Move the existing organization Go workflow rule to the maintained catalogue #645

🤖 Generated by the Agentic Engineer

Delivered on: 2026-10-18

Objective

Move the existing language-selected organization-required Go workflow to the maintained catalogue without changing its protections, then prove that an ordinary KSail PR actually receives and executes it.

Acceptance criteria

• Backfill the complete observed conditions, rules and bypass actors before allowing Observe/Update only; never grant Create, Delete or LateInitialize.
• Preserve every existing policy semantically and change only the required workflow source. Test the actual rendered policy and refusal controls for selectors, bypasses, workflow identity and authority.
• Pass exact-head validation and review, merge, publish and verify the applied native policy and inherited KSail rule.
• Observe a qualifying KSail PR executing the full selected maintained Go validation, with setup-go caching disabled and no PR module-cache save.
• Preserve Repoint organization-required workflows from actions to .github #237/Bound Go cache writes while preserving main-backed restores #565 and KSail #7348's remaining acceptance and all failed cache-budget observations; make no managed-CodeQL or sustained-budget claim.

Source and activation proof

Observe-first prerequisite #643/#644 was released as v7.16.1. The complete native observation captured the Go-language/default-branch selector, active enforcement, existing administrator bypass and workflow policy before enabling Update.

#646 merged at 12:11:40 UTC as verified signed 8d2203af130a8c27b8b98b3d7146f76b5ade7a98. Accepted head 499fcd00f41adec6569a6b38f0bb9efd93623e76 and the merge share tree a875305037e1b15459763482bb0050e9101d5c73. All fourteen local Maintenance checks, 42 refusal controls, full hosted CI and finding-free exact-head CodeRabbit review passed. The earlier provider-required empty-list finding was fixed with RED/GREEN controls; the immutable observation was preserved.

v7.16.2 release/CD and main CI succeeded. The signed revision 7.16.2@sha256:77868c0f343bd1d4a38a368493432f332bf55d579caadb00b6dcb0f8b7f4c87b was verified and applied. The native resource is Ready/Synced at current generation 3 with Observe/Update only. Complete normalized readback preserves the observed policy except source 948529001 → 933213756. GitHub's inherited KSail rule independently confirms the new repository, original path/ref and do_not_enforce_on_create: true.

Ordinary consumer proof

KSail #7864, exact signed head 8363ebd655cc586e4b6c341e1c0bfdc99a0110ce, received direct required Go run 39126460789. The workflow succeeded. All eight selected jobs passed: Build, golangci-lint, dead-code analysis, vulnerability scanning, MegaLinter, tidy, race/coverage and ordinary tests. Change detection and all three signed-fix jobs also passed; the source head stayed unchanged.

Complete successful native log reads for all eight jobs explicitly show setup-go cache disabled and main-backed module restores, with no Go module/setup-go/compilation cache saves. Test and race/coverage restored their separate main compilation modes; their named save steps were skipped. The separate schema/linter caches remain permitted and are not relabeled redundant Go archives. Native log records, not YAML assertions alone, establish this behavior.

The ordinary Test job measured 20m17s in the earlier legacy-source run and 8m04s in this consumer. This is an observational pair with differing cache warmth/source, not a controlled attribution or a whole-CI speedup claim. The separate immutable Calico baseline outcome is completed under KSail #7860.

Preserved boundaries

KSail #7861 merged before activation as required. #237 still owns other legacy/overlapping/template workflow rules and a complete organization-wide inventory. #565 still requires its qualifying main/dependency-PR proof; this CI-only consumer is not a dependency update. KSail #7348 retains the managed-writer work, all failed checkpoints and sustained observation. #7864's remaining system matrix and its mirror-warmer change are not declared complete here. No direct settings mutation, new App, paid capacity or cache deletion was used.

Priority High; effort Medium, including complete policy observation, safe adoption, publication/readback and ordinary consumer proof. The maintainer's WIP waiver changed no security or merge gate. Part of #237.