ci: adopt the ci-workflows#929 ci-status re-run fix

.github/workflows/pr-require-checks.yml

@@ -108,7 +108,7 @@ jobs:
           persist-credentials: false
       - name: Lint shell
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/shellcheck@0691df79a6c0de7f1e49df618ac7b321605563f9 # v0.68.0
+        uses: melodic-software/ci-workflows/.github/actions/shellcheck@94f22d06b68fcfc0e293122c1cbbb6e0eba11ef3 # v0.69.0
         with:
           rcfile: .shellcheckrc
           exclude: components/shellcheck/fixtures/bad
@@ -150,7 +150,7 @@ jobs:
       # the contract tests below run on the repository's .node-version.
       - name: Lint markdown
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/markdownlint@0691df79a6c0de7f1e49df618ac7b321605563f9 # v0.68.0
+        uses: melodic-software/ci-workflows/.github/actions/markdownlint@94f22d06b68fcfc0e293122c1cbbb6e0eba11ef3 # v0.69.0
         with:
           config: .markdownlint-cli2.jsonc
           globs: '**/*.md !components/**/fixtures/bad/**'
@@ -174,7 +174,7 @@ jobs:
         run: bash harness/shell/run-tests.sh components/markdownlint/markdownlint-schema-pin.test.sh
       - name: Check links (offline)
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/lychee-offline@0691df79a6c0de7f1e49df618ac7b321605563f9 # v0.68.0
+        uses: melodic-software/ci-workflows/.github/actions/lychee-offline@94f22d06b68fcfc0e293122c1cbbb6e0eba11ef3 # v0.69.0
         with:
           config: lychee.toml
           exclude: 'components/[^/]+/fixtures/bad'
@@ -222,7 +222,7 @@ jobs:
           persist-credentials: false
       - name: Self-lint repository (installs ec, excludes intentionally-bad fixtures)
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/editorconfig-checker@0691df79a6c0de7f1e49df618ac7b321605563f9 # v0.68.0
+        uses: melodic-software/ci-workflows/.github/actions/editorconfig-checker@94f22d06b68fcfc0e293122c1cbbb6e0eba11ef3 # v0.69.0
         with:
           config: .editorconfig-checker.json
           exclude: 'components/[^/]+/fixtures/bad/'
@@ -231,15 +231,15 @@ jobs:
         run: bash harness/shell/run-tests.sh components/editorconfig-checker/editorconfig-checker.test.sh
       - name: Scan repository for secrets (installs gitleaks)
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/gitleaks@0691df79a6c0de7f1e49df618ac7b321605563f9 # v0.68.0
+        uses: melodic-software/ci-workflows/.github/actions/gitleaks@94f22d06b68fcfc0e293122c1cbbb6e0eba11ef3 # v0.69.0
         with:
           config: .gitleaks.toml
       - name: Gitleaks contract test
         if: ${{ !cancelled() }}
         run: bash harness/shell/run-tests.sh components/gitleaks/gitleaks.test.sh
       - name: Spell-check repository (installs typos, excludes intentionally-bad fixtures)
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/typos@0691df79a6c0de7f1e49df618ac7b321605563f9 # v0.68.0
+        uses: melodic-software/ci-workflows/.github/actions/typos@94f22d06b68fcfc0e293122c1cbbb6e0eba11ef3 # v0.69.0
         with:
           config: _typos.toml
           exclude: 'components/*/fixtures/bad/'
@@ -248,21 +248,21 @@ jobs:
         run: bash harness/shell/run-tests.sh components/typos/typos.test.sh
       - name: Verify shebang files are executable
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/check-exec-bit@0691df79a6c0de7f1e49df618ac7b321605563f9 # v0.68.0
+        uses: melodic-software/ci-workflows/.github/actions/check-exec-bit@94f22d06b68fcfc0e293122c1cbbb6e0eba11ef3 # v0.69.0
       - name: Check for machine-specific paths (excludes the pattern sources, which self-match)
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/check-machine-paths@0691df79a6c0de7f1e49df618ac7b321605563f9 # v0.68.0
+        uses: melodic-software/ci-workflows/.github/actions/check-machine-paths@94f22d06b68fcfc0e293122c1cbbb6e0eba11ef3 # v0.69.0
         with:
           exclude: ':(exclude)components/path-detection/**'
       - name: Path-detection contract test
         if: ${{ !cancelled() }}
         run: bash harness/shell/run-tests.sh components/path-detection/machine-path-patterns.test.sh
       - name: Check index-level EOL drift
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/check-line-endings@0691df79a6c0de7f1e49df618ac7b321605563f9 # v0.68.0
+        uses: melodic-software/ci-workflows/.github/actions/check-line-endings@94f22d06b68fcfc0e293122c1cbbb6e0eba11ef3 # v0.69.0
       - name: Scan comment hygiene (excludes contract fixtures and policy source)
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/check-comment-markers@0691df79a6c0de7f1e49df618ac7b321605563f9 # v0.68.0
+        uses: melodic-software/ci-workflows/.github/actions/check-comment-markers@94f22d06b68fcfc0e293122c1cbbb6e0eba11ef3 # v0.69.0
         with:
           exclude: ':(exclude)components/*/fixtures/bad/** :(exclude)components/comment-hygiene/**'
       - name: Comment-hygiene contract test
@@ -296,7 +296,7 @@ jobs:
           persist-credentials: false
       - name: Analyze PowerShell
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/psscriptanalyzer@0691df79a6c0de7f1e49df618ac7b321605563f9 # v0.68.0
+        uses: melodic-software/ci-workflows/.github/actions/psscriptanalyzer@94f22d06b68fcfc0e293122c1cbbb6e0eba11ef3 # v0.69.0
         with:
           settings: PSScriptAnalyzerSettings.psd1
           exclude: components/psscriptanalyzer/fixtures/bad
@@ -333,7 +333,7 @@ jobs:
     steps:
       - name: Detect relevant changes
         id: changes
-        uses: melodic-software/ci-workflows/.github/actions/detect-changes@0691df79a6c0de7f1e49df618ac7b321605563f9 # v0.68.0
+        uses: melodic-software/ci-workflows/.github/actions/detect-changes@94f22d06b68fcfc0e293122c1cbbb6e0eba11ef3 # v0.69.0
         with:
           filters: |
             lefthook:
@@ -435,7 +435,7 @@ jobs:
     steps:
       - name: Detect relevant changes
         id: changes
-        uses: melodic-software/ci-workflows/.github/actions/detect-changes@0691df79a6c0de7f1e49df618ac7b321605563f9 # v0.68.0
+        uses: melodic-software/ci-workflows/.github/actions/detect-changes@94f22d06b68fcfc0e293122c1cbbb6e0eba11ef3 # v0.69.0
         with:
