Repository navigation
Harden the workflows and the template workflows - #99
Merged
Merged
Conversation
Live workflows: - renovate.json: give the Node that renovate.yml runs on its own group and turn off its automerge. The ci check never runs Renovate, so it cannot catch a Node bump that breaks it (the Nov 3-7 outage). - ci.yml, renovate.yml: pin uv to 0.13.7 on setup-uv. Renovate tracks the input, so uv updates arrive as PRs after minimumReleaseAge instead of reaching CI the day they ship. - ci.yml: workflow_dispatch for manual runs, concurrency that cancels superseded PR runs, a 15-minute timeout, persist-credentials: false. Templates (skill/assets/ci.yml, mutation.yml; setup-standards.sh regenerated with vendor_templates and template_history): - permissions: contents: read, a timeout, persist-credentials: false; the CI template also gets the same concurrency group. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QnzrxP1xjsiBQJYkciuDBX
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requested by Carlos · project thread
Live workflows
renovate.ymlruns on gets its own group with automerge off.cinever runs Renovate, so it cannot catch a Node bump that breaks it (the Nov 3–7 outage). Renovate automerges a branch only when every upgrade in it does (config.automerge = upgrades.every(...)), so a separate group keeps the rest ofgithub-actionsautomerging.setup-uv(released 2026-11-03, past the 3-day window). Renovate's github-actions manager tracksastral-sh/setup-uv'sversioninput (checked in the 44.222.2 package), so uv updates now arrive as PRs.workflow_dispatchfor manual runs, a concurrency group that cancels superseded PR runs (main runs always finish),timeout-minutes: 15(runs take ~1.5 min),persist-credentials: false.Templates (
skill/assets/ci.yml,mutation.yml)permissions: contents: read, a timeout (30 / 120 min),persist-credentials: false; the CI template also gets the concurrency group.setup-standards.shregenerated withvendor_templatesandtemplate_history.Not included: a pre-commit cache in the CI template (it adds a new action,
actions/cache), and--lockedinmutation.sh(it would break libraries, which don't commituv.lock).Checks run locally
pytest (1018 passed, 100% coverage), ruff check/format, pyright, mypy, deptry, check_declarations, check_passthrough: all pass.
Generated by Claude Code