ci: repin ci-workflows to v0.39.0

.github/workflows/maintenance-sync-standards.yml

@@ -30,7 +30,7 @@ jobs:
   maintenance-sync-standards:
     # Real runs attest App access for the complete unfiltered manifest before
     # mutation; `targets` limits reconciliation only, never attestation.
-    uses: melodic-software/ci-workflows/.github/workflows/maintenance-sync-standards.yml@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2
+    uses: melodic-software/ci-workflows/.github/workflows/maintenance-sync-standards.yml@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
     with:
       runner: ubuntu-24.04
       # Schedule and push run for real (inputs is empty on those events, so
@@ -40,5 +40,5 @@ jobs:
       dry-run: ${{ inputs.dry-run || false }}
       targets: ${{ inputs.targets || '' }}
     secrets:
-      app-client-id: ${{ secrets.STANDARDS_SYNC_APP_CLIENT_ID }}
-      app-private-key: ${{ secrets.STANDARDS_SYNC_APP_PRIVATE_KEY }}
+      STANDARDS_SYNC_APP_CLIENT_ID: ${{ secrets.STANDARDS_SYNC_APP_CLIENT_ID }}
+      STANDARDS_SYNC_APP_PRIVATE_KEY: ${{ secrets.STANDARDS_SYNC_APP_PRIVATE_KEY }}

.github/workflows/pr-automerge-dependabot.yml

@@ -20,7 +20,7 @@ jobs:
     permissions:
       contents: write # enablePullRequestAutoMerge
       pull-requests: write # enable or disable auto-merge on the PR
-    uses: melodic-software/ci-workflows/.github/workflows/pr-automerge-dependabot.yml@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2
+    uses: melodic-software/ci-workflows/.github/workflows/pr-automerge-dependabot.yml@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
     with:
       # Public repository: runner-policy admits only a hosted label here.
       runner: ubuntu-24.04

