chore: update repo-platform template to staging@e9b3b64615ad

.copier-answers.yml

@@ -1,6 +1,6 @@
 # This file is managed by Vivswan/repo-platform.
 # Copier uses it to track the template source and version - do not delete.
-_commit: 268ab14
+_commit: e9b3b64
 _src_path: gh:Vivswan/repo-platform
 channel: staging
 copyright_holder: Vivswan Shah (https://github.com/Vivswan)

.editorconfig

@@ -1,3 +1,6 @@
+# This file is managed by Vivswan/repo-platform.
+# Local edits may be replaced during template updates.
+
 root = true
 
 [*]

.gitattributes

@@ -1,3 +1,5 @@
+# Baseline attributes from Vivswan/repo-platform.
+
 # Normalize all detected text files to LF in the repository.
 * text=auto eol=lf
 

.github/workflows/release.yml

@@ -20,6 +20,11 @@
 #      `gh attestation verify <asset> -R <owner>/<repo> --bundle attestation.jsonl`
 #      The bundle rides on the frozen release itself, so verification
 #      never depends on GitHub's attestations API staying reachable.
+# A run in which release-please creates or refreshes the release PR
+# (computed independently of any release cut; a run finding no unreleased
+# releasable commits triggers neither) calls the repo-owned
+# update-release-pr.yml with that PR's number and head branch, so files
+# that must ride in the release commit are regenerated there.
 # Everything runs in the same workflow run, so it works with the default
 # GITHUB_TOKEN too, which cannot trigger `on: release` workflows. Without
 # the REPO_PLATFORM_TOKEN secret the release PR is created by the default
@@ -51,6 +56,14 @@ jobs:
     outputs:
       release_created: ${{ steps.release.outputs.release_created }}
       tag_name: ${{ steps.release.outputs.tag_name }}
+      # The action's pr output is one JSON PullRequest object ({number,
+      # headBranchName, ...}), unset unless a PR was created or refreshed;
+      # the && short-circuit keeps fromJSON off the empty string whenever
+      # no PR was proposed (release-cut-only runs, runs finding nothing
+      # awaiting release, and head-check-skipped runs).
+      prs_created: ${{ steps.release.outputs.prs_created }}
+      pr_number: ${{ steps.release.outputs.pr && fromJSON(steps.release.outputs.pr).number }}
+      pr_head_branch: ${{ steps.release.outputs.pr && fromJSON(steps.release.outputs.pr).headBranchName }}
     steps:
       # A green run releases only the head it tested: if main moved on, skip
       # and let the newer push's own run release (after its CI passes).
@@ -131,6 +144,9 @@ jobs:
   # non-public releases publish unattested by fleet policy).
   publish-release:
     needs: [release-please, update-release]
+    # The needs chain already implies this gate (a skipped update-release
+    # skips this job too); the job that flips a release live keeps its own
+    # explicit gate on purpose.
     if: needs.release-please.outputs.release_created == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 15
@@ -192,3 +208,19 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.REPO_PLATFORM_TOKEN || github.token }}
         run: gh release edit "$TAG" --draft=false
+
+  # The release-PR hook: gated only on prs_created, which release-please
+  # computes independently of release_created (a run finding no unreleased
+  # releasable commits sets neither), so this call sits outside the three
+  # release stages above and never delays publish-release. Same ceiling
+  # passthrough as update-release: no permissions block, so the repo-owned
+  # hook gets the calling job's full ceiling and its jobs narrow it
+  # themselves.
+  update-release-pr:
+    needs: [release-please]
+    if: needs.release-please.outputs.prs_created == 'true'
+    uses: ./.github/workflows/update-release-pr.yml
+    with:
+      pr_number: ${{ needs.release-please.outputs.pr_number }}
+      head_branch: ${{ needs.release-please.outputs.pr_head_branch }}
+    secrets: inherit

.github/workflows/update-release-pr.yml

@@ -0,0 +1,44 @@
+# The release-PR hook of the release pipeline: repo-owned, generated once
+# by Vivswan/repo-platform and never overwritten by template
+# sync. The managed release.yml calls this workflow whenever release-please
+# creates or refreshes the release PR (independently of any release cut),
+# so everything this repository wants on that PR happens here: regenerating
+# files that must ride in the release commit, updating version references
+# in docs. Add jobs freely - releases never wait on this path.
+# Token caveat: pushes to the PR branch made with the default github.token
+# do NOT re-trigger the PR's CI checks (the same limitation behind
+# release.yml's close/reopen note); with REPO_PLATFORM_TOKEN they do.
+
+name: Update Release PR
+
+on:
+  workflow_call:
+    inputs:
+      pr_number:
+        description: The release PR's number
+        required: true
+        type: string
+      head_branch:
+        description: The release PR's head branch (push updates back to it)
+        required: true
+        type: string
+
+jobs:
+  update-release-pr:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: write # enough to push regenerated files back to the PR branch
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ inputs.head_branch }}
+      - name: Update the release PR
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_NUMBER: ${{ inputs.pr_number }}
+          HEAD_BRANCH: ${{ inputs.head_branch }}
+        # Repository-specific release-PR preparation goes here, e.g.:
+        #   ./regenerate-versioned-files.sh
+        #   git commit -am "chore: regenerate for release" && git push origin "$HEAD_BRANCH"
+        run: echo "nothing to add to release PR $PR_NUMBER yet"

