From a8bfd7e263defd8831152d069b4bdc8139af4a14 Mon Sep 17 00:00:00 2001 From: Don Petry <36422719+don-petry@users.noreply.github.com> Date: Mon, 13 Jul 2026 06:39:52 -0500 Subject: [PATCH 1/8] chore: sync 8 org-standard workflow stub(s) from petry-projects/.github --- .github/workflows/pr-review-mention.yml | 16 ++-------------- 1 file changed, 2 insertions(+), 14 deletions(-) diff --git a/.github/workflows/pr-review-mention.yml b/.github/workflows/pr-review-mention.yml index 108495d4..8ea55616 100644 --- a/.github/workflows/pr-review-mention.yml +++ b/.github/workflows/pr-review-mention.yml @@ -35,19 +35,7 @@ permissions: {} jobs: pr-review-mention: - # Skip events whose sender is a Bot (e.g. the Copilot coding agent), marking - # the job skipped (= success) and preventing an unnecessary reusable workflow - # invocation. The mention / review-request flow is human-driven, so a bot - # sender never carries a legitimate review request. - # Limitation: this job-level guard cannot prevent a workflow-level - # `action_required` state — GitHub enforces that approval gate before any - # `if:` condition is evaluated (see issue #307 for context). For bots that - # trigger the repo's first-time-contributor approval requirement the proper - # mitigation is to allowlist the bot account in Settings → Actions → - # "Fork pull request workflows from outside collaborators". - # `github.event.sender` is populated on all three trigger events. - if: github.event.sender.type != 'Bot' permissions: pull-requests: write - uses: petry-projects/.github/.github/workflows/pr-review-mention-reusable.yml@pr-review-mention/stable # NOSONAR(githubactions:S7637) first-party channel ref - secrets: inherit \ No newline at end of file + uses: petry-projects/.github/.github/workflows/pr-review-mention-reusable.yml@pr-review-mention/v2-stable # NOSONAR(githubactions:S7637) first-party channel ref + secrets: inherit From 5f89526a7ae6bf79f9c5440b07ef5ca1a0a84356 Mon Sep 17 00:00:00 2001 From: Don Petry <36422719+don-petry@users.noreply.github.com> Date: Mon, 13 Jul 2026 06:39:58 -0500 Subject: [PATCH 2/8] chore: sync 8 org-standard workflow stub(s) from petry-projects/.github --- .github/workflows/dev-lead.yml | 28 +++++++++++++++++++++++----- 1 file changed, 23 insertions(+), 5 deletions(-) diff --git a/.github/workflows/dev-lead.yml b/.github/workflows/dev-lead.yml index 2a4d6205..4b90ceff 100644 --- a/.github/workflows/dev-lead.yml +++ b/.github/workflows/dev-lead.yml @@ -8,9 +8,22 @@ # 2. Ensure CLAUDE_CODE_OAUTH_TOKEN is set as an org or repo secret. # 3. Optionally set GH_PAT_WORKFLOWS (required if Claude pushes workflow files). # 4. Optionally set vars.DEV_LEAD_ENGINE = "claude" | "gemini" | "copilot". +# 5. SonarCloud-gated repo? Nothing to do — the `uses:` line below already +# carries the inline `# NOSONAR(githubactions:S7637)` marker. The ref is a +# first-party reusable pinned to a moving channel/ring tag, so without the +# marker SonarCloud's githubactions:S7637 would fail the Quality Gate. The +# marker travels with this file on copy; no sonar-project.properties entry +# is needed. See https://github.com/petry-projects/.github/blob/main/standards/ci-standards.md#sonarcloud-exemption-first-party-reusable-ref-s7637. # -# UNLIKE claude.yml, this file has NO OIDC byte-for-byte constraint and may be -# freely modified on PR branches to adjust triggers for repo-specific needs. +# This stub is copied VERBATIM and is full-file identical across every adopting +# repo, modulo the per-repo ring/channel pin on the `uses:` ref and its matching +# `agent_ref` (below). Any other diff is drift, not a repo-specific liberty: +# `on:`, `permissions:`, and `concurrency:` are NOT repo-adjustable — do not trim +# a trigger, narrow a permission, or add a concurrency block on a PR branch. The +# behavior lives in the reusable, so change it there (or via a standards PR) and +# let the channel tag promote it centrally — never by editing this caller. See +# https://github.com/petry-projects/.github/blob/main/standards/ci-standards.md#centralization-tiers and +# https://github.com/petry-projects/.github/blob/main/standards/ci-standards.md#reusable-workflow-versioning--the-stable-channel. # # REQUIRED secrets: CLAUDE_CODE_OAUTH_TOKEN # OPTIONAL secrets: GH_PAT_WORKFLOWS, GOOGLE_API_KEY, GH_PAT @@ -43,9 +56,14 @@ permissions: {} jobs: dev-lead: - uses: petry-projects/.github-private/.github/workflows/dev-lead-reusable.yml@dev-lead/stable # NOSONAR(githubactions:S7637) first-party channel ref + # Pinned to the moving dev-lead/stable channel tag, not @main, so a broken + # change to dev-lead can no longer gate its own fix (the self-host circular + # dependency). Promotion is done by moving the dev-lead/stable tag centrally; this + # caller is never edited on release. agent_ref threads the same channel into + # dev-lead's own scripts/prompts checkout. See https://github.com/petry-projects/.github/blob/main/standards/ci-standards.md#dev-lead-agent. + uses: petry-projects/.github-private/.github/workflows/dev-lead-reusable.yml@dev-lead/v1-stable # NOSONAR(githubactions:S7637) first-party channel ref with: - agent_ref: dev-lead/stable + agent_ref: dev-lead/v1-stable secrets: inherit permissions: contents: write @@ -53,4 +71,4 @@ jobs: issues: write actions: read checks: read - statuses: read \ No newline at end of file + statuses: read From 88da09deae2973fc514f53256cc2980565d3953c Mon Sep 17 00:00:00 2001 From: Don Petry <36422719+don-petry@users.noreply.github.com> Date: Mon, 13 Jul 2026 06:39:59 -0500 Subject: [PATCH 3/8] chore: sync 8 org-standard workflow stub(s) from petry-projects/.github --- .github/workflows/agent-shield.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/agent-shield.yml b/.github/workflows/agent-shield.yml index 42a73bd8..5887d518 100644 --- a/.github/workflows/agent-shield.yml +++ b/.github/workflows/agent-shield.yml @@ -30,4 +30,4 @@ permissions: jobs: agent-shield: - uses: petry-projects/.github/.github/workflows/agent-shield-reusable.yml@agent-shield/stable # NOSONAR(githubactions:S7637) first-party channel ref \ No newline at end of file + uses: petry-projects/.github/.github/workflows/agent-shield-reusable.yml@agent-shield/v2-stable # NOSONAR(githubactions:S7637) first-party channel ref From b324b761df7b3e4862d3478c24b2677b2ebd3221 Mon Sep 17 00:00:00 2001 From: Don Petry <36422719+don-petry@users.noreply.github.com> Date: Mon, 13 Jul 2026 06:40:01 -0500 Subject: [PATCH 4/8] chore: sync 8 org-standard workflow stub(s) from petry-projects/.github --- .github/workflows/auto-rebase.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/auto-rebase.yml b/.github/workflows/auto-rebase.yml index 75112547..7c6f8289 100644 --- a/.github/workflows/auto-rebase.yml +++ b/.github/workflows/auto-rebase.yml @@ -50,5 +50,5 @@ jobs: permissions: contents: write # update-branch via GITHUB_TOKEN (may touch .github/workflows/) pull-requests: write # post comments on PRs - uses: petry-projects/.github/.github/workflows/auto-rebase-reusable.yml@auto-rebase/stable # NOSONAR(githubactions:S7637) first-party channel ref - secrets: inherit \ No newline at end of file + uses: petry-projects/.github/.github/workflows/auto-rebase-reusable.yml@auto-rebase/v2-stable # NOSONAR(githubactions:S7637) first-party channel ref + secrets: inherit From 55ee6b0d111c521201b0390e0224b9f8119368f0 Mon Sep 17 00:00:00 2001 From: Don Petry <36422719+don-petry@users.noreply.github.com> Date: Mon, 13 Jul 2026 06:40:03 -0500 Subject: [PATCH 5/8] chore: sync 8 org-standard workflow stub(s) from petry-projects/.github --- .github/workflows/dependabot-automerge.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml index 8caa29be..0a19abc7 100644 --- a/.github/workflows/dependabot-automerge.yml +++ b/.github/workflows/dependabot-automerge.yml @@ -35,5 +35,5 @@ jobs: permissions: contents: read pull-requests: read - uses: petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml@dependabot-automerge/stable # NOSONAR(githubactions:S7637) first-party channel ref - secrets: inherit \ No newline at end of file + uses: petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml@dependabot-automerge/v2-stable # NOSONAR(githubactions:S7637) first-party channel ref + secrets: inherit From 01f224d5862571d972e77241bf5aa69bf2f02f67 Mon Sep 17 00:00:00 2001 From: Don Petry <36422719+don-petry@users.noreply.github.com> Date: Mon, 13 Jul 2026 06:40:09 -0500 Subject: [PATCH 6/8] chore: sync 8 org-standard workflow stub(s) from petry-projects/.github --- .github/workflows/dependabot-rebase.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/dependabot-rebase.yml b/.github/workflows/dependabot-rebase.yml index fb4d235e..c40be95e 100644 --- a/.github/workflows/dependabot-rebase.yml +++ b/.github/workflows/dependabot-rebase.yml @@ -50,7 +50,7 @@ jobs: permissions: contents: write # update-branch via GITHUB_TOKEN (may touch .github/workflows/) pull-requests: write # re-approve PRs after branch update - uses: petry-projects/.github/.github/workflows/dependabot-rebase-reusable.yml@dependabot-rebase/stable # NOSONAR(githubactions:S7637) first-party channel ref + uses: petry-projects/.github/.github/workflows/dependabot-rebase-reusable.yml@dependabot-rebase/v2-stable # NOSONAR(githubactions:S7637) first-party channel ref secrets: APP_ID: ${{ secrets.APP_ID }} - APP_PRIVATE_KEY: ${{ secrets.APP_PRIVATE_KEY }} \ No newline at end of file + APP_PRIVATE_KEY: ${{ secrets.APP_PRIVATE_KEY }} From 320b1cc3484b6928ee9e9f6df3332714a711dd54 Mon Sep 17 00:00:00 2001 From: Don Petry <36422719+don-petry@users.noreply.github.com> Date: Mon, 13 Jul 2026 06:40:10 -0500 Subject: [PATCH 7/8] chore: sync 8 org-standard workflow stub(s) from petry-projects/.github --- .github/workflows/dependency-audit.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/dependency-audit.yml b/.github/workflows/dependency-audit.yml index a4db5834..80b7b90b 100644 --- a/.github/workflows/dependency-audit.yml +++ b/.github/workflows/dependency-audit.yml @@ -1,6 +1,6 @@ # ───────────────────────────────────────────────────────────────────────────── # SOURCE OF TRUTH: petry-projects/.github/standards/workflows/dependency-audit.yml -# Standard: petry-projects/.github/standards/ci-standards.md#5-dependency-audit-dependency-auditym +# Standard: petry-projects/.github/standards/ci-standards.md#7-dependency-audit-dependency-audityml # Reusable: petry-projects/.github/.github/workflows/dependency-audit-reusable.yml # # AGENTS — READ BEFORE EDITING: @@ -30,4 +30,4 @@ permissions: jobs: dependency-audit: - uses: petry-projects/.github/.github/workflows/dependency-audit-reusable.yml@dependency-audit/stable # NOSONAR(githubactions:S7637) first-party channel ref \ No newline at end of file + uses: petry-projects/.github/.github/workflows/dependency-audit-reusable.yml@dependency-audit/v2-stable # NOSONAR(githubactions:S7637) first-party channel ref From 4b29c2923ec95dc8fdd943363c40b1c39790e07d Mon Sep 17 00:00:00 2001 From: Don Petry <36422719+don-petry@users.noreply.github.com> Date: Mon, 13 Jul 2026 06:40:16 -0500 Subject: [PATCH 8/8] chore: sync 8 org-standard workflow stub(s) from petry-projects/.github --- .github/workflows/add-to-project.yml | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-) diff --git a/.github/workflows/add-to-project.yml b/.github/workflows/add-to-project.yml index b5b28cdf..49fdfca4 100644 --- a/.github/workflows/add-to-project.yml +++ b/.github/workflows/add-to-project.yml @@ -16,9 +16,10 @@ # • If you need different behaviour, open a PR against the reusable. # ───────────────────────────────────────────────────────────────────────────── # -# Auto-add this repo's qualifying issues, PRs, and Ideas-category discussions -# to the org-level Initiatives project -# (https://github.com/orgs/petry-projects/projects/1). +# Track this repo's issues (all, un-gated) and dev-lead-labeled PRs on the +# org-level Initiatives project +# (https://github.com/orgs/petry-projects/projects/1). Ideas live in +# Discussions and are not tracked here. # # To adopt: copy this file to .github/workflows/add-to-project.yml in your # repo. Requires the org secrets INITIATIVES_APP_ID and @@ -26,7 +27,6 @@ # app installation must include this repo. See petry-projects/.github#387. # # Tracking: petry-projects/.github#387, #415 -# Discussion: petry-projects/.github#386 name: Auto-add to Initiatives project on: @@ -34,16 +34,12 @@ on: types: [opened, labeled, unlabeled, reopened] pull_request_target: types: [opened, labeled, unlabeled, reopened, ready_for_review] - discussion: - types: [created, category_changed, deleted, transferred] permissions: {} concurrency: group: >- - add-to-project-${{ github.event_name == 'discussion' - && format('disc-{0}', github.event.discussion.number) - || format('{0}-{1}', github.event_name, + add-to-project-${{ format('{0}-{1}', github.event_name, github.event.issue.number || github.event.pull_request.number) }} cancel-in-progress: false @@ -60,4 +56,4 @@ jobs: # `secrets: inherit` handing the reusable every org secret). secrets: INITIATIVES_APP_ID: ${{ secrets.INITIATIVES_APP_ID }} - INITIATIVES_APP_PRIVATE_KEY: ${{ secrets.INITIATIVES_APP_PRIVATE_KEY }} \ No newline at end of file + INITIATIVES_APP_PRIVATE_KEY: ${{ secrets.INITIATIVES_APP_PRIVATE_KEY }}