Ci/repair release evidence

.changes/restore-release-assurance-ct-riscv.md

@@ -0,0 +1,5 @@
+---
+"rscrypto" = "patch"
+---
+
+Restore release assurance with an attributable RSA fixed-width exponent timing gate, FEAT_DIT hardening for AArch64 private exponentiation, and RISC-V-compatible XXH3 backend tests.

.config/benchmark-matrix.json

@@ -0,0 +1,195 @@
+{
+  "schema": 1,
+  "default_features": ["parallel", "full"],
+  "crates": {
+    "checksum": ["crc"],
+    "hashes": ["sha2", "sha3", "kmac_cshake", "ascon", "xxh3", "rapidhash", "blake2", "blake3"],
+    "auth": ["auth", "kmac_cshake", "password_hashing", "rsa"],
+    "rsa": ["rsa"],
+    "aead": ["aead"]
+  },
+  "benches": {
+    "crc": {
+      "binary": "crc",
+      "kind": "criterion",
+      "required": true,
+      "features": ["parallel", "checksums"]
+    },
+    "sha2": {
+      "binary": "sha2",
+      "kind": "criterion",
+      "required": true,
+      "features": ["parallel", "sha2", "diag"]
+    },
+    "sha3": {
+      "binary": "sha3",
+      "kind": "criterion",
+      "required": true,
+      "features": ["parallel", "sha3"]
+    },
+    "kmac_cshake": {
+      "binary": "kmac_cshake",
+      "kind": "criterion",
+      "required": true,
+      "features": ["parallel", "sha3", "kmac"]
+    },
+    "ascon": {
+      "binary": "ascon",
+      "kind": "criterion",
+      "required": true,
+      "features": ["parallel", "ascon-hash"]
+    },
+    "xxh3": {
+      "binary": "xxh3",
+      "kind": "criterion",
+      "required": true,
+      "features": ["parallel", "xxh3"]
+    },
+    "rapidhash": {
+      "binary": "rapidhash",
+      "kind": "criterion",
+      "required": true,
+      "features": ["parallel", "rapidhash"]
+    },
+    "aead_kernels": {
+      "binary": "aead_kernels",
+      "kind": "criterion",
+      "required": false,
+      "features": ["parallel", "sha2", "chacha20poly1305", "diag"]
+    },
+    "blake2": {
+      "binary": "blake2",
+      "kind": "criterion",
+      "required": true,
+      "features": ["parallel", "blake2b", "blake2s"]
+    },
+    "blake3": {
+      "binary": "blake3",
+      "kind": "criterion",
+      "required": true,
+      "features": ["parallel", "blake3"]
+    },
+    "auth": {
+      "binary": "auth",
+      "kind": "criterion",
+      "required": true,
+      "features": ["parallel", "hmac", "hkdf", "pbkdf2", "ecdsa", "ed25519", "x25519", "ml-kem", "diag"]
+    },
+    "password_hashing": {
+      "binary": "password_hashing",
+      "kind": "criterion",
+      "required": true,
+      "features": ["parallel", "argon2", "scrypt", "phc-strings", "getrandom"]
+    },
+    "rsa": {
+      "binary": "rsa",
+      "kind": "criterion",
+      "required": true,
+      "features": ["parallel", "rsa", "diag"]
+    },
+    "aead_diag": {
+      "binary": "aead",
+      "kind": "criterion",
+      "required": false,
+      "features": ["parallel", "sha2", "aes-gcm", "aes-gcm-siv", "chacha20poly1305", "xchacha20poly1305", "aegis256", "ascon-aead", "diag"]
+    },
+    "aead": {
+      "binary": "aead",
+      "kind": "criterion",
+      "required": true,
+      "features": ["parallel", "aes-gcm", "aes-gcm-siv", "chacha20poly1305", "xchacha20poly1305", "aegis256", "ascon-aead"]
+    },
+    "structural": {
+      "binary": "structural",
+      "kind": "gungraun",
+      "required": false,
+      "features": ["checksums", "sha2", "blake3"]
+    }
+  },
+  "algorithms": {
+    "crc16-ccitt": {"crate": "checksum", "bench": "crc", "filter": "crc16-ccitt"},
