[brujack]

Summary

PR C of the CI and release hardening plan (spec R8).

• Every CI cargo tool is pinned. The 11 cargo install --locked steps across ci.yml, release.yml, mutation-pr.yml, mutation-testing.yml and cargo-audit-scheduled.yml become taiki-e/install-action@1168f6810a3cb30a3514bf5756a3b7f0422c6df8 # v2.87.28 with tool: <name>@X.Y.Z and fallback: none. --locked pinned each tool's dependency tree, not the tool; install-action downloads the pinned release binary instead of compiling it, and fallback: none fails rather than building an unlisted version.
• Pins: cargo-machete 0.9.2, cargo-nextest 0.9.148, cargo-tarpaulin 0.37.5, cargo-deny 0.20.2, cargo-semver-checks 0.51.0, cargo-audit 0.22.2, cargo-mutants 27.1.0 — each at least 14 days old and present for x86_64 Linux in the action's manifest at the pinned SHA.
• tests/test_tool_installs.py enforces it, failing closed on any cargo install/binstall (also with +toolchain or flags in between), a non-SHA or untagged ref, a quoted or recased uses: that is not exactly the pinned form, a missing with: or fallback: none, a non-X.Y.Z tool, or one tool at two versions.
• Also: an unused loop counter in the coverage-badge step renamed _ (SC2034); Backlog rows for that step's silent push failure and for CI-vs-local tool version parity.

Test Plan

• make test: nextest 1145 passed; pytest passed (27 in the new module)
• The new test fails on main's workflows (11 cargo install lines)
• Mutation: disabling the stray-install-action check fails a test
• CI: Test, Cargo Audit, Semver Check and mutation-pr install their tools through the action and pass
• Coverage: no Rust change

Code review

reviewed-sha: 4356b36
diff-hash: 5c470f62d88c0257fefd2d86bd3e111e2490e704c6e1d7f825c02fb91597256e
reviewers: 2/2 (five lenses split across two reviewers for a mostly mechanical diff: bugs and CI behaviour; CLAUDE.md, history, prior PRs and comments)

Round 1 (7d6c88a): no CI-breaking defect. Tag v2.87.28 resolves to the pinned SHA, and every pinned tool version has an x86_64 Linux entry in install-action's manifest at that SHA, so fallback: none will not fail on a missing asset. Required, fixed in d1a0f28: cargo +stable install / cargo -q install evaded the scanner; a quoted or recased uses: taiki-e/install-action was skipped silently. Both now reported (probed), and any unparsed install-action mention fails closed. Also fixed: a no-op line in one test; the dropped "version parity with local installers" requirement is kept as a P4 Backlog row.

Informational

• https://github.com/brujack/etch-cli/blob/4356b3645b372c7e74b706a450fa7d4af4fc839f/.github/workflows/ci.yml (score 50) The coverage-badge publish loop exits 0 after three failed pushes (pre-existing; P3 Backlog row added). Its unused counter (SC2034) is renamed _ here.

RESOLVED: 2 fixed, 0 kept

Spec alignment (2026-10-27)

• spec: docs/superpowers/specs/2026-10-27-ci-release-hardening-design.md
• anchor: 7aed051
• in scope: R1, R2, R3, R4, R5, R6, R7, R8, R9
• out of scope: none

Findings

ID	Reviewer	Verdict	Reason	Amendment
R1	both	NOT-BUILT	Looked for a test listing allowed continue-on-error sites with reasons and failing on unlisted or stale sites; none in the diff (release.yml still carries continue-on-error on 'Check semver compatibility' with no test).	- R1 reviewed: delivered by PR A (#148), merged to main before this branch, so it is in the base, not this diff — the spec delivers in four ordered PRs
R2	both	NOT-BUILT	Looked for changes unmasking the gitleaks and Snyk steps in ci.yml; the diff's ci.yml hunks touch only tool installs and a loop variable.	- R2 reviewed: delivered by PR A (#148), merged to main before this branch, so it is in the base, not this diff — the spec delivers in four ordered PRs
R3	both	NOT-BUILT	Looked for a .snyk file with an exclude naming tests/test_automerge_bot_hold.py and scripts/test_metrics.py; no .snyk appears in the diff.	- R3 reviewed: delivered by PR A (#148), merged to main before this branch, so it is in the base, not this diff — the spec delivers in four ordered PRs
R4	both	NOT-BUILT	Looked for sha256sum -c verification of direct downloads and a test enforcing it; the diff adds neither (the shellcheck step appears only as unchanged context).	- R4 reviewed: delivered by PR A (#148), merged to main before this branch, so it is in the base, not this diff — the spec delivers in four ordered PRs
R5	both	NOT-BUILT	Looked for a release.yml version-validation step (MAJOR.MINOR.PATCH, Cargo.toml parity, no existing tag, refs/heads/main); release.yml hunks only replace cargo install steps.	- R5 reviewed: delivered by PR B (#149), merged to main before this branch, so it is in the base, not this diff — the spec delivers in four ordered PRs
R6	both	NOT-BUILT	Looked for release.yml changes pushing only the tag and scoping notes from git merge-base HEAD; none in the diff.	- R6 reviewed: delivered by PR B (#149), merged to main before this branch, so it is in the base, not this diff — the spec delivers in four ordered PRs
R7	both	NOT-BUILT	Looked for CHANGELOG.md deletion and an ADR reversing ADR-0009's changelog clause; neither is in the diff (only a backlog row mentions ADR-0017).	- R7 reviewed: delivered by PR B (#149), merged to main before this branch, so it is in the base, not this diff — the spec delivers in four ordered PRs
R9	both	NOT-BUILT	Looked for Makefile changes to build/build-linux and a new install target copying to ${XDG_BIN_HOME:-$HOME/.local/bin}/etch; no Makefile change in the diff (the backlog row for it remains).	- R9 reviewed: not in scope for PR C (plan Task 6, R8); delivered by PR D (plan Task 7) — the spec delivers in four ordered PRs