.github/workflows/pr-require-checks.yml

@@ -107,7 +107,7 @@ jobs:
           persist-credentials: false
       - name: Lint shell
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/shellcheck@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2
+        uses: melodic-software/ci-workflows/.github/actions/shellcheck@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
         with:
           rcfile: .shellcheckrc
           exclude: components/shellcheck/fixtures/bad
@@ -149,7 +149,7 @@ jobs:
       # the contract tests below run on the repository's .node-version.
       - name: Lint markdown
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/markdownlint@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2
+        uses: melodic-software/ci-workflows/.github/actions/markdownlint@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
         with:
           config: .markdownlint-cli2.jsonc
           globs: '**/*.md !components/**/fixtures/bad/**'
@@ -173,7 +173,7 @@ jobs:
         run: bash harness/shell/run-tests.sh components/markdownlint/markdownlint-schema-pin.test.sh
       - name: Check links (offline)
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/lychee-offline@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2
+        uses: melodic-software/ci-workflows/.github/actions/lychee-offline@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
         with:
           config: lychee.toml
           exclude: 'components/[^/]+/fixtures/bad'
@@ -222,7 +222,7 @@ jobs:
           persist-credentials: false
       - name: Self-lint repository (installs ec, excludes intentionally-bad fixtures)
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/editorconfig-checker@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2
+        uses: melodic-software/ci-workflows/.github/actions/editorconfig-checker@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
         with:
           config: .editorconfig-checker.json
           exclude: 'components/[^/]+/fixtures/bad/'
@@ -231,15 +231,15 @@ jobs:
         run: bash harness/shell/run-tests.sh components/editorconfig-checker/editorconfig-checker.test.sh
       - name: Scan repository for secrets (installs gitleaks)
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/gitleaks@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2
+        uses: melodic-software/ci-workflows/.github/actions/gitleaks@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
         with:
           config: .gitleaks.toml
       - name: Gitleaks contract test
         if: ${{ !cancelled() }}
         run: bash harness/shell/run-tests.sh components/gitleaks/gitleaks.test.sh
       - name: Spell-check repository (installs typos, excludes intentionally-bad fixtures)
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/typos@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2
+        uses: melodic-software/ci-workflows/.github/actions/typos@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
         with:
           config: _typos.toml
           exclude: 'components/*/fixtures/bad/'
@@ -248,21 +248,21 @@ jobs:
         run: bash harness/shell/run-tests.sh components/typos/typos.test.sh
       - name: Verify shebang files are executable
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/check-exec-bit@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2
+        uses: melodic-software/ci-workflows/.github/actions/check-exec-bit@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
       - name: Check for machine-specific paths (excludes the pattern source, which self-matches)
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/check-machine-paths@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2
+        uses: melodic-software/ci-workflows/.github/actions/check-machine-paths@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
         with:
           exclude: ':(exclude)components/path-detection/**'
       - name: Path-detection contract test
         if: ${{ !cancelled() }}
         run: bash harness/shell/run-tests.sh components/path-detection/machine-path-patterns.test.sh
       - name: Check index-level EOL drift
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/check-line-endings@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2
+        uses: melodic-software/ci-workflows/.github/actions/check-line-endings@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
       - name: Scan comment hygiene (excludes contract fixtures and policy source)
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/check-comment-markers@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2
+        uses: melodic-software/ci-workflows/.github/actions/check-comment-markers@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
         with:
           exclude: ':(exclude)components/*/fixtures/bad/** :(exclude)components/comment-hygiene/**'
       - name: Comment-hygiene contract test
@@ -291,7 +291,7 @@ jobs:
           persist-credentials: false
       - name: Analyze PowerShell
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/psscriptanalyzer@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2
+        uses: melodic-software/ci-workflows/.github/actions/psscriptanalyzer@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
         with:
           settings: PSScriptAnalyzerSettings.psd1
           exclude: components/psscriptanalyzer/fixtures/bad
@@ -328,7 +328,7 @@ jobs:
     steps:
       - name: Detect relevant changes
         id: changes
-        uses: melodic-software/ci-workflows/.github/actions/detect-changes@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2
+        uses: melodic-software/ci-workflows/.github/actions/detect-changes@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
         with:
           filters: |
             lefthook:
@@ -427,7 +427,7 @@ jobs:
     steps:
       - name: Detect relevant changes
         id: changes
-        uses: melodic-software/ci-workflows/.github/actions/detect-changes@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2
+        uses: melodic-software/ci-workflows/.github/actions/detect-changes@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
         with:
           filters: |
             python:
@@ -452,7 +452,7 @@ jobs:
       # find the inline-installed tools first on PATH.
       - name: Lint and format-check Python
         if: ${{ !cancelled() && fromJSON(steps.changes.outputs.results || '{}')['python'] != 'false' }}
-        uses: melodic-software/ci-workflows/.github/actions/ruff@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2
+        uses: melodic-software/ci-workflows/.github/actions/ruff@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
         with:
           config: ruff.toml
           exclude: components/ruff/fixtures/bad
@@ -461,7 +461,7 @@ jobs:
         # at the conforming fixture explicitly (the bad fixture is non-conforming
         # by design).
         if: ${{ !cancelled() && fromJSON(steps.changes.outputs.results || '{}')['python'] != 'false' }}
-        uses: melodic-software/ci-workflows/.github/actions/pyright@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2
+        uses: melodic-software/ci-workflows/.github/actions/pyright@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
         with:
           config: components/pyright/pyrightconfig.json
           paths: components/pyright/fixtures/good
@@ -512,7 +512,7 @@ jobs:
         # fixtures are non-conforming by design; node_modules and locks are
         # excluded by Biome's normal traversal rules.
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/biome@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2
+        uses: melodic-software/ci-workflows/.github/actions/biome@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
         with:
           config: components/biome/biome.json
           paths: components/biome/fixtures/good components/concurrency-policy components/dependabot-policy components/github-actions-conventions components/mcp-launcher components/runner-policy distribution harness/packages
@@ -566,7 +566,7 @@ jobs:
     steps:
       - name: Detect relevant changes
         id: changes
-        uses: melodic-software/ci-workflows/.github/actions/detect-changes@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2
+        uses: melodic-software/ci-workflows/.github/actions/detect-changes@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
         with:
           filters: |
             dotnet:
@@ -622,13 +622,13 @@ jobs:
         # conforming fixture, which imports the base props (the bad fixture is
         # non-conforming by design).
         if: ${{ !cancelled() && fromJSON(steps.changes.outputs.results || '{}')['dotnet'] != 'false' }}
-        uses: melodic-software/ci-workflows/.github/actions/dotnet-build@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2
+        uses: melodic-software/ci-workflows/.github/actions/dotnet-build@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
         with:
           dotnet-version: 10.0.400
           project: components/dotnet-analysis/fixtures/good/good.csproj
       - name: Verify .NET whitespace
         if: ${{ !cancelled() && fromJSON(steps.changes.outputs.results || '{}')['dotnet'] != 'false' }}
-        uses: melodic-software/ci-workflows/.github/actions/dotnet-format@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2
+        uses: melodic-software/ci-workflows/.github/actions/dotnet-format@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
         with:
           dotnet-version: 10.0.400
           project: components/dotnet-analysis/fixtures/good/good.csproj
@@ -647,7 +647,7 @@ jobs:
     steps:
       - name: Detect relevant changes
         id: changes
-        uses: melodic-software/ci-workflows/.github/actions/detect-changes@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2
+        uses: melodic-software/ci-workflows/.github/actions/detect-changes@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
         with:
           filters: |
             go:
@@ -854,7 +854,7 @@ jobs:
           persist-credentials: false
       - name: Lint workflows
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/actionlint@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2
+        uses: melodic-software/ci-workflows/.github/actions/actionlint@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
       - name: Test actionlint component
         if: ${{ !cancelled() }}
         run: bash harness/shell/run-tests.sh components/actionlint/actionlint.test.sh
@@ -974,7 +974,7 @@ jobs:
     # components/managed-files-guard/, which become consumers'
     # .github/workflows/ files, are invisible to a repo-root scan. They are named explicitly so the lane audits what it
     # ships.
-    uses: melodic-software/ci-workflows/.github/workflows/pr-audit-workflows.yml@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2
+    uses: melodic-software/ci-workflows/.github/workflows/pr-audit-workflows.yml@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
     with:
       runner: ubuntu-24.04
       paths: . components/claude-lanes/claude-review.yml components/claude-lanes/claude-security-review.yml components/claude-lanes-hosted/claude-review.yml components/claude-lanes-hosted/claude-security-review.yml components/managed-files-guard/managed-files-guard.yml components/managed-files-guard/managed-files-guard-fleet.yml
@@ -987,7 +987,7 @@ jobs:
     # Advisory dependency vuln scan; reports against package-lock.json without
     # blocking (fail-on-vuln defaults false). Annotation mode needs no
     # security-events write grant.
-    uses: melodic-software/ci-workflows/.github/workflows/pr-scan-dependencies.yml@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2
+    uses: melodic-software/ci-workflows/.github/workflows/pr-scan-dependencies.yml@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
     with:
       runner: ubuntu-24.04
 