+    "crc16-ibm": {"crate": "checksum", "bench": "crc", "filter": "crc16-ibm"},
+    "crc24-openpgp": {"crate": "checksum", "bench": "crc", "filter": "crc24-openpgp"},
+    "crc32-ieee": {"crate": "checksum", "bench": "crc", "filter": "^crc32/"},
+    "crc32c": {"crate": "checksum", "bench": "crc", "filter": "crc32c"},
+    "crc64-xz": {"crate": "checksum", "bench": "crc", "filter": "crc64-xz"},
+    "crc64-nvme": {"crate": "checksum", "bench": "crc", "filter": "crc64-nvme"},
+    "sha224": {"crate": "hashes", "bench": "sha2", "filter": "sha224"},
+    "sha256": {"crate": "hashes", "bench": "sha2", "filter": "sha256"},
+    "sha384": {"crate": "hashes", "bench": "sha2", "filter": "sha384"},
+    "sha512": {"crate": "hashes", "bench": "sha2", "filter": "^sha512/"},
+    "sha512-256": {"crate": "hashes", "bench": "sha2", "filter": "sha512-256"},
+    "sha3-224": {"crate": "hashes", "bench": "sha3", "filter": "sha3-224"},
+    "sha3-256": {"crate": "hashes", "bench": "sha3", "filter": "sha3-256"},
+    "sha3-384": {"crate": "hashes", "bench": "sha3", "filter": "sha3-384"},
+    "sha3-512": {"crate": "hashes", "bench": "sha3", "filter": "sha3-512"},
+    "shake128": {"crate": "hashes", "bench": "sha3", "filter": "shake128"},
+    "shake256": {"crate": "hashes", "bench": "sha3", "filter": "shake256"},
+    "cshake256": {"crate": "auth", "bench": "kmac_cshake", "filter": "cshake256"},
+    "blake2": {"crate": "hashes", "bench": "blake2", "filter": "^blake2/(rscrypto|rustcrypto|keyed|streaming)/"},
+    "blake3": {"crate": "hashes", "bench": "blake3", "filter": "blake3"},
+    "xxh3": {"crate": "hashes", "bench": "xxh3", "filter": "xxh3"},
+    "rapidhash": {"crate": "hashes", "bench": "rapidhash", "filter": "rapidhash"},
+    "ascon-hash256": {"crate": "hashes", "bench": "ascon", "filter": "ascon-hash256"},
+    "ascon-xof128": {"crate": "hashes", "bench": "ascon", "filter": "ascon-xof128"},
+    "ascon-cxof128": {"crate": "hashes", "bench": "ascon", "filter": "ascon-cxof128"},
+    "hmac-sha256": {"crate": "auth", "bench": "auth", "filter": "^hmac-sha256"},
+    "hmac-sha384": {"crate": "auth", "bench": "auth", "filter": "hmac-sha384"},
+    "hmac-sha512": {"crate": "auth", "bench": "auth", "filter": "hmac-sha512"},
+    "hkdf-sha256": {"crate": "auth", "bench": "auth", "filter": "^hkdf-sha256"},
+    "hkdf-sha384": {"crate": "auth", "bench": "auth", "filter": "hkdf-sha384"},
+    "pbkdf2-sha256": {"crate": "auth", "bench": "auth", "filter": "^pbkdf2-sha256/"},
+    "pbkdf2-sha512": {"crate": "auth", "bench": "auth", "filter": "^pbkdf2-sha512/"},
+    "ecdsa-p256": {"crate": "auth", "bench": "auth", "filter": "^ecdsa-p256/"},
+    "ecdsa-p384": {"crate": "auth", "bench": "auth", "filter": "^ecdsa-p384/"},
+    "ed25519": {"crate": "auth", "bench": "auth", "filter": "ed25519"},
+    "x25519": {"crate": "auth", "bench": "auth", "filter": "x25519"},
+    "mlkem512": {"crate": "auth", "bench": "auth", "filter": "^mlkem512/"},
+    "mlkem768": {"crate": "auth", "bench": "auth", "filter": "^mlkem768/"},
+    "mlkem1024": {"crate": "auth", "bench": "auth", "filter": "^mlkem1024/"},
+    "kmac256": {"crate": "auth", "bench": "kmac_cshake", "filter": "kmac256"},
+    "argon2d": {"crate": "auth", "bench": "password_hashing", "filter": "^argon2d-"},
+    "argon2i": {"crate": "auth", "bench": "password_hashing", "filter": "^argon2i-"},
+    "argon2id": {"crate": "auth", "bench": "password_hashing", "filter": "^argon2id-"},
+    "scrypt": {"crate": "auth", "bench": "password_hashing", "filter": "^scrypt-"},
+    "rsa": {"crate": "auth", "bench": "rsa", "filter": "rsa"},
