ci: reuse signed release evidence and complete shared tooling adoption

.github/actions-allowlist.json

@@ -0,0 +1,21 @@
+{
+  "github_owned_allowed": false,
+  "verified_allowed": false,
+  "patterns_allowed": [
+    "acgetchell/research-repo-tools/.github/workflows/dependabot-approve.yml@*",
+    "actions-rust-lang/setup-rust-toolchain@*",
+    "actions/attest@*",
+    "actions/cache@*",
+    "actions/checkout@*",
+    "actions/download-artifact@*",
+    "actions/github-script@*",
+    "actions/upload-artifact@*",
+    "astral-sh/setup-uv@*",
+    "codecov/codecov-action@*",
+    "github/codeql-action/analyze@*",
+    "github/codeql-action/init@*",
+    "github/codeql-action/upload-sarif@*",
+    "rust-lang/crates-io-auth-action@*",
+    "taiki-e/cache-cargo-install-action@*"
+  ]
+}

.github/workflows/ci.yml

@@ -53,3 +53,58 @@ jobs:
 
       - name: Run CI checks
         run: just ci
+
+  release-package:
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Set up declared tools without caches
+        uses: ./.github/actions/setup-tools # zizmor: ignore[self-repository] actionlint 1.7.12 does not accept $/...
+        with:
+          cache: "false"
+      - name: Verify default and exact Cargo packages
+        run: just release-package
+
+  release-evidence:
+    needs: [build, release-package]
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main' && github.repository == 'acgetchell/la-stack'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      actions: read
+      attestations: write
+      id-token: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+        with:
+          version-file: pyproject.toml
+          python-version-file: .python-version
+          enable-cache: false
+      - name: Capture successful native validation identities
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: uv run --locked python -m tooling.release_evidence seal --output target/release-evidence/validation.json
+      - name: Sign original main validation evidence
+        id: validation
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
+        with:
+          subject-path: target/release-evidence/validation.json
+          create-storage-record: false
+      - name: Retain the signature bundle
+        env:
+          VALIDATION_BUNDLE: ${{ steps.validation.outputs.bundle-path }}
+        run: cp "$VALIDATION_BUNDLE" target/release-evidence/validation.sigstore.json
+      - name: Upload signed validation evidence
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: release-evidence-${{ github.run_id }}-${{ github.run_attempt }}
+          path: target/release-evidence/
+          if-no-files-found: error
+          retention-days: 30

.github/workflows/codeql.yml

@@ -39,6 +39,10 @@ jobs:
         with:
           languages: ${{ matrix.language }}
           queries: security-extended
+          # Deliberate violations are exercised by just semgrep-test.
+          config: |
+            paths-ignore:
+              - tests/semgrep/**
 
       - name: Initialize CodeQL (Rust)
         if: matrix.language == 'rust'
@@ -47,6 +51,10 @@ jobs:
           languages: ${{ matrix.language }}
           build-mode: none
           queries: security-extended
+          # Keep ordinary tests in scope; exclude only rule fixtures.
+          config: |
+            paths-ignore:
+              - tests/semgrep/**
 
       - name: Perform CodeQL Analysis
         uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3

.github/workflows/dependabot-auto-merge.yml

@@ -36,7 +36,6 @@ jobs:
             ".github/actions/setup-tools/action.yml",
             ".github/workflows/audit.yml",
             ".github/workflows/benchmarks.yml",
-            ".github/workflows/ci.yml",
             ".github/workflows/codecov.yml",
             ".github/workflows/codeql.yml",
             ".github/workflows/dependabot-auto-merge.yml",

.github/workflows/publish-crates.yml

@@ -27,6 +27,9 @@ jobs:
     permissions:
       contents: read
       checks: read
+      actions: read
+    outputs:
+      ci-evidence: ${{ steps.evidence.outputs.identity }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -45,8 +48,14 @@ jobs:
           RELEASE_TAG: ${{ github.event.release.tag_name }}
         run: just release-gate "$RELEASE_TAG"
 
-      - name: Verify Cargo packaging without uploading
-        run: just release-package
+      - name: Verify original signed main CI evidence
+        id: evidence
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          identity=$(just --quiet release-evidence)
+          printf 'identity=%s\n' "$identity" >> "$GITHUB_OUTPUT"
 
   publish:
     needs: verify
@@ -56,6 +65,7 @@ jobs:
     permissions:
       contents: read
       checks: read
+      actions: read
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -73,16 +83,19 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
           RELEASE_TAG: ${{ github.event.release.tag_name }}
+          CI_EVIDENCE: ${{ needs.verify.outputs.ci-evidence }}
         run: |
           set -euo pipefail
           just release-gate "$RELEASE_TAG"
+          test -n "$CI_EVIDENCE"
+          just release-evidence "$CI_EVIDENCE"
           uv run --locked --no-sync research-repo-tools release registry "$RELEASE_TAG" --expect absent
 
       - name: Obtain a short-lived crates.io token
         id: auth
         uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5
 
