⚙️ [Maintenance]: [process-v8-major-tag] Roll the v8 caller across the fleet #438

Status

Blocked pending structural agreement in #514. The YAML in draft PR #515 is a candidate, not an approved fleet standard. Do not open consumer delivery leaves until #514 records every caller-layout decision and canonical documentation is updated.

Intended outcome

After approval, all 60 Process-PSModule consumers use the agreed v8 caller structure and reference the PSModule-owned reusable workflow through the controlled floating major tag @v8. Compatible v8 releases then roll out through controlled release automation; v9 requires a separate deliberate campaign.

Current evidence

The 2026-08-15 inventory found 0/60 callers on @v8. Every caller still uses an exact v5 or v6 SHA. The fleet also shares the old trigger and concurrency shape, while credential forwarding splits into 41 inherited-secret callers, 15 old-API-key-only callers, three TestData callers, and one TestData plus custom-input caller.

Refresh the evidence with:

./.github/scripts/Get-ProcessPSModuleWorkflowInventory.ps1 `
    -Organization PSModule `
    -TargetReference v8 `
    -JsonPath ./output/process-workflows.json `
    -MarkdownPath ./output/process-workflows.md

Agreed reference policy

• PSModule-owned actions and reusable workflows may use a controlled floating major tag such as @v8.
• External actions and reusable workflows remain pinned to full immutable commit SHAs with readable version comments.
• A major tag never crosses a breaking boundary.
• Release-identity-only governance must be enforced before rollout; consumers retain immutable SHA references until then.

Provisional delivery waves

These waves classify current callers only; they do not approve the candidate structure.

Preconditions

• Agree the Process-PSModule caller workflow structure #514 records the approved file structure and optional surface.
• Canonical guides and Template-PSModule reflect those decisions.
• Only controlled release automation can move v8.
• An organization administrator confirms Actions and Dependabot coverage for every agreed credential.
• Workflow-only pilot changes are confirmed not to publish a module.

Completion criteria

• Every inventoried consumer uses @v8.
• Every caller conforms to the structure approved in Agree the Process-PSModule caller workflow structure #514.
• Supported repository-specific values are preserved.
• No campaign merge creates an unintended release.
• The final inventory reports 60/60 matching v8 with no parse errors.

Related work

• Blocked by Agree the Process-PSModule caller workflow structure #514
• Evidence and candidate: ⚙️ [Maintenance]: Process-PSModule caller fleets can be audited consistently #515
• Cross-org reference policy: 📖 [Docs]: Owned automation can roll compatible releases out centrally MSXOrg/docs#176