hotfix: add RZ1 SHA pin enforcement audit trail to RELEASE_NOTES - #22
Open
AnuarRazii wants to merge 1 commit into
Open
hotfix: add RZ1 SHA pin enforcement audit trail to RELEASE_NOTES#22AnuarRazii wants to merge 1 commit into
AnuarRazii wants to merge 1 commit into
Conversation
All six GitHub Actions workflow files introduced in the initial repository bootstrap used version-tag references (@v4, @v7, @V3) that are blocked by the repository's Actions policy, which requires every action to be pinned to a full-length commit SHA. Root cause (PR #10 base commit d5cb904): The action actions/checkout@v4 is not allowed because all actions must be pinned to a full-length commit SHA. Fix applied (PR #10, merged 2026-07-02T16:21:36Z): - actions/checkout@v4 → @34e114876b0b11c390a56381ad16ebd13914f8d5 - actions/github-script@v7 → @f28e40c7f34bde8b3046d885e986cb6290c5673b - github/codeql-action/init@v3 → @411c4c9a36b3fca4d674f06b6396b2c6d23522c6 - github/codeql-action/analyze@v3 → @411c4c9a36b3fca4d674f06b6396b2c6d23522c6 Workflows fixed: compliance.yml, RZ1-validate.yml, codeql.yml, dco.yml, security.yml, release-immutability.yml All RZ1 governance engines confirmed green at merge commit 083d0fb. This hotfix commit serves as the signed audit record per CONTRIBUTING.md § 9 — Traceability and Auditability. Signed-off-by: Anuar Razii <anuarrazii@outlook.my>
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a signed audit-trail entry to RELEASE_NOTES.md documenting the RZ1 GitHub Actions SHA-pin enforcement hotfix (PR #10), capturing the blocked tag usage, the pinned SHAs applied, and the before/after commits for traceability.
Changes:
- Added a new “Hotfix: v1.0.1 — RZ1 SHA Pin Enforcement” section to Release Notes.
- Documented affected workflows/actions and the specific pinned SHAs applied in PR #10.
- Recorded an audit trail (detected/fixed commits + governance framework reference) to support traceability requirements.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+9
to
+11
| **Hotfix reference:** `hotfix/rz1-sha-pin-enforcement-audit` | ||
| **Applied by:** Anuar Razii \<anuarrazii@outlook.my\> | ||
| **Governance engines affected:** RZ1 Compliance Engine, RZ1 Validate, CodeQL Security Analysis, RZ1 Security Enforcement, DCO Check, Release Immutability Guard |
|
|
||
| ### Audit Trail | ||
|
|
||
| - **Detected at:** `d5cb904972a84211f4e3ba6f4ed2299121ca27fe` — 4 workflows failing |
|
|
||
| --- | ||
|
|
||
| ## Hotfix: v1.0.1 — RZ1 SHA Pin Enforcement (2026-07-02) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
All six GitHub Actions workflow files introduced in the initial repository bootstrap used version-tag references (@v4, @v7, @V3) that are blocked by the repository's Actions policy, which requires every action to be pinned to a full-length commit SHA.
Root cause (PR #10 base commit d5cb904):
The action actions/checkout@v4 is not allowed because all actions
must be pinned to a full-length commit SHA.
Fix applied (PR #10, merged 2026-07-02T16:21:36Z):
Workflows fixed: compliance.yml, RZ1-validate.yml, codeql.yml,
dco.yml, security.yml, release-immutability.yml
All RZ1 governance engines confirmed green at merge commit 083d0fb.
This hotfix commit serves as the signed audit record per CONTRIBUTING.md § 9 — Traceability and Auditability.
Pull Request
Description
Please provide a concise description of the changes in this PR.
Type of Change
Related Issues
Closes #(issue number) – if applicable
Changes Made
Please describe the specific changes:
Alignment with Ethical AI MY Principles
Ethical Alignment
How do these changes align with our ethical principles?
Explanation:
Testing and Validation
How have you tested these changes?
Documentation
Have you updated relevant documentation?
Attribution
Please confirm:
Code of Conduct
Additional Context
Please provide any additional context or information that would be helpful for reviewers.
Reviewer Checklist
Thank you for contributing to Ethical AI MY!