From ddc8eff0a17655d38fe4194f83997692dafd8e41 Mon Sep 17 00:00:00 2001 From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com> Date: Wed, 7 Oct 2026 09:41:21 -0400 Subject: [PATCH 1/3] ci: repin ci-workflows to v0.39.0 Co-Authored-By: Claude Opus 5.5 --- .../workflows/intake-label-needs-triage.yml | 2 +- .github/workflows/intake-triage.yml | 2 +- .../maintenance-audit-test-selection.yml | 2 +- .github/workflows/pr-automerge-dependabot.yml | 2 +- .github/workflows/pr-require-checks.yml | 40 +++++++++---------- README.md | 2 +- scripts/check-docs-only-gate.sh | 2 +- 7 files changed, 26 insertions(+), 26 deletions(-) diff --git a/.github/workflows/intake-label-needs-triage.yml b/.github/workflows/intake-label-needs-triage.yml index aef73657cb..b200fff3d5 100644 --- a/.github/workflows/intake-label-needs-triage.yml +++ b/.github/workflows/intake-label-needs-triage.yml @@ -17,7 +17,7 @@ jobs: intake-label-needs-triage: permissions: issues: write # passed to the reusable, which reads and adds issue labels - uses: melodic-software/ci-workflows/.github/workflows/intake-label-needs-triage.yml@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/workflows/intake-label-needs-triage.yml@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: runner: ubuntu-24.04 label: needs-triage diff --git a/.github/workflows/intake-triage.yml b/.github/workflows/intake-triage.yml index 4281c8c50d..7f2843d25c 100644 --- a/.github/workflows/intake-triage.yml +++ b/.github/workflows/intake-triage.yml @@ -24,7 +24,7 @@ jobs: concurrency: group: intake-triage-${{ github.event.issue.number || github.run_id }} cancel-in-progress: false - uses: melodic-software/ci-workflows/.github/workflows/intake-triage.yml@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/workflows/intake-triage.yml@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: runner: ubuntu-24.04 secrets: diff --git a/.github/workflows/maintenance-audit-test-selection.yml b/.github/workflows/maintenance-audit-test-selection.yml index afa45bed15..237cc80efd 100644 --- a/.github/workflows/maintenance-audit-test-selection.yml +++ b/.github/workflows/maintenance-audit-test-selection.yml @@ -76,7 +76,7 @@ jobs: .github/requirements-ci.txt .github/requirements-ci-animation.txt - name: Install and verify ShellCheck toolchain - uses: melodic-software/ci-workflows/.github/actions/shellcheck@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/shellcheck@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: paths: plugins/bash-format rcfile: .shellcheckrc diff --git a/.github/workflows/pr-automerge-dependabot.yml b/.github/workflows/pr-automerge-dependabot.yml index c8438f2007..1f3a82ce1f 100644 --- a/.github/workflows/pr-automerge-dependabot.yml +++ b/.github/workflows/pr-automerge-dependabot.yml @@ -23,6 +23,6 @@ jobs: permissions: contents: write # enablePullRequestAutoMerge requires it. pull-requests: write # Arm or disarm auto-merge on the PR. - uses: melodic-software/ci-workflows/.github/workflows/pr-automerge-dependabot.yml@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/workflows/pr-automerge-dependabot.yml@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: runner: ubuntu-24.04 diff --git a/.github/workflows/pr-require-checks.yml b/.github/workflows/pr-require-checks.yml index d9965aad31..2ec31bd811 100644 --- a/.github/workflows/pr-require-checks.yml +++ b/.github/workflows/pr-require-checks.yml @@ -307,7 +307,7 @@ jobs: - name: Match the changed files against the filter groups id: match continue-on-error: true - uses: melodic-software/ci-workflows/.github/actions/detect-changes@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/detect-changes@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: filters: | shell: @@ -757,11 +757,11 @@ jobs: path: | ~/.npm/_npx ~/.npm/_cacache - key: npx-markdownlint-cli2-${{ runner.os }}-cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 + key: npx-markdownlint-cli2-${{ runner.os }}-6ba73b97b058602c4dd2bb6e2cce234d11011787 - name: Lint markdown id: markdown continue-on-error: true - uses: melodic-software/ci-workflows/.github/actions/markdownlint@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/markdownlint@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: config: .markdownlint-cli2.jsonc globs: ${{ steps.changed_md.outputs.globs }} @@ -769,7 +769,7 @@ jobs: - name: Spell-check id: typos continue-on-error: true - uses: melodic-software/ci-workflows/.github/actions/typos@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/typos@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: config: _typos.toml # A pack's vendored baseline is replaced verbatim from upstream by its @@ -789,7 +789,7 @@ jobs: - name: Scan for secrets id: gitleaks continue-on-error: true - uses: melodic-software/ci-workflows/.github/actions/gitleaks@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/gitleaks@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: config: .gitleaks.toml scan-mode: git @@ -797,7 +797,7 @@ jobs: - name: Check editorconfig conformance id: editorconfig continue-on-error: true - uses: melodic-software/ci-workflows/.github/actions/editorconfig-checker@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/editorconfig-checker@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: config: .editorconfig-checker.json @@ -811,13 +811,13 @@ jobs: id: actionlint if: needs.select-tests.outputs.run_workflows == 'true' continue-on-error: true - uses: melodic-software/ci-workflows/.github/actions/actionlint@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/actionlint@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 - name: Validate dependabot.yml id: dependabot_schema if: needs.select-tests.outputs.run_workflows == 'true' continue-on-error: true - uses: melodic-software/ci-workflows/.github/actions/check-jsonschema@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/check-jsonschema@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: builtin-schema: vendor.dependabot files: .github/dependabot.yml @@ -825,7 +825,7 @@ jobs: id: workflow_schema if: needs.select-tests.outputs.run_workflows == 'true' continue-on-error: true - uses: melodic-software/ci-workflows/.github/actions/check-jsonschema@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/check-jsonschema@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: builtin-schema: vendor.github-workflows files: >- @@ -838,12 +838,12 @@ jobs: - name: Verify shebang files are executable id: exec_bit continue-on-error: true - uses: melodic-software/ci-workflows/.github/actions/check-exec-bit@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/check-exec-bit@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 - name: Check for machine-specific paths id: machine_paths continue-on-error: true - uses: melodic-software/ci-workflows/.github/actions/check-machine-paths@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/check-machine-paths@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: # The guardrails plugin bundles a path-detection pattern lib whose # regex bodies self-match this lane's own detector. The autonomy @@ -876,12 +876,12 @@ jobs: - name: Check index-level EOL drift id: eol continue-on-error: true - uses: melodic-software/ci-workflows/.github/actions/check-line-endings@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/check-line-endings@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 - name: Scan comment hygiene id: comment_hygiene continue-on-error: true - uses: melodic-software/ci-workflows/.github/actions/check-comment-markers@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/check-comment-markers@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: # The audit-comment-residue skill IS a code-comment linter: its detector # fixtures and shape library necessarily contain the markers this policy @@ -1273,7 +1273,7 @@ jobs: - name: Lint shell scripts id: shellcheck continue-on-error: true - uses: melodic-software/ci-workflows/.github/actions/shellcheck@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/shellcheck@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: files: ${{ steps.changed_shell.outputs.files }} rcfile: .shellcheckrc @@ -1553,7 +1553,7 @@ jobs: id: marketplace_schema if: needs.select-tests.outputs.run_manifests == 'true' continue-on-error: true - uses: melodic-software/ci-workflows/.github/actions/check-jsonschema@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/check-jsonschema@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: schemafile: https://json.schemastore.org/claude-code-marketplace.json files: .claude-plugin/marketplace.json @@ -1561,7 +1561,7 @@ jobs: id: plugin_schema if: needs.select-tests.outputs.run_manifests == 'true' continue-on-error: true - uses: melodic-software/ci-workflows/.github/actions/check-jsonschema@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/check-jsonschema@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: schemafile: https://json.schemastore.org/claude-code-plugin-manifest.json files: plugins/*/.claude-plugin/plugin.json @@ -1890,7 +1890,7 @@ jobs: - name: Validate every eval set against the bundled schema id: evals_schema continue-on-error: true - uses: melodic-software/ci-workflows/.github/actions/check-jsonschema@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/check-jsonschema@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: schemafile: plugins/skill-quality/reference/evals.schema.json files: plugins/*/skills/*/evals/evals.json @@ -2117,7 +2117,7 @@ jobs: # available to the bash-format contract suites in this same job. It # verifies the install on one small file that sources nothing; the # ShellCheck gate in `lint-shell` is what lints the repository. - uses: melodic-software/ci-workflows/.github/actions/shellcheck@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/shellcheck@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: files: scripts/aggregate-hygiene-results.sh rcfile: .shellcheckrc @@ -2498,7 +2498,7 @@ jobs: statuses: write steps: - name: Check the pull-request contract - uses: melodic-software/ci-workflows/.github/actions/pr-require-checks/check-contract@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/pr-require-checks/check-contract@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: token: ${{ github.token }} # Carried over verbatim from `pr-issue-linkage.yml`, the caller