Reviewed

• R5 reviewed: not in scope for PR A (plan Tasks 1-3, R1-R4); delivered by PR B (plan Task 4) of the same plan — the spec delivers in four ordered PRs
• R6 reviewed: not in scope for PR A (plan Tasks 1-3, R1-R4); delivered by PR B (plan Task 4) of the same plan — the spec delivers in four ordered PRs
• R7 reviewed: not in scope for PR A (plan Tasks 1-3, R1-R4); delivered by PR B (plan Task 5) of the same plan — the spec delivers in four ordered PRs
• R8 reviewed: not in scope for PR A (plan Tasks 1-3, R1-R4); delivered by PR C (plan Task 6) of the same plan — the spec delivers in four ordered PRs
• R9 reviewed: not in scope for PR A (plan Tasks 1-3, R1-R4); delivered by PR D (plan Task 7) of the same plan — the spec delivers in four ordered PRs
• R1 reviewed: delivered by PR A (fix(ci): unmask security scans and verify every download #148, merged to main before this branch; tests/test_continue_on_error.py), so it is in the base, not this diff — the spec delivers in four ordered PRs
• R2 reviewed: delivered by PR A (fix(ci): unmask security scans and verify every download #148, merged); its CI run showed gitleaks and Snyk unmasked and passing — the spec delivers in four ordered PRs
• R3 reviewed: delivered by PR A (fix(ci): unmask security scans and verify every download #148, merged; .snyk) — the spec delivers in four ordered PRs
• R4 reviewed: delivered by PR A (fix(ci): unmask security scans and verify every download #148, merged; tests/test_workflow_downloads.py and the pinned ci.yml steps) — the spec delivers in four ordered PRs
• R8 reviewed: not in scope for PR B (plan Tasks 4-5, R5-R7); delivered by PR C (plan Task 6) — the spec delivers in four ordered PRs
• R9 reviewed: not in scope for PR B; delivered by PR D (plan Task 7) — the spec delivers in four ordered PRs
• R1 reviewed: delivered by PR A (fix(ci): unmask security scans and verify every download #148), merged to main before this branch, so it is in the base, not this diff — the spec delivers in four ordered PRs
• R2 reviewed: delivered by PR A (fix(ci): unmask security scans and verify every download #148), merged to main before this branch, so it is in the base, not this diff — the spec delivers in four ordered PRs
• R3 reviewed: delivered by PR A (fix(ci): unmask security scans and verify every download #148), merged to main before this branch, so it is in the base, not this diff — the spec delivers in four ordered PRs
• R4 reviewed: delivered by PR A (fix(ci): unmask security scans and verify every download #148), merged to main before this branch, so it is in the base, not this diff — the spec delivers in four ordered PRs
• R5 reviewed: delivered by PR B (fix(release): validate version, scope notes, push only the tag #149), merged to main before this branch, so it is in the base, not this diff — the spec delivers in four ordered PRs
• R6 reviewed: delivered by PR B (fix(release): validate version, scope notes, push only the tag #149), merged to main before this branch, so it is in the base, not this diff — the spec delivers in four ordered PRs
• R7 reviewed: delivered by PR B (fix(release): validate version, scope notes, push only the tag #149), merged to main before this branch, so it is in the base, not this diff — the spec delivers in four ordered PRs
• R9 reviewed: not in scope for PR C (plan Task 6, R8); delivered by PR D (plan Task 7) — the spec delivers in four ordered PRs

Verifications

• none

🤖 Generated with Claude Code

https://claude.ai/code/session_019xRsBqwrPLVSCJ1hXnhotg