fix(acquisition): pin scheduled audit toolchain

[seonghobae]

Purpose

Test-first hardening of the protected acquisition-readiness workflow. The workflow uses immutable Action revisions, non-persistent checkout credentials, the exact reviewed Node/npm runtime, executes no unnecessary dependency/lifecycle installation, revalidates tracked source before evidence generation, and now fails closed if the retained acquisition evidence artifact is absent.

Exact current lineage

• protected/live base: c85d710804139c0697d7ef8fa47d02b1389e6d84
• branch: fix/acquisition-scan-immutable-toolchain
• no-install contract: 07a6514250c8100f0362c28391a855c6033a7809
• no-install/source-integrity GREEN: 358eaa053ee7de7bcaa0a412ea858cb61cd376a9
• retained-artifact contract commit: 9d0043a68467e3efb112988ca3e9e5be09152c24
• exact current GREEN: a9f22dab16e4c81456350e41d477fd623665919c
• changed files: .github/workflows/acquisition-readiness-scan.yml, test/acquisition-readiness-scan-toolchain-integrity.test.ts

#69 does not change .github/workflows/acquisition-readiness-scan.yml; this branch remains path-disjoint from its stale acquisition implementation surface.

RCA -> remedies -> feasibility -> action -> proof

Dependency/lifecycle authority

The acquisition entrypoints are repository Node scripts composed from Node built-ins/local modules, so dependency installation added avoidable execution authority before buyer-evidence generation. Preserving frozen install, using --ignore-scripts, and removing installation were considered. Eliminating install execution is the smallest authority-reducing remedy and preserves evidence semantics.

Retained evidence fail-open

Fresh inspection found the final actions/upload-artifact step used if-no-files-found: warn. A scheduled/report-only run could therefore complete without retaining the acquisition artifact that downstream diligence expects. Distinct remedies were warning-only telemetry, a separate pre-upload existence check, or using the upload action's native fail-closed contract. if-no-files-found: error is the narrowest supported remedy and directly binds workflow success to evidence retention.

The contract commit 9d0043a68467e3efb112988ca3e9e5be09152c24 preceded the implementation, but its Actions runs were cancelled by branch concurrency after the GREEN follow-up and are not promoted as terminal RED evidence. CodeRabbit independently identified the same current defect on that predecessor. Exact current GREEN a9f22dab16e4c81456350e41d477fd623665919c changes the acquisition upload to if-no-files-found: error while preserving artifact name/path.

Exact current proof

For unchanged head a9f22dab16e4c81456350e41d477fd623665919c:

• application ci run 31472336768: terminal success;
• reviewer-ci run 31472336543: terminal success;
• eligible central Security Scan run 31472336532: terminal success;
• application CI checked out the exact head, passed 650 tests, reports 100% statements/branches/functions/lines for owned production coverage, and npm audit found 0 vulnerabilities;
• current inline review threads: none;
• visible CodeRabbit formal submission is COMMENTED on predecessor 9d0043a..., not qualifying independent approval;
• GitHub reports the PR Ready and mergeable.

The ordinary CI KPI gate still reports SKIP when real production KPI input is absent; that remains non-operational evidence. Missing production KPI, immutable release/deployment, customer/revenue, owner/legal rights and transfer evidence remain fail closed.

Remaining integration

• Pin trusted checkout/setup-node/upload-artifact revisions and disable persisted checkout credentials.
• Bind execution to exact Node 24.19.0 / npm 11.17.0.
• Remove unnecessary dependency/lifecycle execution.
• Revalidate tracked source and exact workflow SHA before evidence generation.
• Fail closed if the acquisition artifact is not retained.
• Reacquire exact-head application CI, reviewer CI, eligible Security Scan and current review/thread state.
• Obtain actual live chore(governance): protect main and enforce release checks #27 governance plus qualifying independent non-author formal approval required by chore(operations): provision and activate hourly maintainer App #29 where applicable.
• Merge only an unchanged exact head after all applicable gates remain satisfied.
• Run protected-main acquisition evidence collection after integration and retain production/release/legal evidence separately.

Technical GREEN is not merge, release, deployment, production, legal or acquisition authority.

Related: #147, #5, #27, #68, #69, #155

[coderabbitai]

📝 Walkthrough

Walkthrough

acquisition-readiness 워크플로가 외부 액션을 커밋에 고정하고 checkout 자격 증명을 비활성화한다. Node.js와 npm 버전을 정확히 검증한다. 증거 생성 전 소스 상태와 커밋을 확인한다. 관련 조건을 자동화 테스트로 검증한다.

Changes

Acquisition readiness 무결성

Layer / File(s)	Summary
워크플로 실행 무결성 .github/workflows/acquisition-readiness-scan.yml	GitHub Actions를 커밋에 고정하고 checkout 자격 증명 저장을 비활성화한다. Node.js와 npm 버전을 검증한다. 기존 의존성 설치 단계를 제거한다. 증거 생성 전 추적 파일과 커밋 SHA를 확인한다. artifact 파일이 없으면 업로드를 실패시킨다.
무결성 계약 검증 test/acquisition-readiness-scan-toolchain-integrity.test.ts	액션 고정, 도구체인 버전, 설치 명령 부재, 증거 생성 전 재검증 순서와 명령, artifact 누락 시 실패 조건을 검증한다.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related issues

• build(acquisition): pin scheduled audit workflow actions and toolchain #147 — 동일한 acquisition-readiness 워크플로의 액션 고정, 정확한 Node/npm 검증, 자격 증명 비활성화와 테스트를 다룬다.
• build(readiness): pin scheduled evidence workflow actions and toolchain #145 — readiness evidence 워크플로의 액션 고정과 정확한 Node/npm 버전 적용을 다룬다.
• build(governance): bind maintainer preflight scripts to exact reviewed Node runtime #153 — setup-node 고정, 정확한 Node 버전 검증, npm ci 부재 조건이 겹친다.

Possibly related PRs

• ContextualWisdomLab/noema#62 — 외부 액션을 커밋 SHA에 고정하고 checkout 자격 증명 저장을 비활성화하는 변경이 겹친다.
• ContextualWisdomLab/noema#69 — acquisition-readiness 워크플로의 checkout 무결성, 증거 검증, 관련 테스트를 함께 다룬다.
• ContextualWisdomLab/noema#150 — readiness 워크플로의 도구체인 설정과 무결성 테스트를 함께 변경한다.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 예약된 acquisition 감사 도구 체인을 커밋에 고정하는 주요 변경 사항을 정확하고 간결하게 설명합니다.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/acquisition-scan-immutable-toolchain

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

.github/workflows/acquisition-readiness-scan.yml (1)

64-68: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

아티팩트 누락을 오류로 처리하십시오.

if-no-files-found: warn은 증거 아티팩트가 없어도 워크플로 성공을 허용합니다. 이는 test/acquisition-readiness-scan-toolchain-integrity.test.ts 50-56행의 fail-closed 계약을 위반합니다. if-no-files-found: error로 변경하십시오.

수정 제안

-          if-no-files-found: warn
+          if-no-files-found: error

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/acquisition-readiness-scan.yml around lines 64 - 68,
Update the if-no-files-found setting in the acquisition-readiness-audit
upload-artifact step to error so missing evidence artifacts fail the workflow,
preserving the existing artifact name and path.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In @.github/workflows/acquisition-readiness-scan.yml:
- Around line 64-68: Update the if-no-files-found setting in the
acquisition-readiness-audit upload-artifact step to error so missing evidence
artifacts fail the workflow, preserving the existing artifact name and path.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: ef723acb-7f3d-4ee5-879b-ad50b0e810b4

📥 Commits

Reviewing files that changed from the base of the PR and between c85d710 and 9d0043a.

📒 Files selected for processing (2)

• .github/workflows/acquisition-readiness-scan.yml
• test/acquisition-readiness-scan-toolchain-integrity.test.ts