Document dotnet/nbgv@master exception and drop redundant secrets: inherit - #76
Merged
Conversation
…erit Two small workflow follow-ups that have been outstanding for several PRs. `get-version-task.yml`: `dotnet/nbgv` is the only third-party action in this repo that's not SHA-pinned. Adding a comment in the workflow that explicitly carves it out as the documented AGENTS.md exception so future readers (and Copilot reviews) don't keep flagging it. Reasoning: the upstream tag stream lags `master` significantly, Dependabot would either silently stall or attempt a downgrade if we pinned to a post-`v0.5.1` master SHA, and the upstream owner is Microsoft so the tag-/branch-retargeting risk the rule guards against is materially lower. `build-nugetlibrary-task.yml`: drop `secrets: inherit` from the `get-version` job call. `get-version-task.yml` declares no required secrets, so the inherit was widening the secret context for a job that consumes none. Same fix that PR #74 applied to `build-pypilibrary-task.yml` for the same caller-callee pair. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
This PR makes two small GitHub Actions workflow follow-ups: (1) it documents the intentional choice to run dotnet/nbgv from master in the reusable version workflow, and (2) it tightens secret propagation by removing an unnecessary secrets: inherit on an internal reusable-workflow call.
Changes:
- Add an inline rationale comment explaining why
dotnet/nbgv@masteris used inget-version-task.yml. - Remove redundant
secrets: inheritwhenbuild-nugetlibrary-task.ymlcallsget-version-task.yml.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| .github/workflows/get-version-task.yml | Adds an explanatory comment for the unpinned dotnet/nbgv@master usage. |
| .github/workflows/build-nugetlibrary-task.yml | Removes unnecessary secret inheritance for the nested get-version workflow call. |
Uh oh!
There was an error while loading. Please reload this page.
Copilot review caught that the prior wording implied AGENTS.md itself documented an exception for `dotnet/nbgv`, which is false — AGENTS.md only states the general SHA-pinning guidance. The exception lives in this workflow comment, not in AGENTS.md. Reword to make that explicit. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Uh oh!
There was an error while loading. Please reload this page.
6 tasks
ptr727 added a commit
that referenced
this pull request
May 12, 2026
…nups (#77) Release merge: brings two squashed PRs and one unnecessary back-merge commit from `develop` into `main`. ## Squashed PRs included - **#76 — Document `dotnet/nbgv@master` exception and drop redundant `secrets: inherit`.** - `.github/workflows/get-version-task.yml`: inline comment carves out `dotnet/nbgv@master` as the deliberate deviation from the AGENTS.md SHA-pinning rule (upstream tag stream is dormant, Dependabot would stall or attempt a downgrade if we pinned, upstream owner is Microsoft so retargeting risk is low). - `.github/workflows/build-nugetlibrary-task.yml`: dropped `secrets: inherit` from the `get-version` job call (same fix PR #74 applied to `build-pypilibrary-task.yml`). - **#78 — Forward-only develop with dual-target Dependabot + codegen.** The substantive change in this release: - **AGENTS.md "Branching Model"** explicitly codifies forward-only develop (no `main → develop` back-merges; develop squash-only ruleset blocks them) and the dual-target bot model with rationale. - **`.github/dependabot.yml`** duplicates every ecosystem entry per branch (six entries total) so Dependabot opens parallel PRs against both `main` and `develop` independently. Both branches stay current on dep versions without back-merges. - **`.github/workflows/run-codegen-pull-request-task.yml`** runs as a matrix over `main` and `develop`. Branch names `codegen-main` and `codegen-develop`; each opens a PR against its own base. - **`.github/workflows/merge-bot-pull-request.yml`** `merge-codegen` job uses strict head/base pairing and dispatches `--squash` (develop) vs `--merge` (main) per base, same `case` statement pattern as `merge-dependabot`. - **README.md "Template - Release Distribution Model: Push vs. Pull"** (new section) — documents the default push-on-merge model and the manual-release alternative for HACS / distro-vendored projects, referencing [homeassistant-purpleair](https://github.com/ptr727/homeassistant-purpleair) as the working example. - **README.md "Template - GitHub Setup"** rulesets section split into separate Develop (squash-only + `Require linear history`) and Main (merge-commit-only) rulesets with shared settings extracted. Repo-level Pull Requests block now correctly shows **both** `Allow merge commits` and `Allow squash merging` enabled (the prior wording suggested merge would be disabled, which contradicted the actual main ruleset). ## Unnecessary back-merge `5ce95cf` (acknowledged misstep) I opened this release with a `Merge remote-tracking branch 'origin/main' into develop` commit assuming the back-merge pattern was the standard cycle close. **It wasn't.