chore(actions): absorb tool-version drift for editorconfig, lefthook and biome

[kyle-sexton]

Summary

Absorbs three of the five rows in #511 — the single-authority ones. The ruff and Node rows are fleet-led and land in a follow-up once their leading pins merge.

Problem

tool-version-drift-check reports: editorconfig-checker 3.11.1 → 3.11.2, Lefthook 2.1.10 → 2.1.11, Biome fallback 2.5.9 → 2.5.10, ruff 0.16.3 → 0.16.4, Node 24.19.0 → 24.20.0.

Fix

• .github/actions/editorconfig/action.yml: version 3.11.2, sha256 bc815e5b…4571a for ec-linux-amd64.tar.gz.
• .github/actions/lefthook-validate/action.yml: version 2.1.11, sha256 9012055a…9622 for lefthook_2.1.11_Linux_x86_64.
• .github/actions/biome/action.yml: fallback-version 2.5.10 (npm lane, no checksum).

Deferred per the report's own fleet-led order:

• ruff → dotfiles#578 raises .chezmoidata/uv-tools.yaml first; this repo follows.
• Node → standards#498 raises the canonical .node-version; the synced copy lands here, then the three composite node-version defaults follow (the drift check holds them equal to .node-version).

Verification

• Both binaries downloaded and sha256sum'd independently; each equals the digest GitHub reports on the release asset (gh api repos/<owner>/<repo>/releases/tags/<tag>).
• npm view @biomejs/biome@2.5.10 version → 2.5.10; releases/latest for both GitHub projects is the version pinned here.
• CI on this PR exercises the editorconfig, lefthook-validate and biome lanes with the new pins.

Related

• No linked issue ([Maintenance] Tool-version drift #511 is partially absorbed here and closes once the two fleet-led rows follow in a second PR).
• dotfiles#578, standards#498

[claude]

Claude finished @kyle-sexton's task in 1m 21s —— View job

---

Security Review — chore/tool-version-drift-511

• Gather context (PR diff, changed files)
• Run security-review procedure
• Inspect version/checksum pins for supply-chain risk
• Post findings

Scope: 3 files, version/checksum bumps only (editorconfig-checker 3.11.1→3.11.2, Lefthook 2.1.10→2.1.11, Biome npm fallback 2.5.9→2.5.10). No logic, workflow, or script changes.

Findings: none.

• Both sha256 values are well-formed 64-hex-char strings (.github/actions/editorconfig/action.yml#L39, .github/actions/lefthook-validate/action.yml#L20), matching the format install-release.sh requires (^[[:xdigit:]]{64}$) before it will proceed — a malformed pin here would hard-fail the install rather than silently skip verification.
• install-release.sh (unchanged by this PR) still enforces sha256sum -c on both cache-hit and fresh-download paths, so an incorrect pin fails closed instead of installing an unverified binary.
• Biome's fallback-version bump (.github/actions/biome/action.yml#L28) has no accompanying checksum by design (npm/npx lane) — consistent with the existing pattern for this action, not a regression introduced here.
• All three values are literal, repo-controlled data (not attacker-influenced input) interpolated into env: blocks, so there's no injection surface from this change.

I can't independently re-verify the actual upstream release hashes against GitHub (no network access in this environment), so I'm relying on static/structural checks only — the PR description states the author already cross-checked both binaries' sha256sum against the GitHub release digest API and the npm registry version, which is the right verification method for this class of change.

Verdict: No security concerns. Mechanical, well-scoped version-pin update.

[claude]

Claude finished @kyle-sexton's task in 2m 52s —— View job

---

Claude's Review

• Gather context (diff, changed files, CLAUDE.md)
• Verify version/checksum claims in the PR body
• Review each changed file
• Post findings (inline + summary)

This is a small, mechanical version-bump PR (editorconfig-checker, Lefthook, Biome fallback), and the three action.yml diffs themselves are correct and internally consistent — version/sha256 pairs updated together, exactly matching the existing pattern, and each install step is exercised by this PR's own ci run (editorconfig, lefthook-validate, biome jobs all resolved and installed their new pins successfully, which effectively confirms the new SHA-256 checksums are correct). Scope (deferring ruff/Node as fleet-led) matches the tool-version-drift-check.yml absorb-order documentation exactly.

However, this PR's own ci run is currently failing, and both failures are directly caused by this change:

1. Stale contract test still expects the old Biome fallback version
.github/scripts/resolve-npm-tool-version.test.cjs line 141 (not touched by this PR) hardcodes the old default:

assert.match(action, /^ {4}default: 2\.5\.9$/mu);

Since .github/actions/biome/action.yml's fallback-version default was bumped to 2.5.10 in this PR, selector-contract fails: The input did not match the regular expression /^ {4}default: 2\.5\.9$/mu. This regex needs to become 2\.5\.10 to match the new pin.
Location:

ci-workflows/.github/scripts/resolve-npm-tool-version.test.cjs

Line 141 in 3e831f5

assert.match(action, /^ {4}default: 2\.5\.9$/mu);

Failing job: https://github.com/melodic-software/ci-workflows/actions/runs/33064630187/job/98491613897
Fix this →

2. PR body fails the pr-issue-linkage-self gate
The "Related" section lists #511 (partially absorbed; closes once the two fleet-led rows follow), which is not a native GitHub closing keyword (Closes/Fixes/Resolves #511) and doesn't use the repo's documented escape hatch (No linked issue / No related issue:). Since this PR intentionally does not close #511 yet, the body needs the literal No linked issue (or No related issue:) phrasing per the gate's own error message, or #511 should be dropped from a native-keyword reference until it's fully absorbed.
Failing job: https://github.com/melodic-software/ci-workflows/actions/runs/33064630191/job/98491583444

Everything else — checksum format (both 64 hex chars), scope boundaries vs. #511, and the drift-check's own "single authority" classification for these three tools — checks out. Once the two CI failures above are fixed, this looks ready to merge.
· Branch

[github-actions]

Last security-reviewed head: 3e831f5576c02cce16005d2836286ec3faa5f6f4. On the next push, the relevance gate compares only the commits since this SHA; delete this comment to force a full re-review.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3e831f5576

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[github-actions]

Claude has reviewed this PR 1 time. The lane skips further automatic reviews after 5; deleting this comment resets the count.