Skip to content

Promote develop to main With the Release Task Scope Fix - #774

Merged
ptr727 merged 2 commits into
mainfrom
develop
Aug 16, 2026
Merged

Promote develop to main With the Release Task Scope Fix#774
ptr727 merged 2 commits into
mainfrom
develop

Conversation

@ptr727

@ptr727 ptr727 commented Aug 16, 2026 •
edited
Loading

Copy link
Copy Markdown
Owner

Promote develop to main, carrying two changes:

The release dispatched after this merge is the live proof of the scope fix: the hub's publish job grants contents: write and actions: write, every target is disabled, and github-release must run and create the tag.

dependabot Bot and others added 2 commits August 16, 2026 21:09
@dependabot
Bump astral-sh/setup-uv from 8.1.0 to 10.0.0 in the actions-deps group (
919b30f 
#771)

Bumps the actions-deps group with 1 update:
[astral-sh/setup-uv](https://github.com/astral-sh/setup-uv).

Updates `astral-sh/setup-uv` from 8.1.0 to 10.0.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/setup-uv/releases">astral-sh/setup-uv's
releases</a>.</em></p>
<blockquote>
<h2>v10.0.0 🌈 Disable automatic caching for sensitive events and new QOL
features</h2>
<h2>Changes</h2>
<p>Another breaking release, directly after v9.0.0 but we think the
added security justifies that.</p>
<h3>Extra security by default</h3>
<p>If you use the default <code>enable-cache: auto</code> this will now
<strong>DISABLE THE CACHE</strong> to protect against cache poisoning
for the following events:</p>
<ul>
<li><code>pull_request_target</code></li>
<li><code>workflow_run</code></li>
<li><code>release</code></li>
</ul>
<p>You can read the full reasoning in <a
href="https://redirect.github.com/astral-sh/setup-uv/issues/984">astral-sh/setup-uv#984</a></p>
<h3><code>version: latest-known</code></h3>
<pre lang="yaml"><code>- name: Install the latest version of uv known to
setup-uv
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version: &quot;latest-known&quot;
</code></pre>
<p>This will now install the latest version with a checksum that is
known by this action. The <a
href="https://github.com/astral-sh/setup-uv/blob/4f6036f71cec78afb113b323f220c9185d983c12/src/download/checksum/known-checksums.ts">known
<code>uv</code> checksums</a> are automatically updated but will take a
release of this action to take effect. You won't be always using the
latest &amp; greatest but you will have an extra level of security.</p>
<h3>Read python version from <code>.tool-versions</code></h3>
<pre lang="yaml"><code>- name: Install uv based on the version defined
in .tool-versions and also set python
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version-file: &quot;pyproject.toml&quot;
</code></pre>
<p>Will now also set the python version if it is defined in
<code>.tool-versions</code>. You can read the details <a
href="https://github.com/astral-sh/setup-uv/blob/main/docs/advanced-version-configuration.md#install-a-version-defined-in-a-requirements-or-config-file">in
the docs</a></p>
<h2>🚨 Breaking changes</h2>
<ul>
<li>Disable automatic caching for sensitive events <a
href="https://github.com/eifinger"><code>@​eifinger</code></a> (<a
href="https://redirect.github.com/astral-sh/setup-uv/issues/992">#992</a>)</li>
</ul>
<h2>🐛 Bug fixes</h2>
<ul>
<li>Reject paths in .tool-versions <a
href="https://github.com/eifinger"><code>@​eifinger</code></a> (<a
href="https://redirect.github.com/astral-sh/setup-uv/issues/1007">#1007</a>)</li>
</ul>
<h2>🚀 Enhancements</h2>
<ul>
<li>Read Python version from .tool-versions <a
href="https://github.com/eifinger"><code>@​eifinger</code></a> (<a
href="https://redirect.github.com/astral-sh/setup-uv/issues/996">#996</a>)</li>
<li>Add latest-known version selector <a
href="https://github.com/eifinger"><code>@​eifinger</code></a> (<a
href="https://redirect.github.com/astral-sh/setup-uv/issues/993">#993</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/setup-uv/commit/ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d"><code>ae62891</code></a>
chore(deps): roll up Dependabot updates (<a
href="https://redirect.github.com/astral-sh/setup-uv/issues/1013">#1013</a>)</li>
<li><a
href="https://github.com/astral-sh/setup-uv/commit/f9cdb47d487aee2be8925d1e57290177ad9e1ac2"><code>f9cdb47</code></a>
Reject paths in .tool-versions (<a
href="https://redirect.github.com/astral-sh/setup-uv/issues/1007">#1007</a>)</li>
<li><a
href="https://github.com/astral-sh/setup-uv/commit/4f6036f71cec78afb113b323f220c9185d983c12"><code>4f6036f</code></a>
Require pull requests for Dependabot rollups (<a
href="https://redirect.github.com/astral-sh/setup-uv/issues/1005">#1005</a>)</li>
<li><a
href="https://github.com/astral-sh/setup-uv/commit/8d6402c9b71205b2d8d0b82de531d8fed8430182"><code>8d6402c</code></a>
chore(deps): roll up Dependabot updates (<a
href="https://redirect.github.com/astral-sh/setup-uv/issues/1004">#1004</a>)</li>
<li><a
href="https://github.com/astral-sh/setup-uv/commit/46f427bd47c794e99536b75ffaa9f27602425027"><code>46f427b</code></a>
Read Python version from .tool-versions (<a
href="https://redirect.github.com/astral-sh/setup-uv/issues/996">#996</a>)</li>
<li><a
href="https://github.com/astral-sh/setup-uv/commit/8ed89c51143f65ea13eaba62db51dbb8ea52d0a3"><code>8ed89c5</code></a>
ci: pin Alpine container image (<a
href="https://redirect.github.com/astral-sh/setup-uv/issues/995">#995</a>)</li>
<li><a
href="https://github.com/astral-sh/setup-uv/commit/8473c7fea42cdfd540f4b01317a17ac5f54126ae"><code>8473c7f</code></a>
chore(deps): roll up Dependabot updates (<a
href="https://redirect.github.com/astral-sh/setup-uv/issues/994">#994</a>)</li>
<li><a
href="https://github.com/astral-sh/setup-uv/commit/18d451d679e1650bc59f25f17116168d04f30748"><code>18d451d</code></a>
Add latest-known version selector (<a
href="https://redirect.github.com/astral-sh/setup-uv/issues/993">#993</a>)</li>
<li><a
href="https://github.com/astral-sh/setup-uv/commit/f45168497b927d08c229345a5ab9ad5c85418d0b"><code>f451684</code></a>
Disable automatic caching for sensitive events (<a
href="https://redirect.github.com/astral-sh/setup-uv/issues/992">#992</a>)</li>
<li><a
href="https://github.com/astral-sh/setup-uv/commit/b68407c192114b6e47cc45b98289832c3df00d5e"><code>b68407c</code></a>
chore: update known checksums for 0.12.3 (<a
href="https://redirect.github.com/astral-sh/setup-uv/issues/991">#991</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/setup-uv/compare/08807647e7069bb48b6ef5acd8ec9567f424441b...ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=astral-sh/setup-uv&package-manager=github_actions&previous-version=8.1.0&new-version=10.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@ptr727
Move the Release Task's Job Scopes to the Caller (#772)
63d244b 
## What

