$WAIVER_FILE_PATH" \
            --arg stable_readiness "$STABLE_READINESS_SUMMARY_PATH" \
            --arg stable_vulnerability "$stable_vulnerability" \
            --arg stable_supply_chain "$stable_supply_chain" \
            --arg stable_dependency_vulnerability "$stable_dependency_vulnerability" \
            --arg history_label "$HISTORY_LABEL" \
            --argjson require_history "$REQUIRE_HISTORY" \
            --argjson write_history "$WRITE_HISTORY" \
            --argjson require_stable "$REQUIRE_STABLE_READINESS" \
            --argjson require_vulnerability "$require_vulnerability" \
            --argjson require_supply_chain "$require_supply_chain" \
            --argjson require_dependency_vulnerability "$require_dependency_vulnerability" \
            '{
              schemaVersion: 1,
              release: {id: $release_id, version: $release_version, profile: $profile},
              output: {root: "build/release-certification", reset: true},
              requirements: {
                history: $require_history,
                liveNetwork: false,
                multiNodeSoak: true,
                sandboxProviderTests: true,
                stableReadiness: $require_stable,
                stableVulnerability: $require_vulnerability,
                stableSupplyChain: $require_supply_chain,
                stableDependencyVulnerability: $require_dependency_vulnerability,
                thirdPartyIntake: true
              },
              inputs: ({}
                + (if $interop_smoke == "" then {} else {interopSmoke: $interop_smoke} end)
                + (if $interop_extended == "" then {} else {interopExtended: $interop_extended} end)
                + (if $performance_smoke == "" then {} else {performanceSmoke: $performance_smoke} end)
                + (if $release_history == "" then {} else {releaseHistory: $release_history} end)
                + (if $waiver_file == "" then {} else {waiverFile: $waiver_file} end)
                + (if $stable_readiness == "" then {} else {stableReadiness: $stable_readiness} end)
                + (if $stable_vulnerability == "" then {} else {stableVulnerabilitySummary: $stable_vulnerability} end)
                + (if $stable_supply_chain == "" then {} else {supplyChainPromotionSummary: $stable_supply_chain} end)
                + (if $stable_dependency_vulnerability == "" then {} else {dependencyVulnerabilityPromotionSummary: $stable_dependency_vulnerability} end)),
              policies: ({metadata: {candidateReleaseId: $release_id}}
                + (if $history_label == "" then {} else {historyLabel: $history_label} end)
                + (if $require_vulnerability then {stableVulnerabilityGovernance: "required"} else {} end)
                + (if $require_supply_chain then {stableSupplyChainGovernance: "required"} else {} end)
                + (if $require_dependency_vulnerability then {
                    stableDependencyVulnerabilityGovernance: "required",
                    candidateSourceCommit: env.GITHUB_SHA,
                    candidateSourceRef: ("commit:" + env.GITHUB_SHA)
                  } else {} end)),
              execution: {collectEvidence: true, writeHistory: $write_history},
              commands: {}
            }' > "$manifest"
          if [[ "$CERT_MODE" == "release-candidate" && "$DEPENDENCY_VULNERABILITY_STAGE" == "post-publication" ]]; then
            python3 tools/release-certification/protected/stable_dependency_intelligence_actions_lineage.py verify-current-summary \
              --repository "$GITHUB_REPOSITORY" \
              --source-status "$dependency_root/stable-1.0-dependency-vulnerability-source-status.json" \
              --promotion-summary "$dependency_summary" \
              --handoff "$dependency_root/stable-1.0-dependency-vulnerability-summary-provenance.json"
            certification_clock="$(date -u +'%Y-%m-%dT%H:%M:%SZ')"
            python3 - "$certification_clock" "$valid_until" <<'PY'
          import datetime as dt
          import sys

          clock = dt.datetime.fromisoformat(sys.argv[1].replace("Z", "+00:00"))
          valid_until = dt.datetime.fromisoformat(sys.argv[2].replace("Z", "+00:00"))
          if clock.tzinfo is None or valid_until.tzinfo is None or clock >= valid_until:
              raise SystemExit(
                  "dependency-vulnerability promotion evidence expired before final certification"
              )
          PY
          fi
          python3 tools/release-certification/certify.py release-certification --manifest "$manifest"

