Record fleet scanner canary and audit lock regeneration

.github/requirements/e2e.txt

@@ -0,0 +1,6 @@
+# SPDX-License-Identifier: MPL-2.0
+# PyPI wheel SHA-256 digests for CPython 3.12–3.14 on the Ubuntu x86_64 runner.
+PyYAML==6.0.3 \
+    --hash=sha256:ba1cc08a7ccde2d2ec775841541641e4548226580ab850948cbfda66a1befcdc \
+    --hash=sha256:0f29edc409a6392443abf94b9cf89ce99889a1dd5376d94316ae5145dfedd5d6 \
+    --hash=sha256:c458b6d084f9b935061bc36216e8a69a7e293a2f1e68bf956dcd9e6cbcd143f5

.github/workflows/e2e.yml

@@ -42,6 +42,10 @@ jobs:
         run: |
           cargo test --locked --manifest-path tools/workflow-lock-audit/Cargo.toml
           bash scripts/audit-workflow-lock-map.sh
+      - name: Test audit workflow diagnostics
+        run: |
+          python3 -c 'import yaml' || python3 -m pip install --user --only-binary=:all: --require-hashes -r .github/requirements/e2e.txt
+          bash scripts/tests/pr-audit-workflows-test.sh
       - name: Verify automation quarantine
         run: bash tests/automation-quarantine-test.sh
       - name: Verify fix-outcome verdicts
@@ -72,20 +76,78 @@ jobs:
         run: bash scripts/tests/pinned-reusable-sources-test.sh
       - name: Authenticate pinned reusable sources
         run: bash scripts/audit-pinned-reusable-sources.sh --fetch-sources
+      - name: Verify live scanner caller and negative controls
+        run: bash scripts/tests/scanner-caller-contract-test.sh
+      - name: Authenticate historical scanner source for archived preflight
+        run: |
+          set -euo pipefail
+          tree="$RUNNER_TEMP/historical-scanner-source"
+          mkdir -p "$tree/scripts/lib"
+          cp -R .github "$tree/"
+          cp scripts/lib/{pinned-reusable-sources.json,lock-closure-receipts.tsv} "$tree/scripts/lib/"
+          bash docs/migrations/secret-scanner-cicd-suite/fixtures/restore-historical-source.sh \
+            "$tree" docs/migrations/secret-scanner-cicd-suite/fixtures/historical-source.json
+          bash scripts/audit-pinned-reusable-sources.sh --repo-root "$tree" --fetch-sources
       - name: Preserve lock closure contracts
         run: bash scripts/tests/lock-closure-test.sh
       - name: Audit vendor lock and pinned-source closure
         run: ./scripts/audit-lock-closure.sh
       - name: Test source closure through migration preflight
-        run: bash scripts/tests/pinned-source-entrypoints-test.sh
+        run: |
+          rc=0
+          bash scripts/tests/pinned-source-entrypoints-test.sh > "$RUNNER_TEMP/preflight-tests.log" 2>&1 || rc=$?
+          cat "$RUNNER_TEMP/preflight-tests.log"
+          if [ "$rc" -ne 0 ]; then
+            detail=$(tail -c 5000 "$RUNNER_TEMP/preflight-tests.log")
+            detail=${detail//'%'/'%25'}; detail=${detail//$'\r'/'%0D'}; detail=${detail//$'\n'/'%0A'}
+            echo "::error::Historical preflight tests failed (exit $rc): $detail"
+          fi
+          exit "$rc"
       - name: Prepared secret-scanner migration stays gated
         run: |
-          # 0 = every precondition holds, 2 = evidence still missing (expected
-          # until the unified-dataset-vocab canary lands). 1 and 3 are findings
-          # in the prepared migration and must fail the build.
+          # 0 = all preconditions hold; 2 = evidence is unavailable. The
+          # historical canary receipt is now present, but online/source evidence
+          # may still be unavailable. Findings (1 or 3) must fail the build.
           rc=0
           ./docs/migrations/secret-scanner-cicd-suite/preflight.sh --quiet || rc=$?
           case "$rc" in
             0|2) echo "preflight exit $rc (no findings)";;
             *) echo "preflight exit $rc: findings in the prepared migration" >&2; exit 1;;
           esac
+      - name: Regenerate vendor lock in a disposable worktree
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          git worktree add --detach "$RUNNER_TEMP/lock-regeneration" HEAD
+          gh extension install github/gh-actions-lock --pin v0.4.1
+          cd "$RUNNER_TEMP/lock-regeneration"
+          gh actions-lock --no-interactive
+          git diff --stat -- .github/workflows
+      - name: Compare regenerated and reviewed vendor closures
+        run: |
+          set -euo pipefail
+          bash scripts/audit-lock-regeneration.sh \
+            .github/workflows/actions.lock "$RUNNER_TEMP/lock-regeneration/.github/workflows/actions.lock"
+      - name: Verify reviewed source closure against regeneration
+        run: |
+          set -euo pipefail
+          # The regeneration comparison alone covers only shared vendor roots.
+          # Independently authenticate the job-level reusable closure, including
+          # the scanner, against the regenerated lock and caller tree.
+          rc=0
+          bash scripts/audit-pinned-reusable-sources.sh \
+            --repo-root "$RUNNER_TEMP/lock-regeneration" \
+            --lock "$RUNNER_TEMP/lock-regeneration/.github/workflows/actions.lock" \
+            > "$RUNNER_TEMP/regenerated-source-audit.txt" 2>&1 || rc=$?
+          cat "$RUNNER_TEMP/regenerated-source-audit.txt"
+          if [ "$rc" -ne 0 ]; then
+            # Surface a bounded, escaped diagnostic in the check annotation as
+            # well as the logs; never turn an incomplete comparison into green.
+            detail=$(head -c 3000 "$RUNNER_TEMP/regenerated-source-audit.txt")
+            detail=${detail//'%'/'%25'}
+            detail=${detail//$'\r'/'%0D'}
+            detail=${detail//$'\n'/'%0A'}
+            echo "::error::Regenerated source audit exited $rc: $detail"
+            exit "$rc"
+          fi

