#13: detect operating evidence by relative path

.github/workflows/ci.yml

@@ -43,7 +43,7 @@ jobs:
 
       - name: Upload coverage reports
         if: always()
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: rust-coverage-${{ github.run_id }}
           path: coverage/*.json

.github/workflows/deterministic-dashboard.yml

@@ -56,7 +56,7 @@ jobs:
 
       - name: Upload dashboard and verification evidence
         if: always()
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: shadow-dashboard-${{ github.run_id }}
           path: |

actions/shadow-ci/src/verify.rs

@@ -205,17 +205,18 @@ fn first_existing(root: &Path, paths: &[&str]) -> Option<PathBuf> {
 }
 
 fn complete_artifact_under(root: &Path, relative: &str, needle: &str) -> Option<PathBuf> {
-    fn walk(dir: &Path, needle: &str) -> Option<PathBuf> {
+    fn walk(dir: &Path, scan_root: &Path, needle: &str) -> Option<PathBuf> {
         let Ok(entries) = std::fs::read_dir(dir) else {
             return None;
         };
         for entry in entries.flatten() {
             let path = entry.path();
-            let name_matches = path
-                .file_name()
-                .and_then(|n| n.to_str())
-                .is_some_and(|n| n.to_lowercase().contains(needle));
-            if path.is_file() && name_matches {
+            let relative_path = path.strip_prefix(scan_root).unwrap_or(&path);
+            let path_matches = relative_path
+                .to_string_lossy()
+                .to_lowercase()
+                .contains(needle);
+            if path.is_file() && path_matches {
                 let body = std::fs::read_to_string(&path).unwrap_or_default();
                 let lower = body.to_lowercase();
                 if body.trim().len() >= 80
@@ -226,14 +227,15 @@ fn complete_artifact_under(root: &Path, relative: &str, needle: &str) -> Option<
                 }
             }
             if path.is_dir() {
-                if let Some(found) = walk(&path, needle) {
+                if let Some(found) = walk(&path, scan_root, needle) {
                     return Some(found);
                 }
             }
         }
         None
     }
-    walk(&root.join(relative), &needle.to_lowercase())
+    let scan_root = root.join(relative);
+    walk(&scan_root, &scan_root, &needle.to_lowercase())
 }
 
 fn attestation_observations(root: &Path, observed_at: &str) -> Vec<Value> {
@@ -1355,4 +1357,25 @@ mod tests {
         assert!(DEPENDENCY_LOCK_PATHS.contains(&"app/package-lock.json"));
         assert!(DEPENDENCY_LOCK_PATHS.contains(&"functions/package-lock.json"));
     }
+
+    #[test]
+    fn evidence_directory_name_can_identify_a_complete_artifact() {
+        let root = Path::new(env!("CARGO_MANIFEST_DIR")).join("target/evidence-path-test");
+        if root.exists() {
+            std::fs::remove_dir_all(&root).unwrap();
+        }
+        let artifact = root.join("evidence/restore-tests/2026-Q3.md");
+        std::fs::create_dir_all(artifact.parent().unwrap()).unwrap();
+        std::fs::write(
+            &artifact,
+            "# Restore test\n\nPerformed: 2026-08-05\nResult: PASS\nA real isolated restore completed successfully and the temporary database was removed.",
+        )
+        .unwrap();
+
+        assert_eq!(
+            complete_artifact_under(&root, "evidence", "restore"),
+            Some(artifact)
+        );
+        std::fs::remove_dir_all(root).unwrap();
+    }
 }

actions/workflows/compliance.yml

@@ -66,7 +66,7 @@ jobs:
 
       - name: Upload report
         if: always()
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: compliance-report-${{ matrix.key }}-${{ github.event.pull_request.number }}
           path: compliance_report.json

actions/workflows/daily-verify.yml

@@ -52,7 +52,7 @@ jobs:
 
       - name: Upload verify report
         if: always()
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: shadow-verify-${{ github.run_id }}
           path: shadow/verify-*.md
@@ -75,7 +75,7 @@ jobs:
       - name: Upload gauge site
         if: always()
         continue-on-error: true
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: shadow-gauge-${{ github.run_id }}
           path: dist/

actions/workflows/deploy.yml

@@ -29,7 +29,7 @@ jobs:
     steps:
       - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
 
-      - uses: google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed # v2
+      - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           workload_identity_provider: ${{ vars.GCP_WIF_PROVIDER }}
           service_account: ${{ vars.GCP_DEPLOY_SA }}

actions/workflows/deterministic-verify.yml

@@ -29,7 +29,7 @@ jobs:
 
       - name: Authenticate the read-only verifier to Google Cloud
         if: ${{ vars.GCP_VERIFY_SA != '' }}
-        uses: google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed # v2
+        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           workload_identity_provider: ${{ vars.GCP_WIF_PROVIDER }}
           service_account: ${{ vars.GCP_VERIFY_SA }}
@@ -65,7 +65,7 @@ jobs:
 
       - name: Upload verification evidence
         if: always()
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: deterministic-shadow-verify-${{ github.run_id }}
           path: |
@@ -77,7 +77,7 @@ jobs:
 
       - name: Upload dashboard snapshot
         if: always()
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: shadow-dashboard-${{ github.run_id }}
           path: dist/

actions/workflows/quarterly-rituals.yml

@@ -32,7 +32,7 @@ jobs:
         run: cargo build --release --manifest-path .shadow/ci/Cargo.toml
 
       # Optional: authenticate gcloud for the GCP IAM sections.
-      # - uses: google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed # v2
+      # - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
       #   with:
       #     credentials_json: ${{ secrets.GCP_READONLY_SA_KEY }}
 

actions/workflows/restore-test.yml

@@ -30,7 +30,7 @@ jobs:
         with:
           fetch-depth: 0
 
-      - uses: google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed # v2
+      - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           # a scoped SA via WIF is ideal here too; a datastore.owner key-less
           # federation identity needs: roles/datastore.owner on the project

actions/workflows/test.yml

@@ -46,7 +46,7 @@ jobs:
 
       - name: Upload coverage reports
         if: always()
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: rust-coverage-${{ github.run_id }}
           path: coverage/*.json

provision/gcp-cloudsql/restore-test-cloudsql.yml

@@ -24,18 +24,18 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
         with:
           fetch-depth: 0
 
-      - uses: google-github-actions/auth@v2
+      - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           # needs roles/cloudsql.admin on the project (a dedicated restore SA
           # via the same WIF pool is the clean setup)
           workload_identity_provider: ${{ vars.GCP_WIF_PROVIDER }}
           service_account: ${{ vars.GCP_RESTORE_SA || vars.GCP_DEPLOY_SA }}
 
-      - uses: google-github-actions/setup-gcloud@v2
+      - uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3
 
       - name: Restore latest backup into a throwaway clone
         id: restore