fix(readiness): restack immutable evidence toolchain after commercial writer

[seonghobae]

Purpose

Fresh protected-main successor for #145 / historical readiness-toolchain work after the commercial-writer integration. This branch is based directly on protected main 2b3eee922efaa7ae2f11040b1a82a2ce305b75c6; no predecessor checks, reviews, scanner/model evidence, production evidence, or merge authority transfer.

Test-first lineage

• RED contract head 3fccc27b192b67f6e45aaf15122db8e532347a20 added only test/readiness-scan-toolchain-integrity.test.ts and reproduced the protected readiness-workflow defects.
• Current GREEN head 1bf9eb8036669939e9a8f0d759571c81ce5b685a changes only .github/workflows/readiness-scan.yml plus that regression test.

The bounded GREEN pins the reviewed checkout/setup-node/upload-artifact revisions, disables persisted checkout credentials, binds Node 24.19.0 and npm 11.17.0, uses the frozen install flags, and fails closed when the retained readiness evidence bundle is missing. KPI collection, scheduled report-only/manual audit semantics, artifact contents, and external production-evidence requirements remain unchanged.

Exact current-head proof

For unchanged exact head 1bf9eb8036669939e9a8f0d759571c81ce5b685a on live protected base 2b3eee922efaa7ae2f11040b1a82a2ce305b75c6:

• application ci run 31581914055: terminal success; verify job checked out the exact head and release verify completed successfully;
• reviewer-ci run 31581913986: terminal success;
• protected-base eligible central Security Scan run 31581914013: terminal success; OSV, supported dependency-review and Trivy hard jobs completed successfully, with Scorecard remaining posture evidence;
• formal GitHub reviews: 0;
• inline review threads: 0;
• CodeRabbit's visible status is the earlier Draft-skip status and is status/model evidence, not formal review or merge authority;
• GitHub reports the PR mergeable and it is Ready for review.

Live governance boundary

The observable active Noema ruleset currently requires the central .github/workflows/security-scan.yml@refs/heads/main workflow on the default branch, has no bypass actors, and does not currently contain a pull-request approval rule. This PR therefore does not invent an independent-approval requirement that live policy does not enforce. Any future live governance change must be re-read before merge.

Technical GREEN does not establish real production KPI, release publication, deployment, customer/revenue, owner/legal/IP-transfer, or acquisition readiness. No protection weakening, synthetic approval, force push, outbound-license choice, version bump, release, or deployment is introduced.

Related: #145, #3, #5, #27, #29

Summary by CodeRabbit

• 개선 사항

  • 자동화된 준비 상태 점검에서 지정된 Node.js 및 npm 버전을 검증하도록 개선했습니다.
  • 외부 작업 도구의 버전을 고정해 점검 결과의 일관성과 보안을 강화했습니다.
  • 필수 결과 파일이 생성되지 않으면 점검이 성공으로 처리되지 않도록 변경했습니다.
  • 설치 옵션을 명확히 적용해 실행 환경 차이로 인한 오류를 줄였습니다.

• 테스트

  • 자동화 설정의 버전 고정, 보안 옵션 및 결과 파일 처리를 검증하는 테스트를 추가했습니다.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: a54dcfc5-e791-4da0-b47f-702fde745588

📥 Commits

Reviewing files that changed from the base of the PR and between 2b3eee9 and 1bf9eb8.

📒 Files selected for processing (2)

• .github/workflows/readiness-scan.yml
• test/readiness-scan-toolchain-integrity.test.ts

---

📝 Walkthrough

Walkthrough

readiness-scan 워크플로의 액션, Node.js, npm 설정을 고정했습니다. 아티팩트 누락 시 업로드가 실패하도록 변경했습니다. 새 Vitest 테스트가 이 설정을 검증합니다.

Changes

Readiness 워크플로 무결성

Layer / File(s)	Summary
워크플로 도구체인 및 아티팩트 설정 .github/workflows/readiness-scan.yml	GitHub Actions를 커밋에 고정하고 checkout 인증 정보 저장을 비활성화했습니다. Node.js 24.19.0과 npm 11.17.0을 검증합니다. npm ci에 고정 옵션을 적용합니다. 아티팩트가 없으면 업로드가 실패합니다.
워크플로 무결성 검증 test/readiness-scan-toolchain-integrity.test.ts	액션 커밋, 인증 설정, 도구체인 버전, npm 설치 옵션, 아티팩트 업로드 설정을 검사하는 Vitest 테스트를 추가했습니다.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related issues

• build(readiness): pin scheduled evidence workflow actions and toolchain #145 — readiness-scan 워크플로에 동일한 액션 고정, Node/npm 버전 고정, npm 옵션 적용을 다룹니다.

Possibly related PRs

• ContextualWisdomLab/noema#216: readiness 워크플로와 무결성 테스트에서 Node/npm 도구체인, 결정적 설치, 아티팩트 실패 설정을 함께 변경합니다.
• ContextualWisdomLab/noema#150: Node.js 24.19.0, npm 11.17.0, 설치 옵션과 무결성 테스트를 직접 연결합니다.
• ContextualWisdomLab/noema#148: readiness 워크플로에서 액션 고정, Node/npm 검증, checkout 인증 비활성화, 아티팩트 실패 설정을 변경합니다.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/readiness-scan-immutable-toolchain-current-main-v2

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}