feat(ci): reusable-promote-squash.yml — clean squash promotion for bluefin/bluefin-lts (C1/C5)

[castrojo]

Summary

Implements consistency-audit C1 (shared promote logic) and C5 (release-state schema) from projectbluefin/common#583.

C1 — reusable-promote-squash.yml

Shared workflow for the squash-promote pattern used by bluefin and bluefin-lts. Companion to the existing reusable-promote.yml (digest-based, used by dakota).

Key improvements over the per-repo 340–354 LoC workflows:

Before	After
Staleness check on squash branch parent → periodic failures	Always rebuild from origin/main — always clean
12-step mergeability poll (3 min max) + GraphQL enqueue	gh pr merge --auto — fires when checks pass, no polling
343–354 LoC duplicated in each image repo	30 LoC thin caller per repo

Inputs:

• variants — JSON array of variant objects for reusable-release-gate.yml
• cosign_identity_regexp — cert identity regex
• run_e2e / e2e_suites / e2e_image — gate config
• registry — GHCR prefix (default: ghcr.io/projectbluefin)

Jobs preserved: promote → gate (release-gate) → close-failure-issue / report-failure

C5 — docs/schemas/release-state.schema.json

Canonical JSON Schema (draft/2020-12) for .github/release-state.yaml. Used by dakota today; bluefin/bluefin-lts will adopt when they wire reusable-promote.yml callers.

Test plan

• CI passes (actionlint, SHA-pin pre-commit)
• After merge: v1 tag updated by update-v1-tag.yml
• Dependent PRs (bluefin-lts + bluefin) update SHA reference to post-merge v1 SHA

Merge order

This PR must merge first. The thin-caller PRs reference this commit SHA — they will run against this workflow at 72ee991c06c58b865c2419db0af8748eef70199b until Renovate bumps to the new v1 tag after merge.

Parent issues: common#584 · common#588 · common#583

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 1 package(s) with unknown licenses.

See the Details below.

License Issues

.github/workflows/reusable-promote-squash.yml

Package	Version	License	Issue Type
projectbluefin/actions/.github/workflows/reusable-release-gate.yml	cd1f55c	Null	Unknown License

OpenSSF Scorecard

Package	Version	Score	Details
actions/actions/checkout	df4cb1c069e1874edd31b4311f1884172cec0e10	🟢 5.9	Details Check Score Reason Binary-Artifacts 🟢 10 no binaries found in the repo Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Code-Review 🟢 10 all changesets reviewed Maintained ⚠️ 2 3 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 2 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Packaging ⚠️ -1 packaging workflow not detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected SAST 🟢 8 SAST tool detected but not run on all commits Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches
actions/actions/github-script	3a2844b7e9c422d3c10d287c895573f7108da1b3	🟢 7.8	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 21 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies ⚠️ 1 dependency not pinned by hash detected -- score normalized to 1 Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected SAST 🟢 10 SAST tool is run on all commits Branch-Protection 🟢 6 branch protection is not maximal on development and all release branches
actions/projectbluefin/actions/.github/workflows/reusable-release-gate.yml	cd1f55c	Unknown	Unknown

Scanned Files

• .github/workflows/reusable-promote-squash.yml