From f8193b79f996bd6b2d0cd1178ad73f35ac12e175 Mon Sep 17 00:00:00 2001 From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com> Date: Wed, 7 Oct 2026 09:44:44 -0400 Subject: [PATCH] ci: repin ci-workflows to v0.39.0 Co-Authored-By: Claude Opus 5.5 --- .../workflows/maintenance-sync-standards.yml | 6 +-- .github/workflows/pr-automerge-dependabot.yml | 2 +- .github/workflows/pr-require-checks.yml | 50 +++++++++---------- .github/workflows/pr-review-security.yml | 2 +- .github/workflows/pr-review.yml | 2 +- 5 files changed, 31 insertions(+), 31 deletions(-) diff --git a/.github/workflows/maintenance-sync-standards.yml b/.github/workflows/maintenance-sync-standards.yml index 15c20c6d..4ee94fcc 100644 --- a/.github/workflows/maintenance-sync-standards.yml +++ b/.github/workflows/maintenance-sync-standards.yml @@ -30,7 +30,7 @@ jobs: maintenance-sync-standards: # Real runs attest App access for the complete unfiltered manifest before # mutation; `targets` limits reconciliation only, never attestation. - uses: melodic-software/ci-workflows/.github/workflows/maintenance-sync-standards.yml@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/workflows/maintenance-sync-standards.yml@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: runner: ubuntu-24.04 # Schedule and push run for real (inputs is empty on those events, so @@ -40,5 +40,5 @@ jobs: dry-run: ${{ inputs.dry-run || false }} targets: ${{ inputs.targets || '' }} secrets: - app-client-id: ${{ secrets.STANDARDS_SYNC_APP_CLIENT_ID }} - app-private-key: ${{ secrets.STANDARDS_SYNC_APP_PRIVATE_KEY }} + STANDARDS_SYNC_APP_CLIENT_ID: ${{ secrets.STANDARDS_SYNC_APP_CLIENT_ID }} + STANDARDS_SYNC_APP_PRIVATE_KEY: ${{ secrets.STANDARDS_SYNC_APP_PRIVATE_KEY }} diff --git a/.github/workflows/pr-automerge-dependabot.yml b/.github/workflows/pr-automerge-dependabot.yml index 53ba127a..cceeea02 100644 --- a/.github/workflows/pr-automerge-dependabot.yml +++ b/.github/workflows/pr-automerge-dependabot.yml @@ -20,7 +20,7 @@ jobs: permissions: contents: write # enablePullRequestAutoMerge pull-requests: write # enable or disable auto-merge on the PR - uses: melodic-software/ci-workflows/.github/workflows/pr-automerge-dependabot.yml@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/workflows/pr-automerge-dependabot.yml@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: # Public repository: runner-policy admits only a hosted label here. runner: ubuntu-24.04 diff --git a/.github/workflows/pr-require-checks.yml b/.github/workflows/pr-require-checks.yml index 0e1e2fca..59acfda0 100644 --- a/.github/workflows/pr-require-checks.yml +++ b/.github/workflows/pr-require-checks.yml @@ -107,7 +107,7 @@ jobs: persist-credentials: false - name: Lint shell if: ${{ !cancelled() }} - uses: melodic-software/ci-workflows/.github/actions/shellcheck@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/shellcheck@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: rcfile: .shellcheckrc exclude: components/shellcheck/fixtures/bad @@ -149,7 +149,7 @@ jobs: # the contract tests below run on the repository's .node-version. - name: Lint markdown if: ${{ !cancelled() }} - uses: melodic-software/ci-workflows/.github/actions/markdownlint@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/markdownlint@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: config: .markdownlint-cli2.jsonc globs: '**/*.md !components/**/fixtures/bad/**' @@ -173,7 +173,7 @@ jobs: run: bash harness/shell/run-tests.sh components/markdownlint/markdownlint-schema-pin.test.sh - name: Check links (offline) if: ${{ !cancelled() }} - uses: melodic-software/ci-workflows/.github/actions/lychee-offline@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/lychee-offline@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: config: lychee.toml exclude: 'components/[^/]+/fixtures/bad' @@ -222,7 +222,7 @@ jobs: persist-credentials: false - name: Self-lint repository (installs ec, excludes intentionally-bad fixtures) if: ${{ !cancelled() }} - uses: melodic-software/ci-workflows/.github/actions/editorconfig-checker@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/editorconfig-checker@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: config: .editorconfig-checker.json exclude: 'components/[^/]+/fixtures/bad/' @@ -231,7 +231,7 @@ jobs: run: bash harness/shell/run-tests.sh components/editorconfig-checker/editorconfig-checker.test.sh - name: Scan repository for secrets (installs gitleaks) if: ${{ !cancelled() }} - uses: melodic-software/ci-workflows/.github/actions/gitleaks@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/gitleaks@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: config: .gitleaks.toml - name: Gitleaks contract test @@ -239,7 +239,7 @@ jobs: run: bash harness/shell/run-tests.sh components/gitleaks/gitleaks.test.sh - name: Spell-check repository (installs typos, excludes intentionally-bad