chore: sync workflow templates - #1198
Conversation
Automated sync from stranske/Workflows Template hash: 536a715df8b0 Changes synced from sync-manifest.yml
📝 WalkthroughWalkthroughAdds ChangesAcceptance-Criteria Gate System
Sequence Diagram(s)sequenceDiagram
rect rgba(100, 149, 237, 0.5)
Note over Workflow,GitHub: Merge guard pre-check
Workflow->>assertRuntimeAcMergeAllowed: owner, repo, prNumber, labels/withRetry, source
assertRuntimeAcMergeAllowed->>GitHub: GET /repos/{owner}/{repo}/pulls/{prNumber}/labels
GitHub-->>assertRuntimeAcMergeAllowed: label list
assertRuntimeAcMergeAllowed-->>Workflow: allowed:true OR throw runtime_ac_merge_blocked
end
rect rgba(144, 238, 144, 0.5)
Note over Workflow,GitHub: Deliberate-break verification (gate_summary)
Workflow->>check_deliberate_break.py: run with base/head refs
check_deliberate_break.py->>check_deliberate_break.py: parse AC markdown, tamper check, run test on head
check_deliberate_break.py->>check_deliberate_break.py: extract base archive, rerun test
check_deliberate_break.py-->>gate_summary.py: TEST_QUALITY_RESULT env var
gate_summary.py-->>Workflow: test-quality row in job table
end
Estimated code review effort🎯 4 (Complex) | ⏱️ ~60 minutes Possibly related issues
🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/agents-81-gate-followups.yml:
- Around line 1736-1744: The assertRuntimeAcMergeAllowed function is making a
redundant API call to fetch labels even though pr.labels is already available
from the current loop's PR data. Pass pr.labels as a parameter to the
assertRuntimeAcMergeAllowed function call, and update the function definition to
accept this parameter and use it directly, only falling back to an API fetch if
the labels parameter is missing or undefined. This eliminates the unnecessary
network call and prevents transient failures when label data is already
available.
In `@scripts/check_deliberate_break.py`:
- Around line 69-93: The `_parse_key_values` function calls `shlex.split(text)`
on line 71 without handling potential `ValueError` exceptions that occur when
the marker text contains unbalanced quotes or malformed syntax. Wrap the
`shlex.split(text)` call in a try-except block to catch `ValueError` and raise a
descriptive `ValueError` with a clear message about invalid deliberate-break
marker syntax, following the same error handling pattern as used in
`_explicit_marker` at line 90.
- Around line 179-216: The _changed_assertions function calls _git which can
raise CalledProcessError when git commands fail, but this exception is not
caught in verify_spec, causing the script to crash. Add exception handling for
CalledProcessError in the verify_spec function alongside the existing
TimeoutExpired handling to gracefully return a VERDICT_BROKEN result when git
operations fail instead of propagating the uncaught exception.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 7eef540e-a3c7-4df7-9f97-d5f516bea41c
📒 Files selected for processing (8)
.github/scripts/gate_summary.py.github/scripts/runtime_ac_merge_guard.js.github/workflows/agents-73-codex-belt-conveyor.yml.github/workflows/agents-81-gate-followups.yml.github/workflows/agents-guard.ymlAGENTS.mdCLAUDE.mdscripts/check_deliberate_break.py
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
stranske/Workflows(auto-detected)stranske/Template(auto-detected)
📜 Review details
🧰 Additional context used
📓 Path-based instructions (7)
{AGENTS.md,CLAUDE.md}
📄 CodeRabbit inference engine (AGENTS.md)
Keep
AGENTS.mdmaterially aligned withCLAUDE.md. Differences between the two should only be agent-specific execution notes, not different repository rules.
