statecraft.
Catalog/spec-spine

060-a-workflow-bump-is-not-a-governed-change

A workflow bump is not a governed change

Lifecycle approvedImplementation completeVerification unknownQualification unknown

A GitHub Actions workflow enters the index content hash as raw bytes, so a Dependabot `uses:` bump moves the global-inputs scalar and stales every shard in the repository. The bot can neither re-index nor add a waiver to its own PR body, so the PR walls on exit 2 and needs a maintainer to push a re-index commit. Spec 027 built the coupling half of this for workflows and read the freshness half as already fine; it was not, and spec 058 made that visible by fixing the default glob, then deferred the real fix as a hashing change with a migration of its own. This is that spec. A workflow folds as its governance projection, the parsed document with the pinned ref of each `uses:` reference removed and the action path kept, so a version or SHA bump is invisible to the ledger while a changed action, a `run:` or `with:` edit, an added step or an unpin all still stale it. The projection and 027's waiver classifier are required to state one rule, and the upgrade restales every workflow-bearing repository once.

Read the full pinned specification ↗

Relationships

Claimed units

  • extends
    {
  "nature": "additive",
  "spec": "004-codebase-index",
  "unit": {
    "kind": "file",
    "path": "crates/spec-spine-core/src/manifest.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "022-index-sharding",
  "unit": {
    "kind": "file",
    "path": "crates/spec-spine-core/src/shard.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "005-coupling-gate",
  "unit": {
    "kind": "file",
    "path": "crates/spec-spine-core/src/dep_only.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "027-cargo-workflow-dependency-waiver",
  "unit": {
    "kind": "file",
    "path": "crates/spec-spine-cli/tests/couple.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "004-codebase-index",
  "unit": {
    "kind": "file",
    "path": "crates/spec-spine-core/tests/index.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "057-the-docs-name-what-adopters-derived",
  "unit": {
    "kind": "file",
    "path": "docs/adoption-guide.md"
  }
}

Source headings

  1. 060: A workflow bump is not a governed change
  2. 1. Purpose
  3. 2. Territory
  4. 3. Behavior
  5. 3.1 A workflow folds as its governance projection (amends 004 3.5)
  6. 3.2 The projection and the waiver state one rule
  7. 3.3 The upgrade restales every workflow-bearing repository once
  8. 3.4 The workflow auto-waive test asserts freshness again (amends 058 3.6)
  9. 3.5 Tests (minimum)
  10. 4. Out of scope
  11. 5. Resolved decisions
  12. Verification

Frozen anchors

No frozen anchors declared.