ci: version reusable workflows with immutable releases

[ss-o]

Objective

Pilot immutable, workflow-specific releases for organization-owned reusable
workflows so callers retain full-SHA execution while dependency automation
updates only for meaningful workflow releases.

Evidence

• Bump z-shell/.github/.github/workflows/zsh-lint.yml from e9cad163297f84eb2c315ac36da82877f0504a01 to 4403e5a200c63596f641966dfb64e08a7a655ffa z-a-meta-plugins#47 updates the zsh-lint.yml caller SHA across
  seven commits that did not change .github/workflows/zsh-lint.yml.
• GitHub documents that an untagged SHA is updated to the latest repository
  commit, which may differ from the latest release.
• GitHub recommends a full commit SHA as the safest reusable-workflow reference.
• Default-branch code search found organization callers split between mutable
  @main references and untagged SHA references, while canonical Z-Shell
  guidance requires full SHA pins for internal reusable workflows.
• Immutable releases are enabled on z-shell/.github.

Approved pilot

1. Publish immutable release zsh-lint/v1.0.0 at exact commit
   1b790f9ac271fbec149f8c92cd9c4fb2e59cc6ac.
2. Update these two callers to the release-associated full SHA with an inline
   # zsh-lint/v1.0.0 version comment:
   • z-shell/z-a-meta-plugins, targeting main;
   • z-shell/zsh-eza, targeting next.
3. Preserve each repository's current Dependabot and Renovate configuration.
4. Supersede Bump z-shell/.github/.github/workflows/zsh-lint.yml from e9cad163297f84eb2c315ac36da82877f0504a01 to 4403e5a200c63596f641966dfb64e08a7a655ffa z-a-meta-plugins#47 after the replacement caller PR exists.
5. Validate both caller changes locally and through their normal GitHub checks.
6. Observe the next configured dependency-update window and verify that no
   unrelated z-shell/.github commit causes a zsh-lint.yml update.

Boundaries

• No merge is authorized by this pilot.
• Do not release or migrate trunk.yml yet.
• Do not expand beyond the two named callers until the pilot evidence is
  recorded and the organization-wide policy/ADR boundary is reviewed.
• Do not remove .github/dependabot.yml; hybrid dependency migration remains
  governed by chore(deps): migrate repositories to hybrid Renovate ownership #452 and its hosted-Renovate evidence gates.

Acceptance criteria

• zsh-lint/v1.0.0 is published as an immutable release at the approved SHA.
• Both callers use that exact SHA and version comment.
• Focused local validation and GitHub checks pass for both caller PRs.
• Bump z-shell/.github/.github/workflows/zsh-lint.yml from e9cad163297f84eb2c315ac36da82877f0504a01 to 4403e5a200c63596f641966dfb64e08a7a655ffa z-a-meta-plugins#47 is closed as superseded with a clear link.
• The next dependency-update window produces no unrelated zsh-lint SHA bump.
• Pilot evidence supports either an organization rollout proposal or an
  explicit rollback/revision.

Instruction-impact review

This pilot does not change mandatory instructions. If the pilot succeeds, the
wider proposal must evaluate the canonical GitHub Actions instruction,
PATTERNS.md, workflow templates, the public instruction manifest, private
generated guidance, and whether the cross-repository release contract requires
a proposed ADR.

Triage

• Item type: CI
• Impact: Medium
• Effort: M
• Priority: P2 - Medium
• Status: Blocked pending scheduled dependency-update evidence
• Workstream: Dependency maintenance

References

• Bump z-shell/.github/.github/workflows/zsh-lint.yml from e9cad163297f84eb2c315ac36da82877f0504a01 to 4403e5a200c63596f641966dfb64e08a7a655ffa z-a-meta-plugins#47
• chore(deps): migrate repositories to hybrid Renovate ownership #452
• .github/instructions/github-actions-ci-cd-best-practices.instructions.md
• PATTERNS.md
• https://docs.github.com/en/actions/reference/security/secure-use
• https://docs.github.com/en/actions/how-tos/reuse-automations/reuse-workflows
• https://docs.github.com/en/code-security/reference/supply-chain-security/troubleshoot-dependabot/vulnerability-detection

[ss-o]

Pilot publication and validation update

Published immutable release:

• zsh-lint/v1.0.0
• exact tag target: 1b790f9ac271fbec149f8c92cd9c4fb2e59cc6ac
• GitHub release verification: passed

Caller pull requests:

• ci: pin zsh-lint workflow to v1.0.0 z-a-meta-plugins#50, targeting main, head
  0f6de4573d5c32f6b605fa12be1efefd2c2725c3
• ci: pin zsh-lint workflow to v1.0.0 zsh-eza#106, targeting next, head
  f9b03d48120ee396c42a95502d73f996742f4c5b

Validation:

• both local actionlint checks passed;
• both git diff --check checks passed;
• both PRs are mergeable;
• all reported Zsh Lint, Trunk, and CodeQL checks passed on the exact heads.

z-shell/z-a-meta-plugins#47 was closed with an explanatory supersession link
to #50.

No Dependabot or Renovate configuration changed, and no PR was merged. The next
action is to observe the configured dependency-update window and verify that
unrelated z-shell/.github commits do not produce a new zsh-lint SHA bump.

