From e0c4034a0d23f7697d5643c4db680d1a957d299a Mon Sep 17 00:00:00 2001
From: Tom Softreck <tom@sapletta.com>
Date: Tue, 8 Sep 2026 12:10:59 +0200
Subject: [PATCH] ci: pin artifact upload v7.0.1 (ticket-090)

---
 .github/workflows/dependencies.yml |  2 +-
 project/ticket-090/README.md       | 14 ++++++
 project/ticket-090/ai-codex.md     |  3 ++
 project/ticket-090/intent.json     | 74 ++++++++++++++++++++++++++++++
 4 files changed, 92 insertions(+), 1 deletion(-)
 create mode 100644 project/ticket-090/README.md
 create mode 100644 project/ticket-090/ai-codex.md
 create mode 100644 project/ticket-090/intent.json

diff --git a/.github/workflows/dependencies.yml b/.github/workflows/dependencies.yml
index 951081c..038730c 100644
--- a/.github/workflows/dependencies.yml
+++ b/.github/workflows/dependencies.yml
@@ -38,7 +38,7 @@ jobs:
             --check > dependency-freshness.json
       - name: Retain freshness evidence
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: goal-dependency-freshness
           path: dependency-freshness.json
diff --git a/project/ticket-090/README.md b/project/ticket-090/README.md
new file mode 100644
index 0000000..2c39665
--- /dev/null
+++ b/project/ticket-090/README.md
@@ -0,0 +1,14 @@
+# Ticket 090: Govern artifact upload update
+
+- **Status**: IN_PROGRESS
+- **Workflow state**: PUBLICATION
+- **Owner**: codex
+
+## Goal and scope
+Publish the upgrade requested by PR #124, pinning upload-artifact v7.0.1 to its immutable revision. A replacement PR carries this ticket in its first material commit because the original Dependabot commit predates a required intent. Preserve the original remote history.
+
+## Acceptance criteria
+- [x] AC-01: Artifact name, path, missing-file handling and workflow permissions remain unchanged; upstream release SHA, archive default and Node runtime are verified.
+- [ ] AC-02: Managed and stack checks pass on current main plus the upgrade; protected Validator merges the exact reviewed head.
+
+Prerequisite: ticket-091 publishes new-project 0.20.12. Upstream v7.0.1 resolves to 043fb46d1a93c77aae656e7c1c64a875d1fc6a0a, uses Node 24 and retains archive=true by default. Full Goal tests passed in the prerequisite (723 passed, 2 skipped); the replacement retains required CI.
diff --git a/project/ticket-090/ai-codex.md b/project/ticket-090/ai-codex.md
new file mode 100644
index 0000000..2f169fa
--- /dev/null
+++ b/project/ticket-090/ai-codex.md
@@ -0,0 +1,3 @@
+SESSION_EXECUTION_AUTHORIZATION: User requested continuation of Semcod pending PR/issue publication. Complete PR 124 in an isolated ticket worktree, preserve remote history without force push, validate, and invoke independent protected publication.
+
+Reconciliation: the original PR lacks intent in its first material commit (GOV-INTENT-003); preserve its remote history and publish an equivalent immutable upgrade in a new governed PR. The pending main import was preserved in an external scanned snapshot, then safely discarded from this agent-owned local branch before rebuilding from current main.
diff --git a/project/ticket-090/intent.json b/project/ticket-090/intent.json
new file mode 100644
index 0000000..0580013
--- /dev/null
+++ b/project/ticket-090/intent.json
@@ -0,0 +1,74 @@
+{
+  "schema": "new-project.intent/v3",
+  "ticket": "ticket-090",
+  "summary": "Publish immutable artifact upload update replacing ungoverned PR 124",
+  "workstream": "infrastructure",
+  "classification": {
+    "kind": "SERVICE",
+    "priority": "P2",
+    "origin": "requested"
+  },
+  "allowedPaths": [
+    ".github/workflows/dependencies.yml",
+    "project/ticket-090/**"
+  ],
+  "forbiddenPaths": [
+    "project/ticket-*/user-*.md"
+  ],
+  "stacks": [
+    "python",
+    "docker"
+  ],
+  "dependsOn": [],
+  "conflictsWith": [],
+  "integrationTicket": null,
+  "delivery": {
+    "acceptedBaseSha": "665e5b384f369116e945dd5948200690ba8b43fa",
+    "targetBranch": "main",
+    "outcome": "Publish upload-artifact v7.0.1 with an immutable pin and a ticket present in the first implementation commit; supersede PR 124 after protected merge.",
+    "nonGoals": [
+      "No required-check, permission, secret, registry or test-matrix changes"
+    ],
+    "complexity": "S",
+    "estimatedMinutes": 30,
+    "budgets": {
+      "maxImplementationFiles": 1,
+      "maxAffectedComponents": 1,
+      "maxPublicInterfaceChanges": 0,
+      "maxRuntimeDependencies": 0
+    },
+    "architecture": {
+      "status": "accepted",
+      "decision": "Create a governed replacement from current main rather than rewriting the original Dependabot commit; keep its original branch recoverable.",
+      "components": [
+        {
+          "name": "dependency-evidence-workflow",
+          "paths": [
+            ".github/workflows/dependencies.yml"
+          ]
+        }
+      ],
+      "responsibilityChanges": false,
+      "interfaceChanges": [],
+      "dataChanges": [],
+      "ui": {
+        "impact": "none",
+        "states": [],
+        "evidence": []
+      },
+      "rollback": "Restore the previous action pin through protected review."
+    },
+    "runtimeDependencies": [],
+    "validation": [
+      {
+        "criterion": "AC-01",
+        "commands": [
+          "./project/governance-check.sh",
+          "python -m pytest tests/ -q",
+          "docker compose config --quiet"
+        ],
+        "evidence": "Upstream action metadata, existing artifact inputs, managed gate and the required Python 3.12/3.13 CI matrix."
+      }
+    ]
+  }
+}