           filters: |
             python:
@@ -460,7 +460,7 @@ jobs:
       # find the inline-installed tools first on PATH.
       - name: Lint and format-check Python
         if: ${{ !cancelled() && fromJSON(steps.changes.outputs.results || '{}')['python'] != 'false' }}
-        uses: melodic-software/ci-workflows/.github/actions/ruff@0691df79a6c0de7f1e49df618ac7b321605563f9 # v0.68.0
+        uses: melodic-software/ci-workflows/.github/actions/ruff@94f22d06b68fcfc0e293122c1cbbb6e0eba11ef3 # v0.69.0
         with:
           config: ruff.toml
           exclude: components/ruff/fixtures/bad
@@ -469,7 +469,7 @@ jobs:
         # at the conforming fixture explicitly (the bad fixture is non-conforming
         # by design).
         if: ${{ !cancelled() && fromJSON(steps.changes.outputs.results || '{}')['python'] != 'false' }}
-        uses: melodic-software/ci-workflows/.github/actions/pyright@0691df79a6c0de7f1e49df618ac7b321605563f9 # v0.68.0
+        uses: melodic-software/ci-workflows/.github/actions/pyright@94f22d06b68fcfc0e293122c1cbbb6e0eba11ef3 # v0.69.0
         with:
           config: components/pyright/pyrightconfig.json
           paths: components/pyright/fixtures/good
@@ -520,7 +520,7 @@ jobs:
         # fixtures are non-conforming by design; node_modules and locks are
         # excluded by Biome's normal traversal rules.
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/biome@0691df79a6c0de7f1e49df618ac7b321605563f9 # v0.68.0
+        uses: melodic-software/ci-workflows/.github/actions/biome@94f22d06b68fcfc0e293122c1cbbb6e0eba11ef3 # v0.69.0
         with:
           config: biome.jsonc
           paths: components/biome/fixtures/good components/concurrency-policy components/dependabot-policy components/github-actions-conventions components/mcp-launcher components/runner-policy distribution harness/packages
@@ -574,7 +574,7 @@ jobs:
     steps:
       - name: Detect relevant changes
         id: changes
-        uses: melodic-software/ci-workflows/.github/actions/detect-changes@0691df79a6c0de7f1e49df618ac7b321605563f9 # v0.68.0
+        uses: melodic-software/ci-workflows/.github/actions/detect-changes@94f22d06b68fcfc0e293122c1cbbb6e0eba11ef3 # v0.69.0
         with:
           filters: |
             dotnet:
@@ -630,13 +630,13 @@ jobs:
         # conforming fixture, which imports the base props (the bad fixture is
         # non-conforming by design).
         if: ${{ !cancelled() && fromJSON(steps.changes.outputs.results || '{}')['dotnet'] != 'false' }}
-        uses: melodic-software/ci-workflows/.github/actions/dotnet-build@0691df79a6c0de7f1e49df618ac7b321605563f9 # v0.68.0
+        uses: melodic-software/ci-workflows/.github/actions/dotnet-build@94f22d06b68fcfc0e293122c1cbbb6e0eba11ef3 # v0.69.0
         with:
           dotnet-version: 10.0.400
           project: components/dotnet-analysis/fixtures/good/good.csproj
       - name: Verify .NET whitespace
         if: ${{ !cancelled() && fromJSON(steps.changes.outputs.results || '{}')['dotnet'] != 'false' }}
-        uses: melodic-software/ci-workflows/.github/actions/dotnet-format@0691df79a6c0de7f1e49df618ac7b321605563f9 # v0.68.0
+        uses: melodic-software/ci-workflows/.github/actions/dotnet-format@94f22d06b68fcfc0e293122c1cbbb6e0eba11ef3 # v0.69.0
         with:
           dotnet-version: 10.0.400
           project: components/dotnet-analysis/fixtures/good/good.csproj
@@ -655,7 +655,7 @@ jobs:
     steps:
       - name: Detect relevant changes
         id: changes
-        uses: melodic-software/ci-workflows/.github/actions/detect-changes@0691df79a6c0de7f1e49df618ac7b321605563f9 # v0.68.0
+        uses: melodic-software/ci-workflows/.github/actions/detect-changes@94f22d06b68fcfc0e293122c1cbbb6e0eba11ef3 # v0.69.0
         with:
           filters: |
             go:
@@ -847,7 +847,7 @@ jobs:
           persist-credentials: false
       - name: Lint workflows
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/actionlint@0691df79a6c0de7f1e49df618ac7b321605563f9 # v0.68.0
+        uses: melodic-software/ci-workflows/.github/actions/actionlint@94f22d06b68fcfc0e293122c1cbbb6e0eba11ef3 # v0.69.0
       - name: Test actionlint component
         if: ${{ !cancelled() }}
         run: bash harness/shell/run-tests.sh components/actionlint/actionlint.test.sh
@@ -1068,13 +1068,14 @@ jobs:
       - test-cloud-environment
       - test-distribution
     runs-on: ubuntu-24.04
-    # No run waits for another: with `yield-to-full-run` a contract-only run
-    # lists in-flight runs once and reads the status once, and a full run's
-    # ci-status runs after its lanes, so either finishes in seconds.
-    timeout-minutes: 3
+    # No run waits for another, so either run finishes in seconds. The bound
+    # covers the action's worst case when the jobs API lags: a 120 s own-job
+    # lookup plus a 30 s writer wait is about 337 s, and a job that times out
+    # ends `cancelled`, which counts as red.
+    timeout-minutes: 8
     steps:
       - name: Check the pull-request contract
-        uses: melodic-software/ci-workflows/.github/actions/pr-require-checks/check-contract@0691df79a6c0de7f1e49df618ac7b321605563f9 # v0.68.0
+        uses: melodic-software/ci-workflows/.github/actions/pr-require-checks/check-contract@94f22d06b68fcfc0e293122c1cbbb6e0eba11ef3 # v0.69.0
         with:
           token: ${{ github.token }}
           # Carried over from the pr-issue-linkage.yml caller this step
@@ -1088,9 +1089,10 @@ jobs:
         # and the `ci-lanes` status is on the SHA for the next contract-only
         # run.
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/pr-require-checks/aggregate-results@0691df79a6c0de7f1e49df618ac7b321605563f9 # v0.68.0
+        uses: melodic-software/ci-workflows/.github/actions/pr-require-checks/aggregate-results@94f22d06b68fcfc0e293122c1cbbb6e0eba11ef3 # v0.69.0
         with:
           treat-skipped-as: fail
+          step-name: Aggregate lane results
           token: ${{ github.token }}
           # A contract-only run never waits: while a full run on the SHA is in
           # flight it fails with "superseded by full run <url>", and that run's

