feat: add read-only case growth convergence verifier

.github/workflows/governance-gate.yml

@@ -13,7 +13,9 @@ jobs:
   required-files:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
       - name: Check Required Governance Files
         shell: pwsh
         run: |
@@ -44,16 +46,20 @@ jobs:
   ho-det-011-case-packet:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
       - name: Install schema validation dependency
-        run: python -m pip install jsonschema
+        run: python -m pip install jsonschema==4.23.0
       - name: Verify HO-DET-011 case packet guardrail
         run: python scripts/verify-ho-det-011-case-packet.py
 
   runtime-route-proof-v1-private-candidate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
       - name: Parse Runtime Route Proof v1 private candidate schema
         run: python -m json.tool contracts/schemas/runtime-route-proof-v1-private-candidate.schema.json >/dev/null
       - name: Parse Runtime Route Proof v1 private candidate sample
@@ -64,9 +70,11 @@ jobs:
   runtime-collector-eligibility-v0:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
       - name: Install schema validation dependency
-        run: python -m pip install jsonschema
+        run: python -m pip install jsonschema==4.23.0
       - name: Verify Runtime Collector Eligibility Registry v0
         run: |
           python scripts/verify-runtime-collector-eligibility-v0.py --registry contracts/examples/runtime-collector-eligibility-v0.sample.json --schema contracts/schemas/runtime-collector-eligibility-v0.schema.json
@@ -75,18 +83,23 @@ jobs:
     if: github.event_name != 'pull_request'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
       - name: Check out HawkinsOperations sibling repositories
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
+          persist-credentials: false
           repository: HawkinsOperations/hawkinsoperations-detections
           path: hawkinsoperations-detections
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
+          persist-credentials: false
           repository: HawkinsOperations/hawkinsoperations-validation
           path: hawkinsoperations-validation
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
+          persist-credentials: false
           repository: HawkinsOperations/hawkinsoperations-proof
           path: hawkinsoperations-proof
       - name: Verify Lifetime Case Ledger v1 spine

.github/workflows/hoxline-main-checks.yml

@@ -13,35 +13,35 @@ jobs:
     name: Main/push governance checks
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           persist-credentials: false
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           repository: HawkinsOperations/.github
           path: hawkinsoperations-github
           persist-credentials: false
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           repository: HawkinsOperations/hawkinsoperations-detections
           path: hawkinsoperations-detections
           persist-credentials: false
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           repository: HawkinsOperations/hawkinsoperations-validation
           path: hawkinsoperations-validation
           persist-credentials: false
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           repository: HawkinsOperations/hawkinsoperations-proof
           path: hawkinsoperations-proof
           persist-credentials: false
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           repository: HawkinsOperations/hoxline
           path: hoxline
           persist-credentials: false
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           repository: HawkinsOperations/hawkinsoperations-website
           path: hawkinsoperations-website

.github/workflows/hoxline-private-canary.yml

@@ -39,7 +39,7 @@ jobs:
     runs-on: [self-hosted, ho-gpu-01, gpu, v100]
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           persist-credentials: false
 

.github/workflows/hoxline-schedule-gated-collection.yml

@@ -32,7 +32,7 @@ jobs:
       HOXLINE_PRIVATE_ROUTE: /var/lib/hoxline/private-scheduled-collector-v0
       HOXLINE_COLLECTOR_STATE: /var/lib/hoxline/private-scheduled-collector-v0/collector-state.sqlite
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           persist-credentials: false