Combine Review Wait Steps - #819
Merged
Merged
Conversation
…nups (#77) Release merge: brings two squashed PRs and one unnecessary back-merge commit from `develop` into `main`. ## Squashed PRs included - **#76 — Document `dotnet/nbgv@master` exception and drop redundant `secrets: inherit`.** - `.github/workflows/get-version-task.yml`: inline comment carves out `dotnet/nbgv@master` as the deliberate deviation from the AGENTS.md SHA-pinning rule (upstream tag stream is dormant, Dependabot would stall or attempt a downgrade if we pinned, upstream owner is Microsoft so retargeting risk is low). - `.github/workflows/build-nugetlibrary-task.yml`: dropped `secrets: inherit` from the `get-version` job call (same fix PR #74 applied to `build-pypilibrary-task.yml`). - **#78 — Forward-only develop with dual-target Dependabot + codegen.** The substantive change in this release: - **AGENTS.md "Branching Model"** explicitly codifies forward-only develop (no `main → develop` back-merges; develop squash-only ruleset blocks them) and the dual-target bot model with rationale. - **`.github/dependabot.yml`** duplicates every ecosystem entry per branch (six entries total) so Dependabot opens parallel PRs against both `main` and `develop` independently. Both branches stay current on dep versions without back-merges. - **`.github/workflows/run-codegen-pull-request-task.yml`** runs as a matrix over `main` and `develop`. Branch names `codegen-main` and `codegen-develop`; each opens a PR against its own base. - **`.github/workflows/merge-bot-pull-request.yml`** `merge-codegen` job uses strict head/base pairing and dispatches `--squash` (develop) vs `--merge` (main) per base, same `case` statement pattern as `merge-dependabot`. - **README.md "Template - Release Distribution Model: Push vs. Pull"** (new section) — documents the default push-on-merge model and the manual-release alternative for HACS / distro-vendored projects, referencing [homeassistant-purpleair](https://github.com/ptr727/homeassistant-purpleair) as the working example. - **README.md "Template - GitHub Setup"** rulesets section split into separate Develop (squash-only + `Require linear history`) and Main (merge-commit-only) rulesets with shared settings extracted. Repo-level Pull Requests block now correctly shows **both** `Allow merge commits` and `Allow squash merging` enabled (the prior wording suggested merge would be disabled, which contradicted the actual main ruleset). ## Unnecessary back-merge `5ce95cf` (acknowledged misstep) I opened this release with a `Merge remote-tracking branch 'origin/main' into develop` commit assuming the back-merge pattern was the standard cycle close. **It wasn't.** That model conflicts with AGENTS.md's squash-only develop rule (the push only succeeded via admin bypass). PR #78's AGENTS.md update now explicitly forbids future back-merges and routes both bots to update both branches independently — closing the gap that made this pattern feel necessary. The back-merge commit is left in place: reverting requires a destructive force-push to develop. Behavioral effect is a one-time gitHeight bump, which fixes the `--pre` channel ordering (develop's next dev publish is now unambiguously higher than main's last release). ## Operator action items (already completed) - `CODEGEN_APP_ID` / `CODEGEN_APP_PRIVATE_KEY` in both Actions and Dependabot secret stores. ✓ - `WORKFLOW_PAT` secret + PAT revoked. ✓ - `pypi` GitHub environment Deployment branch rule allows `main` and `develop`. ✓ ## Open follow-up (tracked separately, not in this release) PR #78 documented a limitation in the actor-check guardrail on `merge-codegen` / `merge-dependabot`: it stops the merge-bot from re-invoking `gh pr merge --auto` on a maintainer-triggered `synchronize`, but **does not** disable auto-merge that's already enabled. Once auto-merge is on a bot PR, maintainer commits will land. The honest workaround is documented (`gh pr merge --disable-auto <PR>` before pushing). The real safeguard — a `synchronize`-triggered job that disables auto-merge automatically when the actor isn't the bot — is a follow-up PR I'll open after this release lands. ## Notes - Merge method: **merge-commit** (per [AGENTS.md branching model](https://github.com/ptr727/ProjectTemplate/blob/develop/AGENTS.md#branching-model)). ## Test plan - [ ] CI passes on the merge commit. - [ ] `publish-release.yml` on main publishes `1.0.<N>.<B>` as the next stable release. - [ ] After release, `pip install ptr727-projecttemplate-library` resolves to the new stable; `pip install --pre ptr727-projecttemplate-library` resolves to the latest develop dev (assuming develop's gitHeight exceeds main's, which the back-merge ensures). - [ ] Next Dependabot scheduled run opens **two** PRs per ecosystem (one against main, one against develop). - [ ] Next codegen weekly run opens **two** PRs (`codegen-main` against main, `codegen-develop` against develop). - [ ] Each bot PR auto-merges via the merge-bot with the correct method (`--squash` for develop, `--merge` for main).
…rules-docs alignment (#80) Release merge: brings two squashed PRs from `develop` into `main`. ## Squashed PRs included - **#79 — Disable auto-merge on maintainer push to bot PR.** Started narrow (a `synchronize`-triggered job that calls `gh pr merge --disable-auto` when a maintainer pushes to a bot PR, closing the gap PR #78 documented but didn't fix) and grew to cover repo-wide SHA pinning of every action after the maintainer corrected my reading of AGENTS.md's first-party-actions clause. ### What landed - **New `disable-auto-merge-on-maintainer-push` job** in `.github/workflows/merge-bot-pull-request.yml`. Fires on `pull_request.synchronize` events against bot-authored PRs (Dependabot or codegen) when the event actor isn't the same bot — calls `gh pr merge --disable-auto`. App-token-driven (Dependabot PRs run with restricted secrets regardless of event actor). - **`merge-dependabot` and `merge-codegen` restricted to `opened`/`reopened`** so auto-merge is enabled exactly once per PR; skipping `synchronize` is what keeps the disable safeguard sticky against bot rebases. - **`concurrency.cancel-in-progress: false`** in `merge-bot-pull-request.yml` so the three-job model runs events to completion in arrival order. - **Every action SHA-pinned** across all workflows: `actions/*` (checkout, setup-dotnet, create-github-app-token, upload-artifact, download-artifact), `docker/*` (setup-qemu-action, setup-buildx-action, login-action, build-push-action), and `RubbaBoy/BYOB`. `dotnet/nbgv@master` is the only documented exception. - **AGENTS.md "Workflow YAML Conventions"** tightened: every action must be SHA-pinned (the prior "first-party `actions/*` encouraged but not required" softening is gone). `# vX` major-only comment allowed when upstream's floating major tag doesn't correspond to a specific patch/minor release SHA. Concurrency convention gains a documented exception for `merge-bot-pull-request.yml`. - **AGENTS.md "Branching Model"** + **README "Template - GitHub Setup"** updated for the new disable job and the auto-merge condition list. - **#81 — Drop "branches up to date" rule from main ruleset (incompatible with forward-only).** Resolved the root cause behind PR #80 being initially blocked. GitHub's "Require branches to be up to date before merging" is a graph-based check (it asks whether main's tip merge commit is reachable from develop) that's fundamentally incompatible with the forward-only develop model PR #78 codified. Historical back-merges had been quietly compensating for this; PR #78 forbade them but left the README's documented "shared settings" ruleset block contradictorily listing the rule. - **README "Rules / Rulesets"**: moved `Require branches to be up to date before merging` out of "Shared settings" into the Develop-only ruleset entry (where it's standard hygiene). Added explicit "intentionally OFF" callout in the Main ruleset entry with the full rationale. - **AGENTS.md "Branching Model"**: new bullet codifying *why* the main ruleset omits this rule, framed purely in graph-reachability terms. ## Operator action already completed - `Require branches to be up to date before merging` unticked on Settings → Rulesets → Main. ✓ Verified via API. ## Notes - Merge method: **merge-commit** (per [AGENTS.md branching model](https://github.com/ptr727/ProjectTemplate/blob/develop/AGENTS.md#branching-model)). - **No rebase required.** With the ruleset rule now disabled, GitHub no longer enforces graph-reachability of main's tip from develop, so the merge proceeds cleanly without admin bypass or back-merge. ## Test plan - [ ] CI passes on the merge commit. - [ ] `publish-release.yml` on main produces the next stable release. - [ ] Next bot PR (Dependabot or codegen) opens with auto-merge enabled exactly once. A maintainer push to the bot's branch disables auto-merge; re-enable manually to land the maintainer's edits. - [ ] No floating-tag actions remain anywhere in `.github/workflows/` except `dotnet/nbgv@master`. - [ ] Future develop → main releases land without admin bypass.
## Summary - Closes#82 — drop strict "Require branches to be up to date before merging" from the `develop` ruleset (already applied on the live ruleset id 15886282). With strict on, two bot PRs against `develop` landing within the same window left the second OPEN forever: the first merge flipped it to `mergeStateStatus: BEHIND`, GitHub's auto-merge will not fire while strict is on, and the merge-bot only enables auto-merge on `opened`/`reopened`. - Closes#83 — fix the GitHub Pre-Release shield with `&filter=*-g*` (NBGV pre-release tags carry a `-g<sha>` suffix, stable tags don't); drop the NuGet Pre-Release badge because shields.io's `vpre` endpoint accepts no filter parameter and silently returns the latest stable whenever one exists. - AGENTS.md "Branching Model" + README.md "Rules / Rulesets" updated in lockstep — both rulesets now document distinct reasons for omitting the strict flag. ## Test plan - [ ] Visual: rendered README badge row shows three pre-release-aware badges (GitHub Release, GitHub Pre-Release, NuGet Release) — `NuGet Pre-Release` is gone. - [ ] Shield URL spot-check: `https://img.shields.io/github/v/release/<owner>/<repo>?include_prereleases&filter=*-g*` renders an NBGV pre-release tag, not the latest stable. - [ ] `gh api repos/ptr727/ProjectTemplate/rulesets/15886282 | jq '.rules[] | select(.type=="required_status_checks")'` shows `strict_required_status_checks_policy: false` (already verified). - [ ] Next pair of overlapping Dependabot/codegen PRs against `develop` both auto-merge without one stalling in `BEHIND`.
This PR updates the codegen files.
…90) (#91) ## Summary Promotes develop → main. Two squashed commits ride along: - **PR #90** — Migrate `actions/create-github-app-token` from deprecated `app-id` to `client-id` (closes#88), bump pin `v1.12.0` → `v3.2.0`, drop inert `codegen` entry from `test-pull-request.yml`'s base-branch filter (closes#89), and relax `AGENTS.md`'s "agents never commit" rule to allow scope-bound, signing-gated authorization. 5 files, 16+/17-. - **PR #86** — `[ptr727-codegen]` weekly codegen refresh; 1 line in `CodeGen/CodeGen.cs`. The `CODEGEN_APP_CLIENT_ID` secret is already provisioned in both Actions and Dependabot stores. The legacy `CODEGEN_APP_ID` secret can be deleted after one round of each bot workflow runs green on main post-merge. ## Test plan - [ ] CI green on this PR. - [ ] Post-merge: trigger `run-periodic-codegen-pull-request.yml` via `workflow_dispatch`; both matrix legs (main, develop) mint App tokens and open codegen PRs as `ptr727-codegen[bot]`. - [ ] Post-merge: next Dependabot PR auto-merges cleanly via `merge-bot-pull-request.yml` `merge-dependabot`. - [ ] After one green round of each bot workflow, delete legacy `CODEGEN_APP_ID` secret from both Actions and Dependabot stores.
This PR updates the codegen files.
This PR updates the codegen files.
This PR updates the codegen files.
Release merge of `develop` into `main`. ## Headline change (#98, closes#97) Two-phase CI/CD that decouples merging from publishing across all four delivery targets (Docker, NuGet, PyPI, console executable): - **PRs smoke-test only** — path-gated, reduced builds (Docker `linux/amd64`, trimmed executable matrix), no publish. - **Sole publisher** — `publish-release.yml` (weekly schedule + manual dispatch) builds/publishes **both** branches via a matrix; the `push` trigger publishes only when the **`PUBLISH_ON_MERGE`** repository variable is `true` (opt-in legacy continuous-release). Default is two-phase. - Parameterized chain (`ref`/`branch`/`smoke`, per-target `enable_*` gates), branch-suffixed artifacts, branch-scoped Docker cache, hardened required-status aggregator. - Robustness: skip GitHub release on a duplicate version (no-op weeks), pin the release tag to NBGV `GitCommitId`, global publish concurrency, `cache-to`/login gating reviewed. - CodeGen weekly → daily; `test-release-task.yml` + `publish-periodic-docker-release.yml` removed. - Corrected the Copilot review runbook (reliable `requestReviews` mutation) and made the wait-for-maintainer-merge gate explicit. Also includes routine codegen updates (#93, #95). 🤖 Generated with [Claude Code](https://claude.com/claude-code)
This PR updates the codegen files.
Release of develop → main. Carries three changes: - **Decouple GitHub-release assembly from per-target builds (#109)** — `github-release` collects assets by the `release-asset-<branch>-*` convention instead of naming build jobs, so the release orchestration is reusable verbatim by downstreams. Fixes#108. - **Back-port CI/CD fixes discovered during the PlexCleaner port (#107)** — commit-pinned release leaves, event-aware github-release gating, Docker cache-export tolerance, publish concurrency scoping, smoke-build gating, badge filtering, Copilot runbook login fix. - **Update codegen files (#106).** Merge-commit (not squash) per the branching model, so main records develop's tip as the second parent.
This PR updates the codegen files.
Release of develop -> main. Two changes: - **Standardize ASCII and `.editorconfig` line endings repo-wide; tighten doc conventions (#114)** - replace typographic Unicode (em-dashes, arrows, `<=`, ellipsis) with ASCII across all tracked files; bring every file to its `.editorconfig` line ending; add the ruleset export/import + signing-order setup docs; add AGENTS rules (Character Set, Line Endings, current-state tense, ruleset-setup). Source edits are comments/docstrings/cosmetic-strings and line endings only - no logic change. - **Update codegen files (#113).** Merge-commit (not squash) per the branching model. The insertions/deletions count is dominated by line-ending normalization (whole-file churn under `* -text`); `git diff --ignore-cr-at-eol main...develop` isolates the real content edits.
