Add one-time release-integrity materialization workflow #1

	name: Apply release integrity materialization

	on:
	push:
	branches: [hardening/release-integrity]
	paths:
	- ".github/workflows/apply-release-integrity.yml"
	workflow_dispatch:

	permissions:
	contents: write

	jobs:
	materialize:
	if: github.actor == 'masarray'
	runs-on: ubuntu-24.04
	steps:
	- name: Checkout hardening branch
	uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
	with:
	ref: hardening/release-integrity
	fetch-depth: 0

	- name: Install PDF dependency
	run: python -m pip install --disable-pip-version-check reportlab==4.4.9

	- name: Generate current GPL release PDFs
	run: python scripts/generate-release-pdfs.py

	- name: Remove one-time staging files
	shell: bash
	run: \|
	rm -rf .github/patch
	rm -f __test_content__
	rm -f .github/workflows/apply-release-integrity.yml

	- name: Preserve historical boundary with annotated tag
	shell: bash
	run: \|
	set -euo pipefail
	boundary="85d43a0fe58a5888a9e8008c168ab76d2333ea87"
	tag="license-boundary/apache-2.0-final"
	if ! git rev-parse "$tag" >/dev/null 2>&1; then
	git config user.name "Ari Sulistiono"
	git config user.email "admin@arisulistiono.com"
	git tag -a "$tag" "$boundary" -m "Final active Apache-2.0 revision"
	git push origin "$tag"
	fi

	- name: Commit generated documents and cleanup
	shell: bash
	run: \|
	set -euo pipefail
	git config user.name "Ari Sulistiono"
	git config user.email "admin@arisulistiono.com"
	git add -A
	if git diff --cached --quiet; then
	exit 0
	fi
	git commit -s -m "Regenerate GPL release documents and remove staging files"
	git push origin HEAD:hardening/release-integrity

Provide feedback