@codyswann/lisa 4.42.2 → 4.42.4

package/dist/core/reusable-workflow-pin.js

@@ -0,0 +1,165 @@
+/**
+ * Reading and rewriting the ref a host project's workflow uses to call one of
+ * Lisa's reusable workflows.
+ *
+ * ## What a caller line looks like
+ *
+ * ```yaml
+ * jobs:
+ *   quality:
+ *     uses: CodySwannGT/lisa/.github/workflows/quality.yml@<40-char sha> # v4.4.11
+ * ```
+ *
+ * The SHA is what Actions resolves; the trailing comment is what a human
+ * reads. Both are written by the pinner, so the comment can never disagree
+ * with the pin — a reader who trusts it is right to.
+ *
+ * ## Why a full SHA and not `@main`
+ *
+ * `@main` means every host repository executes whatever is on Lisa's default
+ * branch at the moment its run starts: not the Lisa the project installed, not
+ * the Lisa anyone reviewed, and not the Lisa that was green the last time CI
+ * passed. A caller's CI can then change without the caller changing, an old
+ * run cannot be reproduced, and the trust boundary moves from "what the pin
+ * pointed at when it was reviewed" to "whatever that ref points at later" —
+ * the supply-chain hole GitHub's own hardening guidance answers by pinning to
+ * a full-length commit SHA.
+ *
+ * A short SHA is not a substitute. It is ambiguous by construction, and
+ * several GitHub APIs in this repository's history have been measured
+ * answering `total_count: 0` for a short SHA that had runs at its full form.
+ *
+ * ## The two failure modes this module has to hold together
+ *
+ * Pinning trades one silent failure for another, and pretending otherwise is
+ * how this decision has already been reversed twice:
+ *
+ *   - **A frozen ref stops receiving fixes** and never goes red. A caller sat
+ *     on a `@v3.35.0` tag while Lisa shipped 4.x, for months, reporting
+ *     healthily the whole time. That is what `@main` was reinstated to solve.
+ *   - **An unreachable ref stops loading.** Actions creates zero jobs, so a
+ *     required check is ABSENT rather than red and pull requests hang on a
+ *     verdict that never arrives.
+ *
+ * The answer to the first is that nothing here is hand-maintained: the pin is
+ * rewritten from the installed version's tag every time Lisa is applied, so it
+ * moves when the package pin moves and cannot silently fall behind it. The
+ * answer to the second is that Lisa's release pipeline refuses to publish a
+ * release commit that is reachable from no durable ref, so the SHA a consumer
+ * is handed is always a tagged commit rather than a loose one; and if history
+ * ever does move under it, the next apply re-derives the pin from the tag and
+ * repairs it without anyone noticing it was broken.
+ * @module core/reusable-workflow-pin
+ */
+/** The repository whose reusable workflows this module governs. */
+export const LISA_REUSABLE_PREFIX = "CodySwannGT/lisa/.github/workflows/";
+/** The only ref shape a caller may carry: a full-length commit SHA. */
+export const FULL_COMMIT_SHA = /^[0-9a-f]{40}$/u;
+/**
+ * A job-level `uses:` pointing at a Lisa reusable workflow.
+ *
+ * Matched as text rather than through a YAML round-trip because these files
+ * are human-maintained and dense with explanatory comments that a parse and
+ * reserialize would delete. The same technique is used by the sibling
+ * workflow migrations for the same reason.
+ */
+const USES_LINE = /^(?<lead>[ \t]*uses:[ \t]*)(?<open>["']?)CodySwannGT\/lisa\/\.github\/workflows\/(?<workflow>[A-Za-z0-9._-]+)@(?<ref>[^\s"'#]+)(?<tail>["' \t]*(?:#[^\n]*)?)$/u;
+/**
+ * Whether a line is entirely a YAML comment.
+ *
+ * A commented-out caller is documentation, not a call. Rewriting one would
+ * edit prose, and reporting one would raise a finding about a line that
+ * invokes nothing.
+ * @param line - One line of a workflow file
+ * @returns True when the first non-space character is `#`
+ */
+function isCommentLine(line) {
+    return /^\s*#/u.test(line);
+}
+/**
+ * Extract the comment text from the tail of a matched `uses:` line.
+ * @param tail - Everything after the ref and its closing quote
+ * @returns Comment text without the `#` and surrounding space, or null
+ */
+function commentOf(tail) {
+    const hash = tail.indexOf("#");
+    return hash < 0 ? null : tail.slice(hash + 1).trim();
+}
+/**
+ * Every Lisa reusable-workflow caller reference in one workflow file.
+ * @param source - Full text of a workflow file
+ * @returns One entry per reference, in file order
+ */
+export function findReusableWorkflowRefs(source) {
+    return source.split("\n").flatMap((line, index) => {
+        if (isCommentLine(line))
+            return [];
+        const groups = USES_LINE.exec(line)?.groups;
+        if (groups === undefined)
+            return [];
+        const { workflow, ref, tail } = groups;
+        if (workflow === undefined || ref === undefined)
+            return [];
+        return [
+            {
+                line: index + 1,
+                workflow,
+                ref,
+                comment: commentOf(tail ?? ""),
+            },
+        ];
+    });
+}
+/**
+ * Whether a reference already carries the exact pin, comment included.
+ * @param reference - A parsed caller reference
+ * @param pin - The identity every caller must carry
+ * @returns True when nothing about this reference needs rewriting
+ */
+export function isPinnedAt(reference, pin) {
+    return reference.ref === pin.sha && reference.comment === `v${pin.version}`;
+}
+/**
+ * Whether a reference names anything other than a full commit SHA.
+ *
+ * This is the question the reporting surface asks, and it is deliberately NOT
+ * "is it the pin I expect": a repository one release behind is current-enough
+ * and self-heals on its next apply, while a repository on `@main` never does.
+ * @param reference - A parsed caller reference
+ * @returns True when the ref is a branch, a tag, or a short SHA
+ */
+export function isMutableRef(reference) {
+    return !FULL_COMMIT_SHA.test(reference.ref);
+}
+/**
+ * Rewrite every Lisa reusable-workflow caller in a file to the given pin.
+ *
+ * The trailing comment on a caller line is Lisa-owned and is replaced
+ * wholesale with `# v<version>`. That is what makes the rewrite idempotent —
+ * appending would grow the line on every apply — and what makes the version a
+ * reader sees impossible to disagree with the SHA above it.
+ *
+ * Quoting, indentation, and everything else on the line are preserved.
+ * @param source - Full text of a workflow file
+ * @param pin - The identity every caller must carry
+ * @returns The rewritten text, byte-identical to the input when nothing changed
+ */
+export function pinReusableWorkflowRefs(source, pin) {
+    return source
+        .split("\n")
+        .map(line => {
+        if (isCommentLine(line))
+            return line;
+        const groups = USES_LINE.exec(line)?.groups;
+        if (groups === undefined)
+            return line;
+        const { lead, open, workflow } = groups;
+        // The closing quote is reconstructed from the opening one rather than
+        // captured: YAML quoting is symmetric, and a separate optional-quote
+        // group adjacent to a greedy tail is the ambiguity that makes this
+        // pattern backtrack super-linearly on a long line.
