ci(workflows): remove obsolete base compatibility paths

.github/workflows/code-scanning.yaml

@@ -66,25 +66,12 @@ jobs:
             scripts/shellcheck-json1-to-sarif.mts
           sparse-checkout-cone-mode: false
 
-      - name: Detect trusted ShellCheck converter
-        id: converter
-        run: |
-          set -euo pipefail
-          if [ -f trusted-shellcheck-converter/scripts/shellcheck-json1-to-sarif.mts ]; then
-            echo "present=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "present=false" >> "$GITHUB_OUTPUT"
-            echo "Trusted base revision does not yet contain the ShellCheck converter; conversion and upload begin after this helper lands on the base branch."
-          fi
-
       - name: Setup Node.js
-        if: steps.converter.outputs.present == 'true'
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22.19.0
 
       - name: Install ShellCheck
-        if: steps.converter.outputs.present == 'true'
         run: |
           set -euo pipefail
           probe="$RUNNER_TEMP/shellcheck-json1-probe.sh"
@@ -117,7 +104,6 @@ jobs:
 
       - name: Collect shell files
         id: shell-files
-        if: steps.converter.outputs.present == 'true'
         working-directory: source
         run: |
           git ls-files -z -- '*.sh' 'install.sh' 'uninstall.sh' | sort -zu > "$GITHUB_WORKSPACE/shell-files.txt"
@@ -128,7 +114,7 @@ jobs:
           fi
 
       - name: Generate ShellCheck SARIF
-        if: steps.converter.outputs.present == 'true' && steps.shell-files.outputs.has_files == 'true'
+        if: steps.shell-files.outputs.has_files == 'true'
         working-directory: source
         run: |
           # Ubuntu's packaged ShellCheck may not support --format=sarif.
@@ -170,7 +156,7 @@ jobs:
 
       - name: Check SARIF has runs
         id: sarif-runs
-        if: steps.converter.outputs.present == 'true' && steps.shell-files.outputs.has_files == 'true'
+        if: steps.shell-files.outputs.has_files == 'true'
         run: |
           run_count="$(jq '.runs | length' shellcheck.sarif)"
           if [ "$run_count" -gt 0 ]; then
@@ -181,7 +167,7 @@ jobs:
           fi
 
       - name: Upload ShellCheck SARIF
-        if: steps.converter.outputs.present == 'true' && steps.shell-files.outputs.has_files == 'true' && steps.sarif-runs.outputs.has_runs == 'true'
+        if: steps.shell-files.outputs.has_files == 'true' && steps.sarif-runs.outputs.has_runs == 'true'
         uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4
         with:
           sarif_file: shellcheck.sarif

.github/workflows/codebase-growth-guardrails.yaml

@@ -113,26 +113,10 @@ jobs:
           ref: ${{ github.event.pull_request.base.sha }}
           persist-credentials: false
 
-      - name: Detect guardrail tools on the base revision
-        id: tools
-        # The tools live in the base tree. On the PR that first adds them, the
-        # base revision predates them, so skip until the change lands on base.
-        run: |
-          set -euo pipefail
-          if [ -f tools/growth-guardrails/test-size-budget.mts ] \
-            && [ -f tools/growth-guardrails/test-conditionals.mts ]; then
-            echo "present=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "present=false" >> "$GITHUB_OUTPUT"
-            echo "Trusted base revision does not yet contain the growth-guardrail tools; the policy applies once this change lands on the base branch."
-          fi
-
       - name: Install trusted dependencies
-        if: steps.tools.outputs.present == 'true'
         run: npm ci --ignore-scripts --no-audit --no-fund
 
       - name: Require changed test files to stay within size budget
-        if: steps.tools.outputs.present == 'true'
         env:
           GH_TOKEN: ${{ github.token }}
           PR_NUMBER: ${{ github.event.pull_request.number }}
@@ -145,7 +129,6 @@ jobs:
           node --experimental-strip-types tools/growth-guardrails/test-size-budget.mts
 
