Merge reviewed candidate 20260920T070025Z-delivery-trust (pulse be6179c2d2)

Refresh reviewed GitHub Actions pins: actions/setup-go 6.4.0 -> 7.0.0, signpath/github-action-submit-signing-request v2 -> v3.0, actions/github-script 8.0.0 -> 9.0.0 with their reviewed pin constants, release-consumer manifest and installer/promotion governance assertions. Clears Dependabot #2094/#2095/#2096.

Change-source: pulse-maintainer

scripts/check_workflow_trust.py

@@ -155,7 +155,7 @@ GENERATED_CODE_ACTION_INPUTS = {
 SAFE_PULL_REQUEST_TARGET_WORKFLOW = "reclaim-closed-pr-capacity.yml"
 SAFE_PULL_REQUEST_TARGET_ACTIONS = (
     "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1",
-    "actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd",
+    "actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3",
 )
 # v7.0.1 includes checkout's fail-closed fork-PR protection for privileged
 # pull_request_target and workflow_run events. Keep this exact-pin allowlist
@@ -172,7 +172,7 @@ REVIEWED_NODE24_ACTION_PINS = {
         {"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c"}
     ),
     "actions/github-script@": frozenset(
-        {"ed597411d8f924073f98dfc5c65a23a2325f34cd"}
+        {"3a2844b7e9c422d3c10d287c895573f7108da1b3"}
     ),
 }
 WRITE_CREDENTIAL_RATIONALE = "# required: authenticated git writes"

scripts/installtests/build_release_assets_test.go

@@ -1427,7 +1427,7 @@ func TestBackfillReleaseWorkflowRepairsPublishedAssetsWithoutRebuilds(t *testing
 		`contents: write`,
 		`runs-on: ubuntu-24.04`,
 		`uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1`,
-		`uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0`,
+		`uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0`,
 		`SYFT_VERSION="1.42.4"`,
 		`SYFT_ARCHIVE="syft_${SYFT_VERSION}_linux_amd64.tar.gz"`,
 		`SYFT_SHA256="590650c2743b83f327d1bf9bec64f6f83b7fec504187bb84f500c862bf8f2a0f"`,
@@ -1747,7 +1747,7 @@ func TestReleaseCandidateRequiresPlatformNativeAgentSigning(t *testing.T) {
 		`sign-windows-agent:`,
 		`collect-windows-signing:`,
 		`windows_signing_backend:`,
-		`signpath/github-action-submit-signing-request@c92b958760219087e01f8d67a1669ed57afe2627 # v2`,
+		`signpath/github-action-submit-signing-request@f6d04783b4569d051e0c80105fe66e82819d0092 # v3.0`,
 		`github-artifact-id: ${{ steps.upload-unsigned-windows.outputs.artifact-id }}`,
 		`wait-for-completion: false`,
 		`windows-signing-request.json`,
@@ -2279,7 +2279,7 @@ func TestUpdateDemoWorkflowUsesGovernedNetworkPath(t *testing.T) {
 		`Waiting for activated release assets to be available`,
 		`bash /tmp/pulse-install.sh --version "$TAG"`,
 		`Refuse mutation during verification-only checks`,
-		`uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0`,
+		`uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0`,
 		`go run ./scripts/release_update_key.go public-key-ssh`,
 		`sed -i "s|^PINNED_RELEASE_SSH_PUBLIC_KEY=.*|PINNED_RELEASE_SSH_PUBLIC_KEY=\"${TRUSTED_SSH_PUBLIC_KEY}\"|" /tmp/pulse-install.sh`,
 		`Verify target host identity`,

scripts/release_control/action_consumer_manifests.json

@@ -165,8 +165,8 @@
     }
   },
   "signpath/github-action-submit-signing-request": {
-    "sha": "c92b958760219087e01f8d67a1669ed57afe2627",
-    "manifest_sha256": "d0b52fdfa234d87c1ff4d21c06a91d2b6e0dd45e1a8866ad3b58cbdeb9aef326",
+    "sha": "f6d04783b4569d051e0c80105fe66e82819d0092",
+    "manifest_sha256": "9afe14756752bb0b43421bf94e7cebdc3fead29765be4f07fbc60d82421ebc23",
     "inputs": [
       "api-token",
       "artifact-configuration-slug",

scripts/release_control/release_promotion_policy_test.py

@@ -1632,7 +1632,7 @@ class ReleasePromotionPolicyTest(unittest.TestCase):
             workflow,
         )
         self.assertIn(
-            "signpath/github-action-submit-signing-request@c92b958760219087e01f8d67a1669ed57afe2627 # v2",
+            "signpath/github-action-submit-signing-request@f6d04783b4569d051e0c80105fe66e82819d0092 # v3.0",
             workflow,
         )
         self.assertIn("signedArtifactsPublished = $false", workflow)
@@ -2008,7 +2008,7 @@ class ReleasePromotionPolicyTest(unittest.TestCase):
         self.assertIn("windows_signing_backend: signpath", content)
         self.assertIn('if [[ "$REQUIRE_WINDOWS_SIGNING" == "true" ]]', candidate_workflow)
         self.assertIn("inputs.require_windows_signing", candidate_workflow)
-        self.assertIn("signpath/github-action-submit-signing-request@c92b958760219087e01f8d67a1669ed57afe2627 # v2", candidate_workflow)
+        self.assertIn("signpath/github-action-submit-signing-request@f6d04783b4569d051e0c80105fe66e82819d0092 # v3.0", candidate_workflow)
         self.assertIn("github-artifact-id: ${{ steps.upload-unsigned-windows.outputs.artifact-id }}", candidate_workflow)
         self.assertIn("windows-signing-evidence.json", candidate_workflow)
         for signpath_setting in (