chore: sync workflow templates

[stranske]

Sync Summary

Files Updated

• agents-guard.yml: Agents guard - enforces agents workflow protections (Health 45)
• agents-auto-pilot.yml: Auto-pilot - end-to-end automation orchestrator (format → optimize → agent → verify)
• maint-76-claude-code-review.yml: Claude Code review (opt-in) - runs only on labeled PRs or manual dispatch
• artifact-cache/ (1 files): Restores, discovers, and caches workflow artifacts by daily, weekly, or run window
• ds_streamlit.py: Streamlit adapter for the design system (inject_theme/empty_state/notice/error/translate_error/dev_note/availability_badge/humanize_id) so Streamlit apps consume the same presentation patterns.
• README.md: Design-system usage guide: how to apply the theme + components/kit per app type.

Files Skipped

• pr-00-gate.yml: File exists and sync_mode is create_only
• ci.yml: File exists and sync_mode is create_only
• renovate.json: File exists and sync_mode is create_only
• cross-repo-smoke.yml: File exists and sync_mode is create_only
• llm_slots.json: None

---

Review Checklist

• CI passes with updated workflows
• No repo-specific customizations were overwritten

Source: stranske/Workflows
Source SHA: f329dbdf3612922fab25b8d002b802c5f3ef7186
Template hash: 2dc5f6ceac12
Sync branch: sync/workflows-2dc5f6ceac12
Consumer repo: stranske/Collab-Admin
Manifest: .github/sync-manifest.yml

Summary by CodeRabbit

Release Notes

• Documentation

  • Updated design system maintenance guidance and propagation process.

• Chores

  • Updated GitHub Actions versions across CI/CD workflows for improved stability and performance.

• Refactor

  • Improved ID display logic in Streamlit adapter for better readability.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: c28140e8-7b0d-4aa2-9275-48f30de59b57

📥 Commits

Reviewing files that changed from the base of the PR and between 6f895ba and fe9116f.

📒 Files selected for processing (6)

• .github/actions/artifact-cache/action.yml
• .github/workflows/agents-auto-pilot.yml
• .github/workflows/agents-guard.yml
• .github/workflows/maint-76-claude-code-review.yml
• design-system/README.md
• design-system/ds_streamlit.py

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• stranske/Workflows (auto-detected)
• stranske/Template (auto-detected)

📜 Recent review details

🧰 Additional context used

📓 Path-based instructions (7)

{pyproject.toml,.github/workflows/*.{yml,yaml}}

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

{pyproject.toml,.github/workflows/*.{yml,yaml}}: Ensure coverage thresholds in pyproject.toml ([tool.coverage.report] fail_under) match the coverage-min settings in CI workflow files to avoid threshold conflicts
The Manager-Database repository has a coverage threshold of 75%

Files:

• .github/workflows/agents-auto-pilot.yml
• .github/workflows/maint-76-claude-code-review.yml
• .github/workflows/agents-guard.yml

.github/workflows/*.{yml,yaml}

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

When a GitHub Actions workflow fails with startup_failure, check for invalid YAML syntax, top-level permissions: blocks on workflow_call reusable workflows (which conflicts with caller permissions), invalid permission scopes, or circular workflow references

Files:

• .github/workflows/agents-auto-pilot.yml
• .github/workflows/maint-76-claude-code-review.yml
• .github/workflows/agents-guard.yml

.github/workflows/**/*.yml

📄 CodeRabbit inference engine (CLAUDE.md)

Reference reusable workflows with @main to match first-party consumer defaults, unless intentionally pinning to an exact commit SHA for a controlled reason.

Files:

• .github/workflows/agents-auto-pilot.yml
• .github/workflows/maint-76-claude-code-review.yml
• .github/workflows/agents-guard.yml

.github/workflows/agents-*.yml

📄 CodeRabbit inference engine (CLAUDE.md)

Synced workflows (agents-*.yml, autofix.yml) should be fixed in stranske/Workflows, not locally in the consumer repo.

