cpp-FuSa dependency pulled via unpinned git clone — non-reproducible CI/release, stale toolVersion in v2.18.0 artifacts #59

Problem

CI and release both pull cpp-FuSa via an unpinned git clone --depth=1 of its default branch, with no --branch/--tag/SHA pin. This makes every safety-tool-derived CI gate and release artifact non-reproducible (the effective cpp-FuSa version depends on exactly when the workflow happens to run), and it is why the safety artifacts baked into the current v2.18.0 release are built against a stale tool version.

Evidence

.github/workflows/ci.yml:214:

git clone --depth=1 https://github.com/SoundMatt/cpp-FuSa /tmp/cpfusa

.github/workflows/release.yml:29: identical unpinned clone.

Every safety artifact currently in the repo tree from the v2.18.0 release (tara.json, fmea.json, sbom.json, sci.json, sas.json, qualify-report.json, provenance.json, safety-case.json) reports "toolVersion": "0.17.0", while gh api repos/SoundMatt/cpp-FuSa/tags shows v0.17.1 is the current latest tag. (At the moment cpp-FuSa's main happens to be bit-identical to the v0.17.1 tag — gh api repos/SoundMatt/cpp-FuSa/compare/v0.17.1...main reports 0 ahead/0 behind — so a fresh CI run today would pick up v0.17.1. That doesn't fix the underlying problem: the resolved version is whatever cpp-FuSa's default branch happens to be at clone time, not a version this repo deliberately selected and can reproduce later.)

RELAY spec §20.1 requires the language safety tool be run as a gated, reproducible CI check across its full lifecycle — an unpinned clone of a moving branch does not satisfy "reproducible."

Why it matters

• Two CI runs of the same commit can silently use different cpp-FuSa versions/behavior depending on unrelated changes landing in cpp-FuSa's main in between.
• Released safety artifacts (TARA, FMEA, SBOM, safety case, etc.) cannot be regenerated later and verified to match, since there's no record pinning which cpp-FuSa commit produced them beyond whatever toolVersion the tool self-reports.
• A breaking or behavior-changing cpp-FuSa main commit would silently start failing (or silently start passing) this repo's CI with no corresponding change in cpp-RCP.

Suggested fix

Pin the clone to a specific tag or SHA (e.g. git clone --depth=1 --branch v0.17.1 ...), track that pin in a version file or workflow variable, and bump it deliberately (with a changelog note) when adopting a new cpp-FuSa release. Apply the same pin in both ci.yml and release.yml.