[Maintenance] Tool-version drift

[github-actions]

Tool-version drift detected

One or more reviewed tool or image pins differ from upstream stable.

• shfmt (mvdan/sh): pinned 3.13.1, upstream latest 3.14.0
• typos (crate-ci/typos): pinned 1.49.0, upstream latest 1.50.0
• editorconfig (editorconfig-checker/editorconfig-checker): pinned 3.11.1, upstream latest 3.11.2
• lefthook-validate (evilmartians/lefthook): pinned 2.1.10, upstream latest 2.1.12
• ruff (astral-sh/ruff): pinned 0.16.3, upstream latest 0.16.5
• biome (@biomejs/biome): pinned 2.5.9, upstream latest 2.5.11
• Runtime Node.js: pinned 24.19.0, reviewed line latest 24.20.0
• zizmor: pinned 1.29.0 (digest dd96df044a6e8538d5f423790f453bdd03d49e5b2bcc38214acc41a2f1297839), upstream latest 1.30.0 (digest ec8c95cd800845abb9bbc5f377ec7c57d2eb8e2386a00a201d3a74ee4092e5ed)
• golangci-lint: pinned 2.13.1, upstream latest 2.13.2

Absorb procedure

Bump the version: (or analyzer-version:) default in the listed
.github/actions/<name>/action.yml. For binary-install lanes (shellcheck,
shfmt, typos, editorconfig, gitleaks, actionlint, lefthook-validate,
lychee-offline) ALSO recompute
the paired sha256: default from the new release asset. The uvx/npx lanes (ruff,
pyright, check-jsonschema, markdown, biome, tsc) and PSScriptAnalyzer carry no
checksum. For OSV, update .github/osv-scanner-pin.json only after reviewing
the release, verifying the official Linux asset checksum and SLSA provenance,
and updating the pinned verifier when required. Consumers pick the new
default up when they re-pin this repository. For golangci-lint, verify both
official linux-amd64 and windows-amd64 archive checksums before changing the
embedded version and hashes. For govulncheck, verify the official Go proxy
version, sum.golang.org module sum, origin tag, and commit before changing the
exact module pin. For Playwright, bump the PLAYWRIGHT_VERSION env value in
.github/workflows/claude-e2e-verify.yml (an npm lane, no checksum).
For zizmor, bump .github/workflows/zizmor.yml's version and sha256
defaults together after verifying the GitHub-reported release-asset digest
(same absorb shape as OSV), and only after raising the fleet pin in
dotfiles .chezmoidata/uv-tools.yaml first.
For runtime drift, update every action's matching exact-patch
input default (and the root global.json plus the dotnet actions' fallback
pins together) only after reviewing the stable patch. Never auto-merge these
updates.

Fleet-led pins absorb in a fixed order

ruff, pyright, check-jsonschema, golangci-lint, and the Python and
Node runtimes are ALSO pinned by the fleet inventory in
melodic-software/dotfiles — .chezmoidata/uv-tools.yaml for the uv tools and
the interpreter, .chezmoidata/golangci-lint.yaml for golangci-lint, and
.node-version for Node — which is what installs every developer's local
toolchain. Raise the fleet pin there FIRST, then bump this repository to
match — never past it. Bumping here alone puts CI on a version no developer
has, which is how CI came to lint with a ruff nobody ran
(#372).

biome is caller-derived at runtime (#377): an exact @biomejs/biome pin
in the caller's root package.json wins; otherwise the reviewed
fallback-version default applies. This drift row monitors that fallback
only (pin-less callers / fixture lanes). Absorb npm latest into
fallback-version like any single-authority npm tool — do not treat a
consumer Dependabot bump as a second authority to chase.

markdown is standards-led: absorb .github/actions/markdown/action.yml's
version default to match melodic-software/standards' markdownlint-cli2 pin
(package.json / $schema), never past it. This report flags npm latest, which
can lead that pin — do not absorb past standards. SHA-pinned consumers pick
the new default up only on their next re-pin of this repository
(#394).

zizmor is fleet-led too — pinned here in .github/workflows/zizmor.yml
and there in .chezmoidata/uv-tools.yaml. Raise the fleet pin in dotfiles
FIRST, then bump this repository's version+sha256 defaults together to match
— never past the fleet (#379).