`build-release-task.yml` no longer declares job-level `permissions:` on
`build-nuget` (`id-token: write`) or `github-release` (`contents:
write`, `actions: write`). The caller grants what the targets it enables
need, and `docs/reusable-workflows.md` "Adopting the Release Chain" says
so.

## Why

The hub's first release through the task, dispatched on `main` at
`82fecef` after #768, ended in `startup_failure` (run 31972504539). A
called job's `permissions:` block is validated against the caller's
grant before its `if:` runs (GOVERNANCE.md "Workflow YAML Conventions",
the reusable-workflows bullet), so `build-nuget` asking for `id-token:
write` fails any caller that does not grant it, the hub's own `publish`
job included, even though the job is disabled. `github-release`'s block
has the same shape and would fail every smoke build, since a Dependabot
pull request holds a read-only token that cannot grant `contents:
write`. This is the finding #762 declined on the ground that only
`NuGet/login` consumes the scope: the consumption was never the problem,
the declaration was.

## Verification

actionlint, prose gate, audit self-test, 686 unit tests, markdownlint.
The live proof is the re-dispatched hub release after this promotes,
which is the next step.
Copilot AI lite review requested due to automatic review settings August 16, 2026 21:30
Copilot AI reviewed Aug 16, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Promotes develop to main with updates centered on reusable workflow permission-scoping for the release chain, plus an additional CI dependency pin update.

Changes:

  • Remove job-level permissions: blocks from build-release-task.yml jobs that are conditionally disabled, relying on the caller to grant permissions to avoid reusable-workflow startup validation failures.
  • Expand docs/reusable-workflows.md guidance to explain the caller-granted permissions model and why called jobs should not declare job-level permissions: in this task.
  • Bump astral-sh/setup-uv pin in validate-task.yml from v8.1.0 to v10.0.0.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File Description
docs/reusable-workflows.md Documents the caller-granted permissions approach for the release chain and explains why job-level permissions: are avoided in the called workflow.
.github/workflows/validate-task.yml Updates the pinned astral-sh/setup-uv action SHA/version used by validation jobs.
.github/workflows/build-release-task.yml Removes job-level permissions declarations for build-nuget and github-release so callers control grants and disabled jobs do not fail validation at startup.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread .github/workflows/validate-task.yml
@ptr727
ptr727 merged commit 0b07a59 into main Aug 16, 2026
8 checks passed
@ptr727 ptr727 mentioned this pull request Aug 16, 2026
Merged
ptr727 added a commit that referenced this pull request Aug 16, 2026
@ptr727
Record 2.0.352 in the Reusable-Workflow Rollout and Add Its Catalog S…
76f15b3 
…nippets (#775)

Release `2.0.352` (`main` `0b07a59d7c65d07d8df275a96deaf2e06cbefd51`) is
the
first tag carrying every hub-hosted reusable workflow task, produced by
[the publish-release
run](https://github.com/ptr727/ProjectTemplate/actions/runs/31974067182)
after promotion #774. In that run `build-release-task.yml` ran with
every
target disabled and its `github-release` job succeeded while all five
build
jobs skipped, proving the `github-release` skip fix (#762) and the
caller-granted scopes (#772). The earlier release attempt on `82fecef`

([run](https://github.com/ptr727/ProjectTemplate/actions/runs/31972504539))
ended in `startup_failure` because `build-nuget`/`github-release`
declared
job-level permissions; #772 fixed it.

## docs/reusable-workflows.md "Rollout"

- Ticks the two stage-0 merge-bot proof items: Dependabot PR #771 merged
to
  `develop` with `--squash` through `merge-bot-task.yml`

([run](https://github.com/ptr727/ProjectTemplate/actions/runs/31972622149)),
  and Dependabot PR #770 merged to `main` with `--merge`

([run](https://github.com/ptr727/ProjectTemplate/actions/runs/31972611554)).
- Ticks "Promoted and released" in stages 2, 3, 4, and 5 with `2.0.352`
on
  `0b07a59d` and #774, and stage 4 also notes the first attempt's
  `startup_failure` and its #772 fix.
- Leaves every adoption and pilot checkbox untouched.
- Does **not** tick either stage's "Catalog snippets ... pinned to that
release" item, since neither stage's full set of snippets is complete
this
  time: stage 2's release-with-smoke shape still calls its own repo's
`build-release-task.yml` by `./` path rather than the hub's, and stage
5's
  `deploy-site.yml`, `publish-docker-readme-task.yml`, and
  `check-upstream-version-task.yml` each stay open for reasons the doc
  itself already states (no manifest-wide snippet by design, or a job
  embedded in a larger stub rather than a standalone caller). Both items
  gain an inline note identifying which of their snippets this PR adds.

## New catalog snippets

Three of the five/six candidate files, each pinned
`0b07a59d7c65d07d8df275a96deaf2e06cbefd51 # 2.0.352` and byte-identical
to
its doc stub block apart from the pin (and, where the doc's own comment
wrapping does not survive an actual YAML file's comment-wrap rule, a
reworded comment kept in sync on both sides):

- `catalog/snippets/workflows/test-pull-request.yml` (the no-build gate
  shape from "Adopting the Gates")
- `catalog/snippets/workflows/publish-release.yml` (the release-repo
shape
  from "Adopting the Release Chain")
- `catalog/snippets/workflows/run-periodic-codegen-pull-request.yml`
(the
  codegen stub, which the doc already says keeps today's per-repo shape)

Skipped, with the doc updated to say why:

- `test-pull-request-smoke.yml` - the doc's smoke stub still calls the
caller's own `./.github/workflows/build-release-task.yml` by local path,
  never the hub's `build-release-task.yml` directly, so it does not meet
  the "calls the hub task" condition.
- `deploy-site.yml` - the doc's own "Deploy-site" paragraph states it
  "has no manifest-wide catalog snippet either," the same reason
`get-version-task.yml`/`publish-plan-task.yml` have none: each site's
own
  shape varies too much around the shared `deploy` job.
- `check-upstream-version.yml` - the doc gives only the
`check-upstream-version:`
job body, not a complete top-level trigger/concurrency shape, and unlike
the codegen stub there is no doc statement that a uniform shape exists
to
  copy.

`catalog/snippets/workflows/README.md` gained rows for the three new
snippets and an updated intro paragraph explaining the partial rollout.

## TODO.md

Added one **Settled** line under "Host the type-specific tasks" naming
`2.0.352` as the release that makes stages 2-5 adoptable and the run
that
proved the release chain, and noting #769 as the one open follow-up from
the promotion review.

## reports/workflow-reuse.md

Regenerated with `python3 spec/workflow_reuse.py --report` against the
live
fleet at hub `63d244b` (this branch's base). The numbers move against
the
last committed report only because the live fleet moved since then, not
because of anything in this PR.

## Gates run locally

`spec/validate.py`, `python3 -m unittest discover -s scripts/tests` (686
tests), `spec/audit.py --selftest`, `spec/workflow_reuse.py --selftest`,
`scripts/repo_gate.py` (sha-pin resolved against GitHub),
`scripts/build_dist.py --check`,
`scripts/prose_lint.py` (all nine checks), `ruff check`/`ruff format
--check`,
`mypy`, and the Docker `actionlint`, `markdownlint-cli2`, and
`editorconfig-checker` linters (only `.ruff_cache` noise there).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@ptr727