From 263d6080275db2e03c923073b46afba2fd2e8d1b Mon Sep 17 00:00:00 2001
From: Matt <47545907+SoundMatt@users.noreply.github.com>
Date: Thu, 30 Jul 2026 17:41:17 -0700
Subject: [PATCH] ci: pin cpp-FuSa to v0.18.0 instead of floating on default
 branch
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Both workflow files that build the cpfusa safety-tooling binary from
source cloned it with `git clone --depth=1
https://github.com/SoundMatt/cpp-FuSa /tmp/cpfusa` — no --branch/tag,
so every CI run built whatever commit happened to be on cpp-FuSa's
default branch at that moment. This is a floating-dependency policy
violation (standing decision, confirmed 2026-07-28: pin every repo,
every language): an unpinned checkout means CI pass/fail can change
with no cpp-RCP-side change at all, which isn't reproducible and isn't
something a reviewer can audit from the diff.

Pins both occurrences to v0.18.0 (cpp-FuSa's latest release):
  - ci.yml's cpfusa-build job (shared by all cpfusa-* jobs via
    upload/download-artifact)
  - release.yml's regenerate-safety-artifacts job (tag-triggered,
    builds its own cpfusa independently rather than reusing ci.yml's
    artifact)

Verified locally before pushing, building cpfusa v0.18.0 from source
the same way CI now will and running every cpfusa subcommand either
workflow invokes against cpp-RCP's own tree:
  - ci.yml set: check, lint, cyber, trace (incl. --req-coverage 100),
    qualify, vuln, verify, analyze, impact, metrics, report — all
    exit 0, 0 errors.
  - release.yml set: fmea --cyber, safety-case, tara, release (SBOM/
    provenance), sas, sci, audit-pack, badge, report — all exit 0.
    iso26262/iec61508/do178 gap-report commands exit 1 as already
    documented in release.yml's comments (non-gating `|| true`,
    pre-existing stub-bridge gaps against ASIL-B/SIL-2/DAL-B
    thresholds, not new).
  - hara (display) — 0 issues.

No new or different ERROR-level findings vs. whatever was floating
before this pin: this is a clean, no-op-for-findings version lock.
(One local-only false alarm caught and ruled out along the way: an
initial `cpfusa lint` run showed 5 errors, all inside
build/_deps/catch2-src — a FetchContent-vendored dependency that only
existed because a full cmake build had been run in that checkout
first. CI's actual cpfusa-lint job never runs cmake, so it never sees
that path; re-running against a clean checkout with no build/
directory confirmed 0 errors.)

Also ran this repo's full local build/test suite against the pin:
cmake+ninja build (213/213 targets, twice in separate checkouts),
ctest (52/52 passed, twice), and clang-tidy scoped to tests/*.cpp
(clean aside from the same pre-existing bugprone-infinite-loop false
positive in test_request.cpp already documented in commit 181e6e2/#96
as a newer-local-clang-tidy-vs-CI's-pinned-clang-14 artifact — this
change touches no C++ source, so it cannot be the cause).

No behavior change and no conformance gap found, so no version bump
(cpp-rcp stays at 2.19.0): CI-workflow-only change, consistent with
this repo's convention of reserving version bumps for commits that
touch library code or behavior.

Signed-off-by: Matt <47545907+SoundMatt@users.noreply.github.com>
---
 .github/workflows/ci.yml      | 2 +-
 .github/workflows/release.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index caf4da0..db9bd2c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -282,7 +282,7 @@ jobs:
 
       - name: Build cpp-FuSa from source
         run: |
-          git clone --depth=1 https://github.com/SoundMatt/cpp-FuSa /tmp/cpfusa
+          git clone --depth=1 --branch v0.18.0 https://github.com/SoundMatt/cpp-FuSa /tmp/cpfusa
           cmake -B /tmp/cpfusa/build -S /tmp/cpfusa \
             -DCMAKE_BUILD_TYPE=Release -G Ninja
           cmake --build /tmp/cpfusa/build --parallel
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1145be8..aa3b80a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -27,7 +27,7 @@ jobs:
 
       - name: Build cpp-FuSa from source
         run: |
-          git clone --depth=1 https://github.com/SoundMatt/cpp-FuSa /tmp/cpfusa
+          git clone --depth=1 --branch v0.18.0 https://github.com/SoundMatt/cpp-FuSa /tmp/cpfusa
           cmake -B /tmp/cpfusa/build -S /tmp/cpfusa \
             -DCMAKE_BUILD_TYPE=Release -G Ninja
           cmake --build /tmp/cpfusa/build --parallel