This PR updates the codegen files.
This PR updates the codegen files.
This PR updates the codegen files.
Promotes `develop` to `main`. - **#124** - Propagate template contract to derived repos: shared `.markdownlint-cli2.jsonc` (#116), explicit verbatim-copy contract + line-ending mandate + upstream-defect-reporting contract (#117), brownfield `required_signatures` migration (#111), and known-working actionlint/markdownlint Docker linter guidance. Review-loop feedback applied (modern re-sign, maintainer-only force-push). - **#123 / #120 / #119** - Update codegen files.
Promotes `develop` to `main`: template-doc refinements captured from the downstream realignment - the ruleset full-payload-PUT caveat (README) and the markdownlint `--fix` first-adoption step incl. CRLF re-check (AGENTS), plus the US-English 'judgment' fix. (#126)
Promotes the versioning-policy documentation to `main` (#131): the develop-leads + maintenance-hold model stated in AGENTS.md, README.md, and .github/copilot-instructions.md. Documentation only; version unchanged (maintenance).
This PR updates the codegen files.
Two squashes. **Merge with a merge commit, never a squash, and never with `--delete-branch`** — this PR's head *is* `develop`. | PR | What | |---|---| | [#659](#659) | A backlog entry recording that a disproof about carried text has nowhere fleet-wide to live, after the same false claim was disproved twice about one canonical | | [#660](#660) | The deletion sweep now says a path grep finds *uses* of a file and misses *descriptions* of it | ## Why [#660](#660) wants promoting rather than waiting It corrects a rule that is actively being followed. Blog's resync ran the sweep correctly, merged, and still left `GOVERNANCE.md` "Repository Layout" describing `repo-config/` as holding *"the apply script"* — a file it had just deleted. The ESPHome-Config agent has since confirmed the identical wording sits unswept in its own `Repository Layout`, **ahead of its own `configure.sh` retirement**. Its eleven grep hits across five files are a floor rather than a count. Promoting this puts the corrected rule in front of that work rather than behind it. ## Verification on the merged head `spec/validate.py` OK, `spec/audit.py --selftest` PASS, 557 script tests OK, `editorconfig-checker` clean, `repo_gate --check eol` clean, working tree clean. One defect of my own was found and fixed inside [#660](#660): a Python `read_text`/`write_text` rewrite silently converted `RESYNC.md` to LF against this repo's CRLF. Restored in `a12cd33` and verified content-identical with `git diff --ignore-cr-at-eol`. `editorconfig-checker` is the only gate that sees that class. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
One squash: [#662](#662) at [`31880f0`](31880f0). **Merge with a merge commit, never a squash, and never with `--delete-branch`** — this PR's head *is* `develop`. ## Why it wants promoting before the release, not after `HISTORY.md`'s Version 2.0 entry enumerates what this repository contains and had stopped at the `AUDIT.md` convergence procedure, omitting three peers of the things it lists: `RESYNC.md`, the host tool contract and its version floors, and the derived detector for files the hub hosts rather than carries. A release cut against the previous text publishes a changelog whose summary omits the work. The release reads `main`, so this promotion is the last step before a dispatch is worth making. ## Verification `README.md` and `HISTORY.md` must open as twins per `spec/readme-structure.md`, checked with the audit's own extraction rather than by eye: titles match, taglines match. `cspell` clean on both gated files, `prose_lint`, `markdownlint-cli2` and `editorconfig-checker` clean, CRLF preserved byte-wise. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
…ng (#670) Five commits, `1927e9a..56f4d7d`. Nineteen files, +4241/-136. ## What lands - **#664** `b0d0d13` — a shellcheck gate in `validate-task.yml`, with the file list from `git ls-files '*.sh'` so a new script is gated without editing the step. Also wired `scripts/test_host_gate.py` into the self-test step, which was running in no workflow at all. - **#666** `8c6fd27` — `prose_lint.py` chose its rule set from the working directory rather than the scanned repository, so standing in an operational repo and scanning a release repo silently discarded `home-path`, the rule that exists because real paths reached a public comment. - **#665** `e2a99f1` — a host stamp at `~/.claude/agent-safety-stamp.json` plus `--report`, so "is this machine current" has an answer that is not a tick in an issue. Also fixed `install.py` taking no arguments while both wrappers passed `"$@"`, which made `--help` perform a full install. - **#668** `6864a9b` — the two remaining `prose_lint.py` false cleans, fixed as a class. An absolute path argument scoped a `--diff` run to nothing and exited 0, and an untracked file was invisible to both a diff-scoped run and a whole-tree sweep. Every input to a verdict now derives from the repository being scanned, and every run states the scope it read. - **#667** `56f4d7d` — the host bootstrap tooling under `host-setup/linux/`, its `bootstrap.sh` loader, `scripts/test_bootstrap.py`, and the rules the scripts run under. ## Review record Every one of the five closed its Copilot loop on its own pull request. #668 ran five rounds and #667 seven, and between them eighteen findings arrived as suppressed comments rather than as inline threads, thirteen of which were real. Two of those were defects that would otherwise have shipped in the gate this promotion carries: a subtree of new files taking a filesystem walk that applies no ignore rules, and a docstring count that was wrong as well as brittle. ## Consequence worth stating The `GOVERNANCE.md` "Hub-Hosted Tooling" paragraph #667 added makes every carrying repository's copy a past revision once this reaches `main`. That is the ordinary consequence of a canonical moving rather than a defect, but a repository meeting it first as a red audit line will read it as a surprise. HomeAutomation-Config has already re-vendored it by content rather than by bytes, since a byte copy from a CRLF hub into an LF repository rewrites every line to change one paragraph. ## Verified on this head `develop` at `56f4d7d`, in sync with `origin/develop`. Local run of the CI invocations: 223 prose self-tests, the prose gate over 117 files, `repo_gate` (eol, eol-coverage, sha-pin), `spec/validate.py` with 22 cataloged, markdownlint over 45 files, and editorconfig-checker, all clean. Merge as a **merge commit**, never a squash, and without `--delete-branch`: this pull request's head is `develop` itself.