+        return `${lead ?? ""}${open ?? ""}${LISA_REUSABLE_PREFIX}${workflow ?? ""}@${pin.sha}${open ?? ""} # v${pin.version}`;
+    })
+        .join("\n");
+}
+//# sourceMappingURL=reusable-workflow-pin.js.map

package/dist/core/reusable-workflow-pin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reusable-workflow-pin.js","sourceRoot":"","sources":["../../src/core/reusable-workflow-pin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAEH,mEAAmE;AACnE,MAAM,CAAC,MAAM,oBAAoB,GAAG,qCAAqC,CAAC;AAE1E,uEAAuE;AACvE,MAAM,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC;AAEjD;;;;;;;GAOG;AACH,MAAM,SAAS,GACb,gKAAgK,CAAC;AAsBnK;;;;;;;;GAQG;AACH,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACvD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,MAAc;IAEd,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAChD,IAAI,aAAa,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAC5C,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;QACpC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;QACvC,IAAI,QAAQ,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;QAC3D,OAAO;YACL;gBACE,IAAI,EAAE,KAAK,GAAG,CAAC;gBACf,QAAQ;gBACR,GAAG;gBACH,OAAO,EAAE,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC;aAC/B;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CACxB,SAA8B,EAC9B,GAAe;IAEf,OAAO,SAAS,CAAC,GAAG,KAAK,GAAG,CAAC,GAAG,IAAI,SAAS,CAAC,OAAO,KAAK,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;AAC9E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,SAA8B;IACzD,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAc,EACd,GAAe;IAEf,OAAO,MAAM;SACV,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,IAAI,CAAC,EAAE;QACV,IAAI,aAAa,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACrC,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAC5C,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACtC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;QACxC,sEAAsE;QACtE,qEAAqE;QACrE,mEAAmE;QACnE,mDAAmD;QACnD,OAAO,GAAG,IAAI,IAAI,EAAE,GAAG,IAAI,IAAI,EAAE,GAAG,oBAAoB,GAAG,QAAQ,IAAI,EAAE,IAAI,GAAG,CAAC,GAAG,GAAG,IAAI,IAAI,EAAE,OAAO,GAAG,CAAC,OAAO,EAAE,CAAC;IACxH,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC"}

package/dist/core/upstream-evidence-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upstream-evidence-manifest.d.ts","sourceRoot":"","sources":["../../src/core/upstream-evidence-manifest.ts"],"names":[],"mappings":"AACA,iFAAiF;AACjF,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAgkFpE,CAAC;AAEL,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAqyQjE,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAk6I/D,CAAC"}
+{"version":3,"file":"upstream-evidence-manifest.d.ts","sourceRoot":"","sources":["../../src/core/upstream-evidence-manifest.ts"],"names":[],"mappings":"AACA,iFAAiF;AACjF,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAkkFpE,CAAC;AAEL,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CA8yQjE,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAk6I/D,CAAC"}

package/dist/core/upstream-evidence-manifest.js

@@ -3,9 +3,9 @@
 export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "all/copy-contents/.gitattributes": "e19d1a971de1a9142cb13d58ce56a98a3ec1c0594a6930ca7f92cb5ef4135d40",
     "all/copy-contents/gitignore": "66e105ae1b6874e6c587d128a04ff5a5005bf923759fc41cc31d73b9ba44bacf",
-    "all/copy-overwrite/scripts/check-conflict-markers.mjs": "d7a689bcc122af7f38d1c536924fc2f3dcb503b09658ffc6035ccbe720d14d6b",
+    "all/copy-overwrite/scripts/check-conflict-markers.mjs": "d30a12d0737381bfc97f2343dca78824a94c1e076848b5e0b18abce18d6f661c",
     "all/copy-overwrite/scripts/check-npm-publish-landed.mjs": "bba6114e5e4643575749210819acfda207260ac1db5fcb48c33c320c3a9503ca",
-    "all/copy-overwrite/scripts/check-orphaned-branches.mjs": "b2a63c522fdc99dd7b89707fd734da9d1cb534bc9a505589c503f2576ac3e39b",
+    "all/copy-overwrite/scripts/check-orphaned-branches.mjs": "857b923b3fb19db9755e5a62e54ad14a33862a17051bc63ec65563c1295713c3",
     "all/copy-overwrite/scripts/check-release-package-identity.mjs": "a0f17592d4436de4c240f7c78512537581aa2ed5e89f0caf1fe890694163a873",
     "all/copy-overwrite/scripts/check-state-classification.mjs": "a72910f9885629dd6d8a739b900f5603e4b53d68ece64100a2a5647016b58e1e",
     "all/copy-overwrite/scripts/check-third-party-action-pins.mjs": "9f441b6b8697f0a64abd29125eb7881ebdb0c8d47487bdd18ff09633eb3dab19",
@@ -489,7 +489,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/rules/reference/documentation-source-paths.md": "555155889c9cf279865b9d8fc554bdd461c96a3ec76a5001dfeb361a71056999",
     "plugins/src/base/rules/reference/empirical-inquiry.md": "8cb166ab9eff4eb30287822a4d7843f76884d70d683d7c61d6a7ffd4ff9f7159",
     "plugins/src/base/rules/reference/factory-model.md": "b28a2ea4df7c33390111667a2807d9003cf8c9a14829f6fb0dbc929b05bfed3a",
-    "plugins/src/base/rules/reference/falsifiable-checks.md": "19ee97221ed90485cf90f766c1fac71d6f281e4a6c71752b6704d566c3738e67",
+    "plugins/src/base/rules/reference/falsifiable-checks.md": "8fab1429274b80f8dc82e4cdead0023ccc8ddd333f3d7d99cd3e0456578a90ab",
     "plugins/src/base/rules/reference/history-audit.md": "20a46390f71fadda499c61193d430c3d53df49b55a4cefa50a112f82fa4b05ef",
     "plugins/src/base/rules/reference/integration-access-layer.md": "c5fc07f5f46ba1f99403b6e4fd5603d153411a9bb1838bea320b26a5bd5273d6",
     "plugins/src/base/rules/reference/intent-routing.md": "988f8f45b41056c2adaa1a3e5f6ea926ac56a2fd041c07f98a9c2b271050efdd",
@@ -576,7 +576,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/skills/lisa-detect-tooling/scripts/commands.mjs": "e28bd61fdde4a336b56ae3395423026943a5816015719d31d04f0d5a0ab50eec",
     "plugins/src/base/skills/lisa-detect-tooling/scripts/detect-tooling.mjs": "d9419814fc04c935bd7e320e85b1977c9bfc9275d9ea5fb557002ad438ee7925",
     "plugins/src/base/skills/lisa-doctor/SKILL.md": "ab7bb855fd3ebe321e41b0143815f202b70f6ba38f6678791d6d9e933e0c3fd8",
-    "plugins/src/base/skills/lisa-drive-pr-to-merge/SKILL.md": "7a0b633393b6c3f607019db8417c224209321cc49bf75849c77124b5c27482a0",
+    "plugins/src/base/skills/lisa-drive-pr-to-merge/SKILL.md": "76b7df5e37ca70d2b48401325974f45d4a89ec2f3a7103cabecc6bdf0f05e08c",
     "plugins/src/base/skills/lisa-epic-triage/SKILL.md": "d02760411249bddbd396f283191fe3e82bb7b95bf9393a19a7025dc5a57c3ab7",
     "plugins/src/base/skills/lisa-evaluation-suite/SKILL.md": "96b5c2091ccd22a565935a7b0b917f67998881b81055ce3e4d518319472eac8b",
     "plugins/src/base/skills/lisa-exploratory-qa/SKILL.md": "562b80ea0be5ffb1087386495a380bfb5808a1da4c08a7e253c5229d747bc5c7",
@@ -584,7 +584,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/skills/lisa-generate-claude-remote-build-script/SKILL.md": "9ae66050b046b3d5bcf4acb582928cb56f295d4d869b712e85b6e0717b67dc7b",
