Run pinned EgoLint profiles through a reusable workflow

[szmyty]

Outcome

Give every repository one thin GitHub Actions integration that runs an immutable EgoLint distribution with consistent event, evidence, permission, and enforcement behavior.

Scope

• Consume a signed/checksummed EgoLint release and egolint-full image pinned by version and digest.
• Provide reusable inputs for profile, enforcement mode, repository configuration path, runtime budgets, and artifact retention.
• Support:
  • manual full audit and reviewed fix-preview generation;
  • non-blocking observation after merges;
  • pull-request fast/changed-scope validation;
  • complete trusted-branch scans;
  • scheduled security/dependency-debt scans;
  • release validation.
• Upload normalized JSON, Markdown, SARIF, execution plan, effective configuration, tool records, and relevant private adapter artifacts.
• Publish annotations and job summaries without parsing raw tool-specific formats in Relay.
• Use least privilege, pinned actions, safe caching, concurrency controls, and hostile-fork boundaries.
• Preserve the distinction between workflow/execution failure and policy findings.
• Keep organization policy and tool implementations in Hygiene/EgoLint rather than duplicating them in Relay.

Acceptance criteria

• A consumer repository needs only a thin workflow call and minimal egolint.toml.
• Manual, observe, ratchet, and enforce semantics match EgoLint exactly.
• Pull requests can block regressions while post-merge scans retain complete evidence.
• Full scans inspect the complete repository and rely on EgoLint applicability decisions.
• SARIF and report artifacts remain available with documented retention.
• Untrusted pull requests cannot exfiltrate secrets or gain write access.
• At least two materially different repositories prove the reusable workflow.
• Release/image provenance and digest are visible in every run.

Dependencies

• Release Egolint with security and dependency-debt profiles egolint#5
• Define adaptive capability detection and execution policy egolint#35
• Implement manual, observe, ratchet, and enforce modes egolint#36

Related file-contract consumer proof

The organization file-contract epic, egohygiene/.github#32, now has an accepted manual gitignore pilot in egohygiene/filament#6. Reusable content validation is tracked in egohygiene/egolint#61, safe materialization in egohygiene/holon#58, and integrated consumer evidence in egohygiene/empathy#92. File rollout is egohygiene/pace#30 and must coordinate workflow adoption with egohygiene/pace#20.

When the compatible validator/distribution is available, use this as a concrete shared-workflow adoption scenario and coordinate required-file reporting with #5. These related capability issues do not become new prerequisites for shipping this general workflow. The existing release/capability/mode dependencies above remain authoritative. Direct Empathy MegaLinter revision/bootstrap repairs remain deferred to the governed EgoLint/Relay adoption track; no finding is declared resolved by this planning link.