diff --git a/.github/workflows/intake-label-needs-triage.yml b/.github/workflows/intake-label-needs-triage.yml index aef73657cb..b200fff3d5 100644 --- a/.github/workflows/intake-label-needs-triage.yml +++ b/.github/workflows/intake-label-needs-triage.yml @@ -17,7 +17,7 @@ jobs: intake-label-needs-triage: permissions: issues: write # passed to the reusable, which reads and adds issue labels - uses: melodic-software/ci-workflows/.github/workflows/intake-label-needs-triage.yml@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/workflows/intake-label-needs-triage.yml@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: runner: ubuntu-24.04 label: needs-triage diff --git a/.github/workflows/intake-triage.yml b/.github/workflows/intake-triage.yml index 4281c8c50d..7f2843d25c 100644 --- a/.github/workflows/intake-triage.yml +++ b/.github/workflows/intake-triage.yml @@ -24,7 +24,7 @@ jobs: concurrency: group: intake-triage-${{ github.event.issue.number || github.run_id }} cancel-in-progress: false - uses: melodic-software/ci-workflows/.github/workflows/intake-triage.yml@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/workflows/intake-triage.yml@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: runner: ubuntu-24.04 secrets: diff --git a/.github/workflows/maintenance-audit-test-selection.yml b/.github/workflows/maintenance-audit-test-selection.yml index afa45bed15..237cc80efd 100644 --- a/.github/workflows/maintenance-audit-test-selection.yml +++ b/.github/workflows/maintenance-audit-test-selection.yml @@ -76,7 +76,7 @@ jobs: .github/requirements-ci.txt .github/requirements-ci-animation.txt - name: Install and verify ShellCheck toolchain - uses: melodic-software/ci-workflows/.github/actions/shellcheck@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/shellcheck@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: paths: plugins/bash-format rcfile: .shellcheckrc diff --git a/.github/workflows/pr-automerge-dependabot.yml b/.github/workflows/pr-automerge-dependabot.yml index c8438f2007..1f3a82ce1f 100644 --- a/.github/workflows/pr-automerge-dependabot.yml +++ b/.github/workflows/pr-automerge-dependabot.yml @@ -23,6 +23,6 @@ jobs: permissions: contents: write # enablePullRequestAutoMerge requires it. pull-requests: write # Arm or disarm auto-merge on the PR. - uses: melodic-software/ci-workflows/.github/workflows/pr-automerge-dependabot.yml@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/workflows/pr-automerge-dependabot.yml@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: runner: ubuntu-24.04 diff --git a/.github/workflows/pr-require-checks.yml b/.github/workflows/pr-require-checks.yml index e61d5e285d..e9b6a854e1 100644 --- a/.github/workflows/pr-require-checks.yml +++ b/.github/workflows/pr-require-checks.yml @@ -307,7 +307,7 @@ jobs: - name: Match the changed files against the filter groups id: match continue-on-error: true - uses: melodic-software/ci-workflows/.github/actions/detect-changes@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/detect-changes@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: filters: | shell: @@ -757,11 +757,11 @@ jobs: path: | ~/.npm/_npx ~/.npm/_cacache - key: npx-markdownlint-cli2-${{ runner.os }}-cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 + key: npx-markdownlint-cli2-${{ runner.os }}-6ba73b97b058602c4dd2bb6e2cce234d11011787 - name: Lint markdown id: markdown continue-on-error: true - uses: melodic-software/ci-workflows/.github/actions/markdownlint@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/markdownlint@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: config: .markdownlint-cli2.jsonc globs: ${{ steps.changed_md.outputs.globs }} @@ -769,7 +769,7 @@ jobs: - name: Spell-check id: typos continue-on-error: true - uses: melodic-software/ci-workflows/.github/actions/typos@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/typos@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: config: _typos.toml # A pack's vendored baseline is replaced verbatim from upstream by its @@ -791,7 +791,7 @@ jobs: - name: Scan for secrets id: gitleaks continue-on-error: true - uses: melodic-software/ci-workflows/.github/actions/gitleaks@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/gitleaks@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: config: .gitleaks.toml scan-mode: git @@ -799,7 +799,7 @@ jobs: - name: Check editorconfig conformance id: editorconfig continue-on-error: true - uses: melodic-software/ci-workflows/.github/actions/editorconfig-checker@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/editorconfig-checker@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: config: .editorconfig-checker.json @@ -813,13 +813,13 @@ jobs: id: actionlint if: needs.select-tests.outputs.run_workflows == 'true' continue-on-error: true - uses: melodic-software/ci-workflows/.github/actions/actionlint@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/actionlint@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 - name: Validate dependabot.yml id: dependabot_schema if: needs.select-tests.outputs.run_workflows == 'true' continue-on-error: true - uses: melodic-software/ci-workflows/.github/actions/check-jsonschema@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/check-jsonschema@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: builtin-schema: vendor.dependabot files: .github/dependabot.yml @@ -827,7 +827,7 @@ jobs: id: workflow_schema if: needs.select-tests.outputs.run_workflows == 'true' continue-on-error: true - uses: melodic-software/ci-workflows/.github/actions/check-jsonschema@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/check-jsonschema@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: builtin-schema: vendor.github-workflows files: >- @@ -840,12 +840,12 @@ jobs: - name: Verify shebang files are executable id: exec_bit continue-on-error: true - uses: melodic-software/ci-workflows/.github/actions/check-exec-bit@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/check-exec-bit@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 - name: Check for machine-specific paths id: machine_paths continue-on-error: true - uses: melodic-software/ci-workflows/.github/actions/check-machine-paths@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/check-machine-paths@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: # The guardrails plugin bundles a path-detection pattern lib whose # regex bodies self-match this lane's own detector. The autonomy @@ -878,12 +878,12 @@ jobs: - name: Check index-level EOL drift id: eol continue-on-error: true - uses: melodic-software/ci-workflows/.github/actions/check-line-endings@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/check-line-endings@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 - name: Scan comment hygiene id: comment_hygiene continue-on-error: true - uses: melodic-software/ci-workflows/.github/actions/check-comment-markers@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/check-comment-markers@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: # The audit-comment-residue skill IS a code-comment linter: its detector # fixtures and shape library necessarily contain the markers this policy @@ -1275,7 +1275,7 @@ jobs: - name: Lint shell scripts id: shellcheck continue-on-error: true - uses: melodic-software/ci-workflows/.github/actions/shellcheck@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/shellcheck@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: files: ${{ steps.changed_shell.outputs.files }} rcfile: .shellcheckrc @@ -1555,7 +1555,7 @@ jobs: id: marketplace_schema if: needs.select-tests.outputs.run_manifests == 'true' continue-on-error: true - uses: melodic-software/ci-workflows/.github/actions/check-jsonschema@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/check-jsonschema@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: schemafile: https://json.schemastore.org/claude-code-marketplace.json files: .claude-plugin/marketplace.json @@ -1563,7 +1563,7 @@ jobs: id: plugin_schema if: needs.select-tests.outputs.run_manifests == 'true' continue-on-error: true - uses: melodic-software/ci-workflows/.github/actions/check-jsonschema@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/check-jsonschema@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: schemafile: https://json.schemastore.org/claude-code-plugin-manifest.json files: plugins/*/.claude-plugin/plugin.json @@ -1892,7 +1892,7 @@ jobs: - name: Validate every eval set against the bundled schema id: evals_schema continue-on-error: true - uses: melodic-software/ci-workflows/.github/actions/check-jsonschema@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/check-jsonschema@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: schemafile: plugins/skill-quality/reference/evals.schema.json files: plugins/*/skills/*/evals/evals.json @@ -2119,7 +2119,7 @@ jobs: # available to the bash-format contract suites in this same job. It # verifies the install on one small file that sources nothing; the # ShellCheck gate in `lint-shell` is what lints the repository. - uses: melodic-software/ci-workflows/.github/actions/shellcheck@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/shellcheck@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: files: scripts/aggregate-hygiene-results.sh rcfile: .shellcheckrc @@ -2491,7 +2491,7 @@ jobs: # The guard diffs base...head; both commits must be present. fetch-depth: 0 - name: Guard managed files - uses: melodic-software/ci-workflows/.github/actions/check-managed-files@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 + uses: melodic-software/ci-workflows/.github/actions/check-managed-files@c586acc8ea288d728cc7d92f641161eec462fa05 # v0.39.1 ci-status: needs: @@ -2532,7 +2532,7 @@ jobs: statuses: write steps: - name: Check the pull-request contract - uses: melodic-software/ci-workflows/.github/actions/pr-require-checks/check-contract@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/pr-require-checks/check-contract@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: token: ${{ github.token }} # Carried over verbatim from `pr-issue-linkage.yml`, the caller this @@ -2677,7 +2677,7 @@ jobs: # aggregation: the job still fails on the contract step's exit code, and # the `ci-lanes` status is on the SHA for the next contract-only run. if: ${{ !cancelled() }} - uses: melodic-software/ci-workflows/.github/actions/pr-require-checks/aggregate-results@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/pr-require-checks/aggregate-results@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: # Every lane of the needs graph above — the single source of truth # for the lane list — through the ordered-skip check. Adding a lane diff --git a/README.md b/README.md index c55fd2c2c1..0d02f2090e 100644 --- a/README.md +++ b/README.md @@ -168,7 +168,7 @@ wraps the runnable rows is a later tooling decision, not this record. - **Basis:** the #3522 owner decision (document running the composite's script from a `ci-workflows` checkout). Verified: the script runs standalone and needs only `EXTENSIONS` and `EXCLUDE`. -- **As of:** `ci-workflows` v0.38.2 (`cf316d12b4a14fbdb96a339b7ad00ce935a8cad4`), the pin in +- **As of:** `ci-workflows` v0.39.0 (`6ba73b97b058602c4dd2bb6e2cce234d11011787`), the pin in `.github/workflows/pr-require-checks.yml`. - **Recheck:** the `pr-require-checks.yml` pin moves, or the composite's entry script changes its environment contract. diff --git a/scripts/check-docs-only-gate.sh b/scripts/check-docs-only-gate.sh index c05a943777..4836fca869 100755 --- a/scripts/check-docs-only-gate.sh +++ b/scripts/check-docs-only-gate.sh @@ -998,7 +998,7 @@ is_required() { [[ "$required_closure" == *$'\n'"$1"$'\n'* ]]; } # carry-forward branch on is NOT checked here and is checked nowhere else # either: ci-workflows tests its composite against its own pr-require-checks.yml, not against # this repository's. It was verified by hand at pin -# cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 (v0.38.2), path +# 6ba73b97b058602c4dd2bb6e2cce234d11011787 (v0.39.0), path # .github/actions/pr-require-checks/aggregate-results: its `contract-only` # default is this predicate token for token, the caller passes no # `contract-only`, and run.sh still branches its carry-forward on that input. It