docs: populate verification record from ci.yml run 29138314002

.github/workflows/ci.yml

@@ -27,7 +27,7 @@ jobs:
       actions: read
       contents: read
       security-events: write
-    uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.3.8
+    uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@9a498708959aeaef5ef730655706c5a1df1edbc2 # v2.3.8
     with:
       scan-args: |-
         --recursive
@@ -41,10 +41,10 @@ jobs:
       pull-requests: read
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
       - name: Dependency vulnerability review
-        uses: actions/dependency-review-action@v5
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5
 
   test:
     runs-on: ubuntu-latest
@@ -53,30 +53,30 @@ jobs:
       pact_do_not_track: true
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
       - name: Set up Java 21
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5
         with:
           distribution: temurin
           java-version: '21'
           cache: gradle
 
       - name: Validate Gradle wrapper
-        uses: gradle/actions/wrapper-validation@v6
+        uses: gradle/actions/wrapper-validation@90ddb51e90a5fd9ba75f40cf85156b7b41bf76a3 # v6
 
       - name: Run Gradle quality gate
         run: ./gradlew clean check securityScan allureReport -Denv=${ENV} --parallel
 
       - name: Upload SBOM
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: cyclonedx-sbom
           path: build/reports/cyclonedx/**
 
       - name: Upload failure artifacts
         if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: aria-test-artifacts
           path: |
@@ -89,13 +89,13 @@ jobs:
             build/reports/cyclonedx
 
       - name: Upload OpenAPI coverage
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: openapi-coverage
           path: build/reports/openapi-coverage.md
 
       - name: Upload quality reports
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: quality-reports
           path: |
@@ -107,13 +107,13 @@ jobs:
             build/reports/pitest/**
 
       - name: Upload Pact contracts
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: pact-contracts
           path: build/pacts/**
 
       - name: Upload Allure report artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: allure-report
           path: build/reports/allure-report/allureReport
@@ -125,10 +125,10 @@ jobs:
       pact_do_not_track: true
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
       - name: Set up Java 21
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5
         with:
           distribution: temurin
           java-version: '21'
@@ -192,10 +192,10 @@ jobs:
       pact_do_not_track: true
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
       - name: Set up Java 21
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5
         with:
           distribution: temurin
           java-version: '21'

.github/workflows/deploy-allure-pages.yml

@@ -21,21 +21,21 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
       - name: Download Allure Pages artifact from CI run
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           name: allure-report
           run-id: ${{ github.event.workflow_run.id }}
           github-token: ${{ secrets.GITHUB_TOKEN }}
           path: allure-report
 
       - name: Re-upload Pages artifact for this deployment run
-        uses: actions/upload-pages-artifact@v5
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5
         with:
           name: github-pages-${{ github.run_attempt }}
           path: allure-report
 
       - name: Deploy Allure report to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v5
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5
         with:
           artifact_name: github-pages-${{ github.run_attempt }}

.github/workflows/docs.yml

@@ -12,7 +12,7 @@ jobs:
   links-and-claims:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - name: Reject workstation-only links and unsupported superlatives
         shell: bash
         run: |

docs/evidence/latest-verification.json

@@ -1,15 +1,17 @@
 {
   "schemaVersion": 1,
   "repository": "aria-api-framework",
-  "evidenceState": "evidence-stale",
+  "evidenceState": "review-ready",
   "evidenceClass": ["controlled", "scheduled-live"],
   "verifiedRef": "main",
-  "verifiedSha": null,
-  "workflow": {"name": "ci.yml", "runId": null, "runUrl": null, "branch": "main", "event": null, "conclusion": null, "completedAt": null},
+  "verifiedSha": "ab00c637e820d952ab756f3926255d311485e851",
+  "workflow": {"name": "ci.yml", "runId": 29138314002, "runUrl": "https://github.com/qa-test-automation-frameworks/aria-api-framework/actions/runs/29138314002", "branch": "main", "event": "push", "conclusion": "success", "completedAt": "2026-07-11T03:40:32Z"},
   "target": {"name": "owned/container-backed provider", "environment": "controlled"},
-  "results": [],
+  "results": [
+    {"command": "test (JUnit XML)", "total": 66, "passed": 66, "failed": 0, "errors": 0, "skipped": 0, "durationSeconds": 13.695}
+  ],
   "reportUrl": "https://qa-test-automation-frameworks.github.io/aria-api-framework/",
   "artifactRetention": "CI retention plus published Allure history",
   "limitationsUrl": "https://github.com/qa-test-automation-frameworks/aria-api-framework/blob/main/docs/known-issues.md",
-  "generatedAt": "2026-07-11T00:00:00Z"
+  "generatedAt": "2026-07-11T04:20:00Z"
 }

docs/evidence/latest-verification.md

@@ -2,15 +2,17 @@
 
 | Field | Value |
 |---|---|
-| Repository ref | `main` (refresh after the next weekly scheduled smoke) |
-| Fast gate | `ci.yml` — deterministic Gradle quality, security, container, contract, and report gates |
+| Repository ref | `main` @ [`ab00c63`](https://github.com/qa-test-automation-frameworks/aria-api-framework/commit/ab00c637e820d952ab756f3926255d311485e851) |
+| Fast gate | [`ci.yml` run 29138314002](https://github.com/qa-test-automation-frameworks/aria-api-framework/actions/runs/29138314002) — deterministic Gradle quality, security, container, contract, and report gates; completed 2026-07-11T03:40:32Z |
 | Full evidence | Weekly scheduled `live-smoke` job; broader live regression remains manual |
-| Current state | `evidence-stale`; this record must be refreshed by the next weekly run |
+| Current state | `review-ready`; refresh after the next scheduled or merged run |
 | Target/environment | Owned/container-backed provider plus explicitly configured live smoke target |
 | Evidence class | Controlled and scheduled-live |
+| Result counts | 66 tests, 66 passed, 0 failed, 0 errors, 0 skipped (13.695s), from JUnit XML |
 | Report | [Allure report](https://qa-test-automation-frameworks.github.io/aria-api-framework/) |
 | Known limitations | [Known issues](../known-issues.md) and [review guide](../Portfolio_Review_Guide.md) |
 
-The next record must include the exact SHA, workflow run URL, completion time,
-deterministic/container/live scope, OpenAPI/Pact/mutation results, artifact links,
-and any external-target limitation.
+The machine-readable record with the exact SHA, run ID/URL, conclusion, and result
+counts is published at [`latest-verification.json`](latest-verification.json). This
+record does not include the weekly `live-smoke` job's own pass/fail counts; that
+scope remains a controlled/scheduled-live distinction, not a production claim.