       - name: Require changed test files not to add if statements
-        if: steps.tools.outputs.present == 'true'
         env:
           GH_TOKEN: ${{ github.token }}
           PR_NUMBER: ${{ github.event.pull_request.number }}

.github/workflows/installer-hash-check.yaml

@@ -4,10 +4,9 @@
 # Verifies pinned installer SHA-256 hashes still match upstream scripts.
 # Checked: allowlisted OpenShell installer and Brev release assets.
 # Reports the required network-backed drift check on every PR, every push to
-# main, and weekly. Pull requests execute checker code from their base commit;
-# the immutable bootstrap is used only for the PR that first adds that action.
-# A new release-manifest allowlist entry must therefore land on main in a
-# prerequisite PR before a later PR changes runtime selectors to that release.
+# main, and weekly. Pull requests execute checker code from their base commit.
+# A new release-manifest allowlist entry must land on main in a prerequisite PR
+# before a later PR changes runtime selectors to that release.
 
 name: Security / Installer Hash Check
 
@@ -42,9 +41,8 @@ jobs:
         with:
           node-version: 22.19.0
 
-      # The full PR-head checkout below supplies data only. Its checker and pin
-      # parser are never executed: later steps run exclusively from either
-      # .trusted-installer-hash or .bootstrap-installer-hash.
+      # The PR checkout supplies data only. The checker and pin parser execute
+      # from the base-trusted checkout below.
       - name: Checkout pull request head
         if: github.event_name == 'pull_request'
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -72,127 +70,12 @@ jobs:
             scripts/checks/extract-installer-pins.mts
           sparse-checkout-cone-mode: false
 
