feat: consolidate prebuilt and source Valhalla packages

[trumpyla]

Summary

Consolidates the Valhalla Homebrew packages and build automation in this canonical tap while preserving existing install tokens.

Package matrix

• Prebuilt macOS cask: jdkvalhalla
• Prebuilt Linux formulas: jdkvalhalla@26, jdkvalhalla@27
• Source formulas: openjdk-valhalla@27, openjdk-valhalla@28
• Rolling source alias: openjdk-valhalla -> openjdk-valhalla@28

The README includes installation, forced source-build, and versioned jenv registration examples.

Automation and security

• Adds pinned source formulas and revision-aware bottle generation.
• Publishes bottles through GHCR with exact artifact and anonymous digest verification.
• Separates read-only update preparation from the write-scoped PR job.
• Constrains official downloads to download.java.net and independently verifies every archive checksum.
• Rejects ambiguous release metadata, unexpected artifact paths, symlinks, and renderer template drift.
• Explicitly dispatches validation for update PRs created with GITHUB_TOKEN.
• Pins every third-party action to a full commit SHA and uses least-privilege workflow permissions.
• Removes the obsolete release workflow.

Validation

• bats tests/formula_contract.bats tests/documentation_contract.bats — 9/9 passed
• ruby tests/bottle_artifact_validator_test.rb — 11 tests, 28 assertions
• ruby tests/parse_valhalla_release_test.rb — 4 tests, 12 assertions
• ruby tests/workflow_security_test.rb — 15 tests, 229 assertions
• actionlint .github/workflows/*.yml — passed
• shellcheck scripts/test.sh tests/*.bats — passed
• brew style — 10 files, no offenses
• brew audit — all four formulas and the unchanged canonical cask passed
• git diff --check origin/main...HEAD — passed
• Agy adversarial security review — READY
• Kimi correctness/portability review — READY

A full Valhalla source build was intentionally not run; CI builds bottles from the pinned source formulas.

Superseded PR mapping

• chore: update Valhalla EA to 27-jep401ea3+1-1 #5: rejected because it applies the Linux x64 checksum to the macOS ARM64 cask and contains a malformed Ruby test string.
• ci(deps): bump github/codeql-action from 0f47cf5ea395a08f5ca3b81a506c66a63ecb648a to d198d2fabf39a7f36b5ce57ce70d4942944f006e #6: CodeQL action pin incorporated here.
• ci(deps): bump peter-evans/create-pull-request from 7.0.8 to 8.1.1 #7: peter-evans/create-pull-request pin incorporated here.
• ci(deps): bump actions/cache from 4.2.3 to 5.0.5 #8: actions/cache pin incorporated here.
• ci(deps): bump softprops/action-gh-release from 2.6.1 to 3.0.0 #9: obsolete release workflow removed here.
• ci(deps): bump actions/checkout from 4.1.1 to 6.0.2 #10: actions/checkout pin incorporated here.

Owner follow-up

On the first bottle publication, GHCR may create the package as private. If anonymous verification stops the workflow, make the package public and rerun it; subsequent publication remains checksum-bound and token-free for verification.

[Copilot]

Pull request overview

This PR consolidates this tap into a single canonical distribution point for both official prebuilt Valhalla binaries and pinned source/bottle-built Valhalla snapshots, while hardening CI/workflow security and preserving existing install tokens.

Changes:

• Adds pinned source formulas (openjdk-valhalla@27, openjdk-valhalla@28) plus a rolling alias and updates user-facing docs to cover both prebuilt and source/bottled installs.
• Introduces a split-trust bottle build/publish workflow plus artifact validation tooling and security/contract tests.
• Reworks validation and update automation to use least-privilege permissions, SHA-pinned actions, and fail-closed aggregation; removes the obsolete release workflow.

Reviewed changes

Copilot reviewed 22 out of 22 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
tests/workflow_security_test.rb	Adds workflow security contract tests (permissions, checkout behavior, action pinning, update/bottle trust boundaries).
tests/parse_valhalla_release_test.rb	Adds unit tests for strict parsing of the official Valhalla release page.
tests/formula_contract.bats	Adds contract tests for formula/cask validity, alias resolution, and source formula pinning.
tests/documentation_contract.bats	Adds contract tests to ensure README/SECURITY document the supported tokens and security posture.
tests/bottle_artifact_validator_test.rb	Adds unit tests for strict validation of bottle artifacts + JSON metadata.
SECURITY.md	Replaces the previous security policy with a tighter, workflow-/supply-chain-focused policy reflecting the new trust model.
scripts/validate-bottle-artifact.rb	Adds strict validator for bottle artifact sets and metadata before publication/merge.
scripts/test.sh	Expands local test runner to cover all package files, contract tests, and Ruby unit tests.
scripts/parse-valhalla-release.rb	Adds strict parser producing validated release metadata for update automation.
README.md	Rewrites documentation to explain the prebuilt vs source/bottle matrix and jenv registration.
Formula/openjdk-valhalla@27.rb	Adds pinned, macOS ARM64 Sonoma-only source formula for JDK 27 Valhalla milestone.
Formula/openjdk-valhalla@28.rb	Adds pinned, macOS ARM64 Sonoma-only source formula for JDK 28 Valhalla snapshot (bottle-capable).
docs/superpowers/specs/2026-07-28-valhalla-tap-consolidation-design.md	Adds design spec documenting consolidation goals, trust boundaries, and acceptance criteria.
docs/superpowers/plans/2026-07-28-legacy-jdk26ea-compatibility-archive.md	Adds execution plan for legacy jdk26ea compatibility + archival workflow (documentation/operations).
docs/superpowers/plans/2026-07-28-canonical-valhalla-tap-consolidation.md	Adds detailed implementation plan for the canonical consolidation (documentation/operations).
.github/workflows/validate.yml	Replaces validation with a read-only, fail-closed workflow plus updated install tests and static checks.
.github/workflows/update.yml	Splits update into read-only prepare + write-scoped PR creation; adds strict download/checksum verification and exact artifact allowlisting.
.github/workflows/release.yml	Removes obsolete release workflow (superseded by bottle publication + updated validation).
.github/workflows/codeql.yml	Updates checkout pinning and CodeQL action pinning; tightens permissions.
.github/workflows/bottles.yml	Adds split-trust bottle build + publish workflow with anonymous digest verification and PR-based bottle block updates.
.github/workflows/audit.yml	Updates audit workflow to be explicitly read-only and SHA-pinned checkout.

Comments suppressed due to low confidence (1)

tests/workflow_security_test.rb:334

• These tests also use YAML.load_file when iterating over workflow files. This has the same unsafe-deserialization risk as above when run against untrusted PR changes.

  def test_every_action_reference_is_an_immutable_commit
    action_references = Dir[File.join(ROOT, ".github", "workflows", "*.yml")].flat_map do |path|
      document = YAML.load_file(path)
      document.fetch("jobs").values.flat_map { |job| job.fetch("steps", []) }
                                   .each_with_object([]) do |step, references|
        references << step["uses"] if step["uses"]
      end
    end

    action_references.each do |reference|
      assert_match(/\A[^@\s]+@[0-9a-f]{40}\z/, reference)
    end
  end

  def test_every_workflow_declares_permissions_and_safe_checkout
    workflow_paths = Dir[File.join(ROOT, ".github", "workflows", "*.yml")]

    workflow_paths.each do |path|
      document = YAML.load_file(path)
      assert document.key?("permissions"), "#{File.basename(path)} has no top-level permissions"