Key merge-bot concurrency on PR number, not github.ref by ptr727 · Pull Request #206 · ptr727/ProjectTemplate

ptr727 · 2026-06-24T05:34:22Z

Surfaced by Copilot during the NxWitness re-sync (#448) — a real regression from the pull_request_target switch (#201).

Under pull_request_target, github.ref resolves to the base branch, so the merge-bot concurrency group …-${{ github.ref }} serialized every bot PR against a base into one queue — delaying auto-merge/disable when multiple Dependabot/codegen PRs are open. Keying on github.event.pull_request.number restores per-PR scoping (a PR's events still process in arrival order; different PRs run concurrently).

🤖 Generated with Claude Code

The pull_request_target switch (#201) changed github.ref from the PR merge ref to the base branch, so the concurrency group serialized every bot PR against a base into one queue - delaying auto-merge/disable when multiple Dependabot/codegen PRs are open. Key on github.event.pull_request.number so each PR's events still process in arrival order while different PRs run concurrently. Surfaced by Copilot on the NxWitness re-sync (#448). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Re-pull the upstream fix (ptr727/ProjectTemplate#206): pull_request_target makes github.ref the base branch, so the group serialized all bot PRs against a base. Key on github.event.pull_request.number for per-PR scoping.

Copilot

Pull request overview

This PR fixes an Actions concurrency regression in the merge-bot workflow introduced by using pull_request_target, where github.ref points at the base branch and unintentionally serialized all bot PR events targeting the same base branch.

Changes:

Change the workflow concurrency group key from ${{ github.ref }} to ${{ github.event.pull_request.number }} to scope concurrency per PR (while preserving cancel-in-progress: false).
Update the workflow comment to document why PR-number scoping is required under pull_request_target.

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

…eadme, carry-whole-file (#207) Phase-0 of the template-to-downstream convergence sweep: the template absorbs everything downstream repos had reinvented, so derived repos can take the carried artifacts verbatim with zero hand-rolling. Builds on #205 (orchestration personas) and #206 (per-PR merge-bot concurrency), which this branch incorporates. Held for end-gate review; not to be merged midway. ## What this PR does - **Absorbs downstream-led action pins** (template now leads per #204): `dependabot/fetch-metadata` v2.5.0 -> v3.1.0 and `softprops/action-gh-release` v2.6.2 -> v3.0.1, the SHAs the downstreams already run. - **Generalizes the release model + adds a loud guard.** Every release is a tag on the built commit plus an auto source zip, README, and LICENSE; targets amend it by uploading `release-asset-<branch>-*` artifacts (binaries/packages) or pushing elsewhere (image/registry). `github-release` collects assets by the `release-asset-<branch>-*` pattern so the job is target-agnostic and carries verbatim. - **Makes the Docker README + date badge main-only, caller-gated.** Neither has per-branch context, so both move out of the publisher branch matrix into single jobs gated on `main` being published. `publish-docker-readme-task.yml` is rebuilt generic: a matrix over a `repositories` input (or a manifest-derived list), a caller-passed `ref`, and an optional transform step (e.g. m4) to render the README before pushing. - **Adopts the carry-whole-file rule.** Replaces "drop the sections you don't ship": derived repos carry each shared file in full (an inert `[*.cs]` block or unused-language `CODESTYLE.md` section costs nothing), so every re-sync is a clean overwrite, not a partial merge. `CODESTYLE.md` is genericized into a self-contained drop-in (no demo-project names, no template-onboarding pointers) and carries both the .NET and Python sections whole. Only per-language `.vscode/tasks.json` task definitions still track the repo's language. All carried files stay self-contained (no template/demo/cross-project references except the sanctioned upstream-drift pointer). Workflow YAML and Markdown remain CRLF per the line-ending governance. Validated with actionlint and markdownlint-cli2 (clean). ## Documented adaptations (for review) These are the genuine, intentional deviations the maintainer should review at the end gate. Each is a sanctioned exception with its rationale recorded inline in the artifact; nothing here is accidental drift. - **`fail_on_unmatched_files: true` on `github-release`** - a promised `release-asset-*` that goes missing or is misnamed fails the release loudly; a Docker-only / no-file-target repo is the one case that relaxes it (no release asset to attach). - **`merge-bot-pull-request.yml` concurrency: per-PR group, `cancel-in-progress: false`** - under `pull_request_target` `github.ref` is the base branch, which would serialize every bot PR against that base, so the group keys on the PR number; cancellation would leave auto-merge in an inconsistent state, so events queue and each runs to completion. - **`publish-release.yml` concurrency: global ref-independent group, `cancel-in-progress: false`** - it publishes shared ref-independent artifacts (both branches' Docker tags/caches and GitHub releases) regardless of the triggering ref, so a ref-scoped group would let a scheduled run and a manual dispatch double-push; cancelling mid-flight can leave a partial tag set or half-created release. - **`dotnet/nbgv` consumed via `@master` (no SHA pin)** - the upstream tag stream lags `master` substantially and Dependabot's tag-tracking would propose a downgrade; this is the one documented no-SHA-pin exception. - **Ruleset-bound job name kept verbatim (no "job" suffix)** - `Check pull request workflow status` in `test-pull-request.yml` is referenced as a required-status-check `context:` in the branch ruleset; renaming it to fit the "every job name ends in job" convention would silently break required-status-check enforcement. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Promote the accumulated `develop` work to `main`. Twelve changes since the last promotion: - Add `WORKFLOW.md`: workflow style, architecture, behavioral contract, test methodology (#223) - Use NBGV `IGNORE_GITHUB_REF` instead of the ineffective `GITHUB_REF` override (#222) - Skip validate-release on smoke builds (#220) - Gate asset delete on the release create/refresh condition (#218) - Ship branch rulesets as versioned JSON in the re-sync / drift loop (#212) - Clean up transfer artifacts surgically at consumption, not blanket-delete (#216) - Version each publish leg against its own branch; validate at entry (#215) - Consolidate workspace configurations into a unified ProjectTemplate workspace (#210) - Template convergence barrier: absorb pins, generic release + docker-readme, carry-whole-file (#207) - Key merge-bot concurrency on PR number, not `github.ref` (#206) - Codify orchestrated re-sync personas and full-replacement rule (#205) - Lead action pins; affirm pattern-based artifact handoff (#204) 🤖 Generated with [Claude Code](https://claude.com/claude-code)

ptr727 · 2026-06-24T05:34:22Z

Surfaced by Copilot during the NxWitness re-sync (#448) — a real regression from the pull_request_target switch (#201).

Under pull_request_target, github.ref resolves to the base branch, so the merge-bot concurrency group …-${{ github.ref }} serialized every bot PR against a base into one queue — delaying auto-merge/disable when multiple Dependabot/codegen PRs are open. Keying on github.event.pull_request.number restores per-PR scoping (a PR's events still process in arrival order; different PRs run concurrently).

