fix(ci): verify-index must read the authoritative index, not the raw CDN

[LukasWodka]

Bugbot flagged this on the staging -> main promotion (client#495) and it's a fair hit on a guard I added yesterday in #467 — the finding is that the guard can pass while the thing it guards is already broken.

The problem

verify-index ran:

curl -fsSL "https://raw.githubusercontent.com/$GITHUB_REPOSITORY/gh-pages/index.yaml?nocache=$GITHUB_RUN_ID"

raw.githubusercontent.com is CDN-fronted and serves a stale copy for some time after a gh-pages push, and a ?nocache= query parameter does not reliably bust it. This job runs seconds after the release job may have pushed, so it could read a pre-push index, see no prerelease versions, and go green while the customer-facing index was already polluted — precisely the leak it was written to catch (the 1.9.7-rc published-as-stable incident).

The fix

Read the blob through the contents API at ?ref=gh-pages, which is read-after-write consistent for a ref rather than CDN-cached:

idx=$(gh api "repos/$GITHUB_REPOSITORY/contents/index.yaml?ref=gh-pages" \
        -H "Accept: application/vnd.github.raw+json")

Plus an explicit empty-read guard: an unreadable index now fails the job instead of letting the invariant checks trivially "hold" against no data. That is the same failure shape as the empty-index commit I made during the gh-pages surgery — a critical read that silently returns nothing must never look like success.

Adds a job-scoped permissions: contents: read.

Verification

• actionlint + shellcheck at CI-pinned versions: 6 findings before, 6 after — my change adds none (all six are pre-existing, in unrelated steps).
• Exercised the new read against the live repo: the API returns the index with 36 chart versions and 0 prerelease-shaped entries, matching the current CDN copy (they agree when there has been no recent push — the divergence only appears in the window this job actually runs in).

Note on the promotion

client was correctly held out of today's prod hop by this finding. It should stay held until the 1.9.8 chart bump reaches staging: promoting now would put 17 commits of chart changes on main while Chart.yaml still reads 1.9.7, so main would no longer match the published 1.9.7 artifact. With this fix plus the bump on staging, the next prod hop promotes and cuts v1.9.8 with content that matches its version.

---

Note

Low Risk
CI-only change to a release guard; no runtime or customer install path behavior changes beyond making the backstop read the current index.

Overview
The post-publish verify-index job no longer fetches index.yaml from raw.githubusercontent.com (CDN can lag right after gh-pages pushes, so checks could pass on a stale file while the public index was already wrong). It now loads the blob with gh api on contents/index.yaml?ref=gh-pages, which is treated as authoritative for that ref.

The job also fails if the read is empty instead of running invariant grep on no data, and grants contents: read for that API call. Workflow error annotations stay on stdout so Actions surfaces them reliably.

^{Reviewed by Cursor Bugbot for commit 0b1bf13. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

bugbot run

[LukasWodka]

👋 Heads-up — Code review queue is at 34 / 30

Above the WIP limit. The team convention is to review existing PRs before opening new work.

Open PRs currently in Code review (oldest first):

• backend#1201 — docs(rfc): Data spaces & federated dataset composition (draft) · author: @LukasWodka · reviewer: @saadqbal
• backend#1217 — docs(rfc): Dataset integrity & score reproducibility (draft) · author: @LukasWodka · reviewer: @saadqbal
• backend#1261 — RFC-BACKEND-0008: board & process reset (decision RFC — for markup) · author: @LukasWodka · reviewer: @saadqbal
• backend#1284 — docs(deploy): backend deploy runbook skeleton (#1263) · author: @LukasWodka · no reviewer assigned
• backend#1332 — feat(check-model): allow KNN/GaussianProcess on a single-edge owned dataset (#923 follow-up) · author: @divyasinghds · no reviewer assigned
• backend#1353 — chore(ci): baseline historical gitleaks findings + wire caller · author: @LukasWodka · no reviewer assigned
• backend#1361 — feat(tasks): bound ExperimentQueue growth for PAUSED experiments (backend#1351) · author: @saqlainsyed007 · reviewer: @saadqbal
• claude-skills#14 — feat(skill): add tracebloc-frontend-app skill · author: @waqaskhanroghani · no reviewer assigned
• claude-skills#15 — feat(skill): add tracebloc-design-system skill · author: @waqaskhanroghani · no reviewer assigned
• claude-skills#16 — feat(skill): add tracebloc-website-frontend skill · author: @waqaskhanroghani · no reviewer assigned

Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.)

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit c60167a. Configure here.}