chore: sync workflow templates

[stranske]

Sync Summary

Files Updated

• agents-guard.yml: Agents guard - enforces agents workflow protections (Health 45)
• tokens.css: Design-system theme tokens (theme-air/theme-paper + density axis). Override tokens in an app stylesheet loaded after this; do not fork.
• components.css: Design-system component layer (.ds): panels/appbar/kpis/tables/fields + presentation-state patterns (.notice, .empty-state, .badge, .skeleton).
• ds_streamlit.py: Streamlit adapter for the design system (inject_theme/empty_state/notice/error/translate_error/dev_note/availability_badge/humanize_id) so Streamlit apps consume the same presentation patterns.
• PRESENTATION_PATTERNS.md: The presentation-patterns standard (P1-P6): the rule behind each pattern + per-app-type application + the finding->pattern map from the 2026-06 UX-Review fleet baseline.
• README.md: Design-system usage guide: how to apply the theme + components/kit per app type.

Files Skipped

• .github/workflows/pr-00-gate.yml: Maintains a fully custom Gate workflow; never overwrite (replaces the hard-coded custom_gate_repos list in maint-68).
• ci.yml: File exists and sync_mode is create_only
• renovate.json: File exists and sync_mode is create_only
• cross-repo-smoke.yml: File exists and sync_mode is create_only
• llm_slots.json: None

---

Review Checklist

• CI passes with updated workflows
• No repo-specific customizations were overwritten

Source: stranske/Workflows
Source SHA: dfe0854ae9b1ba1c616e4b57fb498f283ea3216f
Template hash: d0d4ad2bdd25
Sync branch: sync/workflows-d0d4ad2bdd25
Consumer repo: stranske/Manager-Database
Manifest: .github/sync-manifest.yml

Summary by CodeRabbit

• New Features

  • Added focus indicators for interactive elements to improve keyboard navigation accessibility
  • Added support for reduced-motion preferences, disabling animations for users who prefer it
  • Introduced diagnostics expander component for expanded functionality

• Improvements

  • Enhanced HTML sanitization in UI components for better security
  • Improved error message detection with case-insensitive matching

• Documentation

  • Updated design system distribution and management guidelines
  • Refined design pattern documentation formatting

• Style

  • Updated typography system with improved font family definitions

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 3eecd98e-eb05-43dc-8281-4c77c4145ac2

📥 Commits

Reviewing files that changed from the base of the PR and between 9fd629b and 55b2992.

📒 Files selected for processing (6)

• .github/workflows/agents-guard.yml
• design-system/PRESENTATION_PATTERNS.md
• design-system/README.md
• design-system/components.css
• design-system/ds_streamlit.py
• design-system/tokens.css

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• stranske/Workflows (auto-detected)
• stranske/Template (auto-detected)

📜 Recent review details

🧰 Additional context used

📓 Path-based instructions (5)

**/.github/workflows/**/!(*.md)

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

For workflow_call reusable workflows, do not use top-level permissions: block as it conflicts with caller permissions (documented in docs/INTEGRATION_GUIDE.md)

Files:

• .github/workflows/agents-guard.yml

**/.github/workflows/*.{yml,yaml}

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

For startup_failure in workflows with zero jobs, check for invalid YAML syntax, invalid permission scopes, top-level permissions block on workflow_call, or circular workflow references

Files:

• .github/workflows/agents-guard.yml

.github/workflows/*.yml

📄 CodeRabbit inference engine (CLAUDE.md)

.github/workflows/*.yml: In this consumer repository, keep most workflow logic in stranske/Workflows and only carry repo-specific configuration unless explicitly documented as an exception
First-party consumers should reference reusable workflows with @main unless intentionally pinning to an exact commit SHA for a controlled reason

Reference reusable workflows with @main in first-party consumers unless intentionally pinning to an exact commit SHA for a controlled reason

Files:

• .github/workflows/agents-guard.yml

.github/workflows/agents-*.yml

📄 CodeRabbit inference engine (CLAUDE.md)

Agent workflow files (agents-*.yml) are owned by Workflows; fix issues in stranske/Workflows, not in this consumer repo

Files:

• .github/workflows/agents-guard.yml

**/*.py

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

Manager-Database repository uses Prefect 2.x - import schedules from prefect.client.schemas.schedules

Files:

• design-system/ds_streamlit.py

🪛 LanguageTool

design-system/README.md

[uncategorized] ~50-~50: The official name of this software platform is spelled with a capital “H”.
Context: ...m/and distributed by Maint 68 through.github/sync-manifest.yml`. Update it here firs...

(GITHUB)

🔇 Additional comments (13)

.github/workflows/agents-guard.yml (1)

114-114: LGTM!

Also applies to: 183-183

design-system/README.md (1)

1-1: LGTM!

Also applies to: 41-41, 50-50

design-system/PRESENTATION_PATTERNS.md (1)

17-24: LGTM!

Also applies to: 33-33, 43-51, 60-60

design-system/tokens.css (1)

29-29: LGTM!

Also applies to: 74-74

design-system/components.css (2)

41-41: LGTM!

---

97-99: LGTM!

design-system/ds_streamlit.py (7)

29-30: LGTM!

---

93-98: LGTM!

---

115-121: LGTM!

---

137-149: LGTM!

---

165-172: LGTM!

---

174-177: 🎯 Functional Correctness

Rewrite is not needed — this review concern is incorrect.

The availability_badge() function has no callers in the codebase, so there are no existing dependencies to break. This appears to be a new function being introduced, and the implementation correctly returns plain text for its documented purpose (tab titles/captions in Streamlit, where HTML is unsupported). The function's docstring explicitly indicates it is "Streamlit-safe," confirming this is the intended design.

			> Likely an incorrect or invalid review comment.

---

180-186: 🎯 Functional Correctness

The code comment aligns with the implementation; verify actual ID format conventions in your consumer apps.

The function now extracts the last colon-separated segment (split(":")[-1]) as a best-effort human label. The docstring ("take a trailing human-ish segment") indicates this is intentional. However, the correctness of this approach depends on your actual ID format convention, which is not evident in this codebase.

The function provides defensive fallbacks:

• A mapping parameter allows explicit overrides for non-standard IDs
• Fallback to "item" if extraction yields an empty string

If your IDs follow the convention namespace:entity:human_label, this works correctly. If they follow human_label:hash instead, this will extract the hash. Review your internal ID format to confirm this change matches your usage patterns.

---

📝 Walkthrough

Walkthrough

Bumps the pinned setup-api-client action SHA in agents-guard.yml for both workflow trigger paths. Updates design-system CSS tokens (font stacks) and component styles (focus-visible, reduced-motion). Revises ds_streamlit.py with HTML escaping, case-insensitive error matching, a new diagnostics_expander context manager, and changed behavior for availability_badge and humanize_id. Refreshes design-system documentation.

Changes

CI Workflow Action SHA Bump

Layer / File(s)	Summary
agents-guard.yml SHA update .github/workflows/agents-guard.yml	Replaces the pinned stranske/Workflows setup-api-client fallback action SHA with a newer commit SHA in both the pull_request_target and pull_request trigger paths.

---

Design System Updates

Layer / File(s)	Summary
CSS token and component style changes design-system/tokens.css, design-system/components.css	Updates --font-body to prefer system-ui first and adjusts font quoting; updates --font-heading quoting in .theme-paper; adds :focus-visible outline for .ds interactive elements; adds prefers-reduced-motion media query to disable skeleton animation.
ds_streamlit.py functional changes design-system/ds_streamlit.py	Adds contextmanager and escape imports; escapes user-provided strings in empty_state() and notice(); makes translate_error() case-insensitive; adds diagnostics_expander() context manager; changes availability_badge() to return plain text " · {label}" instead of HTML; changes humanize_id() to extract the last colon-separated segment.
Design system documentation updates design-system/README.md, design-system/PRESENTATION_PATTERNS.md	Removes (staging) from the README title; replaces index.html/preview.html entries with ds_streamlit.py in the files table; updates distribution/status instructions to reference Workflows/templates/consumer-repo/design-system/ and .github/sync-manifest.yml; inserts blank lines after P2–P6 headings.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• stranske/Manager-Database#1197: Updates the same pinned stranske/Workflows/.github/actions/setup-api-client commit SHA in agents-guard.yml for both trigger paths.
• stranske/Manager-Database#1198: Also bumps the "Setup API client (Workflows fallback)" action digest in .github/workflows/agents-guard.yml.
• stranske/Manager-Database#1213: Updates the same stranske/Workflows setup-api-client fallback action pinned SHA in agents-guard.yml.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'chore: sync workflow templates' is partially related to the changeset but does not accurately represent the full scope of changes, which include significant design-system updates beyond just workflow templates.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch sync/workflows-d0d4ad2bdd25

---

_{Comment @coderabbitai help to get the list of available commands.}

[stranske]

Closing as superseded by newer sync PR #1230 from the latest Workflows sync wave.