🤖 Generated with Claude Code

The pull_request_target switch (#201) changed github.ref from the PR merge ref to the base branch, so the concurrency group serialized every bot PR against a base into one queue - delaying auto-merge/disable when multiple Dependabot/codegen PRs are open. Key on github.event.pull_request.number so each PR's events still process in arrival order while different PRs run concurrently. Surfaced by Copilot on the NxWitness re-sync (#448). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Re-pull the upstream fix (ptr727/ProjectTemplate#206): pull_request_target makes github.ref the base branch, so the group serialized all bot PRs against a base. Key on github.event.pull_request.number for per-PR scoping.

Copilot

Pull request overview

This PR fixes an Actions concurrency regression in the merge-bot workflow introduced by using pull_request_target, where github.ref points at the base branch and unintentionally serialized all bot PR events targeting the same base branch.

Changes:

Change the workflow concurrency group key from ${{ github.ref }} to ${{ github.event.pull_request.number }} to scope concurrency per PR (while preserving cancel-in-progress: false).
Update the workflow comment to document why PR-number scoping is required under pull_request_target.

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

…eadme, carry-whole-file (#207) Phase-0 of the template-to-downstream convergence sweep: the template absorbs everything downstream repos had reinvented, so derived repos can take the carried artifacts verbatim with zero hand-rolling. Builds on #205 (orchestration personas) and #206 (per-PR merge-bot concurrency), which this branch incorporates. Held for end-gate review; not to be merged midway. ## What this PR does - **Absorbs downstream-led action pins** (template now leads per #204): `dependabot/fetch-metadata` v2.5.0 -> v3.1.0 and `softprops/action-gh-release` v2.6.2 -> v3.0.1, the SHAs the downstreams already run. - **Generalizes the release model + adds a loud guard.** Every release is a tag on the built commit plus an auto source zip, README, and LICENSE; targets amend it by uploading `release-asset-<branch>-*` artifacts (binaries/packages) or pushing elsewhere (image/registry). `github-release` collects assets by the `release-asset-<branch>-*` pattern so the job is target-agnostic and carries verbatim. - **Makes the Docker README + date badge main-only, caller-gated.** Neither has per-branch context, so both move out of the publisher branch matrix into single jobs gated on `main` being published. `publish-docker-readme-task.yml` is rebuilt generic: a matrix over a `repositories` input (or a manifest-derived list), a caller-passed `ref`, and an optional transform step (e.g. m4) to render the README before pushing. - **Adopts the carry-whole-file rule.** Replaces "drop the sections you don't ship": derived repos carry each shared file in full (an inert `[*.cs]` block or unused-language `CODESTYLE.md` section costs nothing), so every re-sync is a clean overwrite, not a partial merge. `CODESTYLE.md` is genericized into a self-contained drop-in (no demo-project names, no template-onboarding pointers) and carries both the .NET and Python sections whole. Only per-language `.vscode/tasks.json` task definitions still track the repo's language. All carried files stay self-contained (no template/demo/cross-project references except the sanctioned upstream-drift pointer). Workflow YAML and Markdown remain CRLF per the line-ending governance. Validated with actionlint and markdownlint-cli2 (clean). ## Documented adaptations (for review) These are the genuine, intentional deviations the maintainer should review at the end gate. Each is a sanctioned exception with its rationale recorded inline in the artifact; nothing here is accidental drift. - **`fail_on_unmatched_files: true` on `github-release`** - a promised `release-asset-*` that goes missing or is misnamed fails the release loudly; a Docker-only / no-file-target repo is the one case that relaxes it (no release asset to attach). - **`merge-bot-pull-request.yml` concurrency: per-PR group, `cancel-in-progress: false`** - under `pull_request_target` `github.ref` is the base branch, which would serialize every bot PR against that base, so the group keys on the PR number; cancellation would leave auto-merge in an inconsistent state, so events queue and each runs to completion. - **`publish-release.yml` concurrency: global ref-independent group, `cancel-in-progress: false`** - it publishes shared ref-independent artifacts (both branches' Docker tags/caches and GitHub releases) regardless of the triggering ref, so a ref-scoped group would let a scheduled run and a manual dispatch double-push; cancelling mid-flight can leave a partial tag set or half-created release. - **`dotnet/nbgv` consumed via `@master` (no SHA pin)** - the upstream tag stream lags `master` substantially and Dependabot's tag-tracking would propose a downgrade; this is the one documented no-SHA-pin exception. - **Ruleset-bound job name kept verbatim (no "job" suffix)** - `Check pull request workflow status` in `test-pull-request.yml` is referenced as a required-status-check `context:` in the branch ruleset; renaming it to fit the "every job name ends in job" convention would silently break required-status-check enforcement. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Promote the accumulated `develop` work to `main`. Twelve changes since the last promotion: - Add `WORKFLOW.md`: workflow style, architecture, behavioral contract, test methodology (#223) - Use NBGV `IGNORE_GITHUB_REF` instead of the ineffective `GITHUB_REF` override (#222) - Skip validate-release on smoke builds (#220) - Gate asset delete on the release create/refresh condition (#218) - Ship branch rulesets as versioned JSON in the re-sync / drift loop (#212) - Clean up transfer artifacts surgically at consumption, not blanket-delete (#216) - Version each publish leg against its own branch; validate at entry (#215) - Consolidate workspace configurations into a unified ProjectTemplate workspace (#210) - Template convergence barrier: absorb pins, generic release + docker-readme, carry-whole-file (#207) - Key merge-bot concurrency on PR number, not `github.ref` (#206) - Codify orchestrated re-sync personas and full-replacement rule (#205) - Lead action pins; affirm pattern-based artifact handoff (#204) 🤖 Generated with [Claude Code](https://claude.com/claude-code)

ptr727 · 2026-06-24T05:34:22Z

Surfaced by Copilot during the NxWitness re-sync (#448) — a real regression from the pull_request_target switch (#201).

Under pull_request_target, github.ref resolves to the base branch, so the merge-bot concurrency group …-${{ github.ref }} serialized every bot PR against a base into one queue — delaying auto-merge/disable when multiple Dependabot/codegen PRs are open. Keying on github.event.pull_request.number restores per-PR scoping (a PR's events still process in arrival order; different PRs run concurrently).

🤖 Generated with Claude Code

The pull_request_target switch (#201) changed github.ref from the PR merge ref to the base branch, so the concurrency group serialized every bot PR against a base into one queue - delaying auto-merge/disable when multiple Dependabot/codegen PRs are open. Key on github.event.pull_request.number so each PR's events still process in arrival order while different PRs run concurrently. Surfaced by Copilot on the NxWitness re-sync (#448). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Re-pull the upstream fix (ptr727/ProjectTemplate#206): pull_request_target makes github.ref the base branch, so the group serialized all bot PRs against a base. Key on github.event.pull_request.number for per-PR scoping.

Copilot

Pull request overview

This PR fixes an Actions concurrency regression in the merge-bot workflow introduced by using pull_request_target, where github.ref points at the base branch and unintentionally serialized all bot PR events targeting the same base branch.

Changes:

Change the workflow concurrency group key from ${{ github.ref }} to ${{ github.event.pull_request.number }} to scope concurrency per PR (while preserving cancel-in-progress: false).
Update the workflow comment to document why PR-number scoping is required under pull_request_target.