fixtures) if: ${{ !cancelled() }} - uses: melodic-software/ci-workflows/.github/actions/typos@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/typos@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: config: _typos.toml exclude: 'components/*/fixtures/bad/' @@ -248,10 +248,10 @@ jobs: run: bash harness/shell/run-tests.sh components/typos/typos.test.sh - name: Verify shebang files are executable if: ${{ !cancelled() }} - uses: melodic-software/ci-workflows/.github/actions/check-exec-bit@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/check-exec-bit@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 - name: Check for machine-specific paths (excludes the pattern source, which self-matches) if: ${{ !cancelled() }} - uses: melodic-software/ci-workflows/.github/actions/check-machine-paths@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/check-machine-paths@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: exclude: ':(exclude)components/path-detection/**' - name: Path-detection contract test @@ -259,10 +259,10 @@ jobs: run: bash harness/shell/run-tests.sh components/path-detection/machine-path-patterns.test.sh - name: Check index-level EOL drift if: ${{ !cancelled() }} - uses: melodic-software/ci-workflows/.github/actions/check-line-endings@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/check-line-endings@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 - name: Scan comment hygiene (excludes contract fixtures and policy source) if: ${{ !cancelled() }} - uses: melodic-software/ci-workflows/.github/actions/check-comment-markers@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/check-comment-markers@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: exclude: ':(exclude)components/*/fixtures/bad/** :(exclude)components/comment-hygiene/**' - name: Comment-hygiene contract test @@ -291,7 +291,7 @@ jobs: persist-credentials: false - name: Analyze PowerShell if: ${{ !cancelled() }} - uses: melodic-software/ci-workflows/.github/actions/psscriptanalyzer@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/psscriptanalyzer@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: settings: PSScriptAnalyzerSettings.psd1 exclude: components/psscriptanalyzer/fixtures/bad @@ -328,7 +328,7 @@ jobs: steps: - name: Detect relevant changes id: changes - uses: melodic-software/ci-workflows/.github/actions/detect-changes@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/detect-changes@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: filters: | lefthook: @@ -427,7 +427,7 @@ jobs: steps: - name: Detect relevant changes id: changes - uses: melodic-software/ci-workflows/.github/actions/detect-changes@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/detect-changes@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: filters: | python: @@ -452,7 +452,7 @@ jobs: # find the inline-installed tools first on PATH. - name: Lint and format-check Python if: ${{ !cancelled() && fromJSON(steps.changes.outputs.results || '{}')['python'] != 'false' }} - uses: melodic-software/ci-workflows/.github/actions/ruff@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/ruff@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: config: ruff.toml exclude: components/ruff/fixtures/bad @@ -461,7 +461,7 @@ jobs: # at the conforming fixture explicitly (the bad fixture is non-conforming # by design). if: ${{ !cancelled() && fromJSON(steps.changes.outputs.results || '{}')['python'] != 'false' }} - uses: melodic-software/ci-workflows/.github/actions/pyright@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/pyright@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: config: components/pyright/pyrightconfig.json paths: components/pyright/fixtures/good @@ -512,7 +512,7 @@ jobs: # fixtures are non-conforming by design; node_modules and locks are # excluded by Biome's normal traversal rules. if: ${{ !cancelled() }} - uses: melodic-software/ci-workflows/.github/actions/biome@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/biome@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: config: components/biome/biome.json paths: components/biome/fixtures/good components/concurrency-policy components/dependabot-policy components/github-actions-conventions components/mcp-launcher components/runner-policy distribution harness/packages @@ -566,7 +566,7 @@ jobs: steps: - name: Detect relevant changes id: changes - uses: melodic-software/ci-workflows/.github/actions/detect-changes@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/detect-changes@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: filters: | dotnet: @@ -622,13 +622,13 @@ jobs: # conforming fixture, which imports the base props (the bad fixture is # non-conforming by design). if: ${{ !cancelled() && fromJSON(steps.changes.outputs.results || '{}')['dotnet'] != 'false' }} - uses: melodic-software/ci-workflows/.github/actions/dotnet-build@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/dotnet-build@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: dotnet-version: 10.0.400 project: components/dotnet-analysis/fixtures/good/good.csproj - name: Verify .NET whitespace if: ${{ !cancelled() && fromJSON(steps.changes.outputs.results || '{}')['dotnet'] != 'false' }} - uses: melodic-software/ci-workflows/.github/actions/dotnet-format@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/dotnet-format@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: dotnet-version: 10.0.400 project: components/dotnet-analysis/fixtures/good/good.csproj @@ -647,7 +647,7 @@ jobs: steps: - name: Detect relevant changes id: changes - uses: melodic-software/ci-workflows/.github/actions/detect-changes@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/detect-changes@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: filters: | go: @@ -854,7 +854,7 @@ jobs: persist-credentials: false - name: Lint workflows if: ${{ !cancelled() }} - uses: melodic-software/ci-workflows/.github/actions/actionlint@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/actionlint@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 - name: Test actionlint component if: ${{ !cancelled() }} run: bash harness/shell/run-tests.sh components/actionlint/actionlint.test.sh @@ -974,7 +974,7 @@ jobs: # components/managed-files-guard/, which become consumers' # .github/workflows/ files, are invisible to a repo-root scan. They are named explicitly so the lane audits what it # ships. - uses: melodic-software/ci-workflows/.github/workflows/pr-audit-workflows.yml@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/workflows/pr-audit-workflows.yml@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: runner: ubuntu-24.04 paths: . components/claude-lanes/claude-review.yml components/claude-lanes/claude-security-review.yml components/claude-lanes-hosted/claude-review.yml components/claude-lanes-hosted/claude-security-review.yml components/managed-files-guard/managed-files-guard.yml components/managed-files-guard/managed-files-guard-fleet.yml @@ -987,7 +987,7 @@ jobs: # Advisory dependency vuln scan; reports against package-lock.json without # blocking (fail-on-vuln defaults false). Annotation mode needs no # security-events write grant. - uses: melodic-software/ci-workflows/.github/workflows/pr-scan-dependencies.yml@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/workflows/pr-scan-dependencies.yml@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: runner: ubuntu-24.04 @@ -1100,7 +1100,7 @@ jobs: timeout-minutes: 15 steps: - name: Check the pull-request contract - uses: melodic-software/ci-workflows/.github/actions/pr-require-checks/check-contract@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/pr-require-checks/check-contract@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: token: ${{ github.token }} # Carried over from the pr-issue-linkage.yml caller this step @@ -1114,7 +1114,7 @@ jobs: # and the `ci-lanes` status is on the SHA for the next contract-only # run. if: ${{ !cancelled() }} - uses: melodic-software/ci-workflows/.github/actions/pr-require-checks/aggregate-results@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/actions/pr-require-checks/aggregate-results@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: treat-skipped-as: fail token: ${{ github.token }} diff --git a/.github/workflows/pr-review-security.yml b/.github/workflows/pr-review-security.yml index 18b1ffdd..675f5430 100644 --- a/.github/workflows/pr-review-security.yml +++ b/.github/workflows/pr-review-security.yml @@ -41,7 +41,7 @@ jobs: concurrency: group: pr-review-security-${{ github.event.pull_request.number || github.run_id }} cancel-in-progress: false - uses: melodic-software/ci-workflows/.github/workflows/pr-review-security.yml@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/workflows/pr-review-security.yml@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: # DEVIATION from the component, which names the managed fleet label: # this repository is PUBLIC, and runner-policy admits a managed label diff --git a/.github/workflows/pr-review.yml b/.github/workflows/pr-review.yml index 82d25807..805e4905 100644 --- a/.github/workflows/pr-review.yml +++ b/.github/workflows/pr-review.yml @@ -49,7 +49,7 @@ jobs: pull-requests: write # post review + track_progress tracking comment id-token: write # OIDC — mints the Claude GitHub App token (required # even with an OAuth/API-key credential) - uses: melodic-software/ci-workflows/.github/workflows/pr-review.yml@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2 + uses: melodic-software/ci-workflows/.github/workflows/pr-review.yml@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0 with: # DEVIATION from the component, which names the managed fleet label: # this repository is PUBLIC, and runner-policy admits a fleet label only