+    "xchacha20-poly1305": {"crate": "aead", "bench": "aead", "filter": "xchacha20-poly1305"},
+    "chacha20-poly1305": {"crate": "aead", "bench": "aead", "filter": "^chacha20-poly1305/"},
+    "aes-256-gcm-siv": {"crate": "aead", "bench": "aead", "filter": "aes-256-gcm-siv"},
+    "aes-128-gcm-siv": {"crate": "aead", "bench": "aead", "filter": "aes-128-gcm-siv"},
+    "aes-256-gcm": {"crate": "aead", "bench": "aead", "filter": "^aes-256-gcm/"},
+    "aes-128-gcm": {"crate": "aead", "bench": "aead", "filter": "^aes-128-gcm/"},
+    "aegis-256": {"crate": "aead", "bench": "aead", "filter": "aegis-256"},
+    "ascon-aead128": {"crate": "aead", "bench": "aead", "filter": "ascon-aead128"},
+    "aead-diag": {"crate": "aead", "bench": "aead_diag", "filter": "chacha20-poly1305/encrypt"}
+  },
+  "selectors": {
+    "all": ["crc16-ccitt", "crc16-ibm", "crc24-openpgp", "crc32-ieee", "crc32c", "crc64-xz", "crc64-nvme", "sha224", "sha256", "sha384", "sha512", "sha512-256", "sha3-224", "sha3-256", "sha3-384", "sha3-512", "shake128", "shake256", "cshake256", "blake2", "blake3", "xxh3", "rapidhash", "ascon-hash256", "ascon-xof128", "ascon-cxof128", "hmac-sha256", "hmac-sha384", "hmac-sha512", "hkdf-sha256", "hkdf-sha384", "pbkdf2-sha256", "pbkdf2-sha512", "ecdsa-p256", "ecdsa-p384", "ed25519", "x25519", "mlkem512", "mlkem768", "mlkem1024", "kmac256", "argon2d", "argon2i", "argon2id", "scrypt", "rsa", "xchacha20-poly1305", "chacha20-poly1305", "aes-256-gcm-siv", "aes-128-gcm-siv", "aes-256-gcm", "aes-128-gcm", "aegis-256", "ascon-aead128"],
+    "auth": ["hmac-sha256", "hmac-sha384", "hmac-sha512", "hkdf-sha256", "hkdf-sha384", "pbkdf2-sha256", "pbkdf2-sha512", "ecdsa-p256", "ecdsa-p384", "ed25519", "x25519", "mlkem512", "mlkem768", "mlkem1024", "kmac256", "argon2d", "argon2i", "argon2id", "scrypt", "rsa"],
+    "rsa": ["rsa"],
+    "aead": ["xchacha20-poly1305", "chacha20-poly1305", "aes-256-gcm-siv", "aes-128-gcm-siv", "aes-256-gcm", "aes-128-gcm", "aegis-256", "ascon-aead128"],
+    "aeaddiag": ["aead-diag"],
+    "chacha20poly1305diag": ["aead-diag"],
+    "chacha20poly1305par4": ["aead-diag"],
+    "checksum": ["crc16-ccitt", "crc16-ibm", "crc24-openpgp", "crc32-ieee", "crc32c", "crc64-xz", "crc64-nvme"],
+    "checksums": ["crc16-ccitt", "crc16-ibm", "crc24-openpgp", "crc32-ieee", "crc32c", "crc64-xz", "crc64-nvme"],
+    "hash": ["sha224", "sha256", "sha384", "sha512", "sha512-256", "sha3-224", "sha3-256", "sha3-384", "sha3-512", "shake128", "shake256", "cshake256", "blake2", "blake3", "xxh3", "rapidhash", "ascon-hash256", "ascon-xof128", "ascon-cxof128"],
+    "hashes": ["sha224", "sha256", "sha384", "sha512", "sha512-256", "sha3-224", "sha3-256", "sha3-384", "sha3-512", "shake128", "shake256", "cshake256", "blake2", "blake3", "xxh3", "rapidhash", "ascon-hash256", "ascon-xof128", "ascon-cxof128"],
+    "mlkem": ["mlkem512", "mlkem768", "mlkem1024"],
+    "crc64": ["crc64-xz", "crc64-nvme"],
+    "crc64nvme": ["crc64-xz", "crc64-nvme"],
+    "crc64xz": ["crc64-xz", "crc64-nvme"],
+    "crc32": ["crc32-ieee", "crc32c"],
+    "crc16": ["crc16-ccitt", "crc16-ibm"]
+  },
+  "bench_aliases": {
+    "comp": ["crc", "sha2", "sha3", "kmac_cshake", "ascon", "auth", "aead", "xxh3", "rapidhash", "blake3"],
+    "kernels": ["blake3"],
+    "checksum_comp": ["crc"],
+    "checksum_kernels": ["crc"],
+    "hashes_comp": ["sha2", "sha3", "kmac_cshake", "ascon", "xxh3", "rapidhash", "blake3"],
+    "auth_comp": ["auth"],
+    "aead_comp": ["aead"],
+    "hashes_kernels": ["blake3"]
+  }
+}

