From 01a6b0e04f733693fc5acded9c18e92e3d462822 Mon Sep 17 00:00:00 2001
From: Matt <47545907+SoundMatt@users.noreply.github.com>
Date: Thu, 30 Jul 2026 15:49:43 -0700
Subject: [PATCH] chore(ci): bump go-FuSa pin from v0.47.0 to v0.48.0
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Verified locally against both pinned binaries before bumping: check,
trace -req-coverage 100, cyber, vuln, and qualify all exit 0 on this
repo's tree at v0.47.0 and v0.48.0 alike, with byte-for-byte identical
findings — the only diff anywhere in the gated sequence is qualify's
integrity hash, expected per go-FuSa's changelog (qualify.computeHash
now excludes the live generatedAt timestamp and sorts results before
hashing, for reproducibility). go build/go vet/go test/go test -race
all clean.

v0.48.0's headline change is a fix to hara.DetermineASIL (the
hand-written ISO 26262-3:2018 Table 4 lookup previously inflated
ratings in 8/12 S2 cells and 11/12 S3 cells). None of this repo's
gated commands (check/trace/cyber/vuln/qualify) cross-validates
.fusa-hara.json's recorded asil fields against S/E/C, so the bump
itself introduces no new gate finding. Separately, using v0.48.0's
`gofusa hara asil` and independently cross-checking against the
published ISO 26262-3:2018 Table 4, two entries in this repo's own
.fusa-hara.json (H-003: S2/E3/C2, and H-005: S1/E4/C2) are
over-classified as ASIL-B where Table 4 gives ASIL-A. Left unchanged
here since it's outside any CI gate and outside this change's scope;
tracked separately.

Signed-off-by: Matt <47545907+SoundMatt@users.noreply.github.com>
---
 .github/workflows/ci.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 576bf72..c00b94e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -194,12 +194,12 @@ jobs:
           ./socketcan/...
 
   # ── go-FuSa continuous-conformance lifecycle (RELAY spec §20.1.2) ──────────
-  # Pinned to v0.47.0. Runs the FULL lifecycle, not a subset: static check,
+  # Pinned to v0.48.0. Runs the FULL lifecycle, not a subset: static check,
   # 100% requirement traceability (traced AND tested + function-annotation
   # density), cybersecurity analysis, dependency vulnerability scan, and the
   # tool-qualification suite. Conformance must be continuously proven.
   gofusa:
-    name: go-FuSa lifecycle (§20, v0.47.0)
+    name: go-FuSa lifecycle (§20, v0.48.0)
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
@@ -208,7 +208,7 @@ jobs:
           go-version: "1.25"
 
       - name: Install go-FuSa
-        run: go install github.com/SoundMatt/go-FuSa/cmd/gofusa@v0.47.0
+        run: go install github.com/SoundMatt/go-FuSa/cmd/gofusa@v0.48.0
 
       - name: gofusa check (gate on ERROR)
         run: gofusa check ./...