CI: eliminate actions/checkout default-branch init warning without suppressing stderr

[seonghobae]

Current state — 2026-09-15

The warning is now owned by the canonical LifeOS action-runtime branch rather than #275. Protected main@193a87ef54c3fe6dcda4755bce4d6bc81e3a0297 remains unchanged, so the repair is still unshipped.

Draft PR #276 exact bcea58b3eacc612578c59850e7d7f1cac2aa4151, open/mergeable, carries the root repair for the persistent LifeOS checkout boundary. Every retained checkout initialization explicitly supplies:

• GIT_CONFIG_COUNT=1
• GIT_CONFIG_KEY_0=init.defaultBranch
• GIT_CONFIG_VALUE_0=main

This config reaches the git init subprocess itself. It does not hide output with stderr redirection, || true, generic filtering, or advice.defaultBranchName=false; exact-SHA checkout, persist-credentials: false, permissions and existing gates remain intact.

RED → repair evidence

The original exact reproduction remains #275 verifier run 34631647126 / job 103369640323 at b655e343b1b7d60441b4e0ec1a2963b0f6c56a55, using actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1. Git initialized the temporary repository with implicit master and emitted the Git-3.0 default-branch warning while the actual PostgreSQL contract passed.

Hosted Ubuntu 24.04 / Git 2.55 probes on #276 established that the three GIT_CONFIG_* variables cause checkout's internal git init to create main directly without that warning. The #276 permanent contract has since been hardened against env/scalar/sibling-mapping/action-identity/YAML-structure bypasses, so merely placing similar text elsewhere in a workflow cannot satisfy the executable policy.

Current exact #276 has AppGuardrail GREEN. Commercial Readiness run 34792004500 crossed the repaired checkout/setup path successfully before failing later at the separate canonical #247 bounded-GitHub-evidence boundary. CI, SAST, Security and CodeQL evidence still need to terminate on the final owner head; repository-wide GREEN is therefore not claimed.

Acceptance

• Identify the durable owner as LifeOS's persistent checkout bootstrap and repair it on canonical fix(ci): adopt Node 24 GitHub Action runtimes #276.
• Configure init.defaultBranch=main before the affected git init without warning suppression.
• Preserve exact contributor SHA checkout, credential persistence policy and security gates.
• Retain an executable workflow contract resistant to misleading sibling/scalar/YAML placements.
• Obtain terminal applicable current-head checks and independent review on the final fix(ci): adopt Node 24 GitHub Action runtimes #276/restacked descendant.
• Integrate fix(ci): adopt Node 24 GitHub Action runtimes #276 normally into protected main and verify a fresh protected-descendant hosted run remains free of the original warning.

This issue is separate from #275's PostgreSQL init warning repair. Do not close it merely because the Draft owner branch has a verified source fix; protected integration or a verified successor is still required.

Refs #270 #275 #276 #279; ContextualWisdomLab/.github#2106.

[seonghobae]

#277의 checkout Git-init warning 경로를 #276의 동일 workflow-runtime lane에서 수리했습니다.

현실 검증에서 hosted Ubuntu 24.04 / Git 2.55의 fresh git init에 GIT_CONFIG_COUNT=1, GIT_CONFIG_KEY_0=init.defaultBranch, GIT_CONFIG_VALUE_0=main을 전달하면 HEAD가 처음부터 main으로 생성되고 Using 'master' as the name for the initial branch 및 Git 3.0 default-branch warning이 모두 사라지는 것을 확인했습니다. 이를 actions/checkout step의 process env로 적용해 checkout 내부 git init에도 같은 authority를 전달했습니다. stderr filtering, advice.defaultBranchName=false, || true는 사용하지 않았습니다.

Exact hosted candidate 2a82ce060ee9c8b88923b1613b0e5b7af4525ee3, run 34637354400, job 103388393737은 15개 checkout / 6개 persistent workflow repair, permanent contract, formatting, artifact staging을 모두 GREEN으로 검증했습니다. 이어 exact lease dd6d988558925059dc3f550b22522324d8c84e8b의 writer run 34637594717, job 103389180403에서 Commercial Development 23/23, AI live-workflow 7/7, formatting, git diff --check가 모두 PASS했고 ordinary child d8724a3621a59e0b505dbae7cf7a1f9cd3711464를 생성했습니다. Actions App의 workflows permission 부족으로 그 writer 자체 push만 거부되어 권한은 확대하지 않았고, 검증된 child를 repository writer로 non-force fast-forward했습니다.

Temporary write-capable workflow는 즉시 ordinary descendant로 제거했으며 #276 current exact head는 7973277a4c97db6eaa071ff2726187f6b33009f5입니다. #277은 protected-main integration 전이므로 아직 close하지 않습니다.

[seonghobae]

Fresh persistent-workflow canary: #247 exact 48087da1d1d5031374eacc12228d1a96f55359c0, Security run 34643498057, Trivy job 103408671264 still emits Git 2.55's Using 'master' as the name for the initial branch / Git 3.0 warning during its exact-SHA actions/checkout initialization. This is outside the checkout sites already repaired on #276, so #277 is not yet complete repository-wide. Preserve the existing root-cause acceptance: explicit initial-branch authority, no stderr/advice suppression, exact-head checkout and existing security gates.

[seonghobae]

Fresh owner analysis confirms the remaining repository-wide warning is not in a LifeOS-local workflow. main has only the six repository-owned workflows already covered by #276, while the failing #247 Security run 34643498057 / Trivy job 103408671264 executes the organization-required central Security Scan. The live central .github/workflows/security-scan.yml owns Checkout exact Dependency Review/Trivy/Scorecard head steps and its permanent queue-contract test enumerates those identities.

I opened canonical central owner issue ContextualWisdomLab/.github#2101 with the existing hosted RED and the already-proven LifeOS causal mechanism (GIT_CONFIG_COUNT=1, GIT_CONFIG_KEY_0=init.defaultBranch, GIT_CONFIG_VALUE_0=main). Acceptance requires every affected central exact-head checkout to gain explicit process-local initial-branch authority, permanent regression coverage, and a fresh downstream canary with no Git default-branch warning; stderr/advice suppression and downstream source copying remain forbidden.

Keep #277 open until that central repair reaches protected authority and a LifeOS consumer canary proves the warning absent. #276 should not absorb central .github source.