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

…eadme, carry-whole-file (#207) Phase-0 of the template-to-downstream convergence sweep: the template absorbs everything downstream repos had reinvented, so derived repos can take the carried artifacts verbatim with zero hand-rolling. Builds on #205 (orchestration personas) and #206 (per-PR merge-bot concurrency), which this branch incorporates. Held for end-gate review; not to be merged midway. ## What this PR does - **Absorbs downstream-led action pins** (template now leads per #204): `dependabot/fetch-metadata` v2.5.0 -> v3.1.0 and `softprops/action-gh-release` v2.6.2 -> v3.0.1, the SHAs the downstreams already run. - **Generalizes the release model + adds a loud guard.** Every release is a tag on the built commit plus an auto source zip, README, and LICENSE; targets amend it by uploading `release-asset-<branch>-*` artifacts (binaries/packages) or pushing elsewhere (image/registry). `github-release` collects assets by the `release-asset-<branch>-*` pattern so the job is target-agnostic and carries verbatim. - **Makes the Docker README + date badge main-only, caller-gated.** Neither has per-branch context, so both move out of the publisher branch matrix into single jobs gated on `main` being published. `publish-docker-readme-task.yml` is rebuilt generic: a matrix over a `repositories` input (or a manifest-derived list), a caller-passed `ref`, and an optional transform step (e.g. m4) to render the README before pushing. - **Adopts the carry-whole-file rule.** Replaces "drop the sections you don't ship": derived repos carry each shared file in full (an inert `[*.cs]` block or unused-language `CODESTYLE.md` section costs nothing), so every re-sync is a clean overwrite, not a partial merge. `CODESTYLE.md` is genericized into a self-contained drop-in (no demo-project names, no template-onboarding pointers) and carries both the .NET and Python sections whole. Only per-language `.vscode/tasks.json` task definitions still track the repo's language. All carried files stay self-contained (no template/demo/cross-project references except the sanctioned upstream-drift pointer). Workflow YAML and Markdown remain CRLF per the line-ending governance. Validated with actionlint and markdownlint-cli2 (clean). ## Documented adaptations (for review) These are the genuine, intentional deviations the maintainer should review at the end gate. Each is a sanctioned exception with its rationale recorded inline in the artifact; nothing here is accidental drift. - **`fail_on_unmatched_files: true` on `github-release`** - a promised `release-asset-*` that goes missing or is misnamed fails the release loudly; a Docker-only / no-file-target repo is the one case that relaxes it (no release asset to attach). - **`merge-bot-pull-request.yml` concurrency: per-PR group, `cancel-in-progress: false`** - under `pull_request_target` `github.ref` is the base branch, which would serialize every bot PR against that base, so the group keys on the PR number; cancellation would leave auto-merge in an inconsistent state, so events queue and each runs to completion. - **`publish-release.yml` concurrency: global ref-independent group, `cancel-in-progress: false`** - it publishes shared ref-independent artifacts (both branches' Docker tags/caches and GitHub releases) regardless of the triggering ref, so a ref-scoped group would let a scheduled run and a manual dispatch double-push; cancelling mid-flight can leave a partial tag set or half-created release. - **`dotnet/nbgv` consumed via `@master` (no SHA pin)** - the upstream tag stream lags `master` substantially and Dependabot's tag-tracking would propose a downgrade; this is the one documented no-SHA-pin exception. - **Ruleset-bound job name kept verbatim (no "job" suffix)** - `Check pull request workflow status` in `test-pull-request.yml` is referenced as a required-status-check `context:` in the branch ruleset; renaming it to fit the "every job name ends in job" convention would silently break required-status-check enforcement. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Promote the accumulated `develop` work to `main`. Twelve changes since the last promotion: - Add `WORKFLOW.md`: workflow style, architecture, behavioral contract, test methodology (#223) - Use NBGV `IGNORE_GITHUB_REF` instead of the ineffective `GITHUB_REF` override (#222) - Skip validate-release on smoke builds (#220) - Gate asset delete on the release create/refresh condition (#218) - Ship branch rulesets as versioned JSON in the re-sync / drift loop (#212) - Clean up transfer artifacts surgically at consumption, not blanket-delete (#216) - Version each publish leg against its own branch; validate at entry (#215) - Consolidate workspace configurations into a unified ProjectTemplate workspace (#210) - Template convergence barrier: absorb pins, generic release + docker-readme, carry-whole-file (#207) - Key merge-bot concurrency on PR number, not `github.ref` (#206) - Codify orchestrated re-sync personas and full-replacement rule (#205) - Lead action pins; affirm pattern-based artifact handoff (#204) 🤖 Generated with [Claude Code](https://claude.com/claude-code)

ptr727 · 2026-06-24T05:34:22Z

Surfaced by Copilot during the NxWitness re-sync (#448) — a real regression from the pull_request_target switch (#201).

Under pull_request_target, github.ref resolves to the base branch, so the merge-bot concurrency group …-${{ github.ref }} serialized every bot PR against a base into one queue — delaying auto-merge/disable when multiple Dependabot/codegen PRs are open. Keying on github.event.pull_request.number restores per-PR scoping (a PR's events still process in arrival order; different PRs run concurrently).

🤖 Generated with Claude Code

The pull_request_target switch (#201) changed github.ref from the PR merge ref to the base branch, so the concurrency group serialized every bot PR against a base into one queue - delaying auto-merge/disable when multiple Dependabot/codegen PRs are open. Key on github.event.pull_request.number so each PR's events still process in arrival order while different PRs run concurrently. Surfaced by Copilot on the NxWitness re-sync (#448). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Re-pull the upstream fix (ptr727/ProjectTemplate#206): pull_request_target makes github.ref the base branch, so the group serialized all bot PRs against a base. Key on github.event.pull_request.number for per-PR scoping.

Copilot

Pull request overview

This PR fixes an Actions concurrency regression in the merge-bot workflow introduced by using pull_request_target, where github.ref points at the base branch and unintentionally serialized all bot PR events targeting the same base branch.

Changes:

Change the workflow concurrency group key from ${{ github.ref }} to ${{ github.event.pull_request.number }} to scope concurrency per PR (while preserving cancel-in-progress: false).
Update the workflow comment to document why PR-number scoping is required under pull_request_target.

