chore: sync workflow templates

[stranske]

Sync Summary

Files Updated

• agents-guard.yml: Agents guard - enforces agents workflow protections (Health 45)
• tokens.css: Design-system theme tokens (theme-air/theme-paper + density axis). Override tokens in an app stylesheet loaded after this; do not fork.
• components.css: Design-system component layer (.ds): panels/appbar/kpis/tables/fields + presentation-state patterns (.notice, .empty-state, .badge, .skeleton).
• ds_streamlit.py: Streamlit adapter for the design system (inject_theme/empty_state/notice/error/translate_error/dev_note/availability_badge/humanize_id) so Streamlit apps consume the same presentation patterns.
• PRESENTATION_PATTERNS.md: The presentation-patterns standard (P1-P6): the rule behind each pattern + per-app-type application + the finding->pattern map from the 2026-06 UX-Review fleet baseline.
• README.md: Design-system usage guide: how to apply the theme + components/kit per app type.

Files Skipped

• renovate.json: File exists and sync_mode is create_only
• cross-repo-smoke.yml: File exists and sync_mode is create_only
• llm_slots.json: None

---

Review Checklist

• CI passes with updated workflows
• No repo-specific customizations were overwritten

Source: stranske/Workflows
Source SHA: de0849c19ac81e04dc4b1ce6f95c6ec53a4db945
Template hash: 18397dc5e20f
Sync branch: sync/workflows-18397dc5e20f
Consumer repo: stranske/Template
Manifest: .github/sync-manifest.yml

Summary by CodeRabbit

Release Notes

• Accessibility Improvements

  • Enhanced visual focus states for keyboard navigation across interactive elements.
  • Added support for reduced motion preferences to improve experience for users with motion sensitivity.

• Security & Stability

  • Strengthened content rendering safety mechanisms.

• Documentation

  • Updated design system patterns and typography guidance.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 4fbc4b29-58de-4bcd-b561-e093d0350ab1

📥 Commits

Reviewing files that changed from the base of the PR and between c9fd5f1 and 64b3e76.

📒 Files selected for processing (6)

• .github/workflows/agents-guard.yml
• design-system/PRESENTATION_PATTERNS.md
• design-system/README.md
• design-system/components.css
• design-system/ds_streamlit.py
• design-system/tokens.css

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• stranske/Workflows (auto-detected)

📜 Recent review details

🧰 Additional context used

📓 Path-based instructions (5)

.github/workflows/**/*.{yml,yaml}

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

.github/workflows/**/*.{yml,yaml}: Ensure coverage threshold settings in GitHub Actions workflow files for coverage-min match the [tool.coverage.report] fail_under setting in pyproject.toml, as the lower value will be the effective threshold
For startup_failure in GitHub Actions workflows with zero jobs, check for invalid YAML syntax, top-level permissions: blocks in workflow_call reusable workflows (which conflicts with caller permissions), invalid permission scopes, or circular workflow references

Files:

• .github/workflows/agents-guard.yml

.github/workflows/*.yml

📄 CodeRabbit inference engine (CLAUDE.md)

Reference reusable workflows with @main unless intentionally pinning to an exact commit SHA for a controlled reason

Files:

• .github/workflows/agents-guard.yml

.github/workflows/**/*.yml

📄 CodeRabbit inference engine (AGENTS.md)

First-party consumers should reference reusable workflows with @main unless intentionally pinning to an exact commit SHA for a controlled reason

Files:

• .github/workflows/agents-guard.yml

.github/workflows/agents-*.yml

📄 CodeRabbit inference engine (AGENTS.md)

Agent workflows (agents-*.yml), autofix.yml, synced prompts in .github/codex/, and synced scripts/docs should be fixed in stranske/Workflows, not in the consumer repository

Files:

• .github/workflows/agents-guard.yml

**/*.py

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

In Manager-Database repository using Prefect 2.x, import schedules from prefect.client.schemas.schedules rather than other locations

Files:

• design-system/ds_streamlit.py

🪛 LanguageTool

design-system/README.md

[uncategorized] ~50-~50: The official name of this software platform is spelled with a capital “H”.
Context: ...r Repos GitHub Actions workflow through .github/sync-manifest.yml. Update it here firs...

(GITHUB)

🔀 Multi-repo context stranske/Workflows

Based on my exploration of the stranske/Workflows repository, I have gathered sufficient cross-repository context. Here are my findings:

Linked repositories findings

stranske/Workflows (Source Template)

Critical Breaking Changes in design-system/ds_streamlit.py [::stranske/Workflows::]

1. empty_state() function — Now HTML-escapes all string parameters (line 96-103)

   • Icon, title, and description are now escaped before rendering to unsafe_allow_html
   • Breaking change: Any consumer apps passing raw HTML to empty_state() expecting unsafe rendering will see escaped HTML displayed as text instead
   • Backward compatible for normal text usage

2. notice() function — Now HTML-escapes title, body, and action parameters (line 120-126)

   • All user-supplied strings are escaped before rendering
   • Breaking change: Similar to empty_state(), apps relying on raw HTML injection will break
   • The action parameter documentation updated to clarify it's "optional literal remediation text"

3. availability_badge() function signature changed (line 174-184)

   • Old: availability_badge(label: str) -> str
   • New: availability_badge(label: str, *, plain: bool = True) -> str
   • Backward compatible: The new plain parameter defaults to True, preserving existing behavior ("· label" string)
   • When plain=False, renders badge HTML with proper escaping (safe only in trusted HTML containers)

4. New function: diagnostics_expander() (line 166-171)

   • Context manager for wrapping diagnostic content in a Streamlit expander
   • Signature: diagnostics_expander(label: str = "Diagnostics", *, expanded: bool = False) -> ContextManager[None]
   • Replaces ad-hoc st.expander() calls for the P4 pattern

5. Updated translate_error() function (line 148-158)

   • Now performs case-insensitive pattern matching using text.lower()
   • More robust error condition detection but may alter behavior if apps relied on exact case-sensitive matching

Design System Distribution [::stranske/Workflows::]

• The design system is managed in templates/consumer-repo/design-system/ and synced to all consumer repos via the "Maint 68 Sync Consumer Repos" GitHub Actions workflow (configured in .github/sync-manifest.yml)
• Documentation in PRESENTATION_PATTERNS.md specifies 6 patterns (P1-P6) for Streamlit and web apps
• Intended consumer apps: Trend_Model_Project, Counter_Risk, Manager-Database, Inv-Man-Intake, Pension-Data, Portable-Alpha-Extension-Model, Reader, and learning-management-system

Workflow Update [::stranske/Workflows::]

• agents-guard.yml fallback steps pin stranske/Workflows/.github/actions/setup-api-client to commit a335f1af2c35b8f35d2278f56e9af78792a09bf1 for both pull_request_target and pull_request events

Impact Summary for stranske/Template Consumer Repo

The synced changes will impact any Streamlit apps in the consumer repository that:

• Call empty_state() with raw HTML expecting it to render unsafely — will break (now escaped)
• Call notice() with raw HTML expecting unsafe rendering — will break (now escaped)
• Use availability_badge() — no breaking change (backward compatible)
• Need diagnostic panels — gains new capability via diagnostics_expander()

🔇 Additional comments (6)

design-system/components.css (1)

41-41: LGTM!

Also applies to: 97-99

design-system/tokens.css (1)

29-29: LGTM!

Also applies to: 74-74

design-system/ds_streamlit.py (1)

29-30: LGTM!

Also applies to: 93-99, 111-121, 137-149, 165-211

design-system/README.md (1)

1-1: LGTM!

Also applies to: 41-41, 50-50

design-system/PRESENTATION_PATTERNS.md (1)

17-24: LGTM!

Also applies to: 33-33, 43-60, 84-84

.github/workflows/agents-guard.yml (1)

114-114: LGTM!

Also applies to: 183-183

---

📝 Walkthrough

Walkthrough

The PR expands the design system's Streamlit helpers with HTML escaping across empty_state, notice, and a new diagnostics_expander context manager; extends availability_badge with a plain flag; rewrites humanize_id; adds CSS :focus-visible and prefers-reduced-motion rules; fixes font token quoting; updates documentation; and bumps a pinned CI action SHA.

Changes

Design System Updates

Layer / File(s)	Summary
HTML escaping and error normalization in ds_streamlit design-system/ds_streamlit.py	Adds contextmanager and escape imports; escapes icon, title, desc in empty_state and title, body, action in notice before st.markdown; normalizes translate_error to run pattern checks on a lowercased copy of the exception text.
diagnostics_expander, availability_badge(plain), humanize_id design-system/ds_streamlit.py	Adds diagnostics_expander context manager wrapping a Streamlit expander with configurable expanded default; extends availability_badge with a plain flag (plain-text suffix vs. escaped HTML badge); rewrites humanize_id using namespace-segment scanning and a new private _human_label_segment helper that filters digits and hex-like tokens.
CSS accessibility rules and font token fixes design-system/components.css, design-system/tokens.css	Adds a .ds-scoped :focus-visible accent-outline rule for interactive elements; adds a prefers-reduced-motion: reduce override disabling the skeleton shimmer animation; adds quotes around BlinkMacSystemFont in --font-body and "Georgia" in .theme-paper --font-heading.
README and PRESENTATION_PATTERNS docs design-system/README.md, design-system/PRESENTATION_PATTERNS.md	README title updated to "Shared Design System", Files table updated to reference ds_streamlit.py, Status section rewritten to describe the sync workflow distribution path. PRESENTATION_PATTERNS adds explicit plain=False constraint for availability_badge in trusted-HTML-container context, with minor blank-line spacing adjustments across P2–P6 and Streamlit design kit sections.

CI Workflow Pin Update

Layer / File(s)	Summary
setup-api-client action pin bump .github/workflows/agents-guard.yml	Updates the pinned commit SHA for stranske/Workflows/.github/actions/setup-api-client in both the pull_request_target and pull_request "Workflows fallback" steps.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• stranske/Template#834: Updates the same agents-guard.yml setup-api-client pin in the pull_request_target and pull_request fallback steps with a different commit SHA.
• stranske/Template#835: Bumps the same stranske/Workflows/.github/actions/setup-api-client pinned SHA in both fallback steps of agents-guard.yml.
• stranske/Template#841: Changes the same agents-guard.yml setup-api-client revision for both pull_request_target and pull_request paths.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Title check	⚠️ Warning	The title 'chore: sync workflow templates' is generic and does not accurately represent the main change, which is a comprehensive sync of both workflow templates AND design system files from the Workflows repository.	Revise the title to reflect the full scope: 'chore: sync workflow templates and design system from Workflows' or similar to clarify that design system files are also being synced.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	Docstring coverage is 87.50% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch sync/workflows-18397dc5e20f

---

_{Comment @coderabbitai help to get the list of available commands.}

[stranske-keepalive]

Automated Status Summary

Head SHA: 8f2aab8
Latest Runs: ⏳ pending — Gate
Required: core tests (3.12): ⏳ pending, core tests (3.13): ⏳ pending, docker smoke: ⏳ pending, gate: ⏳ pending

Workflow / Job	Result	Logs
(no jobs reported)	⏳ pending	—

Coverage Overview

• Coverage history entries: 1

Coverage Trend

Metric	Value
Current	100.00%
Baseline	0.00%
Delta	+100.00%
Minimum	70.00%
Status	✅ Pass

Top Coverage Hotspots (lowest coverage)

File	Coverage	Missing
src/my_project/__init__.py	100.0%	0

Updated automatically; will refresh on subsequent CI/Docker completions.

---

Keepalive checklist

Scope

No scope information available

Tasks

• No tasks defined

Acceptance criteria

• No acceptance criteria defined