…Python CI Gates (#718) Thirty-one squashes, `56f4d7d..d54862a`. 115 files, +20436/-5298. **Merge with a merge commit, never a squash, and never with `--delete-branch`.** This pull request's head is `develop` itself. ## What lands **Fleet Skills.** The `.agents/skills/` source tree, the generated `.claude-plugin/` distribution, `scripts/build_dist.py` with its `--check` gate, and `scripts/skills_install.py` with its host stamp (#676). Packaged as skills on top of the scaffold: PR review conduct and Copilot instructions upkeep (#677), comment and doc style (#678), resync-a-repo and fleet-conformance-check (#679), the per-language codestyles (#680), git commit conventions and operational vs release workflow (#681), stand up a repo (#683), and repo-worktree (#717). Coverage gaps closed in three passes (#690, #691, #692) plus the P4 sentence-length opt-in (#697). **Host setup.** The Windows host-setup tooling and its PowerShell gate (#674), the Windows bootstrap loader (#682), Docker install and upgrade on Linux and Windows with a version floor (#701, #705), a `uv` floor in `spec/host-tools.json` (#698), self-healing of a shadowing `uv`, `jq`, or `git-restore-mtime` copy (#689), node's real winget package id (#696), and a README for the Linux host-setup nuances (#710). **Python and CI.** Python tooling in CI with the script tests moved to `scripts/tests` (#704), `ruff format` adopted and gated (#709), and the PSScriptAnalyzer claim conditioned on repos that carry `.ps1` files (#686). **Conduct rules.** Triage-order and scope guardrails in pr-review-conduct (#684), `pr_review.py wait` requesting a review rather than only polling for one (#685), a tech-agnostic signed-commit verification (#708), execution rather than analogy to verify platform-specific code (#715), and a unique worktree for every task (#717). **Docs.** The fleet map and gap register with peer messaging declared (#687), mermaid flow diagrams in the kept-authority docs (#702), and the map pointed at the shipped diagrams and current tooling (#703). ## Issues this promotion closes Each landed on `develop` on its own pull request. The keyword fires only on a merge into `main`, so it sits here rather than on the feature pull requests. Closes#700Closes#707Closes#711Closes#712Closes#714Closes#688#699 stays open on purpose: #717 shipped the layout convention and the skill, and the physical migration of existing checkouts is still tracked there. ## Review record Every squash closed its own Copilot loop on its own pull request before merging to `develop`. This promotion carries no new content of its own, so its review is the merged tree as a whole. ## Consequence worth stating The `GOVERNANCE.md` and `AGENTS.md` sections these squashes changed become the canonical the moment this reaches `main`, and every carrying repository reads as drifted from that point until it resyncs. That is the ordinary consequence of a canonical moving rather than a defect. The Skills installer added here is also how a machine picks the new skills up, so a session that keeps restating a rule already packaged as a skill is the signal to run it.
… the Upstream Repo-Layout Segment (#734) Closes#719Closes#720Closes#721Closes#722 Promotes six merged `develop` PRs to `main`: - #732 -- Reconcile the PlexCleaner registry entry and audit report after the 2026-08-15 resync (closes#719). - #731 -- Exempt hub-hosted paths from the prose gate's `dead-path` rule (closes#721). - #730 -- Fix the hub slug and the dead anchor in the canonical `copilot-instructions.md` (closes#720, #722). - #723 -- Refresh the PhotoCleaner audit report after the 0e84805 resync. - #733 -- Add an `upstream/` segment to the repo layout convention (addresses #725, not closed -- the fork-naming variant differs from the issue's proposal). - #724 -- Add the HomeAutomation-Config audit report and reconcile its registry entry. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
…xes (#741) Promotes `develop` to `main`. Two commits since #734, both governance rather than tooling, and the trial merge is conflict-free. Closes#737Closes#738 ## #736, the publisher and validator declared at intent fidelity `spec/files.json` gains `.github/workflows/publish-release.yml` and `.github/workflows/validate-task.yml`, and the two matching `investigate` rows leave `spec/divergences.json`, a declared file being no longer a gap. This reverses the call #732 shipped. That change settled both as `accepted`, which silences the finding and stops the audit measuring either file again, and the maintainer caught that as the opposite of what the fleet wants for them. `interface` genuinely does not fit, since job keys and triggers are per-repo across every carrier, but `intent` does: presence asserted, equivalence judged by hand, and a staleness advisory when the hub's copy moves past a carrier's. Scope is measured rather than assumed. The publisher applies to the three publishing `releaseTrigger` values, which selects exactly the 18 carriers, since every repository lacking one carries `releaseTrigger: none`. The validator applies to `*` by decision, making the reusable validation task the fleet standard. What promoting this turns on, fleet-wide, measured in one run at `audit run 2026-08-15T17:35:45Z | hub 0713008`: 0 absences for the publisher, 8 for the validator (homeassistant-purpleair, KiCadLibrary, EspDinIoT, ESPHome-Config, HomeAssistant-Config, DevKitCIoT, Vantage-Config, HolidayLights), and 30 staleness advisories. 17 of those 30 are a known false class, since the advisory has no action-pin normalization and the hub's publisher last changed in a Dependabot bump, filed as #735. `reports/plexcleaner/audit.md` is updated in the same commit, since it is the report the earlier settlement was written into. ## #740, two carried-wording fixes Both raised by Copilot against a carried copy on ptr727/ESPHome-Config#94, and both are the same failure: a faithful copy makes every carrier re-litigate one finding. - **#737**: the `GOVENANCE.md` quotation now reads as quoted ("the reviewer's own spelling and a path no diff carries") in the three Markdown occurrences. The misspelling stays literal, because it is the evidence for the sentence it sits in. - **#738**: the `AGENTS.md` sentence named no sections and read as "none of this file is editable". It now names the three byte-locked sections and states that the preamble above them is the repository's own. ## Verification Run against `develop` at `7c67328`: whole-tree prose gate, `repo_gate.py` (eol, eol-coverage, sha-pin), `spec/validate.py`, `spec/audit.py --selftest`, `build_dist.py --check`, markdownlint, and editorconfig-checker all pass. `git merge-tree` of `main` and `develop` is conflict-free, so there is no EOL-only conflict to resolve on this promotion.
…leaner Report (#746) Promote `develop` to `main`, carrying two changes: - #744 Host the Merge-Bot in the Hub and Measure Fleet Workflow Reuse: the hub-hosted reusable-workflow design (`docs/reusable-workflows.md`), the fleet workflow-reuse measurement (`spec/workflow_reuse.py`, `reports/workflow-reuse.md`), the first hub task (`.github/workflows/merge-bot-task.yml`) with the hub's own caller stub, the manifest contract change for `merge-bot-pull-request.yml`, and the TODO cluster and adoption sweep. - #739 Mark PhotoCleaner Operational After the Promotion of the b09078e Resync: the PhotoCleaner audit report refresh. The release that follows this promotion is the first tag naming `merge-bot-task.yml`, which is the pin the downstream caller stubs use, so the merge-bot adoption sweep and the catalog snippet both wait on it. A Dependabot pull request against `main` after this merge is the `--merge` half of the live proof of the callee. Refs #521 (hub half shipped in #744, sweep half is the adoption). No issue closes on this promotion.
… Default (#768) Promote `develop` to `main`, carrying the remaining stages of the hub-hosted reusable-workflow rollout and the changes that landed beside them: - #759 Host Get-Version and Publish-Plan as Hub Reusable Tasks - #760 Host the Validate Task and Reshape the Test Pull Request Stub (settles #729 by design: the hub's validate task runs `uvx <tool>@latest`, since Dependabot tracks the action pins and not a uvx version) - #761 Host the Type-Specific Tasks and Retire the Date Badge - #762 Host the Release Chain and the Docker Core in the Hub - #748 and #752, the staged rollout tracker and the PhotoCleaner merge-bot pilot record - #758 Flip the Fleet Line-Ending Default from CRLF to LF - #753, #755, #756, #764, host-setup and test-collection changes The release that follows this promotion is the first tag carrying every hub task, so it is the pin the stage 2 to 5 adoptions and their catalog snippets use. It is also the first run of the hub's own `publish-release.yml` through `build-release-task.yml` with every target disabled, which is the live proof that `github-release` runs when its build needs are skipped. Closes#729. Refs #521 (hub half shipped, the merge-bot adoption sweep is what remains).
Bumps the actions-deps group with 1 update: [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv). Updates `astral-sh/setup-uv` from 8.1.0 to 10.0.0 - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@0880764...ae62891) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 10.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-deps ... Signed-off-by: dependabot[bot] <support@github.com>
#770) Bumps the actions-deps group with 1 update: [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv). Updates `astral-sh/setup-uv` from 8.1.0 to 10.0.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/setup-uv/releases">astral-sh/setup-uv's releases</a>.</em></p> <blockquote> <h2>v10.0.0 🌈 Disable automatic caching for sensitive events and new QOL features</h2> <h2>Changes</h2> <p>Another breaking release, directly after v9.0.0 but we think the added security justifies that.</p> <h3>Extra security by default</h3> <p>If you use the default <code>enable-cache: auto</code> this will now <strong>DISABLE THE CACHE</strong> to protect against cache poisoning for the following events:</p> <ul> <li><code>pull_request_target</code></li> <li><code>workflow_run</code></li> <li><code>release</code></li> </ul> <p>You can read the full reasoning in <a href="https://redirect.github.com/astral-sh/setup-uv/issues/984">astral-sh/setup-uv#984</a></p> <h3><code>version: latest-known</code></h3> <pre lang="yaml"><code>- name: Install the latest version of uv known to setup-uv uses: astral-sh/setup-uv@v10.0.0 with: version: "latest-known" </code></pre> <p>This will now install the latest version with a checksum that is known by this action. The <a href="https://github.com/astral-sh/setup-uv/blob/4f6036f71cec78afb113b323f220c9185d983c12/src/download/checksum/known-checksums.ts">known <code>uv</code> checksums</a> are automatically updated but will take a release of this action to take effect. You won't be always using the latest & greatest but you will have an extra level of security.</p> <h3>Read python version from <code>.tool-versions</code></h3> <pre lang="yaml"><code>- name: Install uv based on the version defined in .tool-versions and also set python uses: astral-sh/setup-uv@v10.0.0 with: version-file: "pyproject.toml" </code></pre> <p>Will now also set the python version if it is defined in <code>.tool-versions</code>. You can read the details <a href="https://github.com/astral-sh/setup-uv/blob/main/docs/advanced-version-configuration.md#install-a-version-defined-in-a-requirements-or-config-file">in the docs</a></p> <h2>🚨 Breaking changes</h2> <ul> <li>Disable automatic caching for sensitive events <a href="https://github.com/eifinger"><code>@eifinger</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/992">#992</a>)</li> </ul> <h2>🐛 Bug fixes</h2> <ul> <li>Reject paths in .tool-versions <a href="https://github.com/eifinger"><code>@eifinger</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1007">#1007</a>)</li> </ul> <h2>🚀 Enhancements</h2> <ul> <li>Read Python version from .tool-versions <a href="https://github.com/eifinger"><code>@eifinger</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/996">#996</a>)</li> <li>Add latest-known version selector <a href="https://github.com/eifinger"><code>@eifinger</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/993">#993</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/setup-uv/commit/ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d"><code>ae62891</code></a> chore(deps): roll up Dependabot updates (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1013">#1013</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/f9cdb47d487aee2be8925d1e57290177ad9e1ac2"><code>f9cdb47</code></a> Reject paths in .tool-versions (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1007">#1007</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/4f6036f71cec78afb113b323f220c9185d983c12"><code>4f6036f</code></a> Require pull requests for Dependabot rollups (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1005">#1005</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/8d6402c9b71205b2d8d0b82de531d8fed8430182"><code>8d6402c</code></a> chore(deps): roll up Dependabot updates (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1004">#1004</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/46f427bd47c794e99536b75ffaa9f27602425027"><code>46f427b</code></a> Read Python version from .tool-versions (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/996">#996</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/8ed89c51143f65ea13eaba62db51dbb8ea52d0a3"><code>8ed89c5</code></a> ci: pin Alpine container image (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/995">#995</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/8473c7fea42cdfd540f4b01317a17ac5f54126ae"><code>8473c7f</code></a> chore(deps): roll up Dependabot updates (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/994">#994</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/18d451d679e1650bc59f25f17116168d04f30748"><code>18d451d</code></a> Add latest-known version selector (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/993">#993</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/f45168497b927d08c229345a5ab9ad5c85418d0b"><code>f451684</code></a> Disable automatic caching for sensitive events (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/992">#992</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/b68407c192114b6e47cc45b98289832c3df00d5e"><code>b68407c</code></a> chore: update known checksums for 0.12.3 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/991">#991</a>)</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/setup-uv/compare/08807647e7069bb48b6ef5acd8ec9567f424441b...ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details>
Promote `develop` to `main`, carrying two changes: - #772 Move the Release Task's Job Scopes to the Caller: `build-release-task.yml` declares no job-level `permissions:` on `build-nuget` or `github-release`, since a called job's block is validated against the caller's grant before its `if:` and failed the hub's own release at startup (run 31972504539 on `82fecef`). The caller grants what its enabled paths write with. - #771 Bump astral-sh/setup-uv from 8.1.0 to 10.0.0 (Dependabot, auto-merged to `develop` by the App through the hub-hosted merge-bot task, run 31972622149, the same bump #770 merged to `main` through it, run 31972611554, so both live proofs of the stage-0 tracker are in). The release dispatched after this merge is the live proof of the scope fix: the hub's `publish` job grants `contents: write` and `actions: write`, every target is disabled, and `github-release` must run and create the tag.
… Fix (#786) Promote `develop` to `main`, carrying: - #783 Drop IGNORE_GITHUB_REF From the Hosted Get-Version Task (the hosted task follows WORKFLOW.md D3.1 like the inline get-version job already does) - #778 Name the Executable Asset for Its Project and Record the PhotoCleaner Pilot (the executable default names its archive for the project file, the publish-release snippet and doc stub carry explicit permissions, PhotoCleaner ticked as the stage 2 and 4 pilot) - #775 Record 2.0.352 in the Reusable-Workflow Rollout and Add Its Catalog Snippets - #773 Expand references/ in large skill files for progressive disclosure - #776 Make the linux host-setup scripts refuse more than one action - #782 Add PowerShell as an Optional Tool From the Microsoft Feed The release that follows is the pin PhotoCleaner's Dependabot bumps to, and PhotoCleaner's next release through it is the proof that the executable asset is named `PhotoCleaner.7z` again. Closes#769.
Promote `develop` to `main`, carrying: - #785 Add the token efficiency plan for issue 766 This promotion contains the documentation plan committed on `develop` since the previous promotion.
Bumps the actions-deps group with 1 update: [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv). Updates `astral-sh/setup-uv` from 10.0.0 to 10.0.1 - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@ae62891...20cfd1b) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 10.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-deps ... Signed-off-by: dependabot[bot] <support@github.com>
…up (#791) Bumps the actions-deps group with 1 update: [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv). Updates `astral-sh/setup-uv` from 10.0.0 to 10.0.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/setup-uv/releases">astral-sh/setup-uv's releases</a>.</em></p> <blockquote> <h2>v10.0.1 🌈 Tolerate transient manifest timeouts</h2> <h2>Changes</h2> <p>Thank you <a href="https://github.com/arguile"><code>@arguile</code></a>- for making this action more resilient.</p> <h2>🐛 Bug fixes</h2> <ul> <li>Tolerate transient manifest timeouts <a href="https://github.com/arguile"><code>@arguile</code></a>- (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1016">#1016</a>)</li> </ul> <h2>🧰 Maintenance</h2> <ul> <li>chore: update known checksums for 0.12.4 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1017">#1017</a>)</li> </ul> <h2>📚 Documentation</h2> <ul> <li>docs: update version references to v10.0.0 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1014">#1014</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/setup-uv/commit/20cfd1bf945f4377ade1205e4dbc17946fc9a30d"><code>20cfd1b</code></a> chore: update known checksums for 0.12.4 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1017">#1017</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/d73a0cab66a532d7afa440d9df4a67ea9fe65a30"><code>d73a0ca</code></a> Tolerate transient manifest timeouts (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1016">#1016</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/ae3b92d1bdb308a10adfe7b8f408e5cc8c30f3f6"><code>ae3b92d</code></a> docs: update version references to v10.0.0 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1014">#1014</a>)</li> <li>See full diff in <a href="https://github.com/astral-sh/setup-uv/compare/ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d...20cfd1bf945f4377ade1205e4dbc17946fc9a30d">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details>
Promotes the current `develop` branch to `main`. Included changes: - test and document self-referenced reusable workflows and composite actions; - package workflow gate implementations with their actions while retaining local script entry points; - carry the already-reviewed dependency and host-setup changes currently on `develop`. Merge method: merge commit. Keep `develop`.
## Summary Promote the reviewed validation-documentation correction from `develop` to `main`. ## Included Change - State that each selected default action validates its own required inputs. - Keep caller-provided hooks independent of default-action input contracts. ## Validation - Feature PR #795 completed 7/7 checks. - Copilot reviewed the exact feature head with full diff coverage. - The single inline finding was fixed, answered, and resolved. This promotion does not publish a release.
Bumps the actions-deps group with 1 update: [streetsidesoftware/cspell-action](https://github.com/streetsidesoftware/cspell-action). Updates `streetsidesoftware/cspell-action` from 8.4.0 to 9.0.1 - [Release notes](https://github.com/streetsidesoftware/cspell-action/releases) - [Changelog](https://github.com/streetsidesoftware/cspell-action/blob/main/CHANGELOG.md) - [Commits](streetsidesoftware/cspell-action@de2a73e...e0668cf) --- updated-dependencies: - dependency-name: streetsidesoftware/cspell-action dependency-version: 9.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-deps ... Signed-off-by: dependabot[bot] <support@github.com>
…ons-deps group (#807) Bumps the actions-deps group with 1 update: [streetsidesoftware/cspell-action](https://github.com/streetsidesoftware/cspell-action). Updates `streetsidesoftware/cspell-action` from 8.4.0 to 9.0.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/streetsidesoftware/cspell-action/releases">streetsidesoftware/cspell-action's releases</a>.</em></p> <blockquote> <h2>v9.0.1</h2> <h2><a href="https://github.com/streetsidesoftware/cspell-action/compare/v9.0.0...v9.0.1">9.0.1</a> (2026-08-15)</h2> <h3>Updates and Bug Fixes</h3> <ul> <li>make sure the dictionaries are up to date. (<a href="https://redirect.github.com/streetsidesoftware/cspell-action/issues/2733">#2733</a>) (<a href="https://github.com/streetsidesoftware/cspell-action/commit/ed61a9ef501ef10e1857a1a852506743cc79913c">ed61a9e</a>)</li> </ul> <h2>v9.0.0</h2> <h2><a href="https://github.com/streetsidesoftware/cspell-action/compare/v8.4.0...v9.0.0">9.0.0</a> (2026-08-15)</h2> <h3>⚠ BREAKING CHANGES</h3> <ul> <li>Update CSpell version (10.0.0) (<a href="https://redirect.github.com/streetsidesoftware/cspell-action/issues/2675">#2675</a>)</li> </ul> <h3>Features</h3> <ul> <li>Update CSpell version (10.0.0) (<a href="https://redirect.github.com/streetsidesoftware/cspell-action/issues/2675">#2675</a>) (<a href="https://github.com/streetsidesoftware/cspell-action/commit/ad2c8811c41452c03875e40778bfffb824c5b46e">ad2c881</a>)</li> </ul> <h3>Updates and Bug Fixes</h3> <ul> <li>Update CSpell version (10.0.1) (<a href="https://redirect.github.com/streetsidesoftware/cspell-action/issues/2711">#2711</a>) (<a href="https://github.com/streetsidesoftware/cspell-action/commit/27dd4ca8ca703e4358a6d6359f28135cc2522eeb">27dd4ca</a>)</li> <li>Update Dictionaries and Dependencies (<a href="https://redirect.github.com/streetsidesoftware/cspell-action/issues/2717">#2717</a>) (<a href="https://github.com/streetsidesoftware/cspell-action/commit/7f801dad894c9650fe1448adae011f10488c7319">7f801da</a>)</li> <li>Update Dictionaries and Dependencies (<a href="https://redirect.github.com/streetsidesoftware/cspell-action/issues/2729">#2729</a>) (<a href="https://github.com/streetsidesoftware/cspell-action/commit/7a3024662c158b069170d64f5961cf5bfcfba8a5">7a30246</a>)</li> <li>Workflow Bot -- Update ALL Dependencies (main) (<a href="https://redirect.github.com/streetsidesoftware/cspell-action/issues/2676">#2676</a>) (<a href="https://github.com/streetsidesoftware/cspell-action/commit/927b1b484eb0b1a5d60be86898b3a3d37b768b60">927b1b4</a>)</li> <li>Workflow Bot -- Update ALL Dependencies (main) (<a href="https://redirect.github.com/streetsidesoftware/cspell-action/issues/2683">#2683</a>) (<a href="https://github.com/streetsidesoftware/cspell-action/commit/1130633c547e1a54423f755c13eb5ad32ad6cd84">1130633</a>)</li> <li>Workflow Bot -- Update ALL Dependencies (main) (<a href="https://redirect.github.com/streetsidesoftware/cspell-action/issues/2694">#2694</a>) (<a href="https://github.com/streetsidesoftware/cspell-action/commit/ec37533c2a3b3538c99017b53454ff5a5e06abd3">ec37533</a>)</li> <li>Workflow Bot -- Update ALL Dependencies (main) (<a href="https://redirect.github.com/streetsidesoftware/cspell-action/issues/2695">#2695</a>) (<a href="https://github.com/streetsidesoftware/cspell-action/commit/7dcf1206fe16820657ebc51459e6292c3e9efc96">7dcf120</a>)</li> <li>Workflow Bot -- Update ALL Dependencies (main) (<a href="https://redirect.github.com/streetsidesoftware/cspell-action/issues/2696">#2696</a>) (<a href="https://github.com/streetsidesoftware/cspell-action/commit/d552416f18f877a6508e5de33265bd6bbf1f51be">d552416</a>)</li> <li>Workflow Bot -- Update ALL Dependencies (main) (<a href="https://redirect.github.com/streetsidesoftware/cspell-action/issues/2710">#2710</a>) (<a href="https://github.com/streetsidesoftware/cspell-action/commit/f433a6252b1c9302284d950de2a903b9b372e03b">f433a62</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/streetsidesoftware/cspell-action/blob/main/CHANGELOG.md">streetsidesoftware/cspell-action's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <p>All notable changes to this project will be documented in this file. See <a href="https://github.com/conventional-changelog/standard-version">standard-version</a> for commit guidelines.</p> <h2><a href="https://github.com/streetsidesoftware/cspell-action/compare/v9.0.0...v9.0.1">9.0.1</a> (2026-08-15)</h2> <h3>Updates and Bug Fixes</h3> <ul> <li>make sure the dictionaries are up to date. (<a href="https://redirect.github.com/streetsidesoftware/cspell-action/issues/2733">#2733</a>) (<a href="https://github.com/streetsidesoftware/cspell-action/commit/ed61a9ef501ef10e1857a1a852506743cc79913c">ed61a9e</a>)</li> </ul> <h2><a href="https://github.com/streetsidesoftware/cspell-action/compare/v8.4.0...v9.0.0">9.0.0</a> (2026-08-15)</h2> <h3>⚠ BREAKING CHANGES</h3> <ul> <li>Update CSpell version (10.0.0) (<a href="https://redirect.github.com/streetsidesoftware/cspell-action/issues/2675">#2675</a>)</li> </ul> <h3>Features</h3> <ul> <li>Update CSpell version (10.0.0) (<a href="https://redirect.github.com/streetsidesoftware/cspell-action/issues/2675">#2675</a>) (<a href="https://github.com/streetsidesoftware/cspell-action/commit/ad2c8811c41452c03875e40778bfffb824c5b46e">ad2c881</a>)</li> </ul> <h3>Updates and Bug Fixes</h3> <ul> <li>Update CSpell version (10.0.1) (<a href="https://redirect.github.com/streetsidesoftware/cspell-action/issues/2711">#2711</a>) (<a href="https://github.com/streetsidesoftware/cspell-action/commit/27dd4ca8ca703e4358a6d6359f28135cc2522eeb">27dd4ca</a>)</li> <li>Update Dictionaries and Dependencies (<a href="https://redirect.github.com/streetsidesoftware/cspell-action/issues/2717">#2717</a>) (<a href="https://github.com/streetsidesoftware/cspell-action/commit/7f801dad894c9650fe1448adae011f10488c7319">7f801da</a>)</li> <li>Update Dictionaries and Dependencies (<a href="https://redirect.github.com/streetsidesoftware/cspell-action/issues/2729">#2729</a>) (<a href="https://github.com/streetsidesoftware/cspell-action/commit/7a3024662c158b069170d64f5961cf5bfcfba8a5">7a30246</a>)</li> <li>Workflow Bot -- Update ALL Dependencies (main) (<a href="https://redirect.github.com/streetsidesoftware/cspell-action/issues/2676">#2676</a>) (<a href="https://github.com/streetsidesoftware/cspell-action/commit/927b1b484eb0b1a5d60be86898b3a3d37b768b60">927b1b4</a>)</li> <li>Workflow Bot -- Update ALL Dependencies (main) (<a href="https://redirect.github.com/streetsidesoftware/cspell-action/issues/2683">#2683</a>) (<a href="https://github.com/streetsidesoftware/cspell-action/commit/1130633c547e1a54423f755c13eb5ad32ad6cd84">1130633</a>)</li> <li>Workflow Bot -- Update ALL Dependencies (main) (<a href="https://redirect.github.com/streetsidesoftware/cspell-action/issues/2694">#2694</a>) (<a href="https://github.com/streetsidesoftware/cspell-action/commit/ec37533c2a3b3538c99017b53454ff5a5e06abd3">ec37533</a>)</li> <li>Workflow Bot -- Update ALL Dependencies (main) (<a href="https://redirect.github.com/streetsidesoftware/cspell-action/issues/2695">#2695</a>) (<a href="https://github.com/streetsidesoftware/cspell-action/commit/7dcf1206fe16820657ebc51459e6292c3e9efc96">7dcf120</a>)</li> <li>Workflow Bot -- Update ALL Dependencies (main) (<a href="https://redirect.github.com/streetsidesoftware/cspell-action/issues/2696">#2696</a>) (<a href="https://github.com/streetsidesoftware/cspell-action/commit/d552416f18f877a6508e5de33265bd6bbf1f51be">d552416</a>)</li> <li>Workflow Bot -- Update ALL Dependencies (main) (<a href="https://redirect.github.com/streetsidesoftware/cspell-action/issues/2710">#2710</a>) (<a href="https://github.com/streetsidesoftware/cspell-action/commit/f433a6252b1c9302284d950de2a903b9b372e03b">f433a62</a>)</li> </ul> <h2><a href="https://github.com/streetsidesoftware/cspell-action/compare/v8.3.0...v8.4.0">8.4.0</a> (2026-04-05)</h2> <h3>Features</h3> <ul> <li>Update CSpell version (9.8.0) (<a href="https://redirect.github.com/streetsidesoftware/cspell-action/issues/2674">#2674</a>) (<a href="https://github.com/streetsidesoftware/cspell-action/commit/fdcf3bab72b55ae5d9444f987b8d596960c093cc">fdcf3ba</a>)</li> </ul> <h3>Updates and Bug Fixes</h3> <ul> <li>Update Dictionaries and Dependencies (<a href="https://redirect.github.com/streetsidesoftware/cspell-action/issues/2628">#2628</a>) (<a href="https://github.com/streetsidesoftware/cspell-action/commit/356d6ad5a4f6dbd9411e5af7a97b4fb6f8a2401d">356d6ad</a>)</li> <li>Update Dictionaries and Dependencies (<a href="https://redirect.github.com/streetsidesoftware/cspell-action/issues/2634">#2634</a>) (<a href="https://github.com/streetsidesoftware/cspell-action/commit/4d2f4fd6311e34b3ae1c4b95bbff649cf8cead85">4d2f4fd</a>)</li> <li>Update Dictionaries and Dependencies (<a href="https://redirect.github.com/streetsidesoftware/cspell-action/issues/2642">#2642</a>) (<a href="https://github.com/streetsidesoftware/cspell-action/commit/21dee0c4a9988af996af6aaea4d5a74292acf071">21dee0c</a>)</li> <li>Update Dictionaries and Dependencies (<a href="https://redirect.github.com/streetsidesoftware/cspell-action/issues/2657">#2657</a>) (<a href="https://github.com/streetsidesoftware/cspell-action/commit/3f8d667b78425b21b07f87f8e3e94bf3e7e484d6">3f8d667</a>)</li> <li>Update Dictionaries and Dependencies (<a href="https://redirect.github.com/streetsidesoftware/cspell-action/issues/2661">#2661</a>) (<a href="https://github.com/streetsidesoftware/cspell-action/commit/e15595b0eac2f375846ab553ba1deae0868e24a6">e15595b</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/streetsidesoftware/cspell-action/commit/e0668cf020899e887ee8ad4d173c31738a79eae8"><code>e0668cf</code></a> chore(main): release 9.0.1 (<a href="https://redirect.github.com/streetsidesoftware/cspell-action/issues/2734">#2734</a>)</li> <li><a href="https://github.com/streetsidesoftware/cspell-action/commit/ed61a9ef501ef10e1857a1a852506743cc79913c"><code>ed61a9e</code></a> fix: make sure the dictionaries are up to date. (<a href="https://redirect.github.com/streetsidesoftware/cspell-action/issues/2733">#2733</a>)</li> <li><a href="https://github.com/streetsidesoftware/cspell-action/commit/a670ca8616c79069394da60e3cc71d6edb1f91c2"><code>a670ca8</code></a> chore(main): release 9.0.0 (<a href="https://redirect.github.com/streetsidesoftware/cspell-action/issues/2682">#2682</a>)</li> <li><a href="https://github.com/streetsidesoftware/cspell-action/commit/7319e02e30249e4faa815ab45e2f33b79739d3c8"><code>7319e02</code></a> ci: Workflow Bot -- Update ALL Dependencies (main) (<a href="https://redirect.github.com/streetsidesoftware/cspell-action/issues/2732">#2732</a>)</li> <li><a href="https://github.com/streetsidesoftware/cspell-action/commit/ffbcf8f2d48ef758a78e2a14e7136bdaa995731f"><code>ffbcf8f</code></a> chore: Set pnpm minimumReleaseAge (<a href="https://redirect.github.com/streetsidesoftware/cspell-action/issues/2731">#2731</a>)</li> <li><a href="https://github.com/streetsidesoftware/cspell-action/commit/c48ca1c435546d78d9fc08f8197e6c7e98dc509b"><code>c48ca1c</code></a> chore: Update PNPM (<a href="https://redirect.github.com/streetsidesoftware/cspell-action/issues/2664">#2664</a>)</li> <li><a href="https://github.com/streetsidesoftware/cspell-action/commit/c223c969c98cabda0e9a4673f90a1415b404d120"><code>c223c96</code></a> chore(deps-dev): bump tsdown from 0.21.10 to 0.22.14 (<a href="https://redirect.github.com/streetsidesoftware/cspell-action/issues/2721">#2721</a>)</li> <li><a href="https://github.com/streetsidesoftware/cspell-action/commit/f433a6252b1c9302284d950de2a903b9b372e03b"><code>f433a62</code></a> fix: Workflow Bot -- Update ALL Dependencies (main) (<a href="https://redirect.github.com/streetsidesoftware/cspell-action/issues/2710">#2710</a>)</li> <li><a href="https://github.com/streetsidesoftware/cspell-action/commit/7a3024662c158b069170d64f5961cf5bfcfba8a5"><code>7a30246</code></a> fix: Update Dictionaries and Dependencies (<a href="https://redirect.github.com/streetsidesoftware/cspell-action/issues/2729">#2729</a>)</li> <li><a href="https://github.com/streetsidesoftware/cspell-action/commit/7f801dad894c9650fe1448adae011f10488c7319"><code>7f801da</code></a> fix: Update Dictionaries and Dependencies (<a href="https://redirect.github.com/streetsidesoftware/cspell-action/issues/2717">#2717</a>)</li> <li>Additional commits viewable in <a href="https://github.com/streetsidesoftware/cspell-action/compare/de2a73e963e7443969755b648a1008f77033c5b2...e0668cf020899e887ee8ad4d173c31738a79eae8">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details>
## Summary Promote the reviewed changes from `develop` to `main`. ## Included Changes - Add the manifest-driven verbatim tree carry engine and downstream Copilot skill distribution. - Refactor Copilot review instructions and generated skills. - Route GitHub writes through portable tooling and make agent workflows sandbox-aware. - Add ripgrep to the managed host tools. - Carry the reviewed CSpell dependency update. ## Validation - Ruff and mypy passed. - All 727 Python tests passed. - Audit and GitHub write-guard self-tests passed. - Distribution, repository, prose, JSON, and specification gates passed. - The carry engine was exercised against PhotoCleaner with matching post-apply tree digests and a clean idempotent check. This promotion uses a merge commit, keeps `develop`, and does not publish a release.
## Summary - promote the current `develop` branch to `main` - include the worktree hook preparation guidance from #815 - distribute the updated `repo-worktree` skill to downstream Copilot reviewers ## Verification - #815 passed all required checks - Copilot reviewed the current #815 head and full diff with no findings - the full local verification chain passed before #815 was merged Closesptr727/PhotoCleaner#61
## Summary - promote the current `develop` branch to `main` - release the clarified hub-checkout requirement for the review helper - unblock the corrected carried skill in PhotoCleaner PR #69 ## Verification - #817 passed the full local verification chain and all required checks - Copilot reviewed the current #817 head and full diff with no findings
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the PR review procedure text to treat the “wait for review” guidance as a single step, reducing ambiguity in the review loop and keeping the distributed skill copies in sync.
Changes:
- Combine the review wait command and its terminal-outcome guidance into step 4, then renumber subsequent steps.
- Regenerate the mirrored skill copies for agent and Claude distributions.
- Update the Claude fleet-skills source digest to match the regenerated content.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| .github/skills/pr-review-conduct/SKILL.md | Combines the “wait” guidance into a single step and renumbers the remaining review-loop steps. |
| .agents/skills/pr-review-conduct/SKILL.md | Mirrors the same review-loop step consolidation and renumbering for the agent skill distribution. |
| .claude-plugin/fleet-skills/skills/pr-review-conduct/SKILL.md | Mirrors the same review-loop step consolidation and renumbering for the Claude skill distribution. |
| .claude-plugin/fleet-skills/.source-digest | Updates the digest to reflect the regenerated Claude fleet-skills content. |
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Uh oh!
There was an error while loading. Please reload this page.
Merged
ptr727 added a commit
that referenced
this pull request
Aug 18, 2026
## Summary - promote the current `develop` branch to `main` - release the unambiguous single-step review wait procedure - unblock the final carried-skill review fix in PhotoCleaner PR #69 ## Verification - #819 passed the full local verification chain and all required checks - Copilot reviewed the current #819 head and full diff with no findings
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Why
PhotoCleaner PR #69 exposed that two adjacent numbered steps both instructed the reader to wait. The second was explanatory text for the first, but its numbering made the procedure look like two separate waits.
Verification
OPERATIONS.mdlocal verification chain