.config/ci-tool-archives.tsv

@@ -1,6 +1,10 @@
 # tool	version	os	architecture	filename	url	sha256
-wasmtime	v47.0.3	linux	x86_64	wasmtime-v47.0.3-x86_64-linux.tar.xz	https://github.com/bytecodealliance/wasmtime/releases/download/v47.0.3/wasmtime-v47.0.3-x86_64-linux.tar.xz	ca1fc56d1afc40c8782e96c297fd182a0da162f9a8f52a1e7b094e1dd648e178
-wasmtime	v47.0.3	linux	aarch64	wasmtime-v47.0.3-aarch64-linux.tar.xz	https://github.com/bytecodealliance/wasmtime/releases/download/v47.0.3/wasmtime-v47.0.3-aarch64-linux.tar.xz	497b518db00ae585f04390758eaa99ad555bee50612dce7d102602778fb46ff0
-wasmtime	v47.0.3	macos	x86_64	wasmtime-v47.0.3-x86_64-macos.tar.xz	https://github.com/bytecodealliance/wasmtime/releases/download/v47.0.3/wasmtime-v47.0.3-x86_64-macos.tar.xz	424a50f76a9dcf4d02dab326b2374be1ad404030576ee915866e4af106058b35
-wasmtime	v47.0.3	macos	aarch64	wasmtime-v47.0.3-aarch64-macos.tar.xz	https://github.com/bytecodealliance/wasmtime/releases/download/v47.0.3/wasmtime-v47.0.3-aarch64-macos.tar.xz	c2684249e5d9ef9351942cf2d315982cf201fe0300f05d63bc1527446f0cd37f
+wasmtime	v48.0.0	linux	x86_64	wasmtime-v48.0.0-x86_64-linux.tar.xz	https://github.com/bytecodealliance/wasmtime/releases/download/v48.0.0/wasmtime-v48.0.0-x86_64-linux.tar.xz	1d23a692da51a4f825698f3f999da71f28bad19a96df5395fadc8d07f162dac3
+wasmtime	v48.0.0	linux	aarch64	wasmtime-v48.0.0-aarch64-linux.tar.xz	https://github.com/bytecodealliance/wasmtime/releases/download/v48.0.0/wasmtime-v48.0.0-aarch64-linux.tar.xz	ea20f14785f908afcd07063ade8d89b82b15228d9e6be426ea12ebecbc9c0c8b
+wasmtime	v48.0.0	macos	x86_64	wasmtime-v48.0.0-x86_64-macos.tar.xz	https://github.com/bytecodealliance/wasmtime/releases/download/v48.0.0/wasmtime-v48.0.0-x86_64-macos.tar.xz	3cf3c8d1f67184183acd61567e758046d40dddd169295dc9e7570b2b20505ac9
+wasmtime	v48.0.0	macos	aarch64	wasmtime-v48.0.0-aarch64-macos.tar.xz	https://github.com/bytecodealliance/wasmtime/releases/download/v48.0.0/wasmtime-v48.0.0-aarch64-macos.tar.xz	b62f687c7b19dd7c04b44ba5d6170a92a2c99bfc190887348aee9323e3703e60
+wasm-tools	1.257.1	linux	x86_64	wasm-tools-1.257.1-x86_64-linux.tar.gz	https://github.com/bytecodealliance/wasm-tools/releases/download/v1.257.1/wasm-tools-1.257.1-x86_64-linux.tar.gz	acea0a6f71b15f3b2d394f97453398f29099cec52df93bb25741a22561639b24
+wasm-tools	1.257.1	linux	aarch64	wasm-tools-1.257.1-aarch64-linux.tar.gz	https://github.com/bytecodealliance/wasm-tools/releases/download/v1.257.1/wasm-tools-1.257.1-aarch64-linux.tar.gz	ff23fa2ed1bf46c590ebaff9ec585c941b820dd56384080466dabc61ed829178
+wasm-tools	1.257.1	macos	x86_64	wasm-tools-1.257.1-x86_64-macos.tar.gz	https://github.com/bytecodealliance/wasm-tools/releases/download/v1.257.1/wasm-tools-1.257.1-x86_64-macos.tar.gz	e35977a05d9e04b8e20208db5d2cd67031d3f782be2da763296b6a8ba13527ce
+wasm-tools	1.257.1	macos	aarch64	wasm-tools-1.257.1-aarch64-macos.tar.gz	https://github.com/bytecodealliance/wasm-tools/releases/download/v1.257.1/wasm-tools-1.257.1-aarch64-macos.tar.gz	1d1ced29aa8320733a7e27452434e66f9bcb61ce39a00ee63229594d71f8544d
 codecov	v11.3.1	linux	x86_64	codecov	https://cli.codecov.io/v11.3.1/linux/codecov	ca1d64196d2d34771084afe76ea657d581bf628e31d993ff8e52ea09cc88a56d