     "plugins/src/base/skills/lisa-git-commit/SKILL.md": "56320566e9278fb43b4d51c00854f3714dc61edc960292d51962a6f49116ac0f",
     "plugins/src/base/skills/lisa-git-prune/SKILL.md": "11fad06d109538f1a8ee4ef8043bb0e083672e3c9a7cb7ae8a7233c5411d6dd2",
-    "plugins/src/base/skills/lisa-git-submit-pr/SKILL.md": "71165d6df755c55532ca41703374d384ccf06a6cad1ddeeb76846d716b30d7bb",
+    "plugins/src/base/skills/lisa-git-submit-pr/SKILL.md": "7847ee39ea3a14445fbf1d459e3cd7d93ed67dcdcf8b6f161ca64bb307233245",
     "plugins/src/base/skills/lisa-github-add-journey/SKILL.md": "4ceda3474a9b32abae835c2676e8cb2b7e888c6ba04b95843dbe7254293bbf32",
     "plugins/src/base/skills/lisa-github-build-intake/SKILL.md": "48ecd7ed8fb69b2023ae87f04cc48963bbc67aec5a8d92d5021d39d83e33f305",
     "plugins/src/base/skills/lisa-github-claim/SKILL.md": "71301c6d45d7eb5523e74aa7f070bb2becf57ca68fb8bde9e02ee937b78815f7",
@@ -1132,6 +1132,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "scripts/check-delivery-deletion-conflicts.mjs": "77eed58c9ff076c4438a5fe01c343f25c1a1c8f29a8f5861d1e1081b1739d300",
     "scripts/check-derived-artifacts.mjs": "b30c86b6a8f0fabb5e5849e470f80429c97dcaa2619b0ed3d2f9807b89234a06",
     "scripts/check-duplicate-versions.mjs": "26b26351dd2735dfd8d9a2436b89e876ce2ed93871d0b264f611215dd03d70ae",
+    "scripts/check-empty-subject-guards.mjs": "02fc6af8de14fa2230e5f601225bda2f51d4ed7a462e67c46a36a6c7d92e1833",
     "scripts/check-learnings-budget.ts": "6e9a735f090a7f1f73f0a447e6688c3dabe9edf61de5e9ad48b0c22701ee38d0",
     "scripts/check-merge-driver-registration.mjs": "7779c47facccaee081651d42abb654edb320873e804e32db38c983f16b992eb4",
     "scripts/check-npm-publish-landed.mjs": "9e79501cd7271b05149a275cf42cc092f6cb11a993696822ac6ef0d1f79a7e78",
@@ -1210,7 +1211,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "scripts/lisa-remote-env/setup.sh": "803ceee995da51503202458a24b4f5bd80ace8c779d0c782bf1197c36e1ebe91",
     "scripts/lisa-ruleset-payload.mjs": "3e10b5a4c113e3aa895c6a09f063045eb198dbdabb11a00be87bea1477c91fbb",
     "scripts/lisa-ruleset-reach.mjs": "e51b12092062379e7317b368c89a789e2067ec302388e557ea84a29a35ffc238",
-    "scripts/lisa-update-local.sh": "c811f9e10dbcb38499a9791c1ae9051460b347051d04a1d2046925bab9a53c96",
+    "scripts/lisa-update-local.sh": "eb031a6bb4735e5096ac52efc3ef027233485c86524a83cd7f258d0b6f7b985b",
     "scripts/lisa-work-item.mjs": "51081847e980f314a764c2e50a7a121b1ced9ef4b980f33898057de4c7b852e6",
     "scripts/materialize-copy-overwrite.mjs": "f510944db5b234131cb659b8780f571b460f8052a854131aa27558d73e126f36",
     "scripts/measure-tmpdir-growth.mjs": "aa2f336fdb9592e4b7bda1a676d0915ba259e66a06081622a7e724604219d56b",
@@ -1249,7 +1250,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "typescript/copy-contents/.husky/pre-push": "e73dde7a1dcb3c10be5db540b9d9f46ec74b90ecc10a850b4fb098481ef6de6e",
     "typescript/copy-contents/.husky/prepare-commit-msg": "4a719c20da65653f266e7c8a346b5546ad05f1dfa34665fc7fec47e89d2f58d1",
     "typescript/copy-overwrite/.claude/hooks/worktree-create.sh": "888cfd16bd1ac04f9f8a835eae62f8bd2c956de654bce12ce9a6a52947b121ca",
-    "typescript/copy-overwrite/.github/GITHUB_ACTIONS.md": "3f5d8e7f5f2c8ec1d369359f2ee64c033736df4bc172d06da1b4be5ee65b173b",
+    "typescript/copy-overwrite/.github/GITHUB_ACTIONS.md": "4289146bae8e112049387d4be86941c563b02376a06f0238364aaf3e61c2b127",
     "typescript/copy-overwrite/.lintstagedrc.json": "60bf2d5e86bf9d72f04b8b14368591f104674ff80046fe8bd82e4174ca1523fd",