.github/workflows/rust.yml

@@ -113,4 +113,20 @@ jobs:
       - name: Audit enabled dependencies (no advisory exclusions)
         # Poise's unmaintained derive macro is reported as maintenance debt;
         # vulnerabilities, unsoundness and yanked crates remain blocking.
-        run: cargo deny --locked --config deny.toml check advisories --warn unmaintained
+        run: |
+          set -uo pipefail
+          set +e
+          cargo deny --locked --config deny.toml check advisories --warn unmaintained 2>&1 | tee "$RUNNER_TEMP/gsbot-advisories.log"
+          statuses=("${PIPESTATUS[@]}")
+          set -e
+          rc=${statuses[0]}
+          if [ "${statuses[1]}" -ne 0 ] && [ "$rc" -eq 0 ]; then rc=${statuses[1]}; fi
+          if [ "$rc" -ne 0 ]; then
+            detail=$(grep -Ei -C 3 'RUSTSEC-|error:|vulnerab|advisories FAILED|failed to|error\[' "$RUNNER_TEMP/gsbot-advisories.log" | head -c 5000 || true)
+            [ -n "$detail" ] || detail='Audit failed; inspect the full job log.'
+            detail=${detail//'%'/'%25'}
+            detail=${detail//$'\r'/'%0D'}
+            detail=${detail//$'\n'/'%0A'}
+            echo "::error::GSBot dependency audit failed (exit $rc): $detail"
+          fi
+          exit "$rc"

.github/workflows/secret-scanner.yml

@@ -36,9 +36,9 @@ jobs:
     # authority, granting less rejects the run at startup with zero jobs.
     permissions:
       contents: read
-    uses: hyperpolymath/cicd-suite/.github/workflows/secret-scanner-reusable.yml@4404c3c0474e17753fe7689f3485c02890aac113
+    uses: hyperpolymath/proven-cicd/.github/workflows/secret-scanner-reusable.yml@03e858b6015e67cc1f9bc31ac1e29ddc1b6fd409
     with:
-      # The canary passed, but introduced-commit PR coverage is not approved.
-      # Every run continues to scan full history.
+      # The old-pin canary does not attest this new pin. Introduced-commit
+      # PR coverage is not approved; every run still scans full history.
       fast-pr: false
     # Deliberately no `secrets:` line — see the boundary note above.

.github/workflows/vendored-bot-drift.yml

@@ -29,6 +29,29 @@ jobs:
           persist-credentials: false
       - run: bash scripts/tests/sync-vendored-bot.sh
 
+  echidnabot-tests:
+    name: echidnabot vendored build and tests
+    runs-on: ubuntu-24.04
+    timeout-minutes: 45
+    defaults:
+      run:
+        working-directory: bots/echidnabot
+    steps:
+      - uses: actions/checkout@v7.0.1
+        with:
+          persist-credentials: false
+      - name: Test the vendored crate at the pinned lock
+        run: |
+          set -euo pipefail
+          # Fleet-owned regression tests are kept outside the pinned source.
+          # Stage them only in this runner and refuse to mask upstream tests.
+          for source in "$GITHUB_WORKSPACE"/tests/echidnabot/*.rs; do
+            target="tests/$(basename "$source")"
+            test ! -e "$target" || { echo "upstream test collision: $target" >&2; exit 1; }
+            cp "$source" "$target"
+          done
+          cargo test --locked --all-targets
+
   drift:
     name: echidnabot pinned to hyperpolymath/echidnabot
     runs-on: ubuntu-24.04