-      # The verify job built default/exact packages without upload credentials.
+      # Original main CI built default/exact packages without upload credentials.
       # Repackage the same clean, revalidated commit without running build scripts.
       - name: Package and upload verified source without building
         env:

README.md

@@ -5,7 +5,6 @@
 [![Downloads](https://badgen.net/crates/d/la-stack)](https://crates.io/crates/la-stack)
 [![License](https://badgen.net/github/license/acgetchell/la-stack)](https://github.com/acgetchell/la-stack/blob/main/LICENSE)
 [![Docs.rs](https://docs.rs/la-stack/badge.svg)](https://docs.rs/la-stack)
-
 [![CI](https://github.com/acgetchell/la-stack/actions/workflows/ci.yml/badge.svg)](https://github.com/acgetchell/la-stack/actions/workflows/ci.yml)
 [![CodeQL][codeql-badge]][codeql-workflow]
 [![zizmor][zizmor-badge]][zizmor-workflow]
@@ -63,8 +62,9 @@ while keeping the API intentionally small and explicit.
   encode lengths and angles and support simplex/facet volume calculations; see
   [Gram matrices and geometric measures][refs-gram].
   Each independent dot product is checked once;
-  rounding has no certified error bound, and positive definiteness or affine
-  independence must still be established by factorization or the caller.
+  rounding has no certified error bound. Positive definiteness or affine
+  independence requires independent proof from the caller; successful
+  floating-point factorization is not a certificate.
 - `Interval` and `IntervalMatrix<const D: usize>` for outward-rounded,
   proof-bearing determinant filters through D=7
 - `Ldlt<const D: usize>` for no-pivot factorization intended for exactly

SECURITY.md

@@ -118,11 +118,11 @@ assignment in that file. Other assignments and paths remain checked.
 
 ### Python tool dependencies
 
-Semgrep 1.180.0 accepts `pyjwt[crypto]>=2.15.0,<3`, so the older security override
+Semgrep 1.182.0 accepts `pyjwt[crypto]>=2.15.0,<3`, so the older security override
 is retired. `tooling/semgrep/uv.lock` retains patched PyJWT 2.15.1 and its crypto
 dependencies. Validate native Semgrep scans when changing the scanner or lock.
 
-Semgrep 1.180.0 pins MCP 1.29.0, which is affected by
+Semgrep 1.182.0 pins MCP 1.29.0, which is affected by
 [GHSA-84m7-p3x7-pcfv](https://github.com/advisories/GHSA-84m7-p3x7-pcfv).
 The isolated environment overrides that pin with `mcp>=1.30.0,<2`, retaining
 the patched 1.x API. Remove the override when a released Semgrep dependency

benches/linear_form.rs

@@ -2,6 +2,7 @@
 
 //! Criterion coverage for certified dot products and affine differences.
 
+use core::array::from_fn;
 use std::hint::black_box;
 
 use criterion::Criterion;
@@ -50,13 +51,13 @@ fn prepared_benchmarks<const D: usize>(criterion: &mut Criterion) {
         (
             "sparse",
             [2.0; D],
-            core::array::from_fn(|i| if i == 0 { 1.0 } else { 0.0 }),
+            from_fn(|i| if i == 0 { 1.0 } else { 0.0 }),
             [0.0; D],
             Some(true),
         ),
         (
             "cancellation",
-            core::array::from_fn(|i| {
+            from_fn(|i| {
                 if i == 0 {
                     1.0
                 } else if i == 1 {
@@ -131,18 +132,14 @@ fn batch_benchmarks<const D: usize>(criterion: &mut Criterion) {
         ("origin", [0.0; D]),
         (
             "translated",
-            core::array::from_fn(|i| {
-                f64::from(u32::try_from(i + 1).or_abort("small dimension")) / 8.0
-            }),
+            from_fn(|i| f64::from(u32::try_from(i + 1).or_abort("small dimension")) / 8.0),
         ),
     ] {
         let axis_rows = [2048.0; D];
-        let positive_rows: [[f64; D]; D] = core::array::from_fn(|i| {
-            core::array::from_fn(|j| shared_rows[j] + if i == j { 1.0 } else { 0.0 })
-        });
-        let negative_rows: [[f64; D]; D] = core::array::from_fn(|i| {
-            core::array::from_fn(|j| shared_rows[j] - if i == j { 1.0 } else { 0.0 })
-        });
+        let positive_rows: [[f64; D]; D] =
+            from_fn(|i| from_fn(|j| shared_rows[j] + if i == j { 1.0 } else { 0.0 }));
+        let negative_rows: [[f64; D]; D] =
+            from_fn(|i| from_fn(|j| shared_rows[j] - if i == j { 1.0 } else { 0.0 }));
         let axis = Vector::try_new(axis_rows).or_abort("batch axis");
         let shared = Vector::try_new(shared_rows).or_abort("batch shared");
         let positive = positive_rows.map(|row| Vector::try_new(row).or_abort("positive vertex"));