     "typescript/copy-overwrite/.nvmrc": "0775c6feb7638122e8b68d611cd709bf270f7b5adb5d0d2baa9afab8a6c0fc42",
     "typescript/copy-overwrite/.prettierignore": "b3b3910fbea6fb918cb213935d3a7a356d0d5d554dd9aca66fb1beb672124d30",
@@ -1270,7 +1271,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "typescript/copy-overwrite/eslint.slow.config.ts": "9f0efef2d1012e21a1d5e03eb98634bfeb459e3427147d75ad6905acbbab8466",
     "typescript/copy-overwrite/knip.json": "d557bfb64c8c23d9f03c173798aa1f176f5e28d395ad6667f855049d4b886db6",
     "typescript/copy-overwrite/scripts/check-nightly-e2e-health.mjs": "dfd2fef680de5ef03e63075e8a61c62ca4d95cdfdff6201939b79c748d3397f6",
-    "typescript/copy-overwrite/scripts/check-skipped-required-checks.mjs": "b0fd287c90182cc0d2f0c29281bc88020cef441a6449c15a99b1c85ea2ed3205",
+    "typescript/copy-overwrite/scripts/check-skipped-required-checks.mjs": "ad97de4cea9ca61b10d637ef093e1697e434942d14d92e3e59955b9a81304a4c",
     "typescript/copy-overwrite/scripts/check-threshold-ratchet.mjs": "47bc8b91e38535e694f43d9d3b76c4589ae2796e4ce9e875ab6b09a273e0c93a",
     "typescript/copy-overwrite/scripts/check-verification-coverage.mjs": "777e46c8e8147935f0b944dc21536f6238b26b5b7dca06c5fdb2d2898a9790dc",
     "typescript/copy-overwrite/scripts/lib/bounded-spawn.mjs": "72e277ada531914d7bc51c3cb8dc67b8881aa817d96fa2f9f4d81668a3d3bbc1",
@@ -1292,7 +1293,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "typescript/copy-overwrite/vitest.config.ts": "dc140e617db43da38f456bcc909ae621a62996fe25e7b0babd5e81941308365c",
     "typescript/create-only/.github/required-checks.json": "01f5b7d8587adc21e85f525b57ac04a8143427459d95b48b616216eca54a73df",
     "typescript/create-only/.github/workflows/ci.yml": "409799708fe51716f3c8228950db3bb26864f43a01a9e6186f6d3d1970e29f2d",
-    "typescript/create-only/.github/workflows/review-evidence.yml": "9111a7cc14f7fcab5b7db374933536b01b4a651d14b069321c14c428145809a7",
+    "typescript/create-only/.github/workflows/review-evidence.yml": "62a115d54c084c64d067825daf869f737e1c25dfd2a6e8b3a9df284d069229a6",
     "typescript/create-only/.github/workflows/third-party-review-evidence.yml": "8f1a3b04fa483c59ac4513a2d16eabf4a3e3bba447a562734b1f35fba2552769",
     "typescript/create-only/.gitleaksignore": "6927d376648675331801c798a4390b652a22a3e5d350cd26f36d42c10af02d67",
     "typescript/create-only/audit.ignore.local.json": "096eba7c600446a2f906369a6ff747804a51b9ad3153ca10d9a1d673e416b337",
@@ -7332,6 +7333,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "scripts/check-delivery-deletion-conflicts.mjs": true,
     "scripts/check-derived-artifacts.mjs": true,
     "scripts/check-duplicate-versions.mjs": true,
+    "scripts/check-empty-subject-guards.mjs": true,
     "scripts/check-learnings-budget.ts": true,
     "scripts/check-merge-driver-registration.mjs": true,
     "scripts/check-npm-publish-landed.mjs": true,
@@ -7755,6 +7757,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "src/core/lisa-owned-provenance.ts": true,
     "src/core/lisa-owned-templates.ts": true,
     "src/core/lisa-plugin-selection.ts": true,
+    "src/core/lisa-release-pin.ts": true,
     "src/core/lisa-rules-mirror.ts": true,
     "src/core/lisa-skill-sources.ts": true,
     "src/core/lisa.ts": true,
@@ -7767,6 +7770,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "src/core/project-config-nightly-e2e.ts": true,
