build(deps): bump github.com/brokenbots/criteria from 0.5.5 to 0.5.7 in /workflow in the minor-and-patch group

[dependabot]

Bumps the minor-and-patch group in /workflow with 1 update: github.com/brokenbots/criteria.

Updates github.com/brokenbots/criteria from 0.5.5 to 0.5.7

Release notes

Sourced from github.com/brokenbots/criteria's releases.

v0.5.7

[Unreleased] — Adapter system v2 (protocol v2; clean break from v0.3.0)

Headline: The adapter system was rewritten end to end. Adapters are now signed OCI artifacts pulled from any registry and pinned per workflow, the wire protocol is v2 (a hard cut — v1 adapters no longer load), and a single term — "adapter" — is used throughout. Existing adapters were migrated in parallel; artifacts track the 0.5.0 line (v2 is the protocol version, not a product version). The release tag and date are finalized by the release gate.

Install / distribution

• Add one-line POSIX shell installer (install.sh) served from the default branch; downloads signed release tarballs and installs criteria plus bundled adapters to ~/.criteria.

Adapter system rewrite

• OCI-based distribution. Adapters publish as multi-platform OCI artifacts (per-platform binary blobs + an adapter.yaml manifest) to any OCI-compliant registry. No central registry; adapters are referenced by source + version.
• Per-workflow lockfile. .criteria.lock.hcl pins every referenced adapter by digest and records the signer identity, for run-to-run reproducibility. Populated by criteria adapter lock.
• Signing & verification. cosign signatures attached as OCI referrers, with the lockfile as the trust anchor: lock pins the signer and pull/compile/apply re-verify against the pin (a changed signer is a SignerChanged diff). Keyless (Sigstore/Fulcio OIDC) is the default CI path — signatures are now recorded in the Rekor transparency log and shipped as a Sigstore bundle, so they remain verifiable after the ephemeral Fulcio certificate expires; an adapter signed by its own repo's CI verifies with no per-consumer config. Explicit Ed25519 keys are supported for offline/ enterprise trust via a trusted_key config (~/.criteria/trust.hcl, a workflow-dir trust.hcl, or --trusted-key). A uniform unsigned-override (--allow-unsigned / CRITERIA_ALLOW_UNSIGNED) and the workflow-level verification = "strict" | "warn" | "off" attribute are honored across pull/lock/compile/apply. The effective default is warn during the signing-completion transition and returns to strict once keyless verification is confirmed in CI.
• New criteria adapter CLI group: pull, lock, list, info, where, remove, prune, dev, publish. publish supports --keyless, --sign-key, and --image (record an already-pushed runnable container image).
• Environment block expanded. New types sandbox (Linux namespaces + landlock
  • seccomp, or bubblewrap; macOS sandbox-exec), container (docker/podman), and remote (phone-home) join shell, with policy fields (policy_mode, sandbox, filesystem, network, secrets, resources, os).
• Lifecycle operations. Protocol v2 adds Pause/Resume, Snapshot/Restore, and Inspect, driven by the host and exercised by the shared conformance suite.
• Secrets channel. Declared secrets resolve through a provider stack and flow over a dedicated channel (never config/process env), with automatic log

... (truncated)

Commits

• 005b44b install-script (#295)
• 5117844 workflow: fix multi-file switch condition source extraction (#294)
• 2e100e8 ops: ops/the-release-pipeline-is-failing-it-seems-to-have cycle 1 (#293)
• f46d683 build(deps): consolidate dependabot updates into one PR (#292)
• 8ca4fa4 workflow: allow compile-time variable references for max_visits (#291)
• dff749c fix(workflow): avoid panic when adapter config references unresolved string v...
• 0829f88 pin whole graph at compile time (#289)
• 67767d6 recursive lock and workflow refs (#288)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions