ci: repin ci-workflows to v0.39.0

.github/workflows/intake-label-needs-triage.yml

@@ -17,7 +17,7 @@ jobs:
   intake-label-needs-triage:
     permissions:
       issues: write # passed to the reusable, which reads and adds issue labels
-    uses: melodic-software/ci-workflows/.github/workflows/intake-label-needs-triage.yml@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2
+    uses: melodic-software/ci-workflows/.github/workflows/intake-label-needs-triage.yml@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
     with:
       runner: ubuntu-24.04
       label: needs-triage

.github/workflows/intake-triage.yml

@@ -24,7 +24,7 @@ jobs:
     concurrency:
       group: intake-triage-${{ github.event.issue.number || github.run_id }}
       cancel-in-progress: false
-    uses: melodic-software/ci-workflows/.github/workflows/intake-triage.yml@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2
+    uses: melodic-software/ci-workflows/.github/workflows/intake-triage.yml@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
     with:
       runner: ubuntu-24.04
     secrets:

.github/workflows/maintenance-audit-test-selection.yml

@@ -76,7 +76,7 @@ jobs:
             .github/requirements-ci.txt
             .github/requirements-ci-animation.txt
       - name: Install and verify ShellCheck toolchain
-        uses: melodic-software/ci-workflows/.github/actions/shellcheck@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2
+        uses: melodic-software/ci-workflows/.github/actions/shellcheck@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
         with:
           paths: plugins/bash-format
           rcfile: .shellcheckrc

.github/workflows/pr-automerge-dependabot.yml

@@ -23,6 +23,6 @@ jobs:
     permissions:
       contents: write # enablePullRequestAutoMerge requires it.
       pull-requests: write # Arm or disarm auto-merge on the PR.
-    uses: melodic-software/ci-workflows/.github/workflows/pr-automerge-dependabot.yml@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2
+    uses: melodic-software/ci-workflows/.github/workflows/pr-automerge-dependabot.yml@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
     with:
       runner: ubuntu-24.04

.github/workflows/pr-require-checks.yml

@@ -307,7 +307,7 @@ jobs:
       - name: Match the changed files against the filter groups
         id: match
         continue-on-error: true
-        uses: melodic-software/ci-workflows/.github/actions/detect-changes@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2
+        uses: melodic-software/ci-workflows/.github/actions/detect-changes@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
         with:
           filters: |
             shell:
@@ -757,19 +757,19 @@ jobs:
           path: |
             ~/.npm/_npx
             ~/.npm/_cacache
-          key: npx-markdownlint-cli2-${{ runner.os }}-cf316d12b4a14fbdb96a339b7ad00ce935a8cad4
+          key: npx-markdownlint-cli2-${{ runner.os }}-6ba73b97b058602c4dd2bb6e2cce234d11011787
       - name: Lint markdown
         id: markdown
         continue-on-error: true
-        uses: melodic-software/ci-workflows/.github/actions/markdownlint@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2
+        uses: melodic-software/ci-workflows/.github/actions/markdownlint@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
         with:
           config: .markdownlint-cli2.jsonc
           globs: ${{ steps.changed_md.outputs.globs }}
 
       - name: Spell-check
         id: typos
         continue-on-error: true
-        uses: melodic-software/ci-workflows/.github/actions/typos@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2
+        uses: melodic-software/ci-workflows/.github/actions/typos@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
         with:
           config: _typos.toml
           # A pack's vendored baseline is replaced verbatim from upstream by its
@@ -791,15 +791,15 @@ jobs:
       - name: Scan for secrets
         id: gitleaks
         continue-on-error: true
-        uses: melodic-software/ci-workflows/.github/actions/gitleaks@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2
+        uses: melodic-software/ci-workflows/.github/actions/gitleaks@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
         with:
           config: .gitleaks.toml
           scan-mode: git
 
       - name: Check editorconfig conformance
         id: editorconfig
         continue-on-error: true
-        uses: melodic-software/ci-workflows/.github/actions/editorconfig-checker@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2
+        uses: melodic-software/ci-workflows/.github/actions/editorconfig-checker@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
         with:
           config: .editorconfig-checker.json
 
@@ -813,21 +813,21 @@ jobs:
         id: actionlint
         if: needs.select-tests.outputs.run_workflows == 'true'
         continue-on-error: true
-        uses: melodic-software/ci-workflows/.github/actions/actionlint@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2
+        uses: melodic-software/ci-workflows/.github/actions/actionlint@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
 
       - name: Validate dependabot.yml
         id: dependabot_schema
         if: needs.select-tests.outputs.run_workflows == 'true'
         continue-on-error: true
-        uses: melodic-software/ci-workflows/.github/actions/check-jsonschema@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2
+        uses: melodic-software/ci-workflows/.github/actions/check-jsonschema@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
         with:
           builtin-schema: vendor.dependabot
           files: .github/dependabot.yml
       - name: Validate workflows
         id: workflow_schema
         if: needs.select-tests.outputs.run_workflows == 'true'
         continue-on-error: true
-        uses: melodic-software/ci-workflows/.github/actions/check-jsonschema@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2
+        uses: melodic-software/ci-workflows/.github/actions/check-jsonschema@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
         with:
           builtin-schema: vendor.github-workflows
           files: >-
@@ -840,12 +840,12 @@ jobs:
       - name: Verify shebang files are executable
         id: exec_bit
         continue-on-error: true
-        uses: melodic-software/ci-workflows/.github/actions/check-exec-bit@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2
+        uses: melodic-software/ci-workflows/.github/actions/check-exec-bit@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
 
       - name: Check for machine-specific paths
         id: machine_paths
         continue-on-error: true
-        uses: melodic-software/ci-workflows/.github/actions/check-machine-paths@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2
+        uses: melodic-software/ci-workflows/.github/actions/check-machine-paths@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
         with:
           # The guardrails plugin bundles a path-detection pattern lib whose
           # regex bodies self-match this lane's own detector. The autonomy
@@ -878,12 +878,12 @@ jobs:
       - name: Check index-level EOL drift
         id: eol
         continue-on-error: true
-        uses: melodic-software/ci-workflows/.github/actions/check-line-endings@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2
+        uses: melodic-software/ci-workflows/.github/actions/check-line-endings@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
 
       - name: Scan comment hygiene
         id: comment_hygiene
         continue-on-error: true
-        uses: melodic-software/ci-workflows/.github/actions/check-comment-markers@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2
+        uses: melodic-software/ci-workflows/.github/actions/check-comment-markers@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
         with:
           # The audit-comment-residue skill IS a code-comment linter: its detector
           # fixtures and shape library necessarily contain the markers this policy
@@ -1275,7 +1275,7 @@ jobs:
       - name: Lint shell scripts
         id: shellcheck
         continue-on-error: true
-        uses: melodic-software/ci-workflows/.github/actions/shellcheck@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2
+        uses: melodic-software/ci-workflows/.github/actions/shellcheck@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
         with:
           files: ${{ steps.changed_shell.outputs.files }}
           rcfile: .shellcheckrc
@@ -1555,15 +1555,15 @@ jobs:
         id: marketplace_schema
         if: needs.select-tests.outputs.run_manifests == 'true'
         continue-on-error: true
-        uses: melodic-software/ci-workflows/.github/actions/check-jsonschema@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2
+        uses: melodic-software/ci-workflows/.github/actions/check-jsonschema@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
         with:
           schemafile: https://json.schemastore.org/claude-code-marketplace.json
           files: .claude-plugin/marketplace.json
       - name: Validate plugin manifests
         id: plugin_schema
         if: needs.select-tests.outputs.run_manifests == 'true'
         continue-on-error: true
-        uses: melodic-software/ci-workflows/.github/actions/check-jsonschema@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2
+        uses: melodic-software/ci-workflows/.github/actions/check-jsonschema@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
         with:
           schemafile: https://json.schemastore.org/claude-code-plugin-manifest.json
           files: plugins/*/.claude-plugin/plugin.json
@@ -1892,7 +1892,7 @@ jobs:
       - name: Validate every eval set against the bundled schema
         id: evals_schema
         continue-on-error: true
-        uses: melodic-software/ci-workflows/.github/actions/check-jsonschema@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2
+        uses: melodic-software/ci-workflows/.github/actions/check-jsonschema@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
         with:
           schemafile: plugins/skill-quality/reference/evals.schema.json
           files: plugins/*/skills/*/evals/evals.json
@@ -2119,7 +2119,7 @@ jobs:
         # available to the bash-format contract suites in this same job. It
         # verifies the install on one small file that sources nothing; the
         # ShellCheck gate in `lint-shell` is what lints the repository.
-        uses: melodic-software/ci-workflows/.github/actions/shellcheck@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2
+        uses: melodic-software/ci-workflows/.github/actions/shellcheck@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
         with:
           files: scripts/aggregate-hygiene-results.sh
           rcfile: .shellcheckrc
@@ -2491,7 +2491,7 @@ jobs:
           # The guard diffs base...head; both commits must be present.
           fetch-depth: 0
       - name: Guard managed files
-        uses: melodic-software/ci-workflows/.github/actions/check-managed-files@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
+        uses: melodic-software/ci-workflows/.github/actions/check-managed-files@c586acc8ea288d728cc7d92f641161eec462fa05 # v0.39.1
 
   ci-status:
     needs:
@@ -2532,7 +2532,7 @@ jobs:
       statuses: write
     steps:
       - name: Check the pull-request contract
-        uses: melodic-software/ci-workflows/.github/actions/pr-require-checks/check-contract@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2
+        uses: melodic-software/ci-workflows/.github/actions/pr-require-checks/check-contract@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
         with:
           token: ${{ github.token }}
           # Carried over verbatim from `pr-issue-linkage.yml`, the caller this
@@ -2677,7 +2677,7 @@ jobs:
         # aggregation: the job still fails on the contract step's exit code, and
         # the `ci-lanes` status is on the SHA for the next contract-only run.
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/pr-require-checks/aggregate-results@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2
+        uses: melodic-software/ci-workflows/.github/actions/pr-require-checks/aggregate-results@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
         with:
           # Every lane of the needs graph above — the single source of truth
           # for the lane list — through the ordered-skip check. Adding a lane

README.md

@@ -168,7 +168,7 @@ wraps the runnable rows is a later tooling decision, not this record.
 - **Basis:** the #3522 owner decision (document running the composite's script from a
   `ci-workflows` checkout). Verified: the script runs standalone and needs only `EXTENSIONS` and
   `EXCLUDE`.
-- **As of:** `ci-workflows` v0.38.2 (`cf316d12b4a14fbdb96a339b7ad00ce935a8cad4`), the pin in
+- **As of:** `ci-workflows` v0.39.0 (`6ba73b97b058602c4dd2bb6e2cce234d11011787`), the pin in
   `.github/workflows/pr-require-checks.yml`.
 - **Recheck:** the `pr-require-checks.yml` pin moves, or the composite's entry script changes its environment
   contract.

scripts/check-docs-only-gate.sh

@@ -998,7 +998,7 @@ is_required() { [[ "$required_closure" == *$'\n'"$1"$'\n'* ]]; }
 # carry-forward branch on is NOT checked here and is checked nowhere else
 # either: ci-workflows tests its composite against its own pr-require-checks.yml, not against
 # this repository's. It was verified by hand at pin
-# cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 (v0.38.2), path
+# 6ba73b97b058602c4dd2bb6e2cce234d11011787 (v0.39.0), path
 # .github/actions/pr-require-checks/aggregate-results: its `contract-only`
 # default is this predicate token for token, the caller passes no
 # `contract-only`, and run.sh still branches its carry-forward on that input. It