Nix Forge CI v2.11.0

Changelog

  • Add opt-in reporting and normal queue admission for verified package source PRs whose explicitly dispatched validation is missing from GitHub's PR rollup.
  • Prove the exact GitHub Actions bot identity, same-repository package branch, actual parent ancestry, selected package/catalog paths, and current protected workflow blobs before trusting source validation. The reconciler executes no PR code.
  • Report actual failed required jobs with their exact job URLs. Missing, running, skipped, stale, or untrusted evidence never becomes success. Producer changes during collection or publication invalidate old results and refuse admission.
  • Reuse verified unchanged-run attestations and cache only immutable Git data and stable workflow identity within one reconciliation. Latest-run state remains live; exact-head events avoid polling unrelated source PRs.

Existing callers keep source reporting disabled and retain their current queue behavior. Update general shared references coherently to the v2.11.0 release commit. Repository checks and SLSA builders retain separately reviewed pins. The package caller opts in through package-source-checks, mapping every configured workflow to all of its protected required job names, including actual source DCO sign-off. Add requested, in_progress, and completed workflow-run notifications and retain hourly scheduled recovery. Regenerate existing source branches from reviewed protected main so their workflow blobs match the caller.

The change adds no token permissions and passes no privileged token to PR builds. Expected-head queue admission and full merge-group validation remain required. Regression coverage includes source identity and ownership, workflow drift, approval runs with zero jobs, actual job run/attempt provenance, failure URLs, producer races, stale-result invalidation, and six-PR request budgets. All 133 repository tests and offline workflow/security checks passed locally; required hosted PR and merge-group validation and representative caller checks must pass before the release tag is published.

The functional source was reviewed at dc803bb28ea7ae9f2c576d2d03bb78a7f497e72b. The signed tag and release manifest identify the final reviewed source commit including these notes. Publication uses nix-forge/ci/.github/workflows/release.yml, which verifies the archive checksum, all provenance subjects, exact pinned builder identity, and protected-main tag ancestry. Restore the v2.10.0 pin and remove the source opt-in for rollback. No support end date is scheduled for compatible v2.x consumers.