Files:
CLAUDE.mdAGENTS.md
**/*.py
📄 CodeRabbit inference engine (.github/copilot-instructions.md)
Manager-Database repository uses Prefect 2.x - import schedules from prefect.client.schemas.schedules
Files:
scripts/check_deliberate_break.py
**/.github/workflows/**/!(*.md)
📄 CodeRabbit inference engine (.github/copilot-instructions.md)
For workflow_call reusable workflows, do not use top-level permissions: block as it conflicts with caller permissions (documented in docs/INTEGRATION_GUIDE.md)
Files:
.github/workflows/agents-73-codex-belt-conveyor.yml.github/workflows/agents-guard.yml.github/workflows/agents-81-gate-followups.yml
**/.github/workflows/*.{yml,yaml}
📄 CodeRabbit inference engine (.github/copilot-instructions.md)
For startup_failure in workflows with zero jobs, check for invalid YAML syntax, invalid permission scopes, top-level permissions block on workflow_call, or circular workflow references
Files:
.github/workflows/agents-73-codex-belt-conveyor.yml.github/workflows/agents-guard.yml.github/workflows/agents-81-gate-followups.yml
.github/workflows/**/*.yml
📄 CodeRabbit inference engine (AGENTS.md)
In GitHub Actions workflows, first-party consumers should reference reusable workflows with
@mainunless intentionally pinning to an exact commit SHA for a controlled reason.
Files:
.github/workflows/agents-73-codex-belt-conveyor.yml.github/workflows/agents-guard.yml.github/workflows/agents-81-gate-followups.yml
{.github/workflows/agents-*.yml,.github/workflows/autofix.yml,.github/codex/**/*,docs/sync/**/*}
📄 CodeRabbit inference engine (AGENTS.md)
Synced workflows (e.g.,
agents-*.yml,autofix.yml), prompts in.github/codex/, and synced scripts/docs should be fixed instranske/Workflowssource, not in the consumer repository. Update the sync manifest in Workflows if a consumer-facing file changed.
Files:
.github/workflows/agents-73-codex-belt-conveyor.yml.github/workflows/agents-guard.yml.github/workflows/agents-81-gate-followups.yml
.github/workflows/*.yml
📄 CodeRabbit inference engine (CLAUDE.md)
Reference reusable workflows with
@mainunless intentionally pinning to an exact commit SHA for a controlled reason.
Files:
.github/workflows/agents-73-codex-belt-conveyor.yml.github/workflows/agents-guard.yml.github/workflows/agents-81-gate-followups.yml
🧠 Learnings (1)
📓 Common learnings
Learnt from: CR
Repo: stranske/Manager-Database
Timestamp: 2026-06-20T01:47:18.988Z
Learning: When evaluating claims, designs, and instructions, act as a critical evaluator—correct judgment takes precedence over agreement. State confidence levels, flag uncertainties, and lead with the strongest objection when something is wrong or weaker than an alternative.
Learnt from: CR
Repo: stranske/Manager-Database
Timestamp: 2026-06-20T01:47:18.988Z
Learning: Keep workflow logic in `stranske/Workflows` root repository. Consumer repositories should only carry repo-specific configuration files unless explicitly documented as an exception.
Learnt from: CR
Repo: stranske/Manager-Database
Timestamp: 2026-06-20T01:47:18.988Z
Learning: For infrastructure work, follow this priority order: (1) `stranske/Workflows` root docs (`README.md`, `docs/WORKFLOW_GUIDE.md`, `docs/ci/WORKFLOWS.md`), (2) `stranske/Workflows/docs/INTEGRATION_GUIDE.md` and `docs/ops/CONSUMER_REPO_MAINTENANCE.md`, (3) `stranske/Workflows/templates/consumer-repo/`, (4) local repo-specific files.
Learnt from: CR
Repo: stranske/Manager-Database
Timestamp: 2026-06-20T01:47:18.988Z
Learning: Before editing local workflow infrastructure, evaluate whether the work belongs in `stranske/Workflows` instead. Changes affecting reusable workflows, agent prompts, routing, keepalive/autofix/verifier behavior, or synced files should be made in the source repository first, then synced to the consumer repo.
Learnt from: CR
Repo: stranske/Manager-Database
Timestamp: 2026-06-20T01:47:30.228Z
Learning: Evaluate claims, designs, and instructions on their merits before agreeing — including the orchestrator's and the user's. When something is wrong, weaker than an alternative, or missing, say so plainly and lead with the strongest objection. Separate 'this is correct' from 'I'll do as asked.'