Everything else above has a single authority, and absorbing upstream latest
for it is correct as written. melodic-software/dotfiles reports a consumer
that lags the fleet, or one bumped ahead of it, on its own schedule.

Why advisory

Dependabot cannot bump these — its github-actions ecosystem updates only
uses: SHAs (see .github/dependabot.yml). A new tool release can ship
checks that break unrelated PRs; binary and image lanes also need reviewed
checksums/digests, so bumps are absorbed deliberately rather than auto-merged.

---

Updated automatically by .github/workflows/tool-version-drift-check.yml.
Closing this issue without absorbing the bump reopens it on the next run.

[kyle-sexton]

This was generated by AI during triage.

Triage (autonomous lane). Verified drift against the working tree: lefthook-validate action's version default is 2.1.10, ruff action's version default is 0.16.3, biome action's fallback-version default is 2.5.9 — all three match the issue's stated pins, so the reported drift is real.

Fleet-pin check for the ruff row: melodic-software/dotfiles .chezmoidata/uv-tools.yaml still pins ruff==0.16.3. Per this issue's own fleet-led-order rule, the ruff row is not absorbable here yet — raise the fleet pin in dotfiles first, then bump this repo to match.

Sites + fix pattern (2 of 3 rows actionable now, work-class: mechanical):

• lefthook-validate action input version + paired sha256 → bump to upstream evilmartians/lefthook latest stable, recompute the Linux_x86_64 release SHA-256 per the absorb procedure.
• biome action input fallback-version → bump to npm @biomejs/biome latest (single npm-authority row, no checksum).
• ruff action input version → excluded from this pass; blocked on the dotfiles fleet pin (see above). Issue will reopen automatically for this row on the next drift-check run if left unaddressed.

Labels applied: agent-ready, work-class: mechanical, priority: medium, status: ready.

[kyle-sexton]

This was generated by AI in the autonomous worker lane. Instance melo-lap-001-worker-202608230449.

Escalated to the human floor — not started. Role label moved agent-ready → needs-human.

Why. The absorb procedure for this item bumps dependency version pins and recomputes their paired sha256: checksums. Dependency pins and checksums sit on this lane's unconditional human floor, so the lane will not absorb them autonomously regardless of the work-class: mechanical classification triage applied. No advisor panel was convened — this is a standing-policy classification, not a stalled worker.

Nothing is wrong with the item. It is well-formed, carries priority: medium, and its procedure is explicit. The blocker is authority, not clarity.

The decision that remains for a human — one question, and it is a standing policy call, not a per-issue one:

May the autonomous worker lane absorb tool-version-drift pin + sha256: bumps in ci-workflows on its own, given that each bump is verified by CI and the checksums are recomputed from the upstream release artifact by the documented procedure?

• If yes: say so once and this whole recurring class (<!-- ci-workflows:tool-version-drift:v1:active -->) can flow through the lane on every future firing. The cleanest durable form is an explicit carve-out in the lane's operating brief or in this repo's tracked config, so the exemption survives compaction and applies on all three machines — not a reply on this issue, which no future cycle will read.
• If no: these issues should stop carrying agent-ready at triage time, so the lane stops re-surfacing them and the queue reflects reality.

Current drift at time of escalation (informational; re-verify against upstream before acting, this snapshot ages):
lefthook-validate 2.1.10 → 2.1.11 · ruff 0.16.3 → 0.16.4 · biome 2.5.9 → 2.5.10

No claim was taken and no lease was held on this item, so nothing needs releasing.