Switch on the go-template deploy-starter policy for a one-week trial #230

🤖 Generated by the Agentic Engineer

Evidence

All ten workflow execution policies now reach the organization from this repository and read back IN-SYNC, every one disabled (#202, 2026-09-23). The 30-day simulation on 2026-09-23 found all 3 observed starters of go-template's deploy and publish workflows already allowed by restrict-deploy-starters-go-template.json. The README names this policy as the first to switch on, but the check rejects any enforcement other than disabled, so it cannot be turned on yet.

Audience and problem

Anyone who can start go-template's cd.yaml or release.yaml today can publish from it. The policy limits that to the portfolio's own identities, but it protects nothing while it stays disabled.

Hypothesis

Switching this one low-risk policy on for a week shows whether our actor evidence is complete before any other repository relies on it.

Success signal

For the week after activation, go-template's releases and syncs keep running (no workflow blocked by the policy), and the apply workflow reads the policy back as active. Guardrail: rollback is reverting the activation pull request.

Acceptance criteria

• The check allows active only for policy files on an explicit, reviewed approval list; every other file must still be disabled, and evaluate is still rejected.
• restrict-deploy-starters-go-template.json is the only file on that list and is set to active.
• Tests cover an approved file that is active or disabled, an unapproved file that is active, and an approved file set to evaluate.
• The README describes the approval list and the trial.
• After merge, the apply run reads the policy back as active; the one-week outcome is recorded on Adopt workflow execution protections across the portfolio #202.

Size: small. Merging needs the maintainer's approval (activation is his call).

Blocker: maintainer approval to switch on the go-template policy (draft #231) | authority | last-verified 2026-09-24: not given | asked pr 2026-09-24