ci(repro): resolve SOURCE_DATE_EPOCH before the SDK Go audit

.ngit/act/workflows/repro-check.yml

@@ -91,6 +91,17 @@ jobs:
             exit 1
           fi
           echo "go $have matches packaging/build-inputs.json"
+      - name: Resolve SOURCE_DATE_EPOCH from the commit
+        # The audit step below sources packaging/build-env.sh, which requires
+        # SOURCE_DATE_EPOCH and cannot derive it from git history in an act
+        # checkout (no usable .git). Resolve it the way this repo
+        # standardized in stage 1: the fail-closed commit-epoch resolver.
+        run: |
+          set -euo pipefail
+          EPOCH=$(bash scripts/ngit-commit-epoch.sh "$GITHUB_SHA")
+          case "$EPOCH" in ''|*[!0-9]*) echo "ERROR: not an epoch: '$EPOCH'" >&2; exit 1 ;; esac
+          echo "SOURCE_DATE_EPOCH=$EPOCH" >> "${GITHUB_ENV}"
+          echo "SOURCE_DATE_EPOCH=$EPOCH ($(date -u -d "@$EPOCH" '+%Y-%m-%d %H:%M:%S UTC'))"
       - name: Audit the SDK Go pins against the live OpenWrt feeds
         # The pin's authority is the SDK's own packages feed: this fails when
         # .go.version stops matching the pinned release's feed, or when the

CHANGELOG.md

@@ -10,6 +10,16 @@ and [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+### Changed / Internal
+
+- **The repro lane's SDK Go audit runs again.** Since #448 landed the
+  audit, `repro-check` failed on every push: the audit sources
+  `packaging/build-env.sh`, which needs a `SOURCE_DATE_EPOCH` that an act
+  checkout cannot derive. The lane now resolves the epoch through the
+  repo-standard fail-closed resolver (`scripts/ngit-commit-epoch.sh`)
+  before the audit.
+  ([#519](https://github.com/OpenTollGate/tollgate-module-basic-go/pull/519))
+
 ### Added
 
 - **`GET /session-state?mac=…` reports a machine-readable session state per