.gitea/workflows/release.yml

@@ -58,7 +58,14 @@ env:
   # lib/test_emit_release_evidence.py}. Andringen ar bakatkompatibel by
   # design: ST0RE-uppladdningen ar OPT-IN via G17_REQUIRE_ST0RE (default 0),
   # sa en AUD0-only-konsument som 0pt kor exakt samma vag som forut.
-  SIAX_TEMPLATES_REF: main
+  #
+  # Deliberately NO branch name here: the pinned commit is checked out
+  # DIRECTLY (see the step below). The previous shape -- clone `main`, then
+  # require its HEAD to equal this pin -- turned every unrelated merge in
+  # siax-templates into a red release chain here (CD-03 / CI-RED-02) while
+  # nothing was actually unsafe. Checking the pin out directly keeps the pin
+  # a real supply-chain control (the gate runs exactly this reviewed commit,
+  # or it fails) without coupling it to someone else's branch tip.
   SIAX_TEMPLATES_PINNED_SHA: 09504e3a593ee8ce0eaba606df31c349a3d52277
   SIAX_TEMPLATES_DIR: /tmp/siax-templates-g17-ref
 
@@ -72,27 +79,45 @@ jobs:
           fetch-depth: 0
 
       # --- fetch the shared G17 reference implementation -----------------
-      # Same authenticated-clone-at-runtime mechanism this repo's OLD
+      # Same authenticated-fetch-at-runtime mechanism this repo's OLD
       # release.yml already used SIAX_CI_TOKEN for (the evidence-commit
-      # push this PR deletes) -- see .siax/hooks/G17.sh's header for why
+      # push a prior PR deleted) -- see .siax/hooks/G17.sh's header for why
       # NOT a `uses:` reusable workflow / submodule / vendored copy. Fails
-      # closed if the branch has moved past the exact commit this adapter
-      # was reviewed against.
-      - name: Fetch siax-templates G17 reference (pinned)
+      # closed if the exact commit this adapter was reviewed against cannot
+      # be checked out (removed or rewritten upstream); an unrelated merge
+      # on siax-templates' own main is NOT a failure and never was a real
+      # signal.
+      - name: Fetch siax-templates G17 reference (pinned commit)
         env:
           SIAX_CI_TOKEN: ${{ secrets.SIAX_CI_TOKEN }}
         run: |
           set -euo pipefail
           rm -rf "$SIAX_TEMPLATES_DIR"
-          git clone --quiet --branch "$SIAX_TEMPLATES_REF" \
-            "https://oauth2:${SIAX_CI_TOKEN}@git.siax.io/${SIAX_TEMPLATES_REPO}.git" "$SIAX_TEMPLATES_DIR"
+          mkdir -p "$SIAX_TEMPLATES_DIR"
+          git -C "$SIAX_TEMPLATES_DIR" init --quiet
+          git -C "$SIAX_TEMPLATES_DIR" remote add origin \
+            "https://oauth2:${SIAX_CI_TOKEN}@git.siax.io/${SIAX_TEMPLATES_REPO}.git"
+          # Ask for the pinned commit by SHA -- one shallow commit, no branch
+          # involved. A server with uploadpack.allowReachableSHA1InWant off
+          # refuses that, so fall back to fetching the branches and taking the
+          # same commit out of them. Either way the work tree ends up at
+          # exactly $SIAX_TEMPLATES_PINNED_SHA, never at a branch tip.
+          if ! git -C "$SIAX_TEMPLATES_DIR" fetch --quiet --depth 1 origin "$SIAX_TEMPLATES_PINNED_SHA"; then
+            echo "note: server refused a by-SHA fetch; falling back to fetching all branches"
+            git -C "$SIAX_TEMPLATES_DIR" fetch --quiet origin
+          fi
+          if ! git -C "$SIAX_TEMPLATES_DIR" -c advice.detachedHead=false \
+                 checkout --quiet --detach "$SIAX_TEMPLATES_PINNED_SHA"; then
+            echo "::error::siax-templates commit $SIAX_TEMPLATES_PINNED_SHA not found in $SIAX_TEMPLATES_REPO -- the reviewed commit was removed or rewritten upstream. Re-review siax-templates and update SIAX_TEMPLATES_PINNED_SHA deliberately."
+            exit 1
+          fi
           actual_sha="$(git -C "$SIAX_TEMPLATES_DIR" rev-parse HEAD)"
           if [ "$actual_sha" != "$SIAX_TEMPLATES_PINNED_SHA" ]; then
-            echo "::error::siax-templates $SIAX_TEMPLATES_REF moved (now $actual_sha, pinned $SIAX_TEMPLATES_PINNED_SHA) -- refusing to run an unreviewed version of the gate. Re-review and update SIAX_TEMPLATES_PINNED_SHA deliberately."
+            echo "::error::checked-out siax-templates HEAD is $actual_sha, expected the pinned $SIAX_TEMPLATES_PINNED_SHA -- refusing to run an unreviewed version of the gate."
             exit 1
           fi
           chmod +x "$SIAX_TEMPLATES_DIR/ci/v2/reference-hooks/"*.sh "$SIAX_TEMPLATES_DIR/ci/v2/reference-hooks/lib/"*.sh
-          echo "siax-templates G17 reference @ $actual_sha (pinned, verified)"
+          echo "siax-templates G17 reference @ $actual_sha (pinned commit, checked out directly)"
 
       - name: Resolve SHA + tag (never :latest)
         id: sha

.siax/hooks/G17.sh

@@ -70,9 +70,10 @@
 # picks up main's current tip rather than an older commit, matching what a
 # fresh migration reviews). Pinned at
 # 384e35060b91ea78ec045e14af114abf5d5eb23b -- the exact ref lives in
-# `.gitea/workflows/release.yml` (SIAX_TEMPLATES_REF=main +
-# SIAX_TEMPLATES_PINNED_SHA, which refuses to run if main has moved past
-# the pin).
+# `.gitea/workflows/release.yml` (SIAX_TEMPLATES_PINNED_SHA, which is
+# fetched and checked out DIRECTLY by SHA -- no branch is consulted, so an
+# unrelated merge on siax-templates' main does not fail this gate; a pinned
+# commit that no longer exists upstream does).
 set -euo pipefail
 REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 

.siax/hooks/README.md

@@ -45,10 +45,15 @@ Pinned to `sax3l/siax-templates` main at
 (`feat/g17-signed-deploy-gate-adr-w16-003`) merged, plus follow-up fixes
 #56/#57 (SPDX compound-license-expression evaluation, exercised live by
 this adapter's own `G17_LICENSE_ALLOW` policy) and #59 (G20 retry logic;
-not used by 0pt yet, see below). `.gitea/workflows/release.yml`'s own
-`SIAX_TEMPLATES_PINNED_SHA` step refuses to run if `siax-templates` main
-has moved past this exact commit -- bumping the pin is a reviewed,
-source-controlled diff to that one line, never a silent re-resolution.
+not used by 0pt yet, see below). `.gitea/workflows/release.yml` fetches
+and checks out `SIAX_TEMPLATES_PINNED_SHA` **directly by SHA** and refuses
+to run if that exact commit cannot be checked out (removed or rewritten
+upstream) -- bumping the pin is a reviewed, source-controlled diff to that
+one line, never a silent re-resolution. It deliberately does **not**
+compare the pin against `main`: that branch tip moves whenever anything
+unrelated merges in `siax-templates`, and failing this chain on that said
+nothing about whether the reviewed gate was safe (CD-03 / CI-RED-02). The
+authoritative pin value is the one in `release.yml`.
 
 ## G20 (live-digest-equality) -- deliberately not wired yet