From a4b0dfdaf3c853b200a43d4f27bff7db36e9ccbf Mon Sep 17 00:00:00 2001 From: Stuart Meeks Date: Thu, 20 Aug 2026 13:25:56 +0000 Subject: [PATCH] Align ci.yml with the canonical template exactly Removes the `release` job. ci.yml's non-comment content is now identical to templates/.github/workflows/ci.yml apart from the tag glob, which makes it identical to SelfUpdate's -- verified by diff, not by eye. This repo was the estate's only divergence from the canonical workflow. Auth and SelfUpdate already matched the template: SelfUpdate exactly, Auth with one gnome-keyring step that has an EXCEPTIONS.md entry. That alignment was real and achieved, and this repo was quietly outside it while the audit reported green, because 3.0 checks filenames and 3.1 checks job names and nothing checked what actually runs. Two earlier attempts at this made it worse. The first widened 3.1 to permit any tag-gated job downstream of `publish` -- weakening a clause so a repo passes, which is the one thing the standards repo exists to stop. The second folded the release steps into `publish`, which kept the four job names and moved the divergence somewhere no check looked. Both are reverted; the job is simply gone. GitHub releases for this package are now cut by hand, as they already were in all four other repos. No consumer impact: the job only ever ran on a v* tag, after the package had already been pushed to nuget.org. Publishing is untouched. STANDARD.md 3.0.1 now requires this match and audit-drift.sh checks it. Verified against both wrong attempts: with the release job, and with the folded steps, 3.0 and 3.1 stay PASS while 3.0.1 goes FAIL. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/ci.yml | 49 +++++++--------------------------------- CHANGELOG.md | 7 ++++++ CLAUDE.md | 11 +++++++-- 3 files changed, 24 insertions(+), 43 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 4b55761..8de1780 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,6 +1,8 @@ # CI for NextIteration.SpectreConsole.Settings. # Canonical shape defined in NextIteration.Standards STANDARD.md section 3 — change it -# there first, then here. +# there first, then here. Section 3.0.1 requires this file's non-comment content to match +# templates/.github/workflows/ci.yml exactly, apart from the tag glob below. It does. +# This repo has no EXCEPTIONS.md entry, so there is nothing else here that differs. # # The single required status check is `ci`, the aggregating gate below. `build` and `test` # must NOT be required directly: `test` is a matrix, so its check names carry the matrix @@ -9,11 +11,12 @@ # The test matrix runs all three platforms (STANDARD.md 3.1.1). This library has no # OS-native backend, but it is a filesystem library: `AtomicFile` needs a different # replace primitive on Windows (`ReplaceFile`) than on POSIX (`rename(2)`), and path -# handling, file locking and case sensitivity all differ. No EXCEPTIONS.md entry applies -# to this repo. +# handling, file locking and case sensitivity all differ. # -# `release` is a fifth, tag-gated job beyond STANDARD.md 3.1's four. It cuts the GitHub -# release from CHANGELOG.md after `publish`, and cannot run on a pull request. +# GitHub releases for this repo are cut by hand, as in every other repo in the estate. +# There used to be a fifth `release` job here that built them from CHANGELOG.md; it was +# removed because it was the only thing in the estate diverging from this template, and +# 3.1's four job names are a closed set. Do not add it back without an EXCEPTIONS.md entry. name: CI on: @@ -165,39 +168,3 @@ jobs: --api-key "${{ steps.login.outputs.NUGET_API_KEY }}" --source https://api.nuget.org/v3/index.json --skip-duplicate - - # Beyond STANDARD.md 3.1's canonical four, and downstream of `publish`, so a GitHub - # release is only ever cut for bytes that actually reached nuget.org. Tag-gated, so it - # can never run on a pull request. - release: - needs: publish - runs-on: ubuntu-latest - timeout-minutes: 10 - if: startsWith(github.ref, 'refs/tags/') - - permissions: - contents: write # creating the GitHub release - - steps: - - uses: actions/checkout@v7 - - # Pull the section for this tag's version out of CHANGELOG.md - # (e.g. tag v0.1.0 -> the "## [0.1.0] — …" block) for the release body. - # Falls back to a minimal note if the section isn't found. - - name: Build release notes - run: | - version="${GITHUB_REF_NAME#v}" - awk -v ver="$version" ' - $0 ~ "^## \\[" ver "\\]" { capture = 1; next } - capture && /^## \[/ { exit } - capture && /^\[.*\]: / { exit } - capture { print } - ' CHANGELOG.md > release-notes.md - if [ ! -s release-notes.md ]; then - echo "Release $GITHUB_REF_NAME" > release-notes.md - fi - - - name: Create GitHub release - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - run: gh release create "$GITHUB_REF_NAME" --title "$GITHUB_REF_NAME" --notes-file release-notes.md --verify-tag diff --git a/CHANGELOG.md b/CHANGELOG.md index e2e8631..dda90d1 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -59,6 +59,13 @@ floor. `setup-dotnet` v6, `upload-artifact` v7, `download-artifact` v8) and dropped the now-redundant `FORCE_JAVASCRIPT_ACTIONS_TO_NODE24` override — those majors already run on Node 24. +- Removed the `release` job that cut the GitHub release automatically from + `CHANGELOG.md`. `ci.yml`'s non-comment content is now identical to the canonical + template apart from the tag glob — the same as every other repo in the estate — and + `STANDARD.md` §3.0.1 now requires that and checks it. GitHub releases for this package + are cut by hand, as they already were everywhere else. **No consumer impact:** the job + only ever ran on a `v*` tag, after the package had already been pushed to nuget.org. + Publishing is unchanged. - Adopted the canonical CI shape from [NextIteration.Standards](https://github.com/StuartMeeks/NextIteration.Standards) (`STANDARD.md` section 3). `build` and `test` are now separate jobs, `test` diff --git a/CLAUDE.md b/CLAUDE.md index 4658352..6f786cd 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -89,5 +89,12 @@ The single required status check is `ci` — an aggregating gate over `build` an Renaming those jobs is safe; the ruleset never names them. Do not make them required checks directly. -`ci.yml` also carries a `release` job beyond the four `STANDARD.md` 3.1 names. It is -tag-gated and downstream of `publish`, and cuts the GitHub release from `CHANGELOG.md`. +**`ci.yml` is not yours to edit freely.** `STANDARD.md` §3.0.1 requires its non-comment +content to match `templates/.github/workflows/ci.yml` in the standards repo exactly, apart +from the tag glob and steps carrying an `EXCEPTIONS.md` entry. This repo has no such entry, +so the only permitted difference is `tags: [ 'v*' ]` and the header comment. `audit-drift.sh` +checks this. Change the template first, then every repo — never this file alone. + +GitHub releases here are cut by hand, as in every other repo in the estate. A fifth +`release` job used to build them from `CHANGELOG.md`; it was removed as the estate's only +divergence from the canonical workflow. Adding it back needs an `EXCEPTIONS.md` entry.