fix: correct v1 tag anchor SHA in ops/tag-v1.sh

[cryptoxdog]

Fix wrong EXPECTED_SHA anchor in ops/tag-v1.sh

The defect

ops/tag-v1.sh cuts the immutable v1.0.0 tag and the moving v1 tag on
Quantum-L9/l9-ci-core at a hardcoded EXPECTED_SHA. That SHA was
2b330a5aab90cd7781bef08f14c5e7904b61bc56.

That commit sits on a branch of l9-ci-core's history that diverged from
main before PR #8 (commit 8928005) landed the Actions SHA-pinning
hardening fix. At 2b330a5, every workflow_call kernel — including
.github/workflows/scorecard.yml — still references third-party GitHub
Actions by floating/mutable tag:

- uses: actions/checkout@v6
- uses: ossf/scorecard-action@v2
- uses: github/codeql-action/upload-sarif@v4

Cutting v1.0.0 at this SHA would have permanently frozen 64 floating
third-party Action references into a tag whose entire purpose is
immutability — the exact supply-chain weakness scorecard-action itself
exists to flag. This is the "scorecard-action ref" defect: a symptom of the
wrong anchor commit, not a typo in scorecard.yml.

The fix

EXPECTED_SHA now points to 2a3270be5f5184099c33a101807f65b1becf4e7c —
confirmed to be the direct parent of the v2-rewrite commit
(54a2f2fc8d060674d544fab14388bb5eff6b8e78), i.e. the last commit of the
pre-v2-rewrite v1 lineage. Verified:

• Identical set of 9 .github/workflows/*.yml files as the old anchor (no
  kernel added/removed), so the tag message's kernel list stays accurate.
• All 8 workflow_call kernels have every third-party Action SHA-pinned,
  with one documented, unrelated exception (pr-pipeline.yml's advisory
  MegaLinter step resolves its flavor from a prior step's output, so the
  uses: path is computed at runtime and cannot be a static SHA pin;
  DISABLE_ERRORS: true, does not gate merges).
• l9-self-ci.yml (self-only CI, no workflow_call trigger — never
  consumed by downstream @v1 consumers) does have pre-existing floating
  refs, identical at both the old and new anchor. That's unrelated,
  internal-only debt and out of scope here; it's why the new
  ops/verify-v1-anchor.sh deliberately scopes to workflow_call kernels
  only.

New: ops/verify-v1-anchor.sh

A lightweight, read-only script the human runs before ops/tag-v1.sh to
re-confirm zero floating refs at tag time (not just at review time — the
same fetch-and-inspect logic that caught this defect, kept as a permanent
pre-push gate). It:

• Parses EXPECTED_SHA out of tag-v1.sh (single source of truth — the two
  scripts can't drift apart).
• Fetches only that commit from l9-ci-core (read-only, no local clone
  required, no repository mutation).
• Asserts every third-party uses: ref in the 8 workflow_call kernels is
  a 40-char SHA, against one explicit, justified allowlist entry
  (the MegaLinter dynamic flavor line above).

Proof

Ran the new script against both anchors as a positive/negative control pair:

• New anchor 2a3270be5... → PASS — 68 refs inspected, 1 documented
  exception, 0 violations.
• Old anchor 2b330a5... → FAIL — 64 violations, including
  scorecard.yml:16 ossf/scorecard-action@v2, pr-pipeline.yml:319 ossf/scorecard-action@v2, and every other floating checkout/
  setup-python/upload-artifact/etc. ref that PR feat(l9-ci-pack): full v2 instantiation pack + legacy-mark @v1 starters + tag-v1.sh fix #8 later fixed on main.

This proves the script detects exactly the defect it exists to catch.

No retag needed

git ls-remote --tags https://github.com/Quantum-L9/l9-ci-core.git shows no
v1 or v1.0.0 tag exists yet. This is a preventive fix — nothing to
roll back.

Out of scope (tracked separately)

• Fixing tag-v1.sh step 4's origin/main == EXPECTED_SHA assertion (which
  will now always fail since l9-ci-core's main has advanced past both
  candidate SHAs into the v2 rewrite) is a distinct, already-tracked task in
  the l9-ci-core core_v2_org_delivery plan (dotgithub-fix-tag-v1). This
  PR only corrects the anchor value and adds the verification gate; it does
  not change the assertion logic.
• Publishing l9-ci to PyPI — explicitly out of scope for this fix.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[sonarqubecloud]

Quality Gate passed

Issues
7 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud