From e6023455fa4bc8bb11dd8752301723de9f4b217c Mon Sep 17 00:00:00 2001
From: Joshua Temple <joshua.temple@stablekernel.com>
Date: Sun, 14 Jun 2026 00:04:13 -0400
Subject: [PATCH] ci: gate dogfood workflow drift and sync promote.yaml

Add a Workflow Drift Check job to PR validation that rebuilds the CLI,
regenerates the dogfood workflows from .github/manifest.yaml, and fails if
the committed files differ from generator output. Sync promote.yaml, which
had drifted across merged changes (source_image_tag, source_image_digest
outputs, and mode injected via env).

Signed-off-by: Joshua Temple <joshua.temple@stablekernel.com>
---
 .github/workflows/pr.yaml      | 42 +++++++++++++++++++++++++++++-----
 .github/workflows/promote.yaml |  6 ++++-
 2 files changed, 41 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/pr.yaml b/.github/workflows/pr.yaml
index 1efa94fc..a4ac5302 100644
--- a/.github/workflows/pr.yaml
+++ b/.github/workflows/pr.yaml
@@ -57,7 +57,9 @@ jobs:
           cache: true
 
       - name: Run unit tests
-        run: go test -v -race -coverprofile=coverage.out $(go list ./... | grep -v /e2e)
+        run: |
+          go list ./... | grep -v /e2e \
+            | xargs go test -v -race -coverprofile=coverage.out
 
       - name: Check coverage
         run: |
@@ -83,9 +85,35 @@ jobs:
         with:
           version: latest
 
+  workflow-drift:
+    name: Workflow Drift Check
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        with:
+          go-version: '1.23'
+          cache: true
+
+      - name: Build cascade CLI
+        run: go build -o /tmp/cascade ./cmd/cascade
+
+      - name: Regenerate dogfood workflows
+        run: /tmp/cascade generate-workflow --config .github/manifest.yaml --force
+
+      - name: Verify generated workflows match committed files
+        run: |
+          if ! git diff --exit-code -- .github/workflows/ .github/actions/; then
+            echo "::error::Committed dogfood workflows have drifted from generator output."
+            echo "Run 'cascade generate-workflow --config .github/manifest.yaml --force' and commit the result."
+            exit 1
+          fi
+          echo "No drift: committed workflows match generator output."
+
   pr-gate:
     name: PR Gate
-    needs: [unit-tests, lint]
+    needs: [unit-tests, lint, workflow-drift]
     if: ${{ always() }}
     runs-on: ubuntu-latest
     steps:
@@ -93,10 +121,12 @@ jobs:
         run: |
           if [ "${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}" = "true" ]; then
             echo "A required check failed or was cancelled."
-            echo "  unit-tests: ${{ needs.unit-tests.result }}"
-            echo "  lint:       ${{ needs.lint.result }}"
+            echo "  unit-tests:     ${{ needs.unit-tests.result }}"
+            echo "  lint:           ${{ needs.lint.result }}"
+            echo "  workflow-drift: ${{ needs.workflow-drift.result }}"
             exit 1
           fi
           echo "PR Gate passed (jobs succeeded or were skipped)."
-          echo "  unit-tests: ${{ needs.unit-tests.result }}"
-          echo "  lint:       ${{ needs.lint.result }}"
+          echo "  unit-tests:     ${{ needs.unit-tests.result }}"
+          echo "  lint:           ${{ needs.lint.result }}"
+          echo "  workflow-drift: ${{ needs.workflow-drift.result }}"
diff --git a/.github/workflows/promote.yaml b/.github/workflows/promote.yaml
index 9d814256..fa58874e 100644
--- a/.github/workflows/promote.yaml
+++ b/.github/workflows/promote.yaml
@@ -66,6 +66,8 @@ jobs:
       target_env: ${{ steps.preflight.outputs.target_env }}
       source_sha: ${{ steps.preflight.outputs.source_sha }}
       source_version: ${{ steps.preflight.outputs.source_version }}
+      source_image_tag: ${{ steps.preflight.outputs.source_image_tag }}
+      source_image_digest: ${{ steps.preflight.outputs.source_image_digest }}
       changelog_base_sha: ${{ steps.preflight.outputs.changelog_base_sha }}
       rollback_sha: ${{ steps.preflight.outputs.rollback_sha }}
       rollback_on_failure: ${{ steps.preflight.outputs.rollback_on_failure }}
@@ -126,9 +128,11 @@ jobs:
           token: ${{ secrets.GITHUB_TOKEN }}
           version: v0.1.0
       - name: Validate Promotion
+        env:
+          MODE: ${{ github.event.inputs.mode }}
         run: |
           echo "Promotion validated by preflight job"
-          echo "Mode: ${{ github.event.inputs.mode }}"
+          echo "Mode: $MODE"
           echo "Source: ${{ needs.preflight.outputs.source_env }}"
           echo "Final Env: ${{ needs.preflight.outputs.target_env }}"
           echo "::notice::Promotion validation completed successfully"