Bump hub reusable-workflow pins to 2.0.518

[ptr727]

Summary

Bumps the pinned validate-task.yml/merge-bot-task.yml/publish-plan-task.yml/
build-release-task.yml SHAs from 2.0.483 to the current hub main (2.0.518), and fixes a
semicolon in OPERATIONS.md prose.

Why

The 2.0.483 pin predates ptr727/ProjectTemplate#1030 (7787662), which added the now-retired
spec/secrets.json to prose_lint.py's HUB_HOSTED dead-path exemption set. Until the pin
catches up, every prose mention of that path (correctly describing it as no longer carried
locally, in AUDIT.md, GOVERNANCE.md, OPERATIONS.md, WORKFLOW.md) fails the Lint sources job's dead-path check, surfaced while driving #116's promotion PR (main's ruleset requires that
check, develop's doesn't).

Verified locally: prose_lint.py --diff aa192d2 -- . (the exact base #116 runs against) reports
zero violations after this change.

[coderabbitai]

Warning

Review limit reached

Next included review available in 1 minute.

View limit details

Limit details: You’ve used all 10 included reviews currently available.

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 8fedda51-5286-4f70-9814-ec63a58b89c2

📥 Commits

Reviewing files that changed from the base of the PR and between 3ffc7cc and e251cd5.

📒 Files selected for processing (4)

• .github/workflows/merge-bot-pull-request.yml
• .github/workflows/publish-release.yml
• .github/workflows/test-pull-request.yml
• OPERATIONS.md

---

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-code-review]

PR Summary by Qodo

Update hub reusable-workflow pins to 2.0.518

⚙️ Configuration changes 📝 Documentation 🕐 Less than 10 minutes

AI Description

• Advances all hub reusable-workflow pins to 2.0.518 for current validation behavior.
• Restores dead-path linting exemptions for retired hub-hosted files during main promotion.
• Corrects OPERATIONS.md punctuation flagged by prose lint.

Diagram

graph TD
  E["GitHub Events"] --> M["Merge Caller"] --> H["Hub 2.0.518"] --> L["Prose Lint"]
  E --> T["PR Validation"] --> H
  E --> P["Release Pipeline"] --> H

Loading

High-Level Assessment

Updating every caller to the same immutable upstream SHA is the appropriate approach: it preserves reproducibility while consuming the centralized lint exemption. Floating refs weaken supply-chain integrity, while a local lint workaround would duplicate already-corrected hub behavior.

Files changed (4) +6 / -6

Documentation (1) +1 / -1

OPERATIONS.mdCorrect ruleset guidance punctuation +1/-1

Correct ruleset guidance punctuation

• Replaces a semicolon with a period between independent statements in the ruleset tooling guidance, satisfying prose lint.

OPERATIONS.md

Other (3) +5 / -5

merge-bot-pull-request.ymlPin merge-bot workflow to hub 2.0.518 +1/-1

Pin merge-bot workflow to hub 2.0.518

• Updates the reusable merge-bot task from ProjectTemplate 2.0.483 to the immutable 2.0.518 commit.

.github/workflows/merge-bot-pull-request.yml

publish-release.ymlPin release workflows to hub 2.0.518 +3/-3

Pin release workflows to hub 2.0.518

• Moves release planning, source validation, and release building to the ProjectTemplate 2.0.518 commit. This keeps every stage of the release pipeline on one hub revision.

.github/workflows/publish-release.yml

test-pull-request.ymlUse updated hub validation workflow +1/-1

Use updated hub validation workflow

• Updates pull-request source validation to ProjectTemplate 2.0.518, including the corrected dead-path exemption for retired hub-hosted files.

.github/workflows/test-pull-request.yml

[Copilot]

🟢 Approval recommended

The changes are limited to workflow SHA pin updates and a minor documentation punctuation fix with no apparent functional regressions in the local workflow definitions.

Pull request overview

Updates this repo’s GitHub Actions workflows to use the latest pinned hub reusable workflows (ProjectTemplate 2.0.518), aligning CI behavior with current hub main, and makes a small prose tweak in OPERATIONS.md.

Changes:

• Bump ProjectTemplate reusable-workflow pins from 2.0.483 to 2.0.518 across CI workflows.
• Minor punctuation/prose adjustment in OPERATIONS.md in the “Repository Tooling Hazards” section.

File summaries

File	Description
OPERATIONS.md	Rewords a sentence to remove the semicolon and improve readability without changing meaning.
.github/workflows/test-pull-request.yml	Updates validate-task.yml pin to the 2.0.518 SHA.
.github/workflows/publish-release.yml	Updates publish-plan-task.yml, validate-task.yml, and build-release-task.yml pins to the 2.0.518 SHA.
.github/workflows/merge-bot-pull-request.yml	Updates merge-bot-task.yml pin to the 2.0.518 SHA.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can group findings by type and pick your Finding display, from Minimal to Full

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