** That model conflicts with AGENTS.md's squash-only develop rule (the push only succeeded via admin bypass). PR #78's AGENTS.md update now explicitly forbids future back-merges and routes both bots to update both branches independently — closing the gap that made this pattern feel necessary. The back-merge commit is left in place: reverting requires a destructive force-push to develop. Behavioral effect is a one-time gitHeight bump, which fixes the `--pre` channel ordering (develop's next dev publish is now unambiguously higher than main's last release). ## Operator action items (already completed) - `CODEGEN_APP_ID` / `CODEGEN_APP_PRIVATE_KEY` in both Actions and Dependabot secret stores. ✓ - `WORKFLOW_PAT` secret + PAT revoked. ✓ - `pypi` GitHub environment Deployment branch rule allows `main` and `develop`. ✓ ## Open follow-up (tracked separately, not in this release) PR #78 documented a limitation in the actor-check guardrail on `merge-codegen` / `merge-dependabot`: it stops the merge-bot from re-invoking `gh pr merge --auto` on a maintainer-triggered `synchronize`, but **does not** disable auto-merge that's already enabled. Once auto-merge is on a bot PR, maintainer commits will land. The honest workaround is documented (`gh pr merge --disable-auto <PR>` before pushing). The real safeguard — a `synchronize`-triggered job that disables auto-merge automatically when the actor isn't the bot — is a follow-up PR I'll open after this release lands. ## Notes - Merge method: **merge-commit** (per [AGENTS.md branching model](https://github.com/ptr727/ProjectTemplate/blob/develop/AGENTS.md#branching-model)). ## Test plan - [ ] CI passes on the merge commit. - [ ] `publish-release.yml` on main publishes `1.0.<N>.<B>` as the next stable release. - [ ] After release, `pip install ptr727-projecttemplate-library` resolves to the new stable; `pip install --pre ptr727-projecttemplate-library` resolves to the latest develop dev (assuming develop's gitHeight exceeds main's, which the back-merge ensures). - [ ] Next Dependabot scheduled run opens **two** PRs per ecosystem (one against main, one against develop). - [ ] Next codegen weekly run opens **two** PRs (`codegen-main` against main, `codegen-develop` against develop). - [ ] Each bot PR auto-merges via the merge-bot with the correct method (`--squash` for develop, `--merge` for main).
This was referenced Aug 25, 2026
Closed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two small workflow follow-ups that have been outstanding through PR #70 and PR #74 reviews.
1.
get-version-task.yml— carve out thedotnet/nbgv@masterexception in commentsdotnet/nbgvis the only third-party action in this repo that's not SHA-pinned. Copilot has flagged this twice now (PR #70 and again in passing). Adding an inline comment that explicitly documents it as the AGENTS.md exception so future reviewers / agents don't keep flagging it. Reasoning recorded in the comment:v0.5.1(3cf2d96c…) lagsmaster(b944774b…as of today). Real fixes accumulate onmasterbetween tag bumps.v0.5.1masterSHA, Dependabot will either silently stall (no new tags to bump to) or attempt a downgrade PR tov0.5.1. Neither beats just floating onmaster.dotnet/), so the tag-/branch-retargeting risk the rule guards against is materially lower than for a random-author action.2.
build-nugetlibrary-task.yml— drop redundantsecrets: inheritget-version-task.ymldeclares no required secrets in itson: workflow_callblock, sosecrets: inheriton theget-versionjob call was passing the caller's secret context to a job that consumes none. Same fixPR #74 applied tobuild-pypilibrary-task.yml; flagged by Copilot there but declined here for opportunistic-pin scope. This PR closes the gap.Test plan
get-version).