      - name: Upload release certification artifacts
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: release-certification-${{ github.run_id }}-${{ github.run_attempt }}
          path: |
            build/release-certification/
            build/release-certification-history/
            !**/private-insert-uris.json
          if-no-files-found: warn
          retention-days: 30

  certify-release-candidate:
    if: >-
      github.event_name == 'push'
      || github.event.inputs.mode == 'release-candidate'
    concurrency:
      group: stable-1-0-vulnerability-ledger
      cancel-in-progress: false
    runs-on: ubuntu-latest
    timeout-minutes: 150
    environment: stable-1-0-release-certification
    permissions:
      contents: read
      actions: read
      attestations: read
    env:
      CERT_MODE: release-candidate
      RUN_EXTENDED_GATES: ${{ github.event.inputs['extended-gates'] || 'false' }}
      PREVIOUS_SUMMARY_PATH: ${{ github.event.inputs['previous-summary-path'] || '' }}
      REQUIRE_HISTORY: ${{ github.event.inputs['require-history'] || 'false' }}
      WRITE_HISTORY: ${{ github.event.inputs['write-history'] || 'false' }}
      HISTORY_LABEL: ${{ github.event.inputs['history-label'] || '' }}
      WAIVER_FILE_PATH: ${{ github.event.inputs['waiver-file-path'] || '' }}
      STABLE_READINESS_SUMMARY_PATH: ${{ github.event.inputs['stable-readiness-summary-path'] || '' }}
      CANDIDATE_RELEASE_ID: ${{ github.event.inputs['candidate-release-id'] || '' }}
      REQUIRE_STABLE_READINESS: ${{ github.event.inputs['require-stable-readiness'] || 'false' }}
      STABLE_VULNERABILITY_RUN_ID: ${{ github.event.inputs['stable-vulnerability-run-id'] || vars.STABLE_VULNERABILITY_PROMOTION_RUN_ID || '' }}
      STABLE_VULNERABILITY_RUN_ATTEMPT: ${{ github.event.inputs['stable-vulnerability-run-attempt'] || vars.STABLE_VULNERABILITY_PROMOTION_RUN_ATTEMPT || '' }}
      STABLE_VULNERABILITY_ARTIFACT_NAME: ${{ github.event.inputs['stable-vulnerability-artifact-name'] || vars.STABLE_VULNERABILITY_PROMOTION_ARTIFACT_NAME || '' }}
      STABLE_VULNERABILITY_ARTIFACT_DIGEST: ${{ github.event.inputs['stable-vulnerability-artifact-digest'] || vars.STABLE_VULNERABILITY_PROMOTION_ARTIFACT_DIGEST || '' }}
      STABLE_DEPENDENCY_VULNERABILITY_RUN_ID: ${{ github.event.inputs['stable-dependency-vulnerability-run-id'] || vars.STABLE_DEPENDENCY_VULNERABILITY_PROMOTION_RUN_ID || '' }}
      STABLE_DEPENDENCY_VULNERABILITY_RUN_ATTEMPT: ${{ github.event.inputs['stable-dependency-vulnerability-run-attempt'] || vars.STABLE_DEPENDENCY_VULNERABILITY_PROMOTION_RUN_ATTEMPT || '' }}
      STABLE_DEPENDENCY_VULNERABILITY_ARTIFACT_NAME: ${{ github.event.inputs['stable-dependency-vulnerability-artifact-name'] || vars.STABLE_DEPENDENCY_VULNERABILITY_PROMOTION_ARTIFACT_NAME || '' }}
      STABLE_DEPENDENCY_VULNERABILITY_ARTIFACT_DIGEST: ${{ github.event.inputs['stable-dependency-vulnerability-artifact-digest'] || vars.STABLE_DEPENDENCY_VULNERABILITY_PROMOTION_ARTIFACT_DIGEST || '' }}
      STABLE_SUPPLY_CHAIN_RUN_ID: ${{ github.event.inputs['stable-supply-chain-run-id'] || vars.STABLE_SUPPLY_CHAIN_PROMOTION_RUN_ID || '' }}
      STABLE_SUPPLY_CHAIN_RUN_ATTEMPT: ${{ github.event.inputs['stable-supply-chain-run-attempt'] || vars.STABLE_SUPPLY_CHAIN_PROMOTION_RUN_ATTEMPT || '' }}
      STABLE_SUPPLY_CHAIN_ARTIFACT_NAME: ${{ github.event.inputs['stable-supply-chain-artifact-name'] || vars.STABLE_SUPPLY_CHAIN_PROMOTION_ARTIFACT_NAME || '' }}
      STABLE_SUPPLY_CHAIN_ARTIFACT_DIGEST: ${{ github.event.inputs['stable-supply-chain-artifact-digest'] || vars.STABLE_SUPPLY_CHAIN_PROMOTION_ARTIFACT_DIGEST || '' }}
      DEPENDENCY_VULNERABILITY_STAGE: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs['dependency-vulnerability-stage'] || 'pre-publication' }}
    steps: *certification-steps