-      - name: Detect base-trusted installer hash action
-        id: trusted-installer-hash
-        if: github.event_name == 'pull_request'
-        shell: bash
-        run: |
-          if [[ -f .trusted-installer-hash/.github/actions/ci-installer-hash-check/action.yaml ]]; then
-            echo "available=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "available=false" >> "$GITHUB_OUTPUT"
-          fi
-
-      # invalidState: the first PR that introduces this action has no copy in
-      # its base commit. Running the mutable PR-side checker would let that PR
-      # authorize its own installer pins.
-      # sourceBoundary: this exact commit and reviewed Git tree contain the
-      # trusted action and checker; the PR head supplies only inspected files.
-      # whyNotSourceFix: a base commit cannot contain a new action before the
-      # introducing PR merges, so the bootstrap must name immutable code once.
-      # regressionTest: test/pr-workflow-contract.test.ts rejects mutable
-      # checker execution, non-immutable refs, and a mismatched reviewed tree.
-      # manualReviewEvidence: on 2026-07-02, independent Git object inspection
-      # confirmed commit cb5e9aefab2b16fedc0995149fc3520da0d5e0c7 has
-      # tree 1fdf59efe40b78c407e222fd42043b23a61e199a. The reviewed bootstrap
-      # script SHA-256 is 179e1572932eedc1a8ed974d534e9f2a5c34db7ebe971000dc20b77ed9d9feb3;
-      # its parser SHA-256 is
-      # e1d6b63a7b0378a3d28ee71d347ade2da75b3fcf2ff55aa55a9b54d2bc2fc13a;
-      # and its composite-action SHA-256 is
-      # 9c48c64cc934032c99a0aa9aa08b1164757988dc2842e1df88d1b7252ce1183f.
-      # removalCondition: remove the bootstrap checkout after this workflow has
-      # landed on every supported PR base. The fallback is refused after the
-      # explicit 180-day review window ending 2026-12-29T19:35:41Z.
-      - name: Enforce immutable installer hash bootstrap expiry
-        if: >-
-          github.event_name == 'pull_request' &&
-          steps.trusted-installer-hash.outputs.available != 'true'
-        shell: bash
-        run: |
-          set -euo pipefail
-          node <<'NODE'
-          const commit = "cb5e9aefab2b16fedc0995149fc3520da0d5e0c7";
-          const expiresAt = "2026-12-29T19:35:41Z";
-          const expiresAtMs = Date.parse(expiresAt);
-          const canonicalExpiresAt =
-            Number.isFinite(expiresAtMs) && /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}Z$/u.test(expiresAt)
-              ? new Date(expiresAtMs).toISOString().replace(".000Z", "Z")
-              : "";
-
-          if (!/^[a-f0-9]{40}$/u.test(commit) || canonicalExpiresAt !== expiresAt) {
-            console.error(
-              "::error::Immutable installer hash bootstrap expiry configuration is invalid; " +
-                "refusing the fallback. Expected a 40-character commit SHA and canonical UTC expiry.",
-            );
-            process.exit(1);
-          }
-
-          if (Date.now() >= expiresAtMs) {
-            console.error(
-              `::error::Immutable installer hash bootstrap ${commit} expired at ${expiresAt}. ` +
-                "Remove the bootstrap fallback or replace it with newly reviewed immutable checker code.",
-            );
-            process.exit(1);
-          }
-
-          const daysRemaining = Math.ceil((expiresAtMs - Date.now()) / 86_400_000);
-          console.log(
-            `Immutable installer hash bootstrap ${commit} remains valid for ${daysRemaining} day(s), ` +
-              `until ${expiresAt}.`,
-          );
-          NODE
-
-      - name: Checkout immutable installer hash bootstrap
-        if: >-
-          github.event_name == 'pull_request' &&
-          steps.trusted-installer-hash.outputs.available != 'true'
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: cb5e9aefab2b16fedc0995149fc3520da0d5e0c7
-          path: .bootstrap-installer-hash
-          persist-credentials: false
-          sparse-checkout: |
-            .github/actions/ci-installer-hash-check
-            scripts/check-installer-hash.sh
-            scripts/checks/extract-installer-pins.mts
-          sparse-checkout-cone-mode: false
-
-      - name: Verify immutable installer hash bootstrap tree
-        if: >-
-          github.event_name == 'pull_request' &&
-          steps.trusted-installer-hash.outputs.available != 'true'
-        shell: bash
-        run: |
-          set -euo pipefail
-          readonly expected_commit="cb5e9aefab2b16fedc0995149fc3520da0d5e0c7"
-          readonly expected_tree="1fdf59efe40b78c407e222fd42043b23a61e199a"
-          actual_commit="$(git -C .bootstrap-installer-hash rev-parse HEAD)"
-          actual_tree="$(git -C .bootstrap-installer-hash rev-parse 'HEAD^{tree}')"
-          if [[ "${actual_commit}" != "${expected_commit}" ]]; then
-            echo "::error::Immutable installer hash bootstrap checkout does not match the reviewed commit." >&2
-            exit 1
-          fi
-          if [[ "${actual_tree}" != "${expected_tree}" ]]; then
-            echo "::error::Immutable installer hash bootstrap checkout does not match the reviewed tree." >&2
-            exit 1
-          fi
-
       - name: Verify pull request installer hashes from base-trusted code
-        if: >-
-          github.event_name == 'pull_request' &&
-          steps.trusted-installer-hash.outputs.available == 'true'
+        if: github.event_name == 'pull_request'
         uses: ./.trusted-installer-hash/.github/actions/ci-installer-hash-check
         with:
           repo-root: ${{ github.workspace }}
 
-      - name: Verify pull request installer hashes from immutable bootstrap
-        if: >-
-          github.event_name == 'pull_request' &&
-          steps.trusted-installer-hash.outputs.available != 'true'
-        uses: ./.bootstrap-installer-hash/.github/actions/ci-installer-hash-check
-        with:
-          repo-root: ${{ github.workspace }}
-
       - name: Verify trusted event installer hashes
         if: github.event_name != 'pull_request'
         uses: ./.github/actions/ci-installer-hash-check