diff --git a/.github/scripts/workflow-pin-metadata.test.cjs b/.github/scripts/workflow-pin-metadata.test.cjs index 066ef96..8072cc5 100644 --- a/.github/scripts/workflow-pin-metadata.test.cjs +++ b/.github/scripts/workflow-pin-metadata.test.cjs @@ -6,8 +6,8 @@ const test = require("node:test"); const repositoryRoot = path.resolve(__dirname, "..", ".."); const workflowDirectory = path.join(repositoryRoot, ".github", "workflows"); const ciWorkflowsReference = "melodic-software/ci-workflows/"; -const ciWorkflowsSha = "d26c750691b5498fab529d115b63f84aa7aecebe"; -const ciWorkflowsVersion = "v0.17.0"; +const ciWorkflowsSha = "0f8176e87e0be518f382664779655011bf95784a"; +const ciWorkflowsVersion = "v0.17.2"; const expectedCiWorkflowsReferences = 21; const canonicalReference = /^\s*uses:\s+melodic-software\/ci-workflows\/[^\s@#]+@(?[0-9a-f]{40})\s+#\s+(?v(?:0|[1-9][0-9]*)\.(?:0|[1-9][0-9]*)\.(?:0|[1-9][0-9]*))\s*$/; @@ -108,13 +108,13 @@ test("ci-workflows references use a full SHA with one release version", () => { 1, "ci-workflows references must move as one reviewed compatibility pin", ); - assert.equal(references[0], ciWorkflowsSha, "ci-workflows must use the reviewed v0.17.0 SHA"); + assert.equal(references[0], ciWorkflowsSha, "ci-workflows must use the reviewed v0.17.2 SHA"); assert.equal( new Set(versions).size, 1, "ci-workflows references must name one release version for online pin verification", ); - assert.equal(versions[0], ciWorkflowsVersion, "ci-workflows must identify release v0.17.0"); + assert.equal(versions[0], ciWorkflowsVersion, "ci-workflows must identify release v0.17.2"); }); test("go-quality uses the exact reusable caller contract", () => { diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 25e5055..8b3b178 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -26,7 +26,7 @@ jobs: with: persist-credentials: false - name: Lint Markdown - uses: melodic-software/ci-workflows/.github/actions/markdown@d26c750691b5498fab529d115b63f84aa7aecebe # v0.17.0 + uses: melodic-software/ci-workflows/.github/actions/markdown@0f8176e87e0be518f382664779655011bf95784a # v0.17.2 with: config: .markdownlint-cli2.jsonc @@ -40,7 +40,7 @@ jobs: with: persist-credentials: false - name: Lint shell - uses: melodic-software/ci-workflows/.github/actions/shellcheck@d26c750691b5498fab529d115b63f84aa7aecebe # v0.17.0 + uses: melodic-software/ci-workflows/.github/actions/shellcheck@0f8176e87e0be518f382664779655011bf95784a # v0.17.2 with: rcfile: .shellcheckrc @@ -54,7 +54,7 @@ jobs: with: persist-credentials: false - name: Check shell formatting - uses: melodic-software/ci-workflows/.github/actions/shfmt@d26c750691b5498fab529d115b63f84aa7aecebe # v0.17.0 + uses: melodic-software/ci-workflows/.github/actions/shfmt@0f8176e87e0be518f382664779655011bf95784a # v0.17.2 typos: name: Spelling @@ -66,7 +66,7 @@ jobs: with: persist-credentials: false - name: Check spelling - uses: melodic-software/ci-workflows/.github/actions/typos@d26c750691b5498fab529d115b63f84aa7aecebe # v0.17.0 + uses: melodic-software/ci-workflows/.github/actions/typos@0f8176e87e0be518f382664779655011bf95784a # v0.17.2 with: config: _typos.toml @@ -80,7 +80,7 @@ jobs: with: persist-credentials: false - name: Check EditorConfig conformance - uses: melodic-software/ci-workflows/.github/actions/editorconfig@d26c750691b5498fab529d115b63f84aa7aecebe # v0.17.0 + uses: melodic-software/ci-workflows/.github/actions/editorconfig@0f8176e87e0be518f382664779655011bf95784a # v0.17.2 with: config: .editorconfig-checker.json @@ -95,7 +95,7 @@ jobs: fetch-depth: 0 persist-credentials: false - name: Scan for secrets - uses: melodic-software/ci-workflows/.github/actions/gitleaks@d26c750691b5498fab529d115b63f84aa7aecebe # v0.17.0 + uses: melodic-software/ci-workflows/.github/actions/gitleaks@0f8176e87e0be518f382664779655011bf95784a # v0.17.2 with: config: .gitleaks.toml @@ -109,7 +109,7 @@ jobs: with: persist-credentials: false - name: Check local links and anchors - uses: melodic-software/ci-workflows/.github/actions/lychee-offline@d26c750691b5498fab529d115b63f84aa7aecebe # v0.17.0 + uses: melodic-software/ci-workflows/.github/actions/lychee-offline@0f8176e87e0be518f382664779655011bf95784a # v0.17.2 with: config: lychee.toml @@ -123,7 +123,7 @@ jobs: with: persist-credentials: false - name: Scan comment hygiene - uses: melodic-software/ci-workflows/.github/actions/comment-hygiene@d26c750691b5498fab529d115b63f84aa7aecebe # v0.17.0 + uses: melodic-software/ci-workflows/.github/actions/comment-hygiene@0f8176e87e0be518f382664779655011bf95784a # v0.17.2 actionlint: name: Actionlint @@ -135,7 +135,7 @@ jobs: with: persist-credentials: false - name: Lint workflows - uses: melodic-software/ci-workflows/.github/actions/actionlint@d26c750691b5498fab529d115b63f84aa7aecebe # v0.17.0 + uses: melodic-software/ci-workflows/.github/actions/actionlint@0f8176e87e0be518f382664779655011bf95784a # v0.17.2 jsonschema: name: JSON schemas @@ -147,12 +147,12 @@ jobs: with: persist-credentials: false - name: Validate Dependabot configuration - uses: melodic-software/ci-workflows/.github/actions/check-jsonschema@d26c750691b5498fab529d115b63f84aa7aecebe # v0.17.0 + uses: melodic-software/ci-workflows/.github/actions/check-jsonschema@0f8176e87e0be518f382664779655011bf95784a # v0.17.2 with: builtin-schema: vendor.dependabot files: .github/dependabot.yml - name: Validate workflows - uses: melodic-software/ci-workflows/.github/actions/check-jsonschema@d26c750691b5498fab529d115b63f84aa7aecebe # v0.17.0 + uses: melodic-software/ci-workflows/.github/actions/check-jsonschema@0f8176e87e0be518f382664779655011bf95784a # v0.17.2 with: builtin-schema: vendor.github-workflows files: .github/workflows/*.yml @@ -167,7 +167,7 @@ jobs: with: persist-credentials: false - name: Check executable bits - uses: melodic-software/ci-workflows/.github/actions/exec-bit@d26c750691b5498fab529d115b63f84aa7aecebe # v0.17.0 + uses: melodic-software/ci-workflows/.github/actions/exec-bit@0f8176e87e0be518f382664779655011bf95784a # v0.17.2 machine-specific-paths: name: Machine-specific paths @@ -179,7 +179,7 @@ jobs: with: persist-credentials: false - name: Check machine-specific paths - uses: melodic-software/ci-workflows/.github/actions/machine-specific-paths@d26c750691b5498fab529d115b63f84aa7aecebe # v0.17.0 + uses: melodic-software/ci-workflows/.github/actions/machine-specific-paths@0f8176e87e0be518f382664779655011bf95784a # v0.17.2 with: # These files assert the official image's fixed in-container runner # home. They contain no host/user path; keep the exception exact. @@ -201,7 +201,7 @@ jobs: with: persist-credentials: false - name: Check index-level EOL drift - uses: melodic-software/ci-workflows/.github/actions/eol-renormalize@d26c750691b5498fab529d115b63f84aa7aecebe # v0.17.0 + uses: melodic-software/ci-workflows/.github/actions/eol-renormalize@0f8176e87e0be518f382664779655011bf95784a # v0.17.2 zizmor: name: Zizmor @@ -212,7 +212,7 @@ jobs: # workflows cannot elevate. Lane stays annotations-only # (upload-sarif defaults false); grant write so the job can start. security-events: write # Mandatory match for the reusable's own grant; see above. - uses: melodic-software/ci-workflows/.github/workflows/zizmor.yml@d26c750691b5498fab529d115b63f84aa7aecebe # v0.17.0 + uses: melodic-software/ci-workflows/.github/workflows/zizmor.yml@0f8176e87e0be518f382664779655011bf95784a # v0.17.2 with: paths: . @@ -244,7 +244,7 @@ jobs: go-quality: permissions: contents: read - uses: melodic-software/ci-workflows/.github/workflows/go-quality.yml@d26c750691b5498fab529d115b63f84aa7aecebe # v0.17.0 + uses: melodic-software/ci-workflows/.github/workflows/go-quality.yml@0f8176e87e0be518f382664779655011bf95784a # v0.17.2 with: config: .golangci.yml @@ -405,7 +405,7 @@ jobs: timeout-minutes: 15 steps: - name: Aggregate lane results - uses: melodic-software/ci-workflows/.github/actions/ci-status@d26c750691b5498fab529d115b63f84aa7aecebe # v0.17.0 + uses: melodic-software/ci-workflows/.github/actions/ci-status@0f8176e87e0be518f382664779655011bf95784a # v0.17.2 with: results: >- ${{ needs.markdown.result }} diff --git a/.github/workflows/do-not-merge.yml b/.github/workflows/do-not-merge.yml index bdedbdc..23f7cf8 100644 --- a/.github/workflows/do-not-merge.yml +++ b/.github/workflows/do-not-merge.yml @@ -24,4 +24,4 @@ jobs: permissions: pull-requests: read # the reusable gate reads the PR's labels only actions: read # mandatory to start the reusable; see pr-title.yml for why - uses: melodic-software/ci-workflows/.github/workflows/do-not-merge-gate.yml@d26c750691b5498fab529d115b63f84aa7aecebe # v0.17.0 + uses: melodic-software/ci-workflows/.github/workflows/do-not-merge-gate.yml@0f8176e87e0be518f382664779655011bf95784a # v0.17.2 diff --git a/.github/workflows/link-check.yml b/.github/workflows/link-check.yml index 851b3aa..01ea226 100644 --- a/.github/workflows/link-check.yml +++ b/.github/workflows/link-check.yml @@ -14,7 +14,7 @@ jobs: permissions: contents: read # Reusable checker reads repository Markdown. issues: write # Reusable checker maintains the scheduled failure issue. - uses: melodic-software/ci-workflows/.github/workflows/link-check.yml@d26c750691b5498fab529d115b63f84aa7aecebe # v0.17.0 + uses: melodic-software/ci-workflows/.github/workflows/link-check.yml@0f8176e87e0be518f382664779655011bf95784a # v0.17.2 with: args: >- --cache diff --git a/.github/workflows/pr-issue-linkage.yml b/.github/workflows/pr-issue-linkage.yml index d74734f..0d8ad49 100644 --- a/.github/workflows/pr-issue-linkage.yml +++ b/.github/workflows/pr-issue-linkage.yml @@ -25,7 +25,7 @@ jobs: permissions: pull-requests: read # the reusable now reads the live PR body itself actions: read # mandatory to start the reusable; see pr-title.yml for why - uses: melodic-software/ci-workflows/.github/workflows/pr-issue-linkage.yml@d26c750691b5498fab529d115b63f84aa7aecebe # v0.17.0 + uses: melodic-software/ci-workflows/.github/workflows/pr-issue-linkage.yml@0f8176e87e0be518f382664779655011bf95784a # v0.17.2 with: # Generated PR bodies cannot carry the closing-keyword + contract-header # markers; exact-login exemption per the reusable's contract, never a diff --git a/.github/workflows/pr-title.yml b/.github/workflows/pr-title.yml index 4bde242..fe5c8d2 100644 --- a/.github/workflows/pr-title.yml +++ b/.github/workflows/pr-title.yml @@ -21,4 +21,4 @@ jobs: # `prerequisite-result`, so the resolver never runs, but the grant is # still mandatory for the reusable to start at all. actions: read # Mandatory match for the reusable's own grant; see above. - uses: melodic-software/ci-workflows/.github/workflows/semantic-pr.yml@d26c750691b5498fab529d115b63f84aa7aecebe # v0.17.0 + uses: melodic-software/ci-workflows/.github/workflows/semantic-pr.yml@0f8176e87e0be518f382664779655011bf95784a # v0.17.2 diff --git a/release/dependencies.json b/release/dependencies.json index 12215ea..69f51c7 100644 --- a/release/dependencies.json +++ b/release/dependencies.json @@ -1,6 +1,6 @@ { "schemaVersion": 1, - "resolvedAt": "2026-08-21T07:40:00.0000000Z", + "resolvedAt": "2026-08-27T08:00:00.0000000Z", "go": { "version": "1.26.6", "source": "https://go.dev/dl/?mode=json" @@ -137,8 +137,8 @@ "repositoryPins": [ { "repository": "melodic-software/ci-workflows", - "commit": "d26c750691b5498fab529d115b63f84aa7aecebe", - "source": "https://github.com/melodic-software/ci-workflows/tree/d26c750691b5498fab529d115b63f84aa7aecebe" + "commit": "0f8176e87e0be518f382664779655011bf95784a", + "source": "https://github.com/melodic-software/ci-workflows/tree/0f8176e87e0be518f382664779655011bf95784a" } ], "reusableWorkflows": []