this @@ -2643,7 +2643,7 @@ jobs: # aggregation: the job still fails on the contract step's exit code, and # the `ci-lanes` status is on the SHA for the next contract-only run. if: ${{ !cancelled() }} - uses: melodic-software/ci-workflows/.github/actions/pr-require-checks/aggregate-results@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/pr-require-checks/aggregate-results@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: # Every lane of the needs graph above — the single source of truth # for the lane list — through the ordered-skip check. Adding a lane diff --git a/README.md b/README.md index c55fd2c2c1..18c1c94cb7 100644 --- a/README.md +++ b/README.md @@ -168,7 +168,7 @@ wraps the runnable rows is a later tooling decision, not this record. - **Basis:** the #3522 owner decision (document running the composite's script from a `ci-workflows` checkout). Verified: the script runs standalone and needs only `EXTENSIONS` and `EXCLUDE`. -- **As of:** `ci-workflows` v0.38.2 (`cf316d12b4a14fbdb96a339b7ad00ce935a8cad4`), the pin in +- **As of:** `ci-workflows` v0.38.2 (`6ba73b97b058602c4dd2bb6e2cce234d11011787`), the pin in `.github/workflows/pr-require-checks.yml`. - **Recheck:** the `pr-require-checks.yml` pin moves, or the composite's entry script changes its environment contract. diff --git a/scripts/check-docs-only-gate.sh b/scripts/check-docs-only-gate.sh index c05a943777..ab768f1a4b 100755 --- a/scripts/check-docs-only-gate.sh +++ b/scripts/check-docs-only-gate.sh @@ -998,7 +998,7 @@ is_required() { [[ "$required_closure" == *$'\n'"$1"$'\n'* ]]; } # carry-forward branch on is NOT checked here and is checked nowhere else # either: ci-workflows tests its composite against its own pr-require-checks.yml, not against # this repository's. It was verified by hand at pin -# cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 (v0.38.2), path +# 6ba73b97b058602c4dd2bb6e2cce234d11011787 (v0.38.2), path # .github/actions/pr-require-checks/aggregate-results: its `contract-only` # default is this predicate token for token, the caller passes no # `contract-only`, and run.sh still branches its carry-forward on that input. It From 529eba0e416fd4137e905977e0202790dd67d214 Mon Sep 17 00:00:00 2001 From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com> Date: Wed, 7 Oct 2026 10:04:24 -0400 Subject: [PATCH 2/3] ci: update ci-workflows tag text beside repinned SHA Co-Authored-By: Claude Opus 5.5 --- README.md | 2 +- scripts/check-docs-only-gate.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 18c1c94cb7..0d02f2090e 100644 --- a/README.md +++ b/README.md @@ -168,7 +168,7 @@ wraps the runnable rows is a later tooling decision, not this record. - **Basis:** the #3522 owner decision (document running the composite's script from a `ci-workflows` checkout). Verified: the script runs standalone and needs only `EXTENSIONS` and `EXCLUDE`. -- **As of:** `ci-workflows` v0.38.2 (`6ba73b97b058602c4dd2bb6e2cce234d11011787`), the pin in +- **As of:** `ci-workflows` v0.39.0 (`6ba73b97b058602c4dd2bb6e2cce234d11011787`), the pin in `.github/workflows/pr-require-checks.yml`. - **Recheck:** the `pr-require-checks.yml` pin moves, or the composite's entry script changes its environment contract. diff --git a/scripts/check-docs-only-gate.sh b/scripts/check-docs-only-gate.sh index ab768f1a4b..4836fca869 100755 --- a/scripts/check-docs-only-gate.sh +++ b/scripts/check-docs-only-gate.sh @@ -998,7 +998,7 @@ is_required() { [[ "$required_closure" == *$'\n'"$1"$'\n'* ]]; } # carry-forward branch on is NOT checked here and is checked nowhere else # either: ci-workflows tests its composite against its own pr-require-checks.yml, not against # this repository's. It was verified by hand at pin -# 6ba73b97b058602c4dd2bb6e2cce234d11011787 (v0.38.2), path +# 6ba73b97b058602c4dd2bb6e2cce234d11011787 (v0.39.0), path # .github/actions/pr-require-checks/aggregate-results: its `contract-only` # default is this predicate token for token, the caller passes no # `contract-only`, and run.sh still branches its carry-forward on that input. It From fc0c20b739dbbe63a50021c9ba64dc0d9888192f Mon Sep 17 00:00:00 2001 From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com> Date: Wed, 7 Oct 2026 10:23:07 -0400 Subject: [PATCH 3/3] ci: pin the required check-managed-files job to v0.39.1 v0.39.1 skips a Dependabot PR only when every commit is a verified Dependabot commit, closing the opener-only skip before synced paths are unowned. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/pr-require-checks.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/pr-require-checks.yml b/.github/workflows/pr-require-checks.yml index 940bac8d41..e9b6a854e1 100644 --- a/.github/workflows/pr-require-checks.yml +++ b/.github/workflows/pr-require-checks.yml @@ -2491,7 +2491,7 @@ jobs: # The guard diffs base...head; both commits must be present. fetch-depth: 0 - name: Guard managed files - uses: melodic-software/ci-workflows/.github/actions/check-managed-files@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 + uses: melodic-software/ci-workflows/.github/actions/check-managed-files@c586acc8ea288d728cc7d92f641161eec462fa05 # v0.39.1 ci-status: needs: