@precisa-saude/cli 1.0.4 → 1.1.0

package/dist/templates/github/workflows/_release.yml

@@ -0,0 +1,156 @@
+name: Release
+
+# Reusable workflow — semantic-release with packages_changed guard.
+# Produces outputs so downstream jobs (publish, deploy-site) can gate
+# on whether a release happened and which commit carries the bump.
+#
+# Guards release on `packages/**` or root `package.json` changing in
+# the pushed range. Site-only or docs-only pushes skip the release
+# cycle. Set `require_package_changes: false` to release regardless.
+
+on:
+  workflow_call:
+    inputs:
+      require_package_changes:
+        description: 'Only run semantic-release if packages/** or package.json changed'
+        type: boolean
+        default: true
+    outputs:
+      released:
+        description: 'Whether a new version was released'
+        value: ${{ jobs.release.outputs.released }}
+      version:
+        description: 'The released version number (without leading v)'
+        value: ${{ jobs.release.outputs.version }}
+      release_sha:
+        description: 'The commit SHA that was released (chore(release) commit, or github.sha on no-op)'
+        value: ${{ jobs.release.outputs.release_sha }}
+
+jobs:
+  release:
+    name: semantic-release
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
+    outputs:
+      released: ${{ steps.semantic.outputs.released }}
+      version: ${{ steps.semantic.outputs.version }}
+      # Fallback to github.sha on no-op — consumers without an `if: released == 'true'`
+      # guard won't checkout an empty ref.
+      release_sha: ${{ steps.semantic.outputs.release_sha || github.sha }}
+    steps:
+      - name: Check for package changes across pushed commits
+        id: changes
+        if: inputs.require_package_changes
+        uses: actions/github-script@v7
+        with:
+          # Compares `before..after` from the push payload. Paginates explicitly
+          # because `compareCommits` truncates at 300 files per page — a large
+          # push could otherwise silently miss detection.
+          script: |
+            const before = context.payload.before;
+            const after = context.sha;
+            const isInitial = !before || /^0+$/.test(before);
+            let filenames = [];
+            if (isInitial) {
+              const { data: commit } = await github.rest.repos.getCommit({
+                owner: context.repo.owner, repo: context.repo.repo, ref: after,
+              });
+              filenames = (commit.files ?? []).map(f => f.filename);
+            } else {
+              const pages = await github.paginate(
+                github.rest.repos.compareCommitsWithBasehead,
+                {
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  basehead: `${before}...${after}`,
+                  per_page: 100,
+                },
+              );
+              filenames = pages.flatMap(p => (p.files ?? []).map(f => f.filename));
+            }
+            const packageChanged = filenames.some(
+              f => f.startsWith('packages/') || f === 'package.json'
+            );
+            core.setOutput('packages_changed', packageChanged ? 'true' : 'false');
+            core.info(`inspected ${filenames.length} files, packages_changed=${packageChanged}`);
+
+      - name: Generate GitHub App token
+        id: app-token
+        if: "!inputs.require_package_changes || steps.changes.outputs.packages_changed == 'true'"
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ secrets.RELEASE_APP_ID }}
+          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
+
+      - uses: actions/checkout@v6
+        if: "!inputs.require_package_changes || steps.changes.outputs.packages_changed == 'true'"
+        with:
+          fetch-depth: 0
+          token: ${{ steps.app-token.outputs.token }}
+
+      - uses: pnpm/action-setup@v4
+        if: "!inputs.require_package_changes || steps.changes.outputs.packages_changed == 'true'"
+
+      - uses: actions/setup-node@v6
+        if: "!inputs.require_package_changes || steps.changes.outputs.packages_changed == 'true'"
+        with:
+          node-version: 22
+          cache: 'pnpm'
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Install dependencies
+        if: "!inputs.require_package_changes || steps.changes.outputs.packages_changed == 'true'"
+        run: pnpm install --frozen-lockfile
+
+      - name: Build
+        if: "!inputs.require_package_changes || steps.changes.outputs.packages_changed == 'true'"
+        run: pnpm turbo run build
+
+      - name: Run semantic-release
+        id: semantic
+        if: "!inputs.require_package_changes || steps.changes.outputs.packages_changed == 'true'"
+        env:
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
+          HUSKY: 0
+        # Three cases:
+        #   (a) success with release: stdout contains 'Published release' →
+        #       we take the version from `git describe --tags` (more robust
+        #       to format changes in semantic-release's stdout).
+        #   (b) no-op: exit 0 AND stdout mentions 'no relevant changes' →
+        #       released=false. Requiring BOTH conditions avoids masking
+        #       silent failures where the tool exits 0 without publishing
+        #       or explaining why.
+        #   (c) real error: any other combination → non-zero exit.
+        run: |
+          set +e
+          OUTPUT=$(npx semantic-release 2>&1)
+          EXIT=$?
+          set -e
+          echo "$OUTPUT"
+
+          if echo "$OUTPUT" | grep -q "Published release"; then
+            RAW_TAG=$(git describe --tags --abbrev=0)
+            VERSION="${RAW_TAG#v}"
+            if [ -z "$VERSION" ]; then
+              echo "::error::semantic-release published but git describe found no tag"
+              exit 1
+            fi
+            RELEASE_SHA=$(git rev-parse HEAD)
+            {
+              echo "released=true"
+              echo "version=$VERSION"
+              echo "release_sha=$RELEASE_SHA"
+            } >> "$GITHUB_OUTPUT"
+          elif [ "$EXIT" -eq 0 ] && echo "$OUTPUT" | grep -qE "no relevant changes|There are no relevant changes"; then
+            echo "released=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "::error::semantic-release exited $EXIT with no recognized release or no-op marker"
+            exit "${EXIT:-1}"
+          fi
+
+      - name: Skip release (no package changes)
+        if: inputs.require_package_changes && steps.changes.outputs.packages_changed != 'true'
+        run: echo "No changes under packages/** — release skipped"

package/dist/templates/github/workflows/ci.yml

@@ -1,4 +1,20 @@
-name: CI
+name: CI/CD
+
+# Canonical CI/CD orchestrator — mirrors platform's split-workflow shape.
+# Each concern lives in its own reusable workflow under `.github/workflows/`:
+#
+#   _checks.yml       — parallel CI checks (lint, typecheck, format, build, test)
+#   _release.yml      — semantic-release with packages_changed guard
+#   _publish.yml      — npm publish pinned to release_sha
+#   _deploy-site.yml  — Cloudflare Pages deploy + Slack notify (repos with sites)
+#   review.yml        — automated Anthropic → OpenAI code review
+#   publish-tag.yml   — manual recovery (workflow_dispatch)
+#
+# This orchestrator wires the pieces together. Each repo adapts:
+#   - Which reusable workflows to call (comment out what doesn't apply)
+#   - The publish `packages` list
+#   - The site `project_name` and `site_filter`
+#   - Extra repo-specific workflows (e.g. fhir's publish-ig.yml)
 
 on:
   push:
@@ -7,38 +23,58 @@ on:
     branches: [main]
   workflow_dispatch:
 
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write
+  deployments: write
+  id-token: write
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
-  build-and-test:
-    name: build + typecheck + lint + test
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: pnpm/action-setup@v4
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '{{NODE_VERSION}}'
-          cache: pnpm
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-      - name: Build
-        run: pnpm -r build
+  # ── CI checks (every PR and push) ──────────────────────────────
+  checks:
+    uses: ./.github/workflows/_checks.yml
+    secrets: inherit
 
-      - name: Typecheck
-        run: pnpm -r typecheck
+  # ── Automated code review (PR only, after checks) ──────────────
+  review:
+    needs: checks
+    if: github.event_name == 'pull_request'
+    uses: ./.github/workflows/review.yml
+    with:
+      pr_number: ${{ github.event.pull_request.number }}
+    secrets: inherit
 
-      - name: Lint
-        run: pnpm -r lint
+  # ── Release (main only, guarded on package changes) ────────────
+  release:
+    needs: checks
+    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
+    uses: ./.github/workflows/_release.yml
+    secrets: inherit
 
-      - name: Format check
-        run: pnpm format:check
+  # ── Publish to npm (when release created a new version) ────────
+  publish:
+    needs: release
+    if: needs.release.outputs.released == 'true'
+    uses: ./.github/workflows/_publish.yml
+    with:
+      release_sha: ${{ needs.release.outputs.release_sha }}
+      # Newline-separated list of package directories. One per line.
+      packages: |
+        packages/core
+        packages/calculators
+    secrets: inherit
 
-      - name: Test
-        run: pnpm -r test
+  # ── Deploy site (repos with a site — remove if not applicable) ──
+  deploy-site:
+    needs: checks
+    if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
+    uses: ./.github/workflows/_deploy-site.yml
+    with:
+      project_name: '{{PROJECT_NAME}}'
+      site_filter: '@{{SITE_FILTER}}'
+    secrets: inherit

package/dist/templates/github/workflows/doctor.yml

@@ -0,0 +1,71 @@
+name: Template drift audit
+
+# Monthly audit — runs `precisa doctor` to detect drift between this
+# repo's templated files (workflows, dotfiles, configs) and the current
+# `@precisa-saude/cli` templates. When drift shows up, open a PR running
+# `pnpm exec precisa sync` to absorb the changes.
+#
+# Runs on the 1st of each month at 06:00 America/Sao_Paulo (09:00 UTC).
+# `workflow_dispatch` is wired so you can trigger it ad-hoc.
+#
+# This workflow catches the class of incident that motivated it:
+# silent drift between canonical workflow templates and the real files
+# in each repo. See fhir-brasil#26 (PAT_TOKEN → GitHub App) for the
+# concrete failure mode — drift went undetected until a conditional
+# job finally fired in production.
+
+on:
+  schedule:
+    - cron: '0 9 1 * *'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  issues: write
+
+jobs:
+  doctor:
+    name: precisa doctor
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v6
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 22
+          cache: 'pnpm'
+      - run: pnpm install --frozen-lockfile
+      - name: Audit templates
+        id: doctor
+        run: pnpm exec precisa doctor
+        continue-on-error: true
+      - name: Open issue on drift
+        if: steps.doctor.outcome == 'failure'
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const runUrl = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
+            const body = [
+              '`precisa doctor` detected drift between this repo and the canonical templates.',
+              '',
+              `Full log: ${runUrl}`,
+              '',
+              'To fix:',
+              '',
+              '```bash',
+              'pnpm exec precisa sync --dry-run  # review the diff',
+              'pnpm exec precisa sync            # apply',
+              '```',
+              '',
+              'Drift typically shows up when `@precisa-saude/cli` publishes',
+              'new templates (workflow changes, dotfile updates) and this',
+              'repo has not run `precisa sync` since.',
+            ].join('\n');
+            await github.rest.issues.create({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              title: 'precisa doctor: template drift detected',
+              body,
+              labels: ['dependencies', 'tooling-drift'],
+            });

package/dist/templates/github/workflows/publish-tag.yml

@@ -0,0 +1,71 @@
+name: Publish tag to npm
+
+# Recuperação manual: publica os pacotes de uma tag git específica no npm.
+# Usado quando semantic-release criou a tag + commit chore(release) mas o
+# step de publish foi interrompido (cancel de concorrência, npm fora do ar,
+# rotação de token mid-release, etc.). Idempotente — só publica se a versão
+# não estiver no registry.
+#
+# Uso: gh workflow run publish-tag.yml -f tag=v1.1.0
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Tag Git para publicar (ex.: v1.1.0)'
+        required: true
+        type: string
+
+permissions:
+  contents: read
+  # `id-token: write` is for Sigstore attestations (`--provenance`),
+  # not for npm auth — see _publish.yml for the full rationale.
+  id-token: write
+
+jobs:
+  publish:
+    name: Publish tag
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.tag }}
+
+      - uses: pnpm/action-setup@v4
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 22
+          cache: 'pnpm'
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build
+        run: pnpm turbo run build
+
+      - name: Publish packages (idempotent)
+        # Auto-discovers publishable packages via pnpm's workspace filter
+        # (`./packages/**`, skipping those with `private: true`). No
+        # per-repo list to keep in sync; adding a new package means
+        # adding it to `packages/` and the next tag picks it up.
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: |
+          set -e
+          pnpm -r --filter "./packages/**" --if-present exec sh -c '
+            pkg_name=$(node -p "require(\"./package.json\").name")
+            pkg_version=$(node -p "require(\"./package.json\").version")
+            pkg_private=$(node -p "Boolean(require(\"./package.json\").private)")
+            if [ "$pkg_private" = "true" ]; then
+              echo "Skipping $pkg_name (private)"
+              exit 0
+            fi
+            if npm view "$pkg_name@$pkg_version" version 2>/dev/null; then
+              echo "Skipping $pkg_name@$pkg_version (already published)"
+            else
+              echo "Publishing $pkg_name@$pkg_version..."
+              pnpm publish --provenance --access public --no-git-checks
+            fi
+          '

package/dist/templates/github/workflows/release.yml

@@ -1,8 +1,19 @@
 name: Release
 
+# Release standalone para repos que publicam pacotes SEM site associado
+# (ex.: tooling). Repos que têm site costumam integrar release+publish no
+# ci.yml — veja ci.yml do template.
+
 on:
   push:
     branches: [main]
+  # Weekly cadence — picks up any docs/CI/chore commits that semantic-
+  # release normally wouldn't promote. Ensures consumers stay within
+  # one minor of the current HEAD even during low-commit weeks.
+  # semantic-release is a no-op when there are no releasable commits,
+  # so this is safe to run unconditionally.
+  schedule:
+    - cron: '0 9 * * 1'
   workflow_dispatch:
 
 concurrency:
@@ -13,23 +24,25 @@ jobs:
   release:
     name: semantic-release
     runs-on: ubuntu-latest
+    # `id-token: write` is for Sigstore attestations (`--provenance`),
+    # not for npm auth. npm auth uses the `NPM_TOKEN` org-secret.
     permissions:
       contents: write
       issues: write
       pull-requests: write
       id-token: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
           persist-credentials: false
 
       - uses: pnpm/action-setup@v4
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: 22
-          cache: pnpm
+          cache: 'pnpm'
           registry-url: 'https://registry.npmjs.org'
 
       - name: Install dependencies
@@ -39,11 +52,12 @@ jobs:
         run: pnpm -r build
 
       - name: Configure npm auth
-        # actions/setup-node writes ~/.npmrc with a ${NODE_AUTH_TOKEN} placeholder
-        # that `npm` interpolates at publish time, but `pnpm publish` (used by our
-        # semantic-release `publishCmd`) doesn't always expand it. Write the
-        # resolved token directly so pnpm reads it unambiguously. Lives in $HOME
-        # so it doesn't pollute the repo working tree.
+        # `actions/setup-node` writes `~/.npmrc` with a literal
+        # `${NODE_AUTH_TOKEN}` placeholder that `npm` expands at publish
+        # time, but `pnpm publish` (used by semantic-release's
+        # `publishCmd`) doesn't always expand it. Write the resolved
+        # token directly so pnpm reads it unambiguously. Lives in $HOME
+        # so it doesn't pollute the working tree.
         env:
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: |

package/dist/templates/github/workflows/review.yml

@@ -1,18 +1,22 @@
 name: Code Review
 
-# Tries providers in order (Anthropic → OpenAI) and uses the first one that
-# returns a 200. Any non-200 from a provider triggers fallback to the next.
-# If all configured providers fail (or none are configured), the workflow
-# exits without posting a review and without emitting a round marker, so
-# the next PR activity retries fresh.
+# Reusable workflow chamado pelo ci.yml para rodar o review automatizado.
+# Tenta providers em ordem (Anthropic → OpenAI → GitHub Models) e usa o
+# primeiro que retorna 200. Qualquer não-200 dispara fallback para o
+# próximo. GitHub Models é o último degrau: usa o GITHUB_TOKEN built-in
+# + permissão `models: read`, então funciona sem nenhum segredo externo
+# — repos que não configuram ANTHROPIC_API_KEY nem OPENAI_API_KEY ainda
+# têm review automatizado. Se todos falham (ou nenhum está configurado),
+# sai sem postar review e sem emitir marker de round, de modo que a
+# próxima atividade no PR retenta fresco.
 
 on:
-  pull_request:
-    types: [opened, synchronize, reopened]
-
-concurrency:
-  group: review-${{ github.event.pull_request.number }}
-  cancel-in-progress: true
+  workflow_call:
+    inputs:
+      pr_number:
+        description: 'PR number to review'
+        type: number
+        required: true
 
 jobs:
   check-review-status:
@@ -26,7 +30,7 @@ jobs:
       should_run: ${{ steps.check.outputs.should_run }}
       review_round: ${{ steps.check.outputs.review_round }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Decide whether to run
         id: check
@@ -34,10 +38,12 @@ jobs:
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
-            const prNumber = context.issue.number;
+            const prNumber = ${{ inputs.pr_number }};
 
-            // Skip docs/config-only PRs
-            const { data: files } = await github.rest.pulls.listFiles({
+            // Paginamos listFiles porque em PRs grandes o .tsx/.ts real pode
+            // cair em página 2+ e a detecção de "código mudou" dava falso
+            // negativo, pulando o review.
+            const files = await github.paginate(github.rest.pulls.listFiles, {
               owner: context.repo.owner,
               repo: context.repo.repo,
               pull_number: prNumber,
@@ -78,12 +84,18 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
+      # `models: read` lets this job call GitHub Models via the built-in
+      # GITHUB_TOKEN — no external API key needed for the fallback
+      # provider. Repos that don't configure ANTHROPIC_API_KEY or
+      # OPENAI_API_KEY still get a review via GitHub Models.
+      models: read
     env:
       ANTHROPIC_MODEL: claude-haiku-4-5-20251001
       OPENAI_MODEL: gpt-4o-mini
+      GITHUB_MODELS_MODEL: openai/gpt-4o-mini
       MAX_DIFF_SIZE: '150000'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
@@ -92,8 +104,8 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           REVIEW_ROUND: ${{ needs.check-review-status.outputs.review_round }}
+          PR_NUMBER: ${{ inputs.pr_number }}
         run: |
-          PR_NUMBER=${{ github.event.pull_request.number }}
           HEAD_SHA=$(gh pr view "$PR_NUMBER" --json headRefOid -q .headRefOid)
           echo "head_sha=$HEAD_SHA" >> $GITHUB_OUTPUT
           echo "number=$PR_NUMBER" >> $GITHUB_OUTPUT
@@ -120,6 +132,9 @@ jobs:
         env:
           ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
           OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+          # GitHub Models uses the built-in GITHUB_TOKEN; `models: read`
+          # on the job permissions is what actually authorizes the call.
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           DIFF_TRUNCATED: ${{ steps.pr.outputs.diff_truncated }}
           REVIEW_ROUND: ${{ needs.check-review-status.outputs.review_round }}
         run: |
@@ -163,8 +178,9 @@ jobs:
             '- If no issues, return an empty feedback array.',
           ].join('\n');
 
-          // Per-1M-token USD pricing. Update when providers change rates.
-          // Missing entries silently skip cost display (tokens still shown).
+          // Pricing por 1M tokens USD. Atualizar quando providers mudarem rates.
+          // Entradas faltando silenciosamente pulam exibição de custo (tokens
+          // ainda são mostrados).
           const PRICING = {
             'claude-haiku-4-5-20251001': { in: 1.00, out: 5.00 },
             'claude-sonnet-4-6': { in: 3.00, out: 15.00 },
@@ -235,10 +251,46 @@ jobs:
               }),
               extractError: (r) => r?.error?.message ?? 'see workflow logs',
             },
+            // GitHub Models — OpenAI-compatible API authenticated via the
+            // built-in GITHUB_TOKEN + `models: read` permission. No
+            // external API key needed, so this is the fallback when
+            // neither Anthropic nor OpenAI secrets are configured.
+            // Rate limits apply per-repo; the models catalog lists what's
+            // available. `openai/gpt-4o-mini` is a safe default.
+            'github-models': {
+              label: 'GitHub Models',
+              envKey: 'GITHUB_TOKEN',
+              modelEnv: 'GITHUB_MODELS_MODEL',
+              defaultModel: 'openai/gpt-4o-mini',
+              build: (model, key) => ({
+                url: 'https://models.github.ai/inference/chat/completions',
+                headers: {
+                  'content-type': 'application/json',
+                  Authorization: `Bearer ${key}`,
+                },
+                body: JSON.stringify({
+                  model,
+                  max_tokens: 8192,
+                  messages: [
+                    { role: 'system', content: system },
+                    { role: 'user', content: user },
+                  ],
+                  response_format: { type: 'json_object' },
+                }),
+              }),
+              extractText: (r) => r?.choices?.[0]?.message?.content ?? '',
+              extractUsage: (r) => ({
+                prompt_tokens: r?.usage?.prompt_tokens ?? 0,
+                completion_tokens: r?.usage?.completion_tokens ?? 0,
+              }),
+              extractError: (r) => r?.error?.message ?? 'see workflow logs',
+            },
           };
 
-          // Provider order: try Anthropic, fall back to OpenAI.
-          const order = ['anthropic', 'openai'];
+          // Provider order: prefer Anthropic (best output quality), then
+          // OpenAI, then GitHub Models as a keyless fallback. Each
+          // provider is skipped if its auth env var isn't set.
+          const order = ['anthropic', 'openai', 'github-models'];
 
           const setOutput = (k, v) => {
             fs.appendFileSync(process.env.GITHUB_OUTPUT, `${k}<<EOF\n${String(v)}\nEOF\n`);
@@ -325,7 +377,6 @@ jobs:
             setOutput('completion_tokens', String(completionTokens));
             setOutput('cost_usd', cost == null ? '' : cost.toFixed(4));
 
-            // Emit fallback details to the workflow log (not the PR comment).
             const failed = attempts.filter((a) => !a.ok && !a.skip);
             const fellBack = failed.length > 0;
             setOutput('fell_back', fellBack ? 'true' : 'false');
@@ -363,7 +414,8 @@ jobs:
               : '';
             const fallbackBadge = fellBack ? ' (fallback)' : '';
 
-            // Failure paths — no round marker, so the next push retries fresh.
+            // Caminhos de falha — sem marker, de modo que o próximo push
+            // retenta como Round 1.
             if (status !== 'ok') {
               const note = status === 'skipped'
                 ? `Review skipped — ${errorReason}. No round marker emitted; the next PR activity will retry as Round 1.`

package/dist/templates/governance/CITATION.cff

@@ -1,6 +1,6 @@
 cff-version: 1.2.0
 title: '{{REPO_NAME}}'
-message: 'If you use this software, please cite it as below.'
+message: 'Se você utilizar este software, por favor cite-o conforme abaixo.'
 type: software
 authors:
   - name: '{{OWNER_ORG}}'