Nix Forge CI v2.9.0

Changelog

  • Add the shared fuzz-atheris action so Python projects can run weighted fuzz campaigns with the same CI contract.
  • Verify the reusable workflow signer identity when publishing source releases.
  • Check Dependabot DCO sign-off on a schedule and keep related CodeQL action updates in one pull request. The workflow validator now detects mismatched CodeQL action revisions within a job.
  • Validate DCO on dispatched merge queue refs when native merge-group events do not run, and require consumer queue reconcilers to include the DCO workflow.
  • Match nested shared action and workflow paths in Dependabot's shared-ci group while keeping the independently reviewed SLSA builder and repository checks pins separate.
  • Update the shared CodeQL actions to v4.38.2.

This compatible v2 release keeps existing reusable workflow inputs and outputs. Consumers should update the general nix-forge/ci action and workflow references in a repository to the published release commit together. Use scripts/sync-release.py --release v2.9.0 to prepare that change, then run the repository's workflow contract check. The script leaves actions/repository-checks and SLSA builders on their separately reviewed pins.

The release is published by nix-forge/ci/.github/workflows/release.yml, which builds the tagged source archive, checksum, manifest, and portable Sigstore provenance through the pinned reusable source builder. The publisher verifies those artifacts and the signer identity before making the release public. No new privileged pull request step is introduced. Candidate validation includes nix develop --command bash scripts/check.sh, nix flake check, a representative consumer check, and passing pull request and merge queue checks before tagging.

The v2.8.0 pin remains available for rollback. No support end date is scheduled for v2.8.x.