ci: add reviewed self-hosted procurement reusable workflow

[seonghobae]

Summary

• Adds a central reusable workflow_call for ContextualWisdomLab/procurement-workbench quality CI on self-hosted Linux x64 runner group CWL procurement CI.
• Keeps this as a source-only, secretless quality lane: no inherited secrets, no GitHub-hosted fallback, fixed caller admission, fork refusal, immutable central definition validation, fresh per-run checkout/cache/temp roots and cleanup.
• Adds contract/lifecycle tests and docs for activation HOLD.

Base and ownership

• Stacked on prerequisite ci(gyeot): add central self-hosted verification #2611 exact head dc59db224eb087d100d343ae125defc47b7a2a2c.
• This PR should be reviewed as additive on top of ci(gyeot): add central self-hosted verification #2611, not as a replacement for ci(gyeot): add central self-hosted verification #2611 or ci: stage all workflows on isolated self-hosted runners #2565.
• Product caller changes remain out of scope until a reviewed central commit, eligible runner/group access and actual canary are available.

Verified local evidence

• Exact accepted tree before commit: 0c5040db2eee525dff20964d3dc403273afd35a9.
• Combined local full gate on ci(gyeot): add central self-hosted verification #2611 + these six files: 5457 passed, 4 skipped, 40 subtests passed.
• Coverage: 18280/18280 statements and 7506/7506 branches, 100%.
• Interrogate: 100%.
• Focused procurement tests: 52 passed; affected combined tests: 169 passed.
• actionlint and git diff --check: passed.

Independent review evidence

• Spec review: APPROVE, SHA-256 0e030a0b8ec34bb5af4ca3a81f9ef62aea7b2b18127f9f31a33e68c65f43892e.
• Security review: APPROVE, SHA-256 f7fc4dee2c8411d44d03a76145bd874c6cf9d0aab26117738f96d19c583284c4.
• Combined integration review: APPROVE, SHA-256 585eff59f0b3f4f9b969f79faa33cef64a23d361edf4f078b993714ac2d84287.
• Full-failure RCA for original base: no candidate regressions among the seven original failures, SHA-256 dc15790200508924f2fbb6ee479daa237012006f80d06441933e5634b17c3614.

Activation HOLD

Not completed by this PR:

• actual GitHub Actions self-hosted run/canary,
• Linux Python 3.12/3.14 matrix execution on the runner,
• formal Noema/OpenCode GitHub App approval on the final PR head,
• LiteLLM auto authenticated inference proof,
• product caller switch and hosted-only retirement.

Those must fail closed until the required evidence exists.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 679def55-c366-4b93-9f0a-2eb85ddb6b93

---

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

2026-10-10 merge-prep checkpoint

Head: 29ff89882faf88f2687597a115e4c153f02464bb.

Source status:

• This PR adds the reviewed procurement reusable workflow and tests on top of ci(gyeot): add central self-hosted verification #2611.
• Local combined source evidence passed: 5,457 pytest cases, 100% coverage, 100% interrogate.
• Independent source/spec/security/integration reviews approved the frozen six-file source.

Current remote status:

• PR is still Draft.
• No formal GitHub review objects are present.
• Noema check completed successfully only after live Draft detection skipped model review before sidecar provisioning.
• OpenCode review is skipped.
• These statuses are not Noema/OpenCode approval.

Activation HOLD remains:

• Runner group CWL procurement CI is not present in the current org runner inventory.
• ContextualWisdomLab/procurement-workbench has zero repo-scoped runners and no observed eligible org-group route.
• Protected main still routes review workflows through the existing non-auto path. Literal LiteLLM auto remains in the unmerged ci: stage all workflows on isolated self-hosted runners #2565 lane and still lacks the required cost/private-retention attestations.

Next merge gate:

• Keep this PR Draft/HOLD until runner eligibility, actual self-hosted canary, literal auto review route, and qualifying Noema/OpenCode App approval are all evidenced.

[devin-ai-integration]

Devin Review found 2 potential issues.

[devin-ai-integration]

🔍 Product PR references lack cross-repository links

The product caller’s PR #4 links within this repository, not to ContextualWisdomLab/procurement-workbench. The doctoring record repeats the same reference; both need linkable cross-repository identifiers.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[devin-ai-integration]

🟨 Unisolated remote actions on procurement runner

On each run, setup-uv and setup-node execute remote action code on the self-hosted runner. Their commit pins do not confine host access; runner isolation remains unverified.

---

Was this helpful? React with 👍 or 👎 to provide feedback.