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

…eadme, carry-whole-file (#207) Phase-0 of the template-to-downstream convergence sweep: the template absorbs everything downstream repos had reinvented, so derived repos can take the carried artifacts verbatim with zero hand-rolling. Builds on #205 (orchestration personas) and #206 (per-PR merge-bot concurrency), which this branch incorporates. Held for end-gate review; not to be merged midway. ## What this PR does - **Absorbs downstream-led action pins** (template now leads per #204): `dependabot/fetch-metadata` v2.5.0 -> v3.1.0 and `softprops/action-gh-release` v2.6.2 -> v3.0.1, the SHAs the downstreams already run. - **Generalizes the release model + adds a loud guard.** Every release is a tag on the built commit plus an auto source zip, README, and LICENSE; targets amend it by uploading `release-asset-<branch>-*` artifacts (binaries/packages) or pushing elsewhere (image/registry). `github-release` collects assets by the `release-asset-<branch>-*` pattern so the job is target-agnostic and carries verbatim. - **Makes the Docker README + date badge main-only, caller-gated.** Neither has per-branch context, so both move out of the publisher branch matrix into single jobs gated on `main` being published. `publish-docker-readme-task.yml` is rebuilt generic: a matrix over a `repositories` input (or a manifest-derived list), a caller-passed `ref`, and an optional transform step (e.g. m4) to render the README before pushing. - **Adopts the carry-whole-file rule.** Replaces "drop the sections you don't ship": derived repos carry each shared file in full (an inert `[*.cs]` block or unused-language `CODESTYLE.md` section costs nothing), so every re-sync is a clean overwrite, not a partial merge. `CODESTYLE.md` is genericized into a self-contained drop-in (no demo-project names, no template-onboarding pointers) and carries both the .NET and Python sections whole. Only per-language `.vscode/tasks.json` task definitions still track the repo's language. All carried files stay self-contained (no template/demo/cross-project references except the sanctioned upstream-drift pointer). Workflow YAML and Markdown remain CRLF per the line-ending governance. Validated with actionlint and markdownlint-cli2 (clean). ## Documented adaptations (for review) These are the genuine, intentional deviations the maintainer should review at the end gate. Each is a sanctioned exception with its rationale recorded inline in the artifact; nothing here is accidental drift. - **`fail_on_unmatched_files: true` on `github-release`** - a promised `release-asset-*` that goes missing or is misnamed fails the release loudly; a Docker-only / no-file-target repo is the one case that relaxes it (no release asset to attach). - **`merge-bot-pull-request.yml` concurrency: per-PR group, `cancel-in-progress: false`** - under `pull_request_target` `github.ref` is the base branch, which would serialize every bot PR against that base, so the group keys on the PR number; cancellation would leave auto-merge in an inconsistent state, so events queue and each runs to completion. - **`publish-release.yml` concurrency: global ref-independent group, `cancel-in-progress: false`** - it publishes shared ref-independent artifacts (both branches' Docker tags/caches and GitHub releases) regardless of the triggering ref, so a ref-scoped group would let a scheduled run and a manual dispatch double-push; cancelling mid-flight can leave a partial tag set or half-created release. - **`dotnet/nbgv` consumed via `@master` (no SHA pin)** - the upstream tag stream lags `master` substantially and Dependabot's tag-tracking would propose a downgrade; this is the one documented no-SHA-pin exception. - **Ruleset-bound job name kept verbatim (no "job" suffix)** - `Check pull request workflow status` in `test-pull-request.yml` is referenced as a required-status-check `context:` in the branch ruleset; renaming it to fit the "every job name ends in job" convention would silently break required-status-check enforcement. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Promote the accumulated `develop` work to `main`. Twelve changes since the last promotion: - Add `WORKFLOW.md`: workflow style, architecture, behavioral contract, test methodology (#223) - Use NBGV `IGNORE_GITHUB_REF` instead of the ineffective `GITHUB_REF` override (#222) - Skip validate-release on smoke builds (#220) - Gate asset delete on the release create/refresh condition (#218) - Ship branch rulesets as versioned JSON in the re-sync / drift loop (#212) - Clean up transfer artifacts surgically at consumption, not blanket-delete (#216) - Version each publish leg against its own branch; validate at entry (#215) - Consolidate workspace configurations into a unified ProjectTemplate workspace (#210) - Template convergence barrier: absorb pins, generic release + docker-readme, carry-whole-file (#207) - Key merge-bot concurrency on PR number, not `github.ref` (#206) - Codify orchestrated re-sync personas and full-replacement rule (#205) - Lead action pins; affirm pattern-based artifact handoff (#204) 🤖 Generated with [Claude Code](https://claude.com/claude-code)

ptr727 · 2026-06-24T05:34:22Z

Surfaced by Copilot during the NxWitness re-sync (#448) — a real regression from the pull_request_target switch (#201).

Under pull_request_target, github.ref resolves to the base branch, so the merge-bot concurrency group …-${{ github.ref }} serialized every bot PR against a base into one queue — delaying auto-merge/disable when multiple Dependabot/codegen PRs are open. Keying on github.event.pull_request.number restores per-PR scoping (a PR's events still process in arrival order; different PRs run concurrently).

🤖 Generated with Claude Code

The pull_request_target switch (#201) changed github.ref from the PR merge ref to the base branch, so the concurrency group serialized every bot PR against a base into one queue - delaying auto-merge/disable when multiple Dependabot/codegen PRs are open. Key on github.event.pull_request.number so each PR's events still process in arrival order while different PRs run concurrently. Surfaced by Copilot on the NxWitness re-sync (#448). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Re-pull the upstream fix (ptr727/ProjectTemplate#206): pull_request_target makes github.ref the base branch, so the group serialized all bot PRs against a base. Key on github.event.pull_request.number for per-PR scoping.

Copilot

Pull request overview

This PR fixes an Actions concurrency regression in the merge-bot workflow introduced by using pull_request_target, where github.ref points at the base branch and unintentionally serialized all bot PR events targeting the same base branch.

Changes:

Change the workflow concurrency group key from ${{ github.ref }} to ${{ github.event.pull_request.number }} to scope concurrency per PR (while preserving cancel-in-progress: false).
Update the workflow comment to document why PR-number scoping is required under pull_request_target.