components/managed-files-guard/managed-files-guard-fleet.yml

@@ -128,7 +128,7 @@ jobs:
       - name: Guard managed files
         # The org requires actions pinned to a full commit SHA (reusable
         # workflows may float on main); this pin moves by hand.
-        uses: melodic-software/ci-workflows/.github/actions/check-managed-files@0691df79a6c0de7f1e49df618ac7b321605563f9 # v0.68.0
+        uses: melodic-software/ci-workflows/.github/actions/check-managed-files@94f22d06b68fcfc0e293122c1cbbb6e0eba11ef3 # v0.69.0
         with:
           # `main` for the soak, per the action's own input contract ("Pin to
           # a full SHA in callers once soak completes"): the guard must read

components/managed-files-guard/managed-files-guard.yml

@@ -113,7 +113,7 @@ jobs:
       - name: Guard managed files
         # The org requires actions pinned to a full commit SHA (reusable
         # workflows may float on main); this pin moves by hand.
-        uses: melodic-software/ci-workflows/.github/actions/check-managed-files@0691df79a6c0de7f1e49df618ac7b321605563f9 # v0.68.0
+        uses: melodic-software/ci-workflows/.github/actions/check-managed-files@94f22d06b68fcfc0e293122c1cbbb6e0eba11ef3 # v0.69.0
         with:
           # `main` for the soak, per the action's own input contract ("Pin to
           # a full SHA in callers once soak completes"): the guard must read