Validate reviewed releases in GitHub Actions - selftune

SelfTune includes a reusable GitHub workflow at .github/workflows/reviewed-skill-set-release.yml. It validates a canonical Skill Set envelope against the exact revision reviewed by your team. Validation is local: it does not upload the envelope or call SelfTune Cloud.

jobs:
  validate-reviewed-set:
    uses: selftune-dev/selftune/.github/workflows/reviewed-skill-set-release.yml@<full-commit-sha>
    with:
      envelope_path: artifacts/support-set.json
      skill_set_id: support
      expected_revision_sha256: <64-character-reviewed-sha256>
      mode: validate

Pin the reusable workflow to a full commit SHA. The workflow itself pins checkout and Bun setup to full action SHAs and Bun 1.3.11, installs the lockfile without lifecycle scripts, and emits deterministic envelope and revision hash outputs. It does not accept or print a SelfTune service credential in validation mode.

Promote after protected approval

Promotion uses the scoped service API only after local validation succeeds. The API atomically checks all of the following before it records the immutable lifecycle event:

the immutable release_id;
the expected Skill Set revision SHA-256;
the expected envelope SHA-256;
readiness: ready; and
the existing active Team owner/admin lifecycle scope.

The reusable workflow’s promotion job is fixed to the skill-set-promotion GitHub Environment. Configure that environment with required reviewers and store a credential scoped only to skill_sets:lifecycle as SELFTUNE_SERVICE_TOKEN. Never pass the credential as a workflow input or command argument.

jobs:
  promote-reviewed-set:
    uses: selftune-dev/selftune/.github/workflows/reviewed-skill-set-release.yml@<full-commit-sha>
    with:
      envelope_path: artifacts/support-set.json
      skill_set_id: support
      expected_revision_sha256: <64-character-reviewed-sha256>
      mode: promote
      release_id: <immutable-hosted-release-id>
      api_base_url: https://<your-convex-http-origin>
    secrets: inherit

The API rejects blocked or unrecorded readiness, hash drift, deprecated releases, revoked credentials, lapsed Team access, and credentials without the lifecycle scope. Workflow validation is local evidence; a returned promotion receipt is hosted development or production evidence only for the API origin you configured.