[ss-o]

Agent handoff

Status: In progress
Repository: z-shell/.github, z-shell/z-a-meta-plugins, z-shell/zsh-eza
Branch/PR: z-shell/z-a-meta-plugins#50 and z-shell/zsh-eza#106
Tracker/Issue: #543, Project 28

Current state

• Immutable release zsh-lint/v1.0.0 is published, verified, and resolves to
  1b790f9ac271fbec149f8c92cd9c4fb2e59cc6ac.
• ci: pin zsh-lint workflow to v1.0.0 zsh-eza#106 squash-merged normally into next as
  72b163afc70d739e589749114c52a9cbb66e1cb1.
• ci: pin zsh-lint workflow to v1.0.0 z-a-meta-plugins#50 remains open and green. Its repository requires
  review, so ordinary squash auto-merge is enabled. No administrator bypass was
  used.
• The obsolete Dependabot PR Bump z-shell/.github/.github/workflows/zsh-lint.yml from e9cad163297f84eb2c315ac36da82877f0504a01 to 4403e5a200c63596f641966dfb64e08a7a655ffa z-a-meta-plugins#47 is closed with a
  supersession comment.
• Dependabot and Renovate configuration files remain unchanged.
• Local task branches were deleted after publication. Both child worktrees are
  back on clean main branches.

Verification

• gh release verify zsh-lint/v1.0.0 --repo z-shell/.github: passed.
• Release tag target comparison: exact approved SHA.
• Local actionlint for both caller workflow files: passed.
• Local git diff --check for both caller branches: passed.
• ci: pin zsh-lint workflow to v1.0.0 z-a-meta-plugins#50: all Zsh Lint, Trunk, and CodeQL checks passed on
  head 0f6de4573d5c32f6b605fa12be1efefd2c2725c3.
• ci: pin zsh-lint workflow to v1.0.0 zsh-eza#106: all Zsh Lint, Trunk, and CodeQL checks passed on head
  f9b03d48120ee396c42a95502d73f996742f4c5b before merge.

Blockers

• ci: pin zsh-lint workflow to v1.0.0 z-a-meta-plugins#50 requires repository review before its configured
  auto-merge can execute.
• The Dependabot result cannot be evaluated until both caller changes are on
  their target branches, a later unrelated z-shell/.github commit exists,
  and the next configured update window has run.

Next steps

1. Review ci: pin zsh-lint workflow to v1.0.0 z-a-meta-plugins#50; allow its configured ordinary auto-merge
   to execute if approved. Do not use administrator bypass.
2. After merge, record the exact squash commit on this issue.
3. After a later unrelated z-shell/.github commit and the next dependency
   update window, inspect both repositories for a zsh-lint update PR.
4. If no unrelated bump appears, record the successful pilot and prepare the
   organization rollout and proposed ADR/policy reconciliation. If a bump does
   appear, preserve it as evidence and revise the release/tag strategy before
   expanding scope.

[ss-o]

Post-merge pilot state

Both caller changes are now on their target branches:

• ci: pin zsh-lint workflow to v1.0.0 zsh-eza#106 squash-merged into next as
  72b163afc70d739e589749114c52a9cbb66e1cb1.
• ci: pin zsh-lint workflow to v1.0.0 z-a-meta-plugins#50 administrator-squash-merged into main as
  971ebbbe2fa494e73365c331d6b23cc36fa3c141 after explicit maintainer
  approval. The exact head was green and the immutable release was reverified
  immediately before merge.

Both remote task branches and both local task/remote-tracking branches are
deleted. The child worktrees are clean on main.

The dependency graph now records the new full SHA on the annex default branch.
The zsh-eza dependency graph endpoint reports its default main branch, while
Dependabot is configured against next, so it cannot serve as equivalent
post-merge evidence for that caller.

Observed Dependabot job cadence, inferred from the recent dynamic-run history:

• z-shell/zsh-eza: Saturdays near 18:41 UTC, next expected run August 29;
• z-shell/z-a-meta-plugins: Mondays near 19:23 UTC, next expected run August 31.

There is no supported immediate dispatch exposed for these dynamic Dependabot
update jobs. Re-running an old job would use old run context and would not prove
the current caller state. The scheduled observation also needs a later,
unrelated commit on z-shell/.github; its current main still equals the
release SHA, so a run before such a commit cannot exercise the noise condition.

The issue is therefore blocked on external time/state until both conditions
exist. Project target date is September 1, 2026 for the first post-window check.

[ss-o]

Pilot prerequisite update

The required unrelated post-release state now exists: z-shell/.github main
advanced from the immutable zsh-lint/v1.0.0 release commit
1b790f9ac271fbec149f8c92cd9c4fb2e59cc6ac to
34330c45575502d06cbb5b0a688e77072ef01317 through #544 without changing the
released workflow contract.

The pilot remains blocked only on the scheduled dependency-update evidence:

• z-shell/zsh-eza after its August 29 window;
• z-shell/z-a-meta-plugins after its August 31 window.

The September 1 Project 28 target date remains appropriate for the first
post-window comparison. No immediate or historical job rerun is being treated
as equivalent evidence.