     "src/core/project-config.ts": true,
     "src/core/reconciliation-report.ts": true,
+    "src/core/reusable-workflow-pin.ts": true,
     "src/core/safe-relative-markdown-path.ts": true,
     "src/core/self-apply.ts": true,
     "src/core/sonar-integration.ts": true,
@@ -7824,6 +7828,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "src/migrations/ensure-lisa-postinstall.ts": true,
     "src/migrations/ensure-nightly-e2e-workflow-pins.ts": true,
     "src/migrations/ensure-oxlint-base-configs.ts": true,
+    "src/migrations/ensure-pinned-reusable-workflow-refs.ts": true,
     "src/migrations/ensure-playwright-dedicated-caller.ts": true,
     "src/migrations/ensure-push-default-safe.ts": true,
     "src/migrations/ensure-quality-caller-scopes.ts": true,
@@ -8116,6 +8121,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/helpers/verification-gate-harness.ts": true,
     "tests/helpers/workflow-job-graph.ts": true,
     "tests/helpers/workflow-test-utils.ts": true,
+    "tests/integration/applied-project-pins-lisa-workflows.test.ts": true,
     "tests/integration/apply-prompted-guard-downgrade.test.ts": true,
     "tests/integration/apply-reports-unchanged-manifest.test.ts": true,
     "tests/integration/apply-unattended-preserves-host-config.test.ts": true,
@@ -8619,6 +8625,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/unit/core/lisa-owned-templates-classification.test.ts": true,
     "tests/unit/core/lisa-owned-templates.test.ts": true,
     "tests/unit/core/lisa-plugin-selection.test.ts": true,
+    "tests/unit/core/lisa-release-pin.test.ts": true,
     "tests/unit/core/lisa-skill-sources.test.ts": true,
     "tests/unit/core/nightly-e2e-pull-request-triggers.test.ts": true,
     "tests/unit/core/no-downstream-project-names.test.ts": true,
@@ -8632,6 +8639,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/unit/core/project-config-nightly-e2e-default.test.ts": true,
     "tests/unit/core/project-config-nightly-e2e.test.ts": true,
     "tests/unit/core/project-config.test.ts": true,
+    "tests/unit/core/reusable-workflow-pin.test.ts": true,
     "tests/unit/core/role-agent-template-contract.test.ts": true,
     "tests/unit/core/self-apply.test.ts": true,
     "tests/unit/core/skill-frontmatter-contract.test.ts": true,
@@ -8787,6 +8795,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/unit/migrations/ensure-lisa-postinstall.test.ts": true,
     "tests/unit/migrations/ensure-nightly-e2e-workflow-pins.test.ts": true,
     "tests/unit/migrations/ensure-oxlint-base-configs.test.ts": true,
+    "tests/unit/migrations/ensure-pinned-reusable-workflow-refs.test.ts": true,
     "tests/unit/migrations/ensure-playwright-dedicated-caller.test.ts": true,
     "tests/unit/migrations/ensure-push-default-safe.test.ts": true,
     "tests/unit/migrations/ensure-quality-caller-scopes.test.ts": true,
@@ -8856,6 +8865,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/unit/scripts/check-duplicate-versions-helpers.ts": true,
     "tests/unit/scripts/check-duplicate-versions.test.ts": true,
     "tests/unit/scripts/check-duplicate-versions.units.test.ts": true,
+    "tests/unit/scripts/check-empty-subject-guards.test.ts": true,
     "tests/unit/scripts/check-learnings-budget-helpers.ts": true,
     "tests/unit/scripts/check-learnings-budget.test.ts": true,
     "tests/unit/scripts/check-npm-publish-landed.test.ts": true,