.config/nextest.toml

@@ -21,6 +21,10 @@ slow-timeout = { period = "60s", terminate-after = 8 }
 filter = 'binary(=rsa_wycheproof) & (test(=wycheproof_oaep_mgf1sha1_vectors_are_rejected_by_sha2_mgf1sha2_profiles) | test(=wycheproof_pkcs1v15_sha2_sig_gen_vectors_match_expected_signatures))'
 slow-timeout = { period = "60s", terminate-after = 4 }
 
+[[profile.default.overrides]]
+filter = 'binary(=rsa_wycheproof) & test(=wycheproof_oaep_sha2_decrypt_vectors_match_expected_results)'
+slow-timeout = { period = "60s", terminate-after = 4 }
+
 [profile.commit]
 status-level = "fail"
 success-output = "never"

.config/rail.toml

@@ -49,7 +49,7 @@ require_changelog_entries = false
 require_release_notes = true
 release_notes_dir = "release-notes"
 pre_1_breaking_bump = "minor"
-unconventional_commits = "allow"  # Required .changes files own bumps and user-facing release notes.
+unconventional_commits = "allow" # Required .changes files own bumps and user-facing release notes.
 semver_check = "warn"
 change_dir = ".changes"
 require_change_files = ["rscrypto"]
@@ -58,16 +58,16 @@ remote_effects = "push" # Release automation pushes commits/tags; the repository
 [release.changelog]
 path = "CHANGELOG.md"
 relative_to = "workspace"
-entry_format = "- {scope}{breaking}{description}{prs} ({sha_link})"  # Entry placeholders: scope, breaking, description, prs, sha, sha_link, type
-emoji = true  # Render emoji in changelog section headers
-group_order = []  # Render reviewed .changes entries only; commit subjects are not release notes.
-fallback = "skip"  # Drop commit-derived entries.
+entry_format = "- {scope}{breaking}{description}{prs} ({sha_link})" # Entry placeholders: scope, breaking, description, prs, sha, sha_link, type
+emoji = true # Render emoji in changelog section headers
+group_order = [] # Render reviewed .changes entries only; commit subjects are not release notes.
+fallback = "skip" # Drop commit-derived entries.
 