Learnt from: CR
Repo: stranske/Manager-Database
Timestamp: 2026-06-20T01:47:30.228Z
Learning: Calibrate dissent — provide not maximal disagreement, but correct judgment calibrated to confidence levels and conditions that would change your mind. Flag uncertainty.
Learnt from: CR
Repo: stranske/Manager-Database
Timestamp: 2026-06-20T01:47:30.228Z
Learning: For infrastructure and workflow work, follow the source-of-truth order: (1) stranske/Workflows root docs, (2) INTEGRATION_GUIDE.md and CONSUMER_REPO_MAINTENANCE.md, (3) consumer sync source in stranske/Workflows/templates/consumer-repo/, (4) local repo-specific files.
Learnt from: CR
Repo: stranske/Manager-Database
Timestamp: 2026-06-20T01:47:30.228Z
Learning: When editing workflow or automation files, ask: 'Does this work belong in stranske/Workflows instead?' The answer is typically yes if the change affects reusable workflows, agent prompts/routing, keepalive/autofix/verifier behavior, synced workflow files, or synced scripts/docs.
Learnt from: CR
Repo: stranske/Manager-Database
Timestamp: 2026-06-20T01:47:30.228Z
Learning: `ci.yml` and `autofix-versions.env` are repo-specific files and should be edited locally; do not sync from Workflows.
Learnt from: CR
Repo: stranske/Manager-Database
Timestamp: 2026-06-20T01:47:30.228Z
Learning: Synced workflows, prompts, scripts, and consumer docs are managed through `.github/sync-manifest.yml` in Workflows. Do not manually edit synced files; fix them in Workflows first.
Learnt from: CR
Repo: stranske/Manager-Database
Timestamp: 2026-06-20T01:47:30.228Z
Learning: Agent workflow files (`agents-*.yml`), `autofix.yml`, and `.github/codex/` prompt files should be fixed in Workflows, not edited locally in the consumer repo.
Learnt from: CR
Repo: stranske/Manager-Database
Timestamp: 2026-06-20T01:47:30.228Z
Learning: Keep CLAUDE.md materially aligned with AGENTS.md. Differences should only be agent-specific execution notes, not different repository rules.
🪛 ast-grep (0.43.0)
scripts/check_deliberate_break.py
[error] 143-150: Command coming from incoming request
Context: subprocess.run(
list(command),
cwd=cwd,
text=True,
capture_output=True,
env=env,
timeout=timeout,
)
Note: [CWE-20].
(subprocess-from-request)
[error] 159-166: Command coming from incoming request
Context: subprocess.run(
["git", *args],
cwd=cwd,
check=True,
text=True,
capture_output=True,
timeout=timeout,
)
Note: [CWE-20].
(subprocess-from-request)
[error] 190-196: Command coming from incoming request
Context: subprocess.run(
["git", "archive", "--format=tar", base],
cwd=cwd,
check=True,
capture_output=True,
timeout=DEFAULT_TIMEOUT_SECONDS,
)
Note: [CWE-20].
(subprocess-from-request)
[error] 143-150: Use of unsanitized data to create processes
Context: subprocess.run(
list(command),
cwd=cwd,
text=True,
capture_output=True,
env=env,
timeout=timeout,
)
Note: [CWE-78].
(os-system-unsanitized-data)
[info] 329-329: use jsonify instead of json.dumps for JSON output
Context: json.dumps(_json_result(VERDICT_SKIPPED, reason="no deliberate-break marker"))
Note: Security best practice.
(use-jsonify)
[info] 341-341: use jsonify instead of json.dumps for JSON output
Context: json.dumps(result, sort_keys=True)
Note: Security best practice.
(use-jsonify)
🔀 Multi-repo context stranske/Template, stranske/Workflows
Perfect! I have confirmed all the cross-repo sync gaps. Here's my final summary:
Linked repositories findings
stranske/Template
Critical Sync Gaps Between Template and Workflows Source:
-
agents-73-codex-belt-conveyor.yml — Missing Runtime AC Merge Guard Logic [::stranske/Template::]
- Template version: 22 lines in "Merge PR with squash" step (lines 82-108)
- Workflows version: 32 lines (10 additional lines for runtime AC guard)
- Missing code: No import of
runtime_ac_merge_guard.jsand no call toassertRuntimeAcMergeAllowed() - Template directly calls
github.rest.pulls.merge()without pre-merge validation - Workflows version: Calls
assertRuntimeAcMergeAllowed()first, which blocks merges for PRs with labels likeruntime-ac,runtime-verification, etc. - Impact: When the sync completes, Template's merge behavior will change—it will start rejecting merges on PRs with runtime AC labels, which may break existing automation that doesn't account for this guard
-
agents-81-gate-followups.yml — Missing runtime_ac_merge_guard.js in Sparse Checkout [::stranske/Template::]
- Template sparse-checkout (guarded-merge job): 2 files
.github/scripts/github-api-with-retry.js.github/scripts/token_load_balancer.js
- Workflows sparse-checkout: 3 files (includes
.github/scripts/runtime_ac_merge_guard.js) - Impact: When agents-73 tries to require the runtime guard file, it will fail if not checked out. This is a pre-requisite dependency that will cause runtime errors.
- Template sparse-checkout (guarded-merge job): 2 files
-
gate_summary.py — Missing test_quality_result Field [::stranske/Template::]
- Template
SummaryContext: 11 fields total, last isdocs_guard_result: str = "success" - Workflows
SummaryContext: 12 fields, includestest_quality_result: str = "skipped" - Template's
build_context(): Does not readTEST_QUALITY_RESULTenvironment variable - Impact: Any workflow trying to pass test-quality results will cause a TypeError; Gate summaries won't include test-quality check outcomes
- Template
stranske/Workflows (Source Repository — Correct State)
Files correctly implement the new features [::stranske/Workflows::]
./templates/consumer-repo/.github/scripts/runtime_ac_merge_guard.js— 137 lines, exportsassertRuntimeAcMergeAllowed./templates/consumer-repo/.github/workflows/agents-73-codex-belt-conveyor.yml— Imports and uses runtime guard before merge./templates/consumer-repo/.github/workflows/agents-81-gate-followups.yml— Includes guard script in sparse-checkout./templates/consumer-repo/.github/scripts/gate_summary.py— Includestest_quality_resultfield and environment variable handling- All three scripts listed in
./.github/sync-manifest.ymlfor syncing to consumer repos
Summary: The PR is syncing these new runtime AC merge guard and test-quality changes from stranske/Workflows to stranske/Manager-Database, but stranske/Template (the reference template for new consumer repos) is currently out of sync. Template has overwrite_repos: [stranske/Template] annotations in the manifest but hasn't been updated with the new guard behavior, creating a version mismatch between the source and the template used for bootstrapping new consumer repositories.
🔇 Additional comments (16)
AGENTS.md (1)
5-8: LGTM!CLAUDE.md (1)
5-8: LGTM!.github/workflows/agents-guard.yml (1)
114-114: No action required—pinned commit is valid and output contract is satisfied.The commit SHA
d68de1904bcdbe16bfe2462b73aa18f41f8a0a47exists in stranske/Workflows and the action exports all three required outputs (token_count, available_tokens, setup_contract) that downstream steps depend on. Both pinned references (lines 114 and 183) use the same commit hash consistently..github/scripts/runtime_ac_merge_guard.js (1)
3-137: LGTM!.github/workflows/agents-73-codex-belt-conveyor.yml (1)
195-195: LGTM!Also applies to: 444-444, 456-464
.github/workflows/agents-81-gate-followups.yml (1)
1555-1555: LGTM!Also applies to: 1567-1567
scripts/check_deliberate_break.py (4)
1-46: LGTM!
133-167: LGTM!
219-309: LGTM!
312-347: LGTM!.github/scripts/gate_summary.py (6)
24-24: LGTM!
242-257: LGTM!
260-291: LGTM!
331-350: LGTM!
387-411: LGTM!
