ci instability

[avrabe]

Looking at the dependabot ci failures and possibly also others I've noticed that there are failing builds tests ... Which should not happen as a green ci shows when it is working and red makes it clear why. The tests and builds seem to be necessary and we need to make the ci more stable

[avrabe]

Root-caused — the "instability" is two deterministic failure sources, zero flakiness, both now fixed:

1. Signing E2E red on every run → stale cert pin + inverted pinning semantics

rekor.sigstore.dev rotated its TLS leaf; wsc fails with Certificate pin mismatch: got 710dd397e55ca148... (I verified the live SPKI matches that exactly). The deeper defect in sigil's verifier: it required the leaf to match and only logged intermediate matches — while the Google Trust Services WR3 intermediate pin (valid to 2029) was in the set and correct the whole time. This is the second occurrence of the class (Fulcio, 2026-05-19, sigil#117) and would recur every ~90 days.

Fix: pulseengine/sigil#147 — chain-match semantics (HPKP/RFC 7469: any cert in the WebPKI-validated chain may satisfy a pin) + the fresh rekor leaf pin. After it merges, a wsc release + the sha256-pinned binary bump in signing-e2e.yml closes this half. Until then Signing E2E stays red-but-understood (it is not a required check).

2. ~10 dependabot update-jobs failing every Tuesday → structural config error

dependabot.yml listed per-crate cargo directories (/crates/synth-abi, -analysis, -awsm, -wasker) — member crates can't be updated independently against the workspace's exact-version path-dep pins (the Version Pin Sweep gate exists to keep them in lockstep), so those update jobs fail by construction. Fix: PR #314 — single workspace-aware root entry.

What was NOT unstable

The actual test/build gates: zero failures in the last 100 runs apart from one Z3-install network flake (re-run, known class). The current dependabot PRs (#299/#301/#304/#308) are green or pending-rerun — they'll be merged/handled in the normal queue.

Your point stands and is the fix's principle: a red gate must mean something. After #314 + sigil#147 land, red = real.