 [release.changelog.filters]
 skip_types = ["chore", "ci"]
 skip_scopes = []
-include_paths = []  # Optional changelog attribution include globs
-exclude_paths = []  # Optional changelog attribution exclude globs
+include_paths = [] # Optional changelog attribution include globs
+exclude_paths = [] # Optional changelog attribution exclude globs
 
 
 [change-detection]

.config/target-matrix.json

@@ -1,39 +1,27 @@
 {
   "groups": {
-    "win": [
-      "aarch64-pc-windows-msvc",
-      "x86_64-pc-windows-msvc"
-    ],
-    "macos": [
-      "aarch64-apple-darwin",
-      "x86_64-apple-darwin"
-    ],
+    "win": ["aarch64-pc-windows-msvc", "x86_64-pc-windows-msvc"],
+    "macos": ["aarch64-apple-darwin", "x86_64-apple-darwin"],
     "linux": [
       "aarch64-unknown-linux-gnu",
       "aarch64-unknown-linux-musl",
       "riscv64gc-unknown-linux-gnu",
       "x86_64-unknown-linux-gnu",
       "x86_64-unknown-linux-musl"
     ],
-    "ibm": [
-      "powerpc64le-unknown-linux-gnu",
-      "s390x-unknown-linux-gnu"
-    ],
+    "ibm": ["powerpc64le-unknown-linux-gnu", "s390x-unknown-linux-gnu"],
     "no_std": [
       "aarch64-unknown-none",
       "riscv32imac-unknown-none-elf",
       "thumbv6m-none-eabi",
       "x86_64-unknown-none"
     ],
-    "wasm": [
-      "wasm32-unknown-unknown",
-      "wasm32-wasip1"
-    ]
+    "wasm": ["wasm32-unknown-unknown", "wasm32-wasip1"]
   },
   "ci": [
-    { "name": "aarch64-pc-windows-msvc",   "type": "gha",    "runner": "windows-11-arm" },
+    { "name": "aarch64-pc-windows-msvc", "type": "gha", "runner": "windows-11-arm" },
     { "name": "aarch64-unknown-linux-gnu", "type": "runson", "pool": "linux-arm64-ci" },
-    { "name": "x86_64-pc-windows-msvc",    "type": "gha",    "runner": "windows-latest" },
-    { "name": "x86_64-unknown-linux-gnu",  "type": "runson", "pool": "linux-x64-ci" }
+    { "name": "x86_64-pc-windows-msvc", "type": "gha", "runner": "windows-latest" },
+    { "name": "x86_64-unknown-linux-gnu", "type": "runson", "pool": "linux-x64-ci" }
   ]
 }

.github/actions/setup/action.yaml

@@ -35,7 +35,7 @@ runs:
     # runs-on.com S3-backed cache intercept. No-op on non-runs-on pools.
     - name: Setup MagicCache
       if: inputs.enable-magic-cache == 'true'
-      uses: runs-on/action@46910bf61b41721b0579f237e186afb35477007a  # v2.3.0
+      uses: runs-on/action@46910bf61b41721b0579f237e186afb35477007a # v2.3.0
 
     - name: Setup Toolchain
       uses: ./.github/actions/setup-toolchain
@@ -52,7 +52,7 @@ runs:
 
     - name: Setup Rust Cache
       if: inputs.enable-rust-cache == 'true'
-      uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6  # v2.9.2
+      uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
       with:
         shared-key: "rscrypto-v1-${{ inputs.cache-key }}"
         cache-directories: ${{ inputs.tools-mode == 'rail' && 'target/cargo-rail/cache' || '' }}

.github/rulesets/protect-main.json

@@ -5,9 +5,7 @@
   "conditions": {
     "ref_name": {
       "exclude": [],
-      "include": [
-        "~DEFAULT_BRANCH"
-      ]
+      "include": ["~DEFAULT_BRANCH"]
     }
   },
   "bypass_actors": [],
@@ -27,11 +25,7 @@
         "require_code_owner_review": false,
         "require_last_push_approval": false,
         "required_review_thread_resolution": true,
-        "allowed_merge_methods": [
-          "merge",
-          "squash",
-          "rebase"
-        ]
+        "allowed_merge_methods": ["merge", "squash", "rebase"]
       }
     },
     {

.github/rulesets/protect-release-tags.json

@@ -5,9 +5,7 @@
   "conditions": {
     "ref_name": {
       "exclude": [],
-      "include": [
-        "refs/tags/v*"
-      ]
+      "include": ["refs/tags/v*"]
     }
   },
   "bypass_actors": [],

.github/workflows/_ci-suite.yaml

@@ -42,7 +42,7 @@ jobs:
       ci: ${{ steps.matrix.outputs.ci }}
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Load matrix