Clarify Bash configuration provenance for repository-managed CI

[WilliamBerryiii]

Context

The Bash authoring guidance demonstrates sourcing configuration after checking only file existence. Repository-managed CI configuration is executable code whose authority should derive from the reviewed repository revision and resulting checkout.

Scope

Clarify the CI-specific contract without generalizing it to operator-managed, user-selected, or externally acquired configuration.

Acceptance criteria

• Guidance distinguishes file existence and quoting from provenance authorization
• Repository-managed CI authority is bound to the reviewed revision and checkout
• Path or symbolic-link substitution and post-checkout modification invalidate authority
• An authorized reviewed update can establish a new trusted checkout state
• A digest without an authorized baseline is not treated as provenance
• Non-CI configuration classes remain outside scope pending separate owner decisions
• Validation does not source configuration fixtures

[github-actions]

Thanks for the detailed write-up. This looks like a well-scoped documentation clarification for the Bash authoring guidance's CI configuration provenance contract, with clear, testable acceptance criteria. Labeled documentation, instructions, and priority-3.

Holding off on agent-ready for now since this touches security-relevant guidance (provenance/authority semantics for CI configuration) where getting the precise wording and scope boundary right likely benefits from maintainer review before an automated change is made. No duplicates found among currently open issues.

Generated by Issue Triage for #2838 · auto · 22.7 AIC · ⌖ 2.14 AIC · ⊞ 11.9K · ◷