@@ -1100,7 +1100,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Check the pull-request contract
-        uses: melodic-software/ci-workflows/.github/actions/pr-require-checks/check-contract@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2
+        uses: melodic-software/ci-workflows/.github/actions/pr-require-checks/check-contract@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
         with:
           token: ${{ github.token }}
           # Carried over from the pr-issue-linkage.yml caller this step
@@ -1114,7 +1114,7 @@ jobs:
         # and the `ci-lanes` status is on the SHA for the next contract-only
         # run.
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/pr-require-checks/aggregate-results@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2
+        uses: melodic-software/ci-workflows/.github/actions/pr-require-checks/aggregate-results@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
         with:
           treat-skipped-as: fail
           token: ${{ github.token }}

.github/workflows/pr-review-security.yml

@@ -41,7 +41,7 @@ jobs:
     concurrency:
       group: pr-review-security-${{ github.event.pull_request.number || github.run_id }}
       cancel-in-progress: false
-    uses: melodic-software/ci-workflows/.github/workflows/pr-review-security.yml@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2
+    uses: melodic-software/ci-workflows/.github/workflows/pr-review-security.yml@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
     with:
       # DEVIATION from the component, which names the managed fleet label:
       # this repository is PUBLIC, and runner-policy admits a managed label

.github/workflows/pr-review.yml

@@ -49,7 +49,7 @@ jobs:
       pull-requests: write   # post review + track_progress tracking comment
       id-token: write        # OIDC — mints the Claude GitHub App token (required
                              # even with an OAuth/API-key credential)
-    uses: melodic-software/ci-workflows/.github/workflows/pr-review.yml@cf316d12b4a14fbdb96a339b7ad00ce935a8cad4 # v0.38.2
+    uses: melodic-software/ci-workflows/.github/workflows/pr-review.yml@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
     with:
       # DEVIATION from the component, which names the managed fleet label:
       # this repository is PUBLIC, and runner-policy admits a fleet label only