diff --git a/.github/workflows/merge-bot-pull-request.yml b/.github/workflows/merge-bot-pull-request.yml index 359dac0..61bcac0 100644 --- a/.github/workflows/merge-bot-pull-request.yml +++ b/.github/workflows/merge-bot-pull-request.yml @@ -19,7 +19,7 @@ jobs: merge-bot: name: Merge bot pull request job - uses: ptr727/ProjectTemplate/.github/workflows/merge-bot-task.yml@a33d7d77ffa7f6af52cddce01f7250be282546ed # 2.0.483 + uses: ptr727/ProjectTemplate/.github/workflows/merge-bot-task.yml@32582848ffb0505e1044e5552b5ed94c32500c57 # 2.0.518 secrets: CODEGEN_APP_CLIENT_ID: ${{ secrets.CODEGEN_APP_CLIENT_ID }} CODEGEN_APP_PRIVATE_KEY: ${{ secrets.CODEGEN_APP_PRIVATE_KEY }} diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml index e68b0c9..08adcaf 100644 --- a/.github/workflows/publish-release.yml +++ b/.github/workflows/publish-release.yml @@ -28,7 +28,7 @@ jobs: plan: name: Plan release job needs: [assert-dispatch-ref] - uses: ptr727/ProjectTemplate/.github/workflows/publish-plan-task.yml@a33d7d77ffa7f6af52cddce01f7250be282546ed # 2.0.483 + uses: ptr727/ProjectTemplate/.github/workflows/publish-plan-task.yml@32582848ffb0505e1044e5552b5ed94c32500c57 # 2.0.518 with: event_name: ${{ github.event_name }} actor: ${{ github.actor }} @@ -38,7 +38,7 @@ jobs: name: Validate sources job needs: [plan] if: ${{ needs.plan.outputs.publish == 'true' }} - uses: ptr727/ProjectTemplate/.github/workflows/validate-task.yml@a33d7d77ffa7f6af52cddce01f7250be282546ed # 2.0.483 + uses: ptr727/ProjectTemplate/.github/workflows/validate-task.yml@32582848ffb0505e1044e5552b5ed94c32500c57 # 2.0.518 permissions: contents: read @@ -46,7 +46,7 @@ jobs: name: Publish project release job needs: [plan, validate] if: ${{ needs.plan.outputs.publish == 'true' && needs.validate.result == 'success' }} - uses: ptr727/ProjectTemplate/.github/workflows/build-release-task.yml@a33d7d77ffa7f6af52cddce01f7250be282546ed # 2.0.483 + uses: ptr727/ProjectTemplate/.github/workflows/build-release-task.yml@32582848ffb0505e1044e5552b5ed94c32500c57 # 2.0.518 permissions: contents: write actions: write diff --git a/.github/workflows/test-pull-request.yml b/.github/workflows/test-pull-request.yml index c298400..6e8f4b8 100644 --- a/.github/workflows/test-pull-request.yml +++ b/.github/workflows/test-pull-request.yml @@ -32,7 +32,7 @@ jobs: validate: name: Validate sources job - uses: ptr727/ProjectTemplate/.github/workflows/validate-task.yml@a33d7d77ffa7f6af52cddce01f7250be282546ed # 2.0.483 + uses: ptr727/ProjectTemplate/.github/workflows/validate-task.yml@32582848ffb0505e1044e5552b5ed94c32500c57 # 2.0.518 permissions: contents: read diff --git a/OPERATIONS.md b/OPERATIONS.md index 78c7c62..b1f20ab 100644 --- a/OPERATIONS.md +++ b/OPERATIONS.md @@ -478,7 +478,7 @@ The steps below run ESPHome outside the live instance, on a workstation, which i Sharp edges in the tooling around this repository, each one learned by tripping over it. - **Never build a GitHub comment or reply body inside a double-quoted shell string.** Write it to a file and pass `--body-file`, or `-F body=@file` on a REST call. Backticks in a double-quoted string are command substitution, so a body that mentions a path in code formatting **executes that path**. This is not theoretical: a review reply naming the ruleset apply script in code formatting **executed** it, back when this repository carried its own copy, and that script writes by default, so the posted comment came out with its code spans replaced by command output. Escaping each backtick works and is one missed backslash from repeating the incident. The hazard is the shell's, not that script's, so it survives the copy being retired. -- **The ruleset apply script writes unless told otherwise, and it is hub-hosted rather than carried here.** Run it from a hub checkout and name this repository explicitly, since it otherwise targets whichever repository the shell is sitting in. Its default mode PATCHes repository settings, toggles Dependabot features, and PUTs both branch rulesets. Pass its `check` mode for read-only validation, which is what you almost always want. The payloads it compares against are the hub's own committed `repo-config/` files; this repository carries no local copy, per [AUDIT.md "General Settings and Rulesets"][audit-general-settings-and-rulesets]. +- **The ruleset apply script writes unless told otherwise, and it is hub-hosted rather than carried here.** Run it from a hub checkout and name this repository explicitly, since it otherwise targets whichever repository the shell is sitting in. Its default mode PATCHes repository settings, toggles Dependabot features, and PUTs both branch rulesets. Pass its `check` mode for read-only validation, which is what you almost always want. The payloads it compares against are the hub's own committed `repo-config/` files. This repository carries no local copy, per [AUDIT.md "General Settings and Rulesets"][audit-general-settings-and-rulesets]. - **This file uses reference-style links, and it is the one file in this repository that should not.** The fleet rule allows four agent-instruction files to keep inline links, [`AGENTS.md`][agents], [`GOVERNANCE.md`][governance], this one, and `.github/copilot-instructions.md`, on the grounds that they are read one section at a time so a definition at the foot of the file is never reached. The other three take that allowance and this one does not, which is a divergence to close deliberately rather than incidentally. Every other Markdown file in the repository is reference-style by the rule rather than by exception. Definitions live at the bottom of the file, grouped under `` and `` and alphabetized within each group. A reference name encodes what it points at, so `analog-max17048-link`, never `analog-en-products-link` after a URL path segment. Removing a link also removes its definition, since an orphan fails the lint. - **Inline HTML is limited to `
` and ``.** Those two are allowed because a collapsible has no markdown equivalent. Every other element still fails `MD033`, and that includes a `` nested inside a `` - use a markdown code span there instead. - **The spell-check gate covers `**/README.md` plus [`DEVICES.md`][devices] and `HISTORY.md`**, wider than the fleet default, so a nested README fails CI like any other. The CI workflow and the `Lint: Spelling` task carry the identical list.