[Steward] Fail pull requests when generated setup artifacts drift (bld-439b8b55ce5d9b03545cbdbd)

[suraj-ranganath]

Draft candidate for Steward operation bld-439b8b55ce5d9b03545cbdbd.

• Adds deterministic setup-artifact generation and drift verification.
• Runs the read-only verification on pull requests.
• Reuses the shared generator in main-branch publication.

Validation: go test ./...

[github-actions]

🟡 Suggestion: This file's header declares it "managed by baton-admin. DO NOT EDIT!!!", but this PR adds the setup-artifacts job here manually. If baton-admin regenerates this workflow, the new job may be silently clobbered. Confirm this addition is applied through the baton-admin template/generator rather than as a one-off edit. (low confidence)

[github-actions]

🟡 Suggestion: The binary path ./dist/linux_amd64/baton-gitlab is hardcoded, while the Makefile builds to dist/$(GOOS)_$(GOARCH). If this job's runs-on arch/OS ever changes, this path breaks silently. Consider deriving the path from the runner env or a make variable to keep it in sync. (low confidence)

[github-actions]

Connector PR Review: [Steward] Fail pull requests when generated setup artifacts drift

Blocking Issues: 0 | Suggestions: 2 | Threads Resolved: 0
Criteria: loaded .claude/skills/ci-review.md from trusted base 3ccb0753efce.
Review mode: full
View review run

Review Summary

Reviewed the full PR diff for security and correctness. This is a CI/build-tooling change: it adds generate-setup-artifacts/verify-setup-artifacts Makefile targets, a read-only drift-verification job in verify.yaml, reuses the generator in the main-branch publish workflow, and commits regenerated pkg/config/conf.gen.go. The conf.gen.go diff is generator output (a gofmt spacing fix plus byte-slice handling in GetString), not a hand edit, so G1 is satisfied. No go.mod/go.sum changes and no connector runtime code changed. No security or correctness issues found; two low-confidence maintainability suggestions noted.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

• .github/workflows/verify.yaml:12 — new setup-artifacts job added to a file whose header says "managed by baton-admin. DO NOT EDIT"; confirm it is introduced via the generator so it is not clobbered on the next regen.
• .github/workflows/capabilities_and_config.yaml:39 — hardcoded dist/linux_amd64/baton-gitlab path can drift from the Makefile's $(GOOS)_$(GOARCH) output if the runner OS/arch changes.

Prompt for AI agents

Verify each finding against the current code and only fix it if needed.

## Suggestions

In .github/workflows/verify.yaml:
- Around line 12: The file header states it is managed by baton-admin and must not be
  hand-edited, yet a new setup-artifacts job was added directly. Ensure this job is
  introduced via the baton-admin workflow template/generator that produces this file,
  so a future regeneration does not silently remove it.

In .github/workflows/capabilities_and_config.yaml:
- Around line 39: The step invokes ./dist/linux_amd64/baton-gitlab, a hardcoded arch
  path, while the Makefile builds to dist/(GOOS)_(GOARCH). Derive the binary path from
  go env GOOS/GOARCH (or a make variable) so the step keeps working if the runner
  OS/arch changes instead of failing.

[github-actions]

No blocking issues found.