chore: sync workflow templates

.gitattributes

@@ -12,6 +12,3 @@ ci/autofix/history.json merge=ours linguist-generated
 # Agent ledger files are metadata, not reviewable code
 # Mark as generated to exclude from Copilot/Codex code reviews
 .agents/*.yml linguist-generated
-
-# Windows command launchers must retain CRLF on every checkout.
-*.cmd text eol=crlf

.github/scripts/source_context.js

@@ -50,6 +50,8 @@ const CHECKBOX_SOURCE_PATTERNS = Object.freeze([
 ]);
 
 const NO_AUTOMATION_CHECKBOX_PATTERN = /\bdo\s+not\s+automate\b|\bhuman[- ]only\b/i;
+const DEPENDENCY_REPAIR_PROMOTION_PATTERN =
+  /<!--\s*dependency-repair-promotion:v1\s+(\{[^\n]*\})\s*-->/;
 
 function cleanString(value) {
   return String(value || '').trim();
@@ -281,6 +283,29 @@ function parseWorkflowSourceBlock(body) {
   return result;
 }
 
+function parseDependencyRepairPromotionSource(body) {
+  const match = String(body || '').match(DEPENDENCY_REPAIR_PROMOTION_PATTERN);
+  if (!match) {
+    return null;
+  }
+
+  try {
+    const metadata = JSON.parse(match[1]);
+    const sourcePr = Number(metadata?.source_pr);
+    const validShas = [
+      metadata?.source_base_sha,
+      metadata?.source_head_sha,
+      metadata?.promotion_base_sha,
+    ].every((value) => /^[0-9a-f]{40}$/i.test(String(value || '')));
+    if (!Number.isInteger(sourcePr) || sourcePr <= 0 || !validShas) {
+      return null;
+    }
+    return { ...metadata, source_pr: sourcePr };
+  } catch {
+    return null;
+  }
+}
+
 function sourceTypeFromCheckedTemplate(body) {
   const sectionLines = workflowSourceSectionLines(body);
   if (!sectionLines.length) {
@@ -355,6 +380,7 @@ function inferredSourceType(pull = {}) {
 function resolvePrSourceContext(pull = {}) {
   const body = String(pull?.body || '');
   const block = parseWorkflowSourceBlock(body);
+  const dependencyRepairPromotion = parseDependencyRepairPromotionSource(body);
   const issueNumber = extractIssueNumberFromPull(pull);
   const noAutomation = hasNoAutomationWorkflowContext(pull);
 
@@ -363,7 +389,9 @@ function resolvePrSourceContext(pull = {}) {
   const checkboxType = sourceTypeFromCheckedTemplate(body);
   const labelType = sourceTypeFromLabels(pull);
   const inferredType = inferredSourceType(pull);
-  const detectedSourceType = issueNumber
+  const detectedSourceType = dependencyRepairPromotion
+    ? SOURCE_TYPES.DEPENDABOT
+    : issueNumber
     ? SOURCE_TYPES.GITHUB_ISSUE
     : [markerType, blockType, checkboxType, labelType, inferredType].find((type) => type !== SOURCE_TYPES.UNKNOWN)
       || SOURCE_TYPES.UNKNOWN;
@@ -372,6 +400,9 @@ function resolvePrSourceContext(pull = {}) {
     : detectedSourceType;
 
   const sourceRef =
+    (dependencyRepairPromotion
+      ? `dependency-pr:#${dependencyRepairPromotion.source_pr}`
+      : '') ||
     cleanString(parseHtmlMarker(body, 'workflow-source-ref')) ||
     cleanString(block.source_ref || block.ref || block.reference) ||
     (issueNumber ? `#${issueNumber}` : '');
@@ -392,6 +423,7 @@ function resolvePrSourceContext(pull = {}) {
     isValid: VALID_SOURCE_TYPES.has(sourceType),
     isExplicit: Boolean(
       issueNumber ||
+        dependencyRepairPromotion ||
         markerType !== SOURCE_TYPES.UNKNOWN ||
         blockType !== SOURCE_TYPES.UNKNOWN ||
         checkboxType !== SOURCE_TYPES.UNKNOWN ||
@@ -433,6 +465,7 @@ module.exports = {
   extractIssueNumbersFromText,
   extractIssueNumberFromPull,
   parseWorkflowSourceBlock,
+  parseDependencyRepairPromotionSource,
   sourceTypeFromCheckedTemplate,
   sourceTypeFromLabels,
   hasNoAutomationWorkflowContext,

.github/workflows/agents-80-pr-event-hub.yml

@@ -326,7 +326,7 @@ jobs:
 
       - name: Set up Python
         if: steps.check-merged.outputs.merged == 'true'
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: ${{ env.PYTHON_VERSION }}
 

