github-issue-tower-defence-management 2.19.0 → 2.19.2

package/README.md

@@ -162,7 +162,7 @@ The `checkIssueReviewReadiness` sub-command lets an agent self-check whether an
 
 The `selectOauthToken` sub-command reads the same per-token rate-limit cache that the `startDaemon` proxy writes (see "Claude OAuth Token Rotation" below) and prints exactly one token string to stdout so a caller can choose an appropriate token before launching Claude Code. It is read-only: it never starts the proxy, never mutates any cache file, and never writes the token anywhere. Selection runs in two stages. First, a candidate filter keeps tokens whose 5-hour window is at least 60% free (5-hour utilization at most 0.40) AND whose 7-day window is at least 14% free (7-day utilization at most 0.86), where "% free" is `1 - utilization`. A token with no cache file, or whose window reset epoch has already passed, is treated as fully free (utilization 0) for these checks. The filter additionally excludes any token carrying a non-expired reactive `seven_day_fable` rejection marker — set when a `fable`-model request on that token was rejected with HTTP 429