421-448: LGTM!
| await assertRuntimeAcMergeAllowed({ | ||
| github, | ||
| core, | ||
| owner, | ||
| repo, | ||
| prNumber, | ||
| withRetry, | ||
| source: 'agents-81-gate-followups guarded merge', | ||
| }); |
There was a problem hiding this comment.
Avoid a second label API read in the guarded-merge loop.
At Line 1736, assertRuntimeAcMergeAllowed re-fetches labels even though pr.labels is already available from the PR fetch in this loop. That adds an unnecessary network dependency and can fail merges on transient label-read errors despite already having label data. Pass pr.labels into the guard and only fall back to API fetch when labels are missing.
Suggested patch
try {
+ const knownLabels = Array.isArray(pr.labels) ? pr.labels : undefined;
await assertRuntimeAcMergeAllowed({
github,
core,
owner,
repo,
prNumber,
+ labels: knownLabels,
withRetry,
source: 'agents-81-gate-followups guarded merge',
});🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/agents-81-gate-followups.yml around lines 1736 - 1744, The
assertRuntimeAcMergeAllowed function is making a redundant API call to fetch
labels even though pr.labels is already available from the current loop's PR
data. Pass pr.labels as a parameter to the assertRuntimeAcMergeAllowed function
call, and update the function definition to accept this parameter and use it
directly, only falling back to an API fetch if the labels parameter is missing
or undefined. This eliminates the unnecessary network call and prevents
transient failures when label data is already available.
| def _parse_key_values(text: str) -> dict[str, str]: | ||
| values: dict[str, str] = {} | ||
| for token in shlex.split(text): | ||
| if "=" not in token: | ||
| continue | ||
| key, value = token.split("=", 1) | ||
| values[key.strip().replace("_", "-").lower()] = value.strip() | ||
| return values | ||
|
|
||
|
|
||
| def _explicit_marker(section: str) -> DeliberateBreakSpec | None: | ||
| for line in section.splitlines(): | ||
| match = MARKER_RE.search(line.strip()) | ||
| if not match: | ||
| continue | ||
| values = _parse_key_values(match.group("body")) | ||
| test_id = values.get("test") or values.get("test-id") | ||
| test_file = values.get("test-file") or values.get("file") | ||
| break_file = values.get("break-file") or values.get("revert-file") | ||
| command_text = values.get("command") | ||
| if not test_id or not test_file or not break_file: | ||
| raise ValueError("deliberate-break marker requires test, test-file, and break-file") | ||
| command = tuple(shlex.split(command_text)) if command_text else _pytest_command(test_id) | ||
| return DeliberateBreakSpec(test_id, test_file, break_file, command) | ||
| return None |
There was a problem hiding this comment.
Unhandled ValueError from shlex.split on malformed marker syntax.
If the deliberate-break marker contains unbalanced quotes (e.g., command="pytest test.py), shlex.split at line 71 raises ValueError which propagates as an unhandled exception. The script already raises ValueError at line 90 for missing keys—consider catching parsing errors similarly.
Proposed fix
def _parse_key_values(text: str) -> dict[str, str]:
values: dict[str, str] = {}
- for token in shlex.split(text):
+ try:
+ tokens = shlex.split(text)
+ except ValueError:
+ return values
+ for token in tokens:
if "=" not in token:
continue
key, value = token.split("=", 1)
values[key.strip().replace("_", "-").lower()] = value.strip()
return values🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@scripts/check_deliberate_break.py` around lines 69 - 93, The
`_parse_key_values` function calls `shlex.split(text)` on line 71 without
handling potential `ValueError` exceptions that occur when the marker text
contains unbalanced quotes or malformed syntax. Wrap the `shlex.split(text)`
call in a try-except block to catch `ValueError` and raise a descriptive
`ValueError` with a clear message about invalid deliberate-break marker syntax,
following the same error handling pattern as used in `_explicit_marker` at line
90.
| def _changed_assertions(base: str, head: str, test_file: str, cwd: Path) -> list[str]: | ||
| status = _git(["diff", "--name-status", f"{base}...{head}", "--", test_file], cwd) | ||
| if any(line.split("\t", 1)[0] == "A" for line in status.stdout.splitlines()): | ||
| return [] | ||
| completed = _git( | ||
| ["diff", "--no-ext-diff", "--unified=0", f"{base}...{head}", "--", test_file], | ||
| cwd, | ||
| ) | ||
| return list(_assertion_diff_lines(completed.stdout)) | ||
|
|
||
|
|
||
| def _archive_ref(base: str, target: Path, cwd: Path) -> None: | ||
| archive = subprocess.run( | ||
| ["git", "archive", "--format=tar", base], | ||
| cwd=cwd, | ||
| check=True, | ||
| capture_output=True, | ||
| timeout=DEFAULT_TIMEOUT_SECONDS, | ||
| ) | ||
| target_root = target.resolve() | ||
| with tarfile.open(fileobj=BytesIO(archive.stdout), mode="r:") as tar: | ||
| for member in tar: | ||
| member_path = target_root / member.name | ||
| resolved = member_path.resolve() | ||
| if not resolved.is_relative_to(target_root): | ||
| raise ValueError(f"unsafe archive path: {member.name}") | ||
| if member.isdir(): | ||
| resolved.mkdir(parents=True, exist_ok=True) | ||
| continue | ||
| if not member.isfile(): | ||
| continue | ||
| resolved.parent.mkdir(parents=True, exist_ok=True) | ||
| source = tar.extractfile(member) | ||
| if source is None: | ||
| continue | ||
| with source, resolved.open("wb") as destination: | ||
| shutil.copyfileobj(source, destination) | ||
| resolved.chmod(member.mode & 0o777) |
There was a problem hiding this comment.
Unhandled CalledProcessError from git commands can crash the script.
_changed_assertions calls _git which uses check=True (line 163). If git fails (e.g., invalid base ref, file not tracked), CalledProcessError propagates uncaught. verify_spec catches TimeoutExpired but not CalledProcessError, causing the script to crash with a stack trace instead of returning a graceful VERDICT_BROKEN result.
Proposed fix in verify_spec
try:
if enforce_tamper:
tampered = _changed_assertions(base, head, spec.test_file, repo)
if tampered:
return _json_result(
VERDICT_BROKEN,
reason="test-assertion-tamper",
test_file=spec.test_file,
changed_assertions=tampered,
)
head_run = _run(spec.command, repo)
except subprocess.TimeoutExpired as exc:
return _json_result(
VERDICT_BROKEN,
reason="command-timeout",
command=list(exc.cmd) if isinstance(exc.cmd, (tuple, list)) else str(exc.cmd),
timeout=exc.timeout,
)
+ except subprocess.CalledProcessError as exc:
+ return _json_result(
+ VERDICT_BROKEN,
+ reason="git-command-failed",
+ command=exc.cmd,
+ returncode=exc.returncode,
+ stderr=exc.stderr,
+ )🧰 Tools
🪛 ast-grep (0.43.0)
[error] 190-196: Command coming from incoming request
Context: subprocess.run(
["git", "archive", "--format=tar", base],
cwd=cwd,
check=True,
capture_output=True,
timeout=DEFAULT_TIMEOUT_SECONDS,
)
Note: [CWE-20].
(subprocess-from-request)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@scripts/check_deliberate_break.py` around lines 179 - 216, The
_changed_assertions function calls _git which can raise CalledProcessError when
git commands fail, but this exception is not caught in verify_spec, causing the
script to crash. Add exception handling for CalledProcessError in the
verify_spec function alongside the existing TimeoutExpired handling to
gracefully return a VERDICT_BROKEN result when git operations fail instead of
propagating the uncaught exception.
Sync Summary
Files Updated
Files Skipped
Review Checklist
Source: stranske/Workflows
Source SHA:
deacb8ee2852a7c22fe229645468776f35921628Template hash:
536a715df8b0Sync branch:
sync/workflows-536a715df8b0Consumer repo:
stranske/Manager-DatabaseManifest:
.github/sync-manifest.ymlSummary by CodeRabbit
Release Notes
Documentation
New Features