Files:

• .github/workflows/agents-auto-pilot.yml
• .github/workflows/agents-guard.yml

.github/workflows/*.yml

📄 CodeRabbit inference engine (AGENTS.md)

First-party consumers should reference reusable workflows with @main unless intentionally pinning to an exact commit SHA for a controlled reason.

Files:

• .github/workflows/agents-auto-pilot.yml
• .github/workflows/maint-76-claude-code-review.yml
• .github/workflows/agents-guard.yml

{.github/workflows/agents-*.yml,.github/workflows/autofix.yml,.github/codex/**/*.{md,txt,prompt},**/*.sync.*}

📄 CodeRabbit inference engine (AGENTS.md)

Synced workflow files, agent prompts, scripts, and consumer docs should be fixed in stranske/Workflows through the sync manifest, not edited locally.

Files:

• .github/workflows/agents-auto-pilot.yml
• .github/workflows/agents-guard.yml

**/*.py

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

In the Manager-Database repository, use Prefect 2.x and import schedules from prefect.client.schemas.schedules

Files:

• design-system/ds_streamlit.py

🪛 LanguageTool

design-system/README.md

[uncategorized] ~50-~50: The official name of this software platform is spelled with a capital “H”.
Context: ...r Repos GitHub Actions workflow through .github/sync-manifest.yml. Update the Workflow...

(GITHUB)

🔀 Multi-repo context stranske/Template, stranske/Workflows

Based on my exploration of the related repositories, I have sufficient cross-repo context to inform the review. Here are my findings:

Linked repositories findings

stranske/Template

Consumer of synced design-system files:

• design-system/ds_streamlit.py — This file is synced from stranske/Workflows/templates/consumer-repo/design-system/ds_streamlit.py. Template is marked as an overwrite_repos target in the sync-manifest, meaning it will receive updates to this file. [::stranske/Template::]
• The Template repo already has ds_streamlit.py with the new lazy streamlit import and refactored humanize_id() helper functions (_is_opaque_id_segment(), _is_opaque_id_token(), _HEX_CHARS, _UUID_RE). [::stranske/Template::]

Backward compatibility:

• No actual calls to humanize_id() or related helper functions are found in the Template repo codebase, suggesting these helpers are either: (1) intended for downstream Streamlit apps that consume this library, or (2) used conditionally in code not yet searched. [::stranske/Template::]
• The function signatures for public APIs (inject_theme(), empty_state(), error(), dev_note(), diagnostics_expander(), availability_badge(), humanize_id()) remain unchanged—only internal implementation details changed. [::stranske/Template::]

stranske/Workflows

Sync configuration:

• .github/sync-manifest.yml shows that design-system/ directory is synced to all consumer repos as part of the template sync process. Template is marked with overwrite_repos: [stranske/Template], so it will receive all updates to design system files. [::stranske/Workflows::]
• The agents-guard.yml workflow contains a fallback reference to stranske/Workflows/.github/actions/setup-api-client@6c3391d38bbc20a4577ac42b9aa6c9dc4e462c09, which is the same action SHA being updated in the consumers. [::stranske/Workflows::]

API action updates:

• artifact-cache action updated from actions/cache@v5 to actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 (v6). This is a source-of-truth update that will propagate to all consumers. [::stranske/Workflows::]
• setup-api-client action remains stable in the source—commit SHA 6c3391d38bbc20a4577ac42b9aa6c9dc4e462c09 is used for the fallback reference. [::stranske/Workflows::]

Key observation: The PR is updating Template (a consumer repo) by syncing the latest versions of files from Workflows. The design-system changes are refactoring internal ID humanization logic to detect opaque identifiers (UUIDs, long hex strings) and filter them out before formatting human-readable labels. These changes are backward compatible with the public API. [::stranske/Workflows::], [::stranske/Template::]

🔇 Additional comments (8)

design-system/README.md (1)

50-50: LGTM!

.github/actions/artifact-cache/action.yml (1)

62-62: LGTM!

.github/workflows/agents-auto-pilot.yml (1)

225-225: LGTM!

.github/workflows/agents-guard.yml (1)

114-114: LGTM!

Also applies to: 183-183

.github/workflows/maint-76-claude-code-review.yml (1)

192-192: LGTM!

design-system/ds_streamlit.py (3)

57-68: Lazy Streamlit accessor looks correct.

(?i) sits at the start of the pattern (valid on the project's runtime) and import_module("streamlit") resolves from sys.modules after the first import, so routing st through _streamlit() adds no meaningful overhead while deferring the import.

---

100-100: LGTM!

Also applies to: 121-121, 177-177

---

208-240: Opaque-id filtering is logically sound; apply any changes upstream.

The detectors are correct: pure-digit words are filtered by lowered.isdigit() before the token check, UUID/compact-hex segments are rejected, and the empty-segment guard returns True. The >=8 all-hex token rule can in theory drop a label made solely of a–f characters, but such English words of that length are vanishingly rare, so this is acceptable.

One process note: per the PR objectives and linked-repository findings, design-system/ds_streamlit.py is synced from stranske/Workflows/templates/consumer-repo/design-system/. Any future adjustment to this logic should be made in stranske/Workflows so it propagates fleet-wide rather than being edited locally in this consumer repo.

Source: Linked repositories

---

📝 Walkthrough

Walkthrough

Bumps pinned commit SHAs for actions/cache (v5→v6), stranske/Workflows setup-api-client, and anthropics/claude-code-action across four CI workflow files. Separately, refactors ds_streamlit.py to lazily import Streamlit via import_module, adds _HEX_CHARS/_UUID_RE constants plus _is_opaque_id_segment()/_is_opaque_id_token() helpers, updates _human_label_segment() to use them, and corrects the README template path.

Changes

CI Action Pin Updates

Layer / File(s)	Summary
actions/cache v5→v6 pin bump .github/actions/artifact-cache/action.yml, .github/workflows/agents-auto-pilot.yml	The actions/cache uses: reference is updated to a pinned v6 SHA in both the composite artifact-cache action and the agents-auto-pilot pip caching step.
setup-api-client SHA bump .github/workflows/agents-guard.yml	The pinned commit SHA for stranske/Workflows/.github/actions/setup-api-client is replaced in both the pull_request_target and pull_request event paths.
claude-code-action SHA bump .github/workflows/maint-76-claude-code-review.yml	The anthropics/claude-code-action pinned SHA in the claude-review step is replaced with a newer v1 commit hash.

Design System ds_streamlit Refactor

Layer / File(s)	Summary
Lazy import helper, constants, and inject_theme design-system/ds_streamlit.py	Adds re and import_module to imports, defines _HEX_CHARS and _UUID_RE, introduces the _streamlit() lazy accessor, and updates inject_theme() to call it.
Remaining call-sites updated to _streamlit() design-system/ds_streamlit.py	empty_state(), notice(), and diagnostics_expander each updated to obtain st via _streamlit().
Opaque-ID detectors and _human_label_segment refactor design-system/ds_streamlit.py	Adds _is_opaque_id_segment() and _is_opaque_id_token() and rewrites _human_label_segment() to use them for filtering UUID-like and compact-hex identifier tokens.
README template path update design-system/README.md	Template source location changed to stranske/Workflows/templates/consumer-repo/design-system/ and propagation wording revised.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• stranske/Collab-Admin#829: Updates the same anthropics/claude-code-action pinned SHA in the same claude-review step of maint-76-claude-code-review.yml.
• stranske/Collab-Admin#843: Also replaces the anthropics/claude-code-action pinned commit hash in maint-76-claude-code-review.yml with no other logic changes.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'chore: sync workflow templates' accurately summarizes the main change—synchronizing workflow templates from the stranske/Workflows source repository. It is concise, clear, and specific enough for teammates scanning history to understand the primary change.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch sync/workflows-2dc5f6ceac12

---

_{Comment @coderabbitai help to get the list of available commands.}