Migrate shared-file checksums to per-repo manifests

[bernardladenthin]

Replace the centralized checksum table in crossrepostatus.md with per-repository manifest files (.github/shared-files.sha256) and a shared-files CI job that validates them on every run.

Summary

This change decentralizes the maintenance of shared-file checksums from a single consolidated table to individual manifest files in each repository. The new approach:

• Moves checksums from crossrepostatus.md into each repo's .github/shared-files.sha256
• Introduces a shared-files CI job that runs check-shared-files.py to validate file integrity
• Extends the job to also run check-versions.py (Maven dependency/plugin version consistency) and check-run-scripts.py (bash syntax validation)
• Adds a release-gate check (check-release-gate.py) to ensure informational steps don't block releases
• Replaces manual verification commands with automated checks that fail on drift within a single repo and warn when siblings diverge

Key Changes

• crossrepostatus.md:

  • Removed the detailed checksum table with SHA-256 hashes and manual verification commands
  • Replaced with a reference table pointing to each repo's manifest file and its shared-files job
  • Updated the tool-versions row to note that check-versions.py now validates Maven dependency consistency
  • Clarified that the identity half (all four repos carry the same values) is now machine-checked
  • Updated references to shared files to point to manifests instead of the old table

• policies/ci-test-diagnostics.md:

  • Replaced the inline crash-log printing script with a reference to the shared .github/print-crash-logs.sh
  • Updated to note that the script is now listed in each repo's shared-files.sha256 and checked by the shared-files job
  • Clarified that the script accepts module directories as arguments

• policies/fat-jar-release-assets.md:

  • Updated references to shared files to use the new manifest-based approach
  • Changed instructions from "update the checksum table" to "run check-shared-files.py --write"
  • Updated the jllama smoke-test job description to reflect the matrix structure
  • Clarified srcmorph's classifier-based fat jar naming

• policies/lombok-config.md:

  • Updated to reference the new per-repo manifest approach instead of the centralized checksum table
  • Changed sync instructions to use check-shared-files.py --write

Implementation Details

The new system uses manifest files (.github/shared-files.sha256) that list all shared files with their expected SHA-256 hashes. The shared-files CI job:

• Fails if a file in the manifest has changed in the current repository
• Warns if a sibling repository's default branch lists the same file with a different hash
• Also validates Maven versions and bash script syntax as part of the same job
• Enforces that informational steps in publish.yml don't gate the release process

This approach makes drift detection automatic and explicit, eliminating the need for manual checksum maintenance and verification commands.

https://claude.ai/code/session_01AytmJF9faEiQEVt6eetQS2