.github/workflows/agents-auto-label.yml

@@ -17,18 +17,26 @@ env:
   AUTO_APPLY_THRESHOLD: "0.90"
   # Threshold for suggesting labels (lower, for comments)
   SUGGEST_THRESHOLD: "0.75"
+  # Keep embedding queries bounded for large issue bodies.
+  AUTO_LABEL_QUERY_MAX_CHARS: "6000"
+
+concurrency:
+  group: >-
+    agents-auto-label-${{ github.repository }}-${{ github.event.issue.number || github.run_id }}
+  cancel-in-progress: false
 
 jobs:
   auto-label:
     runs-on: ubuntu-latest
-    # Skip if issue already has agent-related labels
+    # Skip issues already routed by agents or machine-managed campaign issues.
     if: |
       !contains(github.event.issue.labels.*.name, 'agents:auto-pilot') &&
       !contains(github.event.issue.labels.*.name, 'agents:formatted') &&
       !contains(github.event.issue.labels.*.name, 'agents:autofix') &&
       !contains(github.event.issue.labels.*.name, 'agent:codex') &&
       !contains(github.event.issue.labels.*.name, 'agent:claude') &&
       !contains(github.event.issue.labels.*.name, 'agent:auto') &&
+      !contains(join(github.event.issue.labels.*.name, ','), 'campaign:') &&
       !contains(github.event.issue.labels.*.name, 'automated')
 
     steps:
@@ -65,7 +73,7 @@ jobs:
 
       - name: Set up Python
         if: steps.eligibility.outputs.should-run == 'true'
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: "3.14"
 
@@ -136,7 +144,22 @@ jobs:
           # Get issue content
           issue_title = os.environ.get('ISSUE_TITLE', '')
           issue_body = os.environ.get('ISSUE_BODY', '')
+          query_max_chars_raw = os.environ.get('AUTO_LABEL_QUERY_MAX_CHARS', '6000')
+          try:
+              query_max_chars = int(query_max_chars_raw)
+          except ValueError:
+              query_max_chars = 6000
+              print(
+                  "Invalid AUTO_LABEL_QUERY_MAX_CHARS value "
+                  f"{query_max_chars_raw!r}; using 6000"
+              )
+          if query_max_chars <= 0:
+              query_max_chars = 6000
+              print("AUTO_LABEL_QUERY_MAX_CHARS must be positive; using 6000")
           query = f"{issue_title}\n\n{issue_body}"
+          if len(query) > query_max_chars:
+              query = query[:query_max_chars]
+              print(f"Truncated issue query to {query_max_chars} characters")
 
           # Get thresholds
           auto_threshold = float(os.environ.get('AUTO_APPLY_THRESHOLD', '0.90'))

.github/workflows/agents-auto-pilot.yml

@@ -216,7 +216,7 @@ jobs:
       - name: Set up Python
         id: setup-python
         if: steps.check_enabled.outputs.enabled == 'true'
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: '3.14'
 

.github/workflows/agents-capability-check.yml

@@ -34,7 +34,7 @@ jobs:
           github_token: ${{ github.token }}
 
       - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: "3.14"
 

.github/workflows/agents-decompose.yml

@@ -29,7 +29,7 @@ jobs:
           github_token: ${{ github.token }}
 
       - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: "3.14"
 

.github/workflows/agents-dedup.yml

@@ -38,7 +38,7 @@ jobs:
           github_token: ${{ github.token }}
 
       - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: "3.14"
 

.github/workflows/agents-issue-optimizer.yml

@@ -139,7 +139,7 @@ jobs:
 
       - name: Set up Python
         if: steps.check.outputs.should_run == 'true'
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: '3.14'
 

.github/workflows/agents-verify-to-new-pr.yml

@@ -78,6 +78,7 @@ jobs:
             .github/scripts/github-api-with-retry.js
             .github/scripts/terminal_disposition.js
             .github/scripts/token_load_balancer.js
+            config
             scripts/langchain
             tools
           sparse-checkout-cone-mode: false
@@ -92,7 +93,7 @@ jobs:
 
       - name: Set up Python
         if: steps.check-merged.outputs.merged == 'true'
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: ${{ env.PYTHON_VERSION }}
 

.github/workflows/agents-weekly-metrics.yml

@@ -58,7 +58,7 @@ jobs:
 
 
       - name: Setup Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: "3.14"
 

.github/workflows/backplane-conformance.yml

@@ -29,7 +29,7 @@ jobs:
       manifest: artifacts/reference/manifest.json
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: '3.14'
       - run: pip install -e .

.github/workflows/pr-46-dependency-repair-contract.yml

@@ -0,0 +1,25 @@
+name: PR 46 Dependency Repair Contract
+
+on:
+  # zizmor: ignore[dangerous-triggers] trusted reusable workflow reads only
+  # PR metadata and git objects
+  pull_request_target:
+    types: [opened, reopened, synchronize, edited]
+
+permissions:
+  contents: read
+  pull-requests: read
+
+concurrency:
+  group: dependency-repair-contract-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  contract:
+    if: >-
+      github.event.pull_request.user.login == 'renovate[bot]' ||
+      github.event.pull_request.user.login == 'dependabot[bot]' ||
+      startsWith(github.event.pull_request.head.ref, 'renovate/') ||
+      startsWith(github.event.pull_request.head.ref, 'dependabot/') ||
+      contains(github.event.pull_request.body || '', 'dependency-repair-promotion:v1')
+    uses: stranske/Workflows/.github/workflows/reusable-19-dependency-repair-contract.yml@main