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

…eadme, carry-whole-file (#207) Phase-0 of the template-to-downstream convergence sweep: the template absorbs everything downstream repos had reinvented, so derived repos can take the carried artifacts verbatim with zero hand-rolling. Builds on #205 (orchestration personas) and #206 (per-PR merge-bot concurrency), which this branch incorporates. Held for end-gate review; not to be merged midway. ## What this PR does - **Absorbs downstream-led action pins** (template now leads per #204): `dependabot/fetch-metadata` v2.5.0 -> v3.1.0 and `softprops/action-gh-release` v2.6.2 -> v3.0.1, the SHAs the downstreams already run. - **Generalizes the release model + adds a loud guard.** Every release is a tag on the built commit plus an auto source zip, README, and LICENSE; targets amend it by uploading `release-asset-<branch>-*` artifacts (binaries/packages) or pushing elsewhere (image/registry). `github-release` collects assets by the `release-asset-<branch>-*` pattern so the job is target-agnostic and carries verbatim. - **Makes the Docker README + date badge main-only, caller-gated.** Neither has per-branch context, so both move out of the publisher branch matrix into single jobs gated on `main` being published. `publish-docker-readme-task.yml` is rebuilt generic: a matrix over a `repositories` input (or a manifest-derived list), a caller-passed `ref`, and an optional transform step (e.g. m4) to render the README before pushing. - **Adopts the carry-whole-file rule.** Replaces "drop the sections you don't ship": derived repos carry each shared file in full (an inert `[*.cs]` block or unused-language `CODESTYLE.md` section costs nothing), so every re-sync is a clean overwrite, not a partial merge. `CODESTYLE.md` is genericized into a self-contained drop-in (no demo-project names, no template-onboarding pointers) and carries both the .NET and Python sections whole. Only per-language `.vscode/tasks.json` task definitions still track the repo's language. All carried files stay self-contained (no template/demo/cross-project references except the sanctioned upstream-drift pointer). Workflow YAML and Markdown remain CRLF per the line-ending governance. Validated with actionlint and markdownlint-cli2 (clean). ## Documented adaptations (for review) These are the genuine, intentional deviations the maintainer should review at the end gate. Each is a sanctioned exception with its rationale recorded inline in the artifact; nothing here is accidental drift. - **`fail_on_unmatched_files: true` on `github-release`** - a promised `release-asset-*` that goes missing or is misnamed fails the release loudly; a Docker-only / no-file-target repo is the one case that relaxes it (no release asset to attach). - **`merge-bot-pull-request.yml` concurrency: per-PR group, `cancel-in-progress: false`** - under `pull_request_target` `github.ref` is the base branch, which would serialize every bot PR against that base, so the group keys on the PR number; cancellation would leave auto-merge in an inconsistent state, so events queue and each runs to completion. - **`publish-release.yml` concurrency: global ref-independent group, `cancel-in-progress: false`** - it publishes shared ref-independent artifacts (both branches' Docker tags/caches and GitHub releases) regardless of the triggering ref, so a ref-scoped group would let a scheduled run and a manual dispatch double-push; cancelling mid-flight can leave a partial tag set or half-created release. - **`dotnet/nbgv` consumed via `@master` (no SHA pin)** - the upstream tag stream lags `master` substantially and Dependabot's tag-tracking would propose a downgrade; this is the one documented no-SHA-pin exception. - **Ruleset-bound job name kept verbatim (no "job" suffix)** - `Check pull request workflow status` in `test-pull-request.yml` is referenced as a required-status-check `context:` in the branch ruleset; renaming it to fit the "every job name ends in job" convention would silently break required-status-check enforcement. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Promote the accumulated `develop` work to `main`. Twelve changes since the last promotion: - Add `WORKFLOW.md`: workflow style, architecture, behavioral contract, test methodology (#223) - Use NBGV `IGNORE_GITHUB_REF` instead of the ineffective `GITHUB_REF` override (#222) - Skip validate-release on smoke builds (#220) - Gate asset delete on the release create/refresh condition (#218) - Ship branch rulesets as versioned JSON in the re-sync / drift loop (#212) - Clean up transfer artifacts surgically at consumption, not blanket-delete (#216) - Version each publish leg against its own branch; validate at entry (#215) - Consolidate workspace configurations into a unified ProjectTemplate workspace (#210) - Template convergence barrier: absorb pins, generic release + docker-readme, carry-whole-file (#207) - Key merge-bot concurrency on PR number, not `github.ref` (#206) - Codify orchestrated re-sync personas and full-replacement rule (#205) - Lead action pins; affirm pattern-based artifact handoff (#204) 🤖 Generated with [Claude Code](https://claude.com/claude-code)

ptr727 · 2026-06-24T05:34:22Z

Surfaced by Copilot during the NxWitness re-sync (#448) — a real regression from the pull_request_target switch (#201).

Under pull_request_target, github.ref resolves to the base branch, so the merge-bot concurrency group …-${{ github.ref }} serialized every bot PR against a base into one queue — delaying auto-merge/disable when multiple Dependabot/codegen PRs are open. Keying on github.event.pull_request.number restores per-PR scoping (a PR's events still process in arrival order; different PRs run concurrently).

🤖 Generated with Claude Code

The pull_request_target switch (#201) changed github.ref from the PR merge ref to the base branch, so the concurrency group serialized every bot PR against a base into one queue - delaying auto-merge/disable when multiple Dependabot/codegen PRs are open. Key on github.event.pull_request.number so each PR's events still process in arrival order while different PRs run concurrently. Surfaced by Copilot on the NxWitness re-sync (#448). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Re-pull the upstream fix (ptr727/ProjectTemplate#206): pull_request_target makes github.ref the base branch, so the group serialized all bot PRs against a base. Key on github.event.pull_request.number for per-PR scoping.

Copilot

Pull request overview

This PR fixes an Actions concurrency regression in the merge-bot workflow introduced by using pull_request_target, where github.ref points at the base branch and unintentionally serialized all bot PR events targeting the same base branch.

Changes:

Change the workflow concurrency group key from ${{ github.ref }} to ${{ github.event.pull_request.number }} to scope concurrency per PR (while preserving cancel-in-progress: false).
Update the workflow comment to document why PR-number scoping is required under pull_request_target.

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

…eadme, carry-whole-file (#207) Phase-0 of the template-to-downstream convergence sweep: the template absorbs everything downstream repos had reinvented, so derived repos can take the carried artifacts verbatim with zero hand-rolling. Builds on #205 (orchestration personas) and #206 (per-PR merge-bot concurrency), which this branch incorporates. Held for end-gate review; not to be merged midway. ## What this PR does - **Absorbs downstream-led action pins** (template now leads per #204): `dependabot/fetch-metadata` v2.5.0 -> v3.1.0 and `softprops/action-gh-release` v2.6.2 -> v3.0.1, the SHAs the downstreams already run. - **Generalizes the release model + adds a loud guard.** Every release is a tag on the built commit plus an auto source zip, README, and LICENSE; targets amend it by uploading `release-asset-<branch>-*` artifacts (binaries/packages) or pushing elsewhere (image/registry). `github-release` collects assets by the `release-asset-<branch>-*` pattern so the job is target-agnostic and carries verbatim. - **Makes the Docker README + date badge main-only, caller-gated.** Neither has per-branch context, so both move out of the publisher branch matrix into single jobs gated on `main` being published. `publish-docker-readme-task.yml` is rebuilt generic: a matrix over a `repositories` input (or a manifest-derived list), a caller-passed `ref`, and an optional transform step (e.g. m4) to render the README before pushing. - **Adopts the carry-whole-file rule.** Replaces "drop the sections you don't ship": derived repos carry each shared file in full (an inert `[*.cs]` block or unused-language `CODESTYLE.md` section costs nothing), so every re-sync is a clean overwrite, not a partial merge. `CODESTYLE.md` is genericized into a self-contained drop-in (no demo-project names, no template-onboarding pointers) and carries both the .NET and Python sections whole. Only per-language `.vscode/tasks.json` task definitions still track the repo's language. All carried files stay self-contained (no template/demo/cross-project references except the sanctioned upstream-drift pointer). Workflow YAML and Markdown remain CRLF per the line-ending governance. Validated with actionlint and markdownlint-cli2 (clean). ## Documented adaptations (for review) These are the genuine, intentional deviations the maintainer should review at the end gate. Each is a sanctioned exception with its rationale recorded inline in the artifact; nothing here is accidental drift. - **`fail_on_unmatched_files: true` on `github-release`** - a promised `release-asset-*` that goes missing or is misnamed fails the release loudly; a Docker-only / no-file-target repo is the one case that relaxes it (no release asset to attach). - **`merge-bot-pull-request.yml` concurrency: per-PR group, `cancel-in-progress: false`** - under `pull_request_target` `github.ref` is the base branch, which would serialize every bot PR against that base, so the group keys on the PR number; cancellation would leave auto-merge in an inconsistent state, so events queue and each runs to completion. - **`publish-release.yml` concurrency: global ref-independent group, `cancel-in-progress: false`** - it publishes shared ref-independent artifacts (both branches' Docker tags/caches and GitHub releases) regardless of the triggering ref, so a ref-scoped group would let a scheduled run and a manual dispatch double-push; cancelling mid-flight can leave a partial tag set or half-created release. - **`dotnet/nbgv` consumed via `@master` (no SHA pin)** - the upstream tag stream lags `master` substantially and Dependabot's tag-tracking would propose a downgrade; this is the one documented no-SHA-pin exception. - **Ruleset-bound job name kept verbatim (no "job" suffix)** - `Check pull request workflow status` in `test-pull-request.yml` is referenced as a required-status-check `context:` in the branch ruleset; renaming it to fit the "every job name ends in job" convention would silently break required-status-check enforcement. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Promote the accumulated `develop` work to `main`. Twelve changes since the last promotion: - Add `WORKFLOW.md`: workflow style, architecture, behavioral contract, test methodology (#223) - Use NBGV `IGNORE_GITHUB_REF` instead of the ineffective `GITHUB_REF` override (#222) - Skip validate-release on smoke builds (#220) - Gate asset delete on the release create/refresh condition (#218) - Ship branch rulesets as versioned JSON in the re-sync / drift loop (#212) - Clean up transfer artifacts surgically at consumption, not blanket-delete (#216) - Version each publish leg against its own branch; validate at entry (#215) - Consolidate workspace configurations into a unified ProjectTemplate workspace (#210) - Template convergence barrier: absorb pins, generic release + docker-readme, carry-whole-file (#207) - Key merge-bot concurrency on PR number, not `github.ref` (#206) - Codify orchestrated re-sync personas and full-replacement rule (#205) - Lead action pins; affirm pattern-based artifact handoff (#204) 🤖 Generated with [Claude Code](https://claude.com/claude-code)

ptr727 · 2026-06-24T05:34:22Z

Surfaced by Copilot during the NxWitness re-sync (#448) — a real regression from the pull_request_target switch (#201).

Under pull_request_target, github.ref resolves to the base branch, so the merge-bot concurrency group …-${{ github.ref }} serialized every bot PR against a base into one queue — delaying auto-merge/disable when multiple Dependabot/codegen PRs are open. Keying on github.event.pull_request.number restores per-PR scoping (a PR's events still process in arrival order; different PRs run concurrently).

🤖 Generated with Claude Code

The pull_request_target switch (#201) changed github.ref from the PR merge ref to the base branch, so the concurrency group serialized every bot PR against a base into one queue - delaying auto-merge/disable when multiple Dependabot/codegen PRs are open. Key on github.event.pull_request.number so each PR's events still process in arrival order while different PRs run concurrently. Surfaced by Copilot on the NxWitness re-sync (#448). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Re-pull the upstream fix (ptr727/ProjectTemplate#206): pull_request_target makes github.ref the base branch, so the group serialized all bot PRs against a base. Key on github.event.pull_request.number for per-PR scoping.

Copilot

Pull request overview

This PR fixes an Actions concurrency regression in the merge-bot workflow introduced by using pull_request_target, where github.ref points at the base branch and unintentionally serialized all bot PR events targeting the same base branch.

Changes:

Change the workflow concurrency group key from ${{ github.ref }} to ${{ github.event.pull_request.number }} to scope concurrency per PR (while preserving cancel-in-progress: false).
Update the workflow comment to document why PR-number scoping is required under pull_request_target.

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

…eadme, carry-whole-file (#207) Phase-0 of the template-to-downstream convergence sweep: the template absorbs everything downstream repos had reinvented, so derived repos can take the carried artifacts verbatim with zero hand-rolling. Builds on #205 (orchestration personas) and #206 (per-PR merge-bot concurrency), which this branch incorporates. Held for end-gate review; not to be merged midway. ## What this PR does - **Absorbs downstream-led action pins** (template now leads per #204): `dependabot/fetch-metadata` v2.5.0 -> v3.1.0 and `softprops/action-gh-release` v2.6.2 -> v3.0.1, the SHAs the downstreams already run. - **Generalizes the release model + adds a loud guard.** Every release is a tag on the built commit plus an auto source zip, README, and LICENSE; targets amend it by uploading `release-asset-<branch>-*` artifacts (binaries/packages) or pushing elsewhere (image/registry). `github-release` collects assets by the `release-asset-<branch>-*` pattern so the job is target-agnostic and carries verbatim. - **Makes the Docker README + date badge main-only, caller-gated.** Neither has per-branch context, so both move out of the publisher branch matrix into single jobs gated on `main` being published. `publish-docker-readme-task.yml` is rebuilt generic: a matrix over a `repositories` input (or a manifest-derived list), a caller-passed `ref`, and an optional transform step (e.g. m4) to render the README before pushing. - **Adopts the carry-whole-file rule.** Replaces "drop the sections you don't ship": derived repos carry each shared file in full (an inert `[*.cs]` block or unused-language `CODESTYLE.md` section costs nothing), so every re-sync is a clean overwrite, not a partial merge. `CODESTYLE.md` is genericized into a self-contained drop-in (no demo-project names, no template-onboarding pointers) and carries both the .NET and Python sections whole. Only per-language `.vscode/tasks.json` task definitions still track the repo's language. All carried files stay self-contained (no template/demo/cross-project references except the sanctioned upstream-drift pointer). Workflow YAML and Markdown remain CRLF per the line-ending governance. Validated with actionlint and markdownlint-cli2 (clean). ## Documented adaptations (for review) These are the genuine, intentional deviations the maintainer should review at the end gate. Each is a sanctioned exception with its rationale recorded inline in the artifact; nothing here is accidental drift. - **`fail_on_unmatched_files: true` on `github-release`** - a promised `release-asset-*` that goes missing or is misnamed fails the release loudly; a Docker-only / no-file-target repo is the one case that relaxes it (no release asset to attach). - **`merge-bot-pull-request.yml` concurrency: per-PR group, `cancel-in-progress: false`** - under `pull_request_target` `github.ref` is the base branch, which would serialize every bot PR against that base, so the group keys on the PR number; cancellation would leave auto-merge in an inconsistent state, so events queue and each runs to completion. - **`publish-release.yml` concurrency: global ref-independent group, `cancel-in-progress: false`** - it publishes shared ref-independent artifacts (both branches' Docker tags/caches and GitHub releases) regardless of the triggering ref, so a ref-scoped group would let a scheduled run and a manual dispatch double-push; cancelling mid-flight can leave a partial tag set or half-created release. - **`dotnet/nbgv` consumed via `@master` (no SHA pin)** - the upstream tag stream lags `master` substantially and Dependabot's tag-tracking would propose a downgrade; this is the one documented no-SHA-pin exception. - **Ruleset-bound job name kept verbatim (no "job" suffix)** - `Check pull request workflow status` in `test-pull-request.yml` is referenced as a required-status-check `context:` in the branch ruleset; renaming it to fit the "every job name ends in job" convention would silently break required-status-check enforcement. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Promote the accumulated `develop` work to `main`. Twelve changes since the last promotion: - Add `WORKFLOW.md`: workflow style, architecture, behavioral contract, test methodology (#223) - Use NBGV `IGNORE_GITHUB_REF` instead of the ineffective `GITHUB_REF` override (#222) - Skip validate-release on smoke builds (#220) - Gate asset delete on the release create/refresh condition (#218) - Ship branch rulesets as versioned JSON in the re-sync / drift loop (#212) - Clean up transfer artifacts surgically at consumption, not blanket-delete (#216) - Version each publish leg against its own branch; validate at entry (#215) - Consolidate workspace configurations into a unified ProjectTemplate workspace (#210) - Template convergence barrier: absorb pins, generic release + docker-readme, carry-whole-file (#207) - Key merge-bot concurrency on PR number, not `github.ref` (#206) - Codify orchestrated re-sync personas and full-replacement rule (#205) - Lead action pins; affirm pattern-based artifact handoff (#204) 🤖 Generated with [Claude Code](https://claude.com/claude-code)

ptr727 · 2026-06-24T05:34:22Z

Surfaced by Copilot during the NxWitness re-sync (#448) — a real regression from the pull_request_target switch (#201).

Under pull_request_target, github.ref resolves to the base branch, so the merge-bot concurrency group …-${{ github.ref }} serialized every bot PR against a base into one queue — delaying auto-merge/disable when multiple Dependabot/codegen PRs are open. Keying on github.event.pull_request.number restores per-PR scoping (a PR's events still process in arrival order; different PRs run concurrently).

🤖 Generated with Claude Code

The pull_request_target switch (#201) changed github.ref from the PR merge ref to the base branch, so the concurrency group serialized every bot PR against a base into one queue - delaying auto-merge/disable when multiple Dependabot/codegen PRs are open. Key on github.event.pull_request.number so each PR's events still process in arrival order while different PRs run concurrently. Surfaced by Copilot on the NxWitness re-sync (#448). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Re-pull the upstream fix (ptr727/ProjectTemplate#206): pull_request_target makes github.ref the base branch, so the group serialized all bot PRs against a base. Key on github.event.pull_request.number for per-PR scoping.

Copilot

Pull request overview

This PR fixes an Actions concurrency regression in the merge-bot workflow introduced by using pull_request_target, where github.ref points at the base branch and unintentionally serialized all bot PR events targeting the same base branch.

Changes:

Change the workflow concurrency group key from ${{ github.ref }} to ${{ github.event.pull_request.number }} to scope concurrency per PR (while preserving cancel-in-progress: false).
Update the workflow comment to document why PR-number scoping is required under pull_request_target.

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

…eadme, carry-whole-file (#207) Phase-0 of the template-to-downstream convergence sweep: the template absorbs everything downstream repos had reinvented, so derived repos can take the carried artifacts verbatim with zero hand-rolling. Builds on #205 (orchestration personas) and #206 (per-PR merge-bot concurrency), which this branch incorporates. Held for end-gate review; not to be merged midway. ## What this PR does - **Absorbs downstream-led action pins** (template now leads per #204): `dependabot/fetch-metadata` v2.5.0 -> v3.1.0 and `softprops/action-gh-release` v2.6.2 -> v3.0.1, the SHAs the downstreams already run. - **Generalizes the release model + adds a loud guard.** Every release is a tag on the built commit plus an auto source zip, README, and LICENSE; targets amend it by uploading `release-asset-<branch>-*` artifacts (binaries/packages) or pushing elsewhere (image/registry). `github-release` collects assets by the `release-asset-<branch>-*` pattern so the job is target-agnostic and carries verbatim. - **Makes the Docker README + date badge main-only, caller-gated.** Neither has per-branch context, so both move out of the publisher branch matrix into single jobs gated on `main` being published. `publish-docker-readme-task.yml` is rebuilt generic: a matrix over a `repositories` input (or a manifest-derived list), a caller-passed `ref`, and an optional transform step (e.g. m4) to render the README before pushing. - **Adopts the carry-whole-file rule.** Replaces "drop the sections you don't ship": derived repos carry each shared file in full (an inert `[*.cs]` block or unused-language `CODESTYLE.md` section costs nothing), so every re-sync is a clean overwrite, not a partial merge. `CODESTYLE.md` is genericized into a self-contained drop-in (no demo-project names, no template-onboarding pointers) and carries both the .NET and Python sections whole. Only per-language `.vscode/tasks.json` task definitions still track the repo's language. All carried files stay self-contained (no template/demo/cross-project references except the sanctioned upstream-drift pointer). Workflow YAML and Markdown remain CRLF per the line-ending governance. Validated with actionlint and markdownlint-cli2 (clean). ## Documented adaptations (for review) These are the genuine, intentional deviations the maintainer should review at the end gate. Each is a sanctioned exception with its rationale recorded inline in the artifact; nothing here is accidental drift. - **`fail_on_unmatched_files: true` on `github-release`** - a promised `release-asset-*` that goes missing or is misnamed fails the release loudly; a Docker-only / no-file-target repo is the one case that relaxes it (no release asset to attach). - **`merge-bot-pull-request.yml` concurrency: per-PR group, `cancel-in-progress: false`** - under `pull_request_target` `github.ref` is the base branch, which would serialize every bot PR against that base, so the group keys on the PR number; cancellation would leave auto-merge in an inconsistent state, so events queue and each runs to completion. - **`publish-release.yml` concurrency: global ref-independent group, `cancel-in-progress: false`** - it publishes shared ref-independent artifacts (both branches' Docker tags/caches and GitHub releases) regardless of the triggering ref, so a ref-scoped group would let a scheduled run and a manual dispatch double-push; cancelling mid-flight can leave a partial tag set or half-created release. - **`dotnet/nbgv` consumed via `@master` (no SHA pin)** - the upstream tag stream lags `master` substantially and Dependabot's tag-tracking would propose a downgrade; this is the one documented no-SHA-pin exception. - **Ruleset-bound job name kept verbatim (no "job" suffix)** - `Check pull request workflow status` in `test-pull-request.yml` is referenced as a required-status-check `context:` in the branch ruleset; renaming it to fit the "every job name ends in job" convention would silently break required-status-check enforcement. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Promote the accumulated `develop` work to `main`. Twelve changes since the last promotion: - Add `WORKFLOW.md`: workflow style, architecture, behavioral contract, test methodology (#223) - Use NBGV `IGNORE_GITHUB_REF` instead of the ineffective `GITHUB_REF` override (#222) - Skip validate-release on smoke builds (#220) - Gate asset delete on the release create/refresh condition (#218) - Ship branch rulesets as versioned JSON in the re-sync / drift loop (#212) - Clean up transfer artifacts surgically at consumption, not blanket-delete (#216) - Version each publish leg against its own branch; validate at entry (#215) - Consolidate workspace configurations into a unified ProjectTemplate workspace (#210) - Template convergence barrier: absorb pins, generic release + docker-readme, carry-whole-file (#207) - Key merge-bot concurrency on PR number, not `github.ref` (#206) - Codify orchestrated re-sync personas and full-replacement rule (#205) - Lead action pins; affirm pattern-based artifact handoff (#204) 🤖 Generated with [Claude Code](https://claude.com/claude-code)

CopilotAI review requested due to automatic review settings June 24, 2026 05:34

Copilotstarted reviewing on behalf of ptr727 June 24, 2026 05:34 View session

CopilotAI reviewed Jun 24, 2026
View reviewed changes

ptr727 requested a review from Copilot June 24, 2026 05:36

Copilotstarted reviewing on behalf of ptr727 June 24, 2026 05:36 View session

CopilotAI reviewed Jun 24, 2026
View reviewed changes

ptr727 mentioned this pull request Jun 24, 2026
Template convergence barrier: absorb pins, generic release + docker-readme, carry-whole-file #207
Merged

ptr727 merged commit 5981466 into developJun 25, 2026
11 checks passed

ptr727 deleted the mergebot-per-pr-concurrency branch June 25, 2026 14:04

ptr727 mentioned this pull request Jul 4, 2026
Release: promote develop to main #225
Merged

CopilotAI review requested due to automatic review settings June 24, 2026 05:34

Copilotstarted reviewing on behalf of ptr727 June 24, 2026 05:34 View session

CopilotAI reviewed Jun 24, 2026
View reviewed changes

ptr727 requested a review from Copilot June 24, 2026 05:36

Copilotstarted reviewing on behalf of ptr727 June 24, 2026 05:36 View session

CopilotAI reviewed Jun 24, 2026
View reviewed changes

ptr727 mentioned this pull request Jun 24, 2026
Template convergence barrier: absorb pins, generic release + docker-readme, carry-whole-file #207
Merged

ptr727 merged commit 5981466 into developJun 25, 2026
11 checks passed

ptr727 deleted the mergebot-per-pr-concurrency branch June 25, 2026 14:04

ptr727 mentioned this pull request Jul 4, 2026
Release: promote develop to main #225
Merged

CopilotAI review requested due to automatic review settings June 24, 2026 05:34

Copilotstarted reviewing on behalf of ptr727 June 24, 2026 05:34 View session

CopilotAI reviewed Jun 24, 2026
View reviewed changes

ptr727 requested a review from Copilot June 24, 2026 05:36

Copilotstarted reviewing on behalf of ptr727 June 24, 2026 05:36 View session

CopilotAI reviewed Jun 24, 2026
View reviewed changes

ptr727 mentioned this pull request Jun 24, 2026
Template convergence barrier: absorb pins, generic release + docker-readme, carry-whole-file #207
Merged

ptr727 merged commit 5981466 into developJun 25, 2026
11 checks passed

ptr727 deleted the mergebot-per-pr-concurrency branch June 25, 2026 14:04

ptr727 mentioned this pull request Jul 4, 2026
Release: promote develop to main #225
Merged

CopilotAI review requested due to automatic review settings June 24, 2026 05:34

Copilotstarted reviewing on behalf of ptr727 June 24, 2026 05:34 View session

CopilotAI reviewed Jun 24, 2026
View reviewed changes

ptr727 requested a review from Copilot June 24, 2026 05:36

Copilotstarted reviewing on behalf of ptr727 June 24, 2026 05:36 View session

CopilotAI reviewed Jun 24, 2026
View reviewed changes

ptr727 mentioned this pull request Jun 24, 2026
Template convergence barrier: absorb pins, generic release + docker-readme, carry-whole-file #207
Merged

ptr727 merged commit 5981466 into developJun 25, 2026
11 checks passed

ptr727 deleted the mergebot-per-pr-concurrency branch June 25, 2026 14:04

ptr727 mentioned this pull request Jul 4, 2026
Release: promote develop to main #225
Merged

CopilotAI review requested due to automatic review settings June 24, 2026 05:34

Copilotstarted reviewing on behalf of ptr727 June 24, 2026 05:34 View session

CopilotAI reviewed Jun 24, 2026
View reviewed changes

ptr727 requested a review from Copilot June 24, 2026 05:36

Copilotstarted reviewing on behalf of ptr727 June 24, 2026 05:36 View session

CopilotAI reviewed Jun 24, 2026
View reviewed changes

ptr727 mentioned this pull request Jun 24, 2026
Template convergence barrier: absorb pins, generic release + docker-readme, carry-whole-file #207
Merged

ptr727 merged commit 5981466 into developJun 25, 2026
11 checks passed

ptr727 deleted the mergebot-per-pr-concurrency branch June 25, 2026 14:04

ptr727 mentioned this pull request Jul 4, 2026
Release: promote develop to main #225
Merged

CopilotAI review requested due to automatic review settings June 24, 2026 05:34

Copilotstarted reviewing on behalf of ptr727 June 24, 2026 05:34 View session

CopilotAI reviewed Jun 24, 2026
View reviewed changes

ptr727 requested a review from Copilot June 24, 2026 05:36

Copilotstarted reviewing on behalf of ptr727 June 24, 2026 05:36 View session

CopilotAI reviewed Jun 24, 2026
View reviewed changes

ptr727 mentioned this pull request Jun 24, 2026
Template convergence barrier: absorb pins, generic release + docker-readme, carry-whole-file #207
Merged

ptr727 merged commit 5981466 into developJun 25, 2026
11 checks passed

ptr727 deleted the mergebot-per-pr-concurrency branch June 25, 2026 14:04

ptr727 mentioned this pull request Jul 4, 2026
Release: promote develop to main #225
Merged

CopilotAI review requested due to automatic review settings June 24, 2026 05:34

Copilotstarted reviewing on behalf of ptr727 June 24, 2026 05:34 View session

CopilotAI reviewed Jun 24, 2026
View reviewed changes

ptr727 requested a review from Copilot June 24, 2026 05:36

Copilotstarted reviewing on behalf of ptr727 June 24, 2026 05:36 View session

CopilotAI reviewed Jun 24, 2026
View reviewed changes

ptr727 mentioned this pull request Jun 24, 2026
Template convergence barrier: absorb pins, generic release + docker-readme, carry-whole-file #207
Merged

ptr727 merged commit 5981466 into developJun 25, 2026
11 checks passed

ptr727 deleted the mergebot-per-pr-concurrency branch June 25, 2026 14:04

ptr727 mentioned this pull request Jul 4, 2026
Release: promote develop to main #225
Merged

CopilotAI review requested due to automatic review settings June 24, 2026 05:34

Copilotstarted reviewing on behalf of ptr727 June 24, 2026 05:34 View session

CopilotAI reviewed Jun 24, 2026
View reviewed changes

ptr727 requested a review from Copilot June 24, 2026 05:36

Copilotstarted reviewing on behalf of ptr727 June 24, 2026 05:36 View session

CopilotAI reviewed Jun 24, 2026
View reviewed changes

ptr727 mentioned this pull request Jun 24, 2026
Template convergence barrier: absorb pins, generic release + docker-readme, carry-whole-file #207
Merged

ptr727 merged commit 5981466 into developJun 25, 2026
11 checks passed

ptr727 deleted the mergebot-per-pr-concurrency branch June 25, 2026 14:04

ptr727 mentioned this pull request Jul 4, 2026
Release: promote develop to main #225
Merged

Conversation

ptr727 commented Jun 24, 2026

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

ptr727 commented Jun 24, 2026

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

ptr727 commented Jun 24, 2026

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

ptr727 commented Jun 24, 2026

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants