From f63e8b77040a46d9da819c3e5c797d2e85c3e401 Mon Sep 17 00:00:00 2001 From: repo-platform-sync Date: Mon, 24 Aug 2026 09:21:48 +0000 Subject: [PATCH] chore: update repo-platform template to staging@e9b3b64615ad --- .copier-answers.yml | 2 +- .editorconfig | 3 ++ .gitattributes | 2 ++ .github/workflows/release.yml | 32 ++++++++++++++++++ .github/workflows/update-release-pr.yml | 44 +++++++++++++++++++++++++ .typography-allow | 8 ++--- .yamllint | 3 +- AGENTS.md | 5 ++- CODE_OF_CONDUCT.md | 2 ++ LICENSE.md | 4 +-- SECURITY.md | 3 +- 11 files changed, 96 insertions(+), 12 deletions(-) create mode 100644 .github/workflows/update-release-pr.yml diff --git a/.copier-answers.yml b/.copier-answers.yml index f78a8191..0d584f8b 100644 --- a/.copier-answers.yml +++ b/.copier-answers.yml @@ -1,6 +1,6 @@ # This file is managed by Vivswan/repo-platform. # Copier uses it to track the template source and version - do not delete. -_commit: 268ab14 +_commit: e9b3b64 _src_path: gh:Vivswan/repo-platform channel: staging copyright_holder: Vivswan Shah (https://github.com/Vivswan) diff --git a/.editorconfig b/.editorconfig index a7c1f3cc..acead647 100644 --- a/.editorconfig +++ b/.editorconfig @@ -1,3 +1,6 @@ +# This file is managed by Vivswan/repo-platform. +# Local edits may be replaced during template updates. + root = true [*] diff --git a/.gitattributes b/.gitattributes index b631a428..0fe55142 100644 --- a/.gitattributes +++ b/.gitattributes @@ -1,3 +1,5 @@ +# Baseline attributes from Vivswan/repo-platform. + # Normalize all detected text files to LF in the repository. * text=auto eol=lf diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index f40ef55e..9947feac 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -20,6 +20,11 @@ # `gh attestation verify -R / --bundle attestation.jsonl` # The bundle rides on the frozen release itself, so verification # never depends on GitHub's attestations API staying reachable. +# A run in which release-please creates or refreshes the release PR +# (computed independently of any release cut; a run finding no unreleased +# releasable commits triggers neither) calls the repo-owned +# update-release-pr.yml with that PR's number and head branch, so files +# that must ride in the release commit are regenerated there. # Everything runs in the same workflow run, so it works with the default # GITHUB_TOKEN too, which cannot trigger `on: release` workflows. Without # the REPO_PLATFORM_TOKEN secret the release PR is created by the default @@ -51,6 +56,14 @@ jobs: outputs: release_created: ${{ steps.release.outputs.release_created }} tag_name: ${{ steps.release.outputs.tag_name }} + # The action's pr output is one JSON PullRequest object ({number, + # headBranchName, ...}), unset unless a PR was created or refreshed; + # the && short-circuit keeps fromJSON off the empty string whenever + # no PR was proposed (release-cut-only runs, runs finding nothing + # awaiting release, and head-check-skipped runs). + prs_created: ${{ steps.release.outputs.prs_created }} + pr_number: ${{ steps.release.outputs.pr && fromJSON(steps.release.outputs.pr).number }} + pr_head_branch: ${{ steps.release.outputs.pr && fromJSON(steps.release.outputs.pr).headBranchName }} steps: # A green run releases only the head it tested: if main moved on, skip # and let the newer push's own run release (after its CI passes). @@ -131,6 +144,9 @@ jobs: # non-public releases publish unattested by fleet policy). publish-release: needs: [release-please, update-release] + # The needs chain already implies this gate (a skipped update-release + # skips this job too); the job that flips a release live keeps its own + # explicit gate on purpose. if: needs.release-please.outputs.release_created == 'true' runs-on: ubuntu-latest timeout-minutes: 15 @@ -192,3 +208,19 @@ jobs: env: GH_TOKEN: ${{ secrets.REPO_PLATFORM_TOKEN || github.token }} run: gh release edit "$TAG" --draft=false + + # The release-PR hook: gated only on prs_created, which release-please + # computes independently of release_created (a run finding no unreleased + # releasable commits sets neither), so this call sits outside the three + # release stages above and never delays publish-release. Same ceiling + # passthrough as update-release: no permissions block, so the repo-owned + # hook gets the calling job's full ceiling and its jobs narrow it + # themselves. + update-release-pr: + needs: [release-please] + if: needs.release-please.outputs.prs_created == 'true' + uses: ./.github/workflows/update-release-pr.yml + with: + pr_number: ${{ needs.release-please.outputs.pr_number }} + head_branch: ${{ needs.release-please.outputs.pr_head_branch }} + secrets: inherit diff --git a/.github/workflows/update-release-pr.yml b/.github/workflows/update-release-pr.yml new file mode 100644 index 00000000..d6cd4c37 --- /dev/null +++ b/.github/workflows/update-release-pr.yml @@ -0,0 +1,44 @@ +# The release-PR hook of the release pipeline: repo-owned, generated once +# by Vivswan/repo-platform and never overwritten by template +# sync. The managed release.yml calls this workflow whenever release-please +# creates or refreshes the release PR (independently of any release cut), +# so everything this repository wants on that PR happens here: regenerating +# files that must ride in the release commit, updating version references +# in docs. Add jobs freely - releases never wait on this path. +# Token caveat: pushes to the PR branch made with the default github.token +# do NOT re-trigger the PR's CI checks (the same limitation behind +# release.yml's close/reopen note); with REPO_PLATFORM_TOKEN they do. + +name: Update Release PR + +on: + workflow_call: + inputs: + pr_number: + description: The release PR's number + required: true + type: string + head_branch: + description: The release PR's head branch (push updates back to it) + required: true + type: string + +jobs: + update-release-pr: + runs-on: ubuntu-latest + timeout-minutes: 20 + permissions: + contents: write # enough to push regenerated files back to the PR branch + steps: + - uses: actions/checkout@v7 + with: + ref: ${{ inputs.head_branch }} + - name: Update the release PR + env: + GH_TOKEN: ${{ github.token }} + PR_NUMBER: ${{ inputs.pr_number }} + HEAD_BRANCH: ${{ inputs.head_branch }} + # Repository-specific release-PR preparation goes here, e.g.: + # ./regenerate-versioned-files.sh + # git commit -am "chore: regenerate for release" && git push origin "$HEAD_BRANCH" + run: echo "nothing to add to release PR $PR_NUMBER yet" diff --git a/.typography-allow b/.typography-allow index 3c9aa910..efbce3c1 100644 --- a/.typography-allow +++ b/.typography-allow @@ -1,8 +1,8 @@ -# Managed by Vivswan/repo-platform. Path prefixes exempt from -# the check-typography action, one per line, relative to the repository root. -# Template sync overwrites this file; repository-specific exemptions belong +# This file is managed by Vivswan/repo-platform. +# Local edits may be replaced during template updates. +# Path prefixes exempt from the check-typography action, one per line, +# relative to the repository root; repository-specific exemptions belong # in .typography-allow.local (same format, repo-owned, read alongside it). # release-please writes CHANGELOG.md from commit and PR text, which is not # ASCII-guaranteed. CHANGELOG.md -# END REPO-PLATFORM MANAGED diff --git a/.yamllint b/.yamllint index 33a1658b..1bd5753f 100644 --- a/.yamllint +++ b/.yamllint @@ -1,4 +1,5 @@ -# Shared yamllint configuration from Vivswan/repo-platform. +# This file is managed by Vivswan/repo-platform. +# Local edits may be replaced during template updates. # The key win is key-duplicates: YAML loaders silently keep the last value, # so nothing else in the CI gate would catch a duplicated key. extends: default diff --git a/AGENTS.md b/AGENTS.md index b981e2b8..0f37a521 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -2,6 +2,8 @@ This file provides guidance to AI coding agents working in this repository. `CLAUDE.md`, `.github/copilot-instructions.md`, and `.github/agents.md` are symlinks to this file, so edit only here. +Everything above the marker at the bottom of this file is managed by Vivswan/repo-platform and overwritten by template sync; this repository's own guidance belongs below the marker. + ## Project GitHub Settings as Code: GitHub Action applying declarative repository settings: rulesets, labels, branch protection, and more. A loud, stateless Probot Settings replacement. @@ -10,6 +12,7 @@ GitHub Settings as Code: GitHub Action applying declarative repository settings: - Runtime and package manager: bun (`bun install`, `bun test`, `bun run