From d2e60e6a63023b0dbcc8bc3c9dd6cae22e1f1c25 Mon Sep 17 00:00:00 2001 From: Pieter Viljoen Date: Mon, 26 Oct 2026 08:14:25 -0700 Subject: [PATCH 1/2] Carry the Markdown Config, Scope the Publisher's Concurrency, and Fix the README Shields Co-Authored-By: Claude Opus 5.5 --- .github/workflows/publish-release.yml | 2 +- .markdownlint-cli2.jsonc | 12 +++++++++--- README.md | 8 ++++---- 3 files changed, 14 insertions(+), 8 deletions(-) diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml index 47c4234e..cdc641b2 100644 --- a/.github/workflows/publish-release.yml +++ b/.github/workflows/publish-release.yml @@ -6,7 +6,7 @@ on: # A publish is a deliberate dispatch, so runs serialize on one group and queue rather than cancel. # That keeps a run from being left with a half-created GitHub release. concurrency: - group: ${{ github.workflow }} + group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: false permissions: {} diff --git a/.markdownlint-cli2.jsonc b/.markdownlint-cli2.jsonc index e4331776..b66ba624 100644 --- a/.markdownlint-cli2.jsonc +++ b/.markdownlint-cli2.jsonc @@ -16,11 +16,17 @@ "MD060": false }, "gitignore": true, - // Declared here rather than only as the CI action's globs input, because the ignores entry below only subtracts, so without a positive glob a run lints nothing and exits clean. + // Declared here rather than only as the CI action's globs input. + // It is declared because the ignores entry below only subtracts, so without a positive glob a run lints nothing and exits clean. "globs": ["**/*.md"], // Third-party Markdown under node_modules is not authored prose, and a repository's .gitignore does not reliably exclude it. // A bare `node_modules` entry would match the root copy only. - // This list is fleet-wide. A repository excluding a subtree of its own adds no entry here, and puts a `.markdownlint-cli2.jsonc` carrying its own `ignores` beside that content instead, which a bare local run and CI both honor. - // Those `ignores` patterns resolve against the directory holding that file rather than against the repository root, so each entry names its target as seen from that directory and a repository-root path matches nothing there, reporting no error saying so. + // This list is fleet-wide. + // A repository excluding a subtree of its own adds no entry here. + // It puts a `.markdownlint-cli2.jsonc` carrying its own `ignores` beside that content instead. + // A bare local run and CI both honor that file. + // Those `ignores` patterns resolve against the directory holding that file rather than against the repository root. + // Each entry names its target as seen from that directory. + // A repository-root path matches nothing there, and the run reports no error saying so. "ignores": ["**/node_modules/**"] } diff --git a/README.md b/README.md index ef304eb4..5759a859 100644 --- a/README.md +++ b/README.md @@ -226,7 +226,7 @@ Licensed under the [MIT License][license]\ [last-commit-shield]: https://img.shields.io/github/last-commit/ptr727/Blog?logo=github&label=Last%20Commit [license-shield]: https://img.shields.io/github/license/ptr727/Blog?label=License -[pre-release-version-shield]: https://img.shields.io/github/v/release/ptr727/Blog?include_prereleases&label=GitHub%20Pre-Release&logo=github +[pre-release-version-shield]: https://img.shields.io/github/v/release/ptr727/Blog?include_prereleases&filter=*-g*&label=GitHub%20Pre-Release&logo=github [release-status-shield]: https://img.shields.io/github/actions/workflow/status/ptr727/Blog/publish-release.yml?event=workflow_dispatch&logo=github&label=Release%20Status [release-version-shield]: https://img.shields.io/github/v/release/ptr727/Blog?logo=github&label=GitHub%20Release @@ -243,9 +243,6 @@ Licensed under the [MIT License][license]\ [capture]: ./capture/ [capture-readme]: ./capture/README.md -[media-metadata-gate]: ./checks/media_metadata_gate.py -[media-redactions-gate]: ./checks/media_redactions_gate.py -[text-pii-gate]: ./checks/text_pii_gate.py [checks]: ./checks/ [content]: ./CONTENT.md [deploy]: ./deploy/ @@ -258,11 +255,14 @@ Licensed under the [MIT License][license]\ [history]: ./HISTORY.md [hugo-config]: ./hugo.yaml [license]: ./LICENSE +[media-metadata-gate]: ./checks/media_metadata_gate.py [media-redactions]: ./checks/media-redactions.json +[media-redactions-gate]: ./checks/media_redactions_gate.py [migration-post]: ./content/posts/2026/08/01/moving-this-blog-from-wordpress-to-hugo.md [normalize-media]: ./scripts/normalize_media.py [operations]: ./OPERATIONS.md [operations-family]: ./OPERATIONS.md#the-family-site +[text-pii-gate]: ./checks/text_pii_gate.py [workflow]: ./WORKFLOW.md From 4d572a633436701f735b6984551ea677442ca26a Mon Sep 17 00:00:00 2001 From: Pieter Viljoen Date: Mon, 26 Oct 2026 08:21:08 -0700 Subject: [PATCH 2/2] Cite Each Concurrency Exception by Number Co-Authored-By: Claude Opus 5.5 --- .github/workflows/deploy-site.yml | 2 +- .github/workflows/merge-bot-pull-request.yml | 3 +-- .github/workflows/publish-release.yml | 3 +-- 3 files changed, 3 insertions(+), 5 deletions(-) diff --git a/.github/workflows/deploy-site.yml b/.github/workflows/deploy-site.yml index c951d85d..abf3c04a 100644 --- a/.github/workflows/deploy-site.yml +++ b/.github/workflows/deploy-site.yml @@ -11,7 +11,7 @@ on: - staging - production -# Runs queue rather than cancel, because a cancelled deploy leaves a release uploaded and unflipped. +# GOVERNANCE.md "Workflow YAML Conventions" Concurrency exception (3). concurrency: group: ${{ github.workflow }}-${{ inputs.environment }} cancel-in-progress: false diff --git a/.github/workflows/merge-bot-pull-request.yml b/.github/workflows/merge-bot-pull-request.yml index 8ee729c3..51d3029f 100644 --- a/.github/workflows/merge-bot-pull-request.yml +++ b/.github/workflows/merge-bot-pull-request.yml @@ -6,8 +6,7 @@ on: pull_request_target: types: [opened, reopened, synchronize] -# Concurrency keys on the PR number rather than on github.ref, which under pull_request_target is the base branch and would serialize every bot PR against it, so each PR queues independently. -# The cancel-in-progress setting is false so a follow-up synchronize does not cancel an in-flight opened run before it enables auto-merge. +# GOVERNANCE.md "Workflow YAML Conventions" Concurrency exception (1). concurrency: group: ${{ github.workflow }}-${{ github.event.pull_request.number }} cancel-in-progress: false diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml index cdc641b2..804a6592 100644 --- a/.github/workflows/publish-release.yml +++ b/.github/workflows/publish-release.yml @@ -3,8 +3,7 @@ name: Publish project release action on: workflow_dispatch: -# A publish is a deliberate dispatch, so runs serialize on one group and queue rather than cancel. -# That keeps a run from being left with a half-created GitHub release. +# GOVERNANCE.md "Workflow YAML Conventions" Concurrency exception (2). concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: false