From f90d5aa5cd5740168a336c9f0f19f11d5a09732a Mon Sep 17 00:00:00 2001
From: Wikid82 <jhatfield82@gmail.com>
Date: Wed, 9 Sep 2026 07:47:41 -0400
Subject: [PATCH 1/3] fix(ci): toolchain rebuild bot evaluates development, not
 the default branch
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The daily schedule / weekly workflow_call runs of toolchain-image.yml
checked out the default branch (main) and computed the toolchain key
from main's recipe, then compared it against main's Dockerfile pin. On
main those always match, so open-bump-pr's 'did the pin move?' check was
never true and no bot PR was opened — even though open-bump-pr targets
'base: development' and development accumulates its own Dockerfile ARG
bumps (x/net, x/crypto, ...) that shift the toolchain key independently
of main.

Result: development-side toolchain-pin drift had no automated detection
or repair path. It only surfaced when a main -> development propagation
PR ran verify-toolchain-pin against the merge recipe (e.g. #1320/#1322),
by which point the pin was already stale on the branch and no bot PR
existed to fix it.

Pin the build-toolchain, trivy-scan and open-bump-pr checkouts to
'development' on every non-pull_request trigger (schedule /
workflow_dispatch / the weekly rebuild's workflow_call). pull_request
runs keep the default merge-ref checkout. sync-pin-on-pr is unchanged
(PR-only, already checks out the PR head; still guarded off for
main/development/nightly/beta head refs).

Claude-Session: https://claude.ai/code/session_01Jz4LgwfkxaF8E7TdAgk94y
---
 .github/workflows/toolchain-image.yml | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/.github/workflows/toolchain-image.yml b/.github/workflows/toolchain-image.yml
index 4681c6024..3218e6133 100644
--- a/.github/workflows/toolchain-image.yml
+++ b/.github/workflows/toolchain-image.yml
@@ -81,6 +81,18 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          # Non-PR entry points (schedule / workflow_dispatch, and the weekly
+          # rebuild's workflow_call — whose github.event_name is the caller's
+          # 'schedule'/'workflow_dispatch') evaluate `development`, not the
+          # default branch (main). `open-bump-pr` opens its digest-bump PR with
+          # `base: development`, and `development` carries its own Dockerfile ARG
+          # bumps (x/net, x/crypto, …) that move the toolchain key independently
+          # of main. Checking out main here made the daily bot blind to
+          # development-side drift, which then only surfaced on the next
+          # main -> development propagation PR's verify-toolchain-pin check.
+          # pull_request keeps the default merge-ref checkout.
+          ref: ${{ github.event_name != 'pull_request' && 'development' || '' }}
 
       - name: Classify trust (same-repo vs fork)
         id: trust
@@ -255,6 +267,11 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          # Match build-toolchain: on non-PR triggers, use development's
+          # .trivyignore so the CRITICAL/HIGH gate scores the development-recipe
+          # image against development's suppressions.
+          ref: ${{ github.event_name != 'pull_request' && 'development' || '' }}
 
       - name: Determine scan reference
         id: ref
@@ -389,6 +406,11 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          # Evaluate + bump development's Dockerfile pin (this job's PR targets
+          # `base: development`). Never runs on pull_request, so this is always
+          # `development`; the expression mirrors build-toolchain for symmetry.
+          ref: ${{ github.event_name != 'pull_request' && 'development' || '' }}
 
       - name: Decide whether the pin moved
         id: moved

From e1788a93ba3bbf47d7396b28c5ffb9d049fdb40f Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Wed, 9 Sep 2026 12:37:32 +0000
Subject: [PATCH 2/3] chore(main): release 0.40.3

---
 .release-please-manifest.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index 0491ea373..77b342632 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "0.40.2"
+  ".": "0.40.3"
 }

From 3b5fe8ddd77c58a3971d1a5524682d93fe1cb487 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Mon, 14 Sep 2026 11:54:43 +0000
Subject: [PATCH 3/3] chore(main): release 0.40.4

---
 .release-please-manifest.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index 77b342632..9fc388f8d 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "0.40.3"
+  ".": "0.40.4"
 }