[automation-audit] supplement 2026-06-10 landed — track follow-up batches

[castrojo]

The 2026-06-09 automation audit was supplemented on 2026-06-10 with three new artifacts and elevation of the operating principle into top-level docs. See:

• docs/factory/automation-audit/consistency-audit.md
• docs/factory/automation-audit/publish-loop-test-plan.md
• docs/factory/automation-audit/reusable-promote.yml
• docs/factory/automation-audit/dry-run-publish-loop.sh

Tracking children

• Phase 1: actions-v1-tag-update.yml — ✅ Merged: actions#154
• Phase 2: git-cliff changelog — ✅ Merged: common#592
• Phase 3: retry composite action — ✅ Merged: actions#155
• Phase 4: token-health composite action — ✅ Merged: actions#156
• Phase 6: supply chain (keyless cosign + SBOM + SLSA + Trivy) — 🔶 PR open: common#595. Needs 2 human approvals (merge queue). Post-merge: remove SIGNING_SECRET from org secrets.
• Phase 7: dakota cache-warm — ✅ Merged: dakota#787
• C1: reusable-promote.yml (dakota) — ✅ Merged: actions#157 + dakota#788
• C1: reusable-promote-squash.yml (bluefin + bluefin-lts) — ✅ Merged: actions#161 + bluefin-lts#161 + bluefin#486. 697 LoC → 60 LoC.
• C2: pin @main refs in bluefin — merged to testing (bluefin#484); lands on main at next promotion
• C2: pin @main refs in bluefin-lts — ✅ Merged: bluefin-lts#159
• C3: Renovate grouping rule — ✅ Merged: common#593
• C5: release-state.yaml JSON schema — ✅ In actions#161 (docs/schemas/release-state.schema.json)

Out of scope (this rollout)

• iso repo work — iso-auto-rebuild.yml and iso-dispatch-snippet.yml retained as proposals only
• T4: Dakota build machine — blocked on hardware (Replace Logo Menu extension checks with custom logo menu tests #497)
• T7: MERGERAPTOR provisioning — blocked on human-only secret admin
• C5 pre-commit wiring in dakota — minor follow-up

Remaining open

• Phase 6 PR common#595 — awaiting 2 human approvals

Operating principle

Humans approve design, security, and merge. Everything else is automated, self-healing, and non-blocking.

[castrojo]

Session execution report — 2026-06-10

✅ Landed

• Batch 1 — doc push: commit e10bb69 on main. 4 new artifacts + 3 mantra-elevation edits.
• Batch 2 — tracking issues: this issue + [consistency C1] Land reusable-promote.yml in projectbluefin/actions #584 [consistency C2] Pin @main reusable-workflow refs to SHA in bluefin #585 [consistency C2] Pin @main reusable-workflow refs to SHA in bluefin-lts #586 [consistency C3] Renovate grouping rule for projectbluefin/actions refs #587 [consistency C5] JSON schema for .github/release-state.yaml #588.
• Batch 7 — dakota cache-warm: projectbluefin/dakota#782 (Phase 7).

⚠️ Design Gate hit — not pushed

actions-v1-tag-update.yml (originally Phase 1 of the roadmap) directly contradicts the existing hard rule in projectbluefin/actions/AGENTS.md:

@v1 tag moves require human authorization. Force-pushing the shared tag affects every consumer repo simultaneously. Do not initiate this as an agent action.

The actions-v1-tag-update.yml artifact in this audit was drafted before that rule was added (or in ignorance of it). Two possible resolutions, both human-decision territory:

1. Keep the rule, retire the artifact — accept that v1 tag advances stay manual; rely on Renovate to bump SHAs in consumers (which doesn't need a v1 move).
2. Relax the rule, ship the workflow — but only after a security review of who can trigger merges to actions/main (the human merge gate already exists, so the v1 move arguably becomes mechanical post-merge).

Filing as a separate design-decision issue would be appropriate; not doing it autonomously per the upstream-issue gate.

⏸ Deferred — needs paired consumer PR

The actions repo's consumer-validation.yml gate enforces real consumer PR + CI run URLs for any change to bootc-build/*/action.yml or .github/workflows/reusable-*.yml. The following audit artifacts can be split into two PR types:

Artifact	Where	Consumer-validation needed?
retry/action.yml	root of actions/	No (top-level composite, not under bootc-build/)
check-token-health/action.yml	root of actions/	No
.github/workflows/reusable-promote.yml	actions/	Yes — needs canary dakota draft PR

Recommended next session: open the actions PR with the two top-level composites (no consumer gate), then a separate canary PR pair (actions + dakota draft) for reusable-promote.yml.

❌ Out of scope (this rollout)

• projectbluefin/iso — explicit user constraint. iso-auto-rebuild.yml and iso-dispatch-snippet.yml retained as proposals only.

[castrojo]

Drift-refresh finding tracked: #589 — iso and bonedigger need CODEOWNERS. Joins #584 / #585 / #586 as the live follow-up batch.

[castrojo]

Execution batch landed (4 PRs, lockstep with the audit-doc roadmap):

Issue	PR	Repo
#585 (C2 bluefin)	projectbluefin/bluefin#484	bluefin
#586 (C2 bluefin-lts)	projectbluefin/bluefin-lts#159	bluefin-lts
#589 (CODEOWNERS)	projectbluefin/bonedigger#22	bonedigger
#589 (CODEOWNERS)	projectbluefin/iso#59	iso

Remaining open from the audit: #584 (C1 reusable-promote — 1-day refactor, separate session).