.typography-allow

@@ -1,8 +1,8 @@
-# Managed by Vivswan/repo-platform. Path prefixes exempt from
-# the check-typography action, one per line, relative to the repository root.
-# Template sync overwrites this file; repository-specific exemptions belong
+# This file is managed by Vivswan/repo-platform.
+# Local edits may be replaced during template updates.
+# Path prefixes exempt from the check-typography action, one per line,
+# relative to the repository root; repository-specific exemptions belong
 # in .typography-allow.local (same format, repo-owned, read alongside it).
 # release-please writes CHANGELOG.md from commit and PR text, which is not
 # ASCII-guaranteed.
 CHANGELOG.md
-# END REPO-PLATFORM MANAGED

.yamllint

@@ -1,4 +1,5 @@
-# Shared yamllint configuration from Vivswan/repo-platform.
+# This file is managed by Vivswan/repo-platform.
+# Local edits may be replaced during template updates.
 # The key win is key-duplicates: YAML loaders silently keep the last value,
 # so nothing else in the CI gate would catch a duplicated key.
 extends: default

AGENTS.md

@@ -2,6 +2,8 @@
 
 This file provides guidance to AI coding agents working in this repository. `CLAUDE.md`, `.github/copilot-instructions.md`, and `.github/agents.md` are symlinks to this file, so edit only here.
 
+Everything above the marker at the bottom of this file is managed by Vivswan/repo-platform and overwritten by template sync; this repository's own guidance belongs below the marker.
+
 ## Project
 
 GitHub Settings as Code: GitHub Action applying declarative repository settings: rulesets, labels, branch protection, and more. A loud, stateless Probot Settings replacement.
@@ -10,6 +12,7 @@ GitHub Settings as Code: GitHub Action applying declarative repository settings:
 
 - Runtime and package manager: bun (`bun install`, `bun test`, `bun run <script>`)
 - See `package.json` scripts for the available commands.
+- `.bun-version` pins the toolchain and is managed by the template: sync overwrites it, so version overrides belong in the repo-owned workflows' explicit version inputs.
 
 ## Conventions
 
@@ -21,7 +24,7 @@ GitHub Settings as Code: GitHub Action applying declarative repository settings:
 
 - Files whose header says "managed by Vivswan/repo-platform" arrive via sync PRs pushed by that repository. Do not edit them here; change them in Vivswan/repo-platform and let the next sync PR deliver the update.
 - Repository settings (description, topics, labels, rulesets, merge policy) are applied from Vivswan/repo-platform: by the `settings/repos/` file named after this repository over there when one exists, otherwise by this repository's own `.github/settings.yml`. Do not change settings by hand in the GitHub UI; edit the settings file.
-- Repo-owned escape hatches stay local: `.github/workflows/checks.yml`, `.github/workflows/update-release.yml`, `.gitleaks.toml`, `.gitignore`'s marked LOCAL section, `.typography-allow.local` (typography exemptions; the managed `.typography-allow` is overwritten by sync), and the repository-specific section below.
+- Repo-owned escape hatches stay local: `.github/workflows/checks.yml`, `.github/workflows/update-release.yml`, `.github/workflows/update-release-pr.yml`, `release-please-config.json` and `.release-please-manifest.json` (release state, seeded once), `.gitleaks.toml`, `.gitignore`'s marked LOCAL section, `.typography-allow.local` (typography exemptions; the managed `.typography-allow` is overwritten by sync), and the repository-specific section below.
 - Module selection is this repository's own: edit the `modules` list in `.repo-platform.yml` and the next sync PR applies the change.
 
 ## Repository-specific guidance

CODE_OF_CONDUCT.md

@@ -1,3 +1,5 @@
+<!-- This file is managed by Vivswan/repo-platform. Local edits may be replaced during template updates. The text is the unmodified Contributor Covenant v2.1. -->
+
 # Contributor Covenant Code of Conduct
 
 ## Our Pledge

LICENSE.md

@@ -533,7 +533,5 @@ expression.
 **Use** means anything you do with the software requiring one of your
 licenses.
 
-<!-- Repository-specific license notices (third-party components,
-     differently licensed paths) go below this line. They survive
-     template updates via three-way merge. -->
+<!-- The license text above is managed by Vivswan/repo-platform and replaced on template sync. Repository-specific license notices (third-party components, differently licensed paths) go below this line; they are this repository's own and survive template updates via three-way merge. -->
 <!-- repo-platform:local-section -->

SECURITY.md

@@ -18,8 +18,7 @@ Expect an acknowledgement within a few days, and a fix in the next release once
 
 Never include real credentials in a report; redact everything that looks like a key.
 
-<!-- Repository-specific security documentation (scope, threat model, review
-     expectations for security-relevant changes) goes below this line. It survives template updates via three-way merge. -->
+<!-- Everything above this line is managed by Vivswan/repo-platform and replaced on template sync. Repository-specific security documentation (scope, threat model, review expectations for security-relevant changes) goes below this line; it is this repository's own and survives template updates via three-way merge. -->
 <!-- repo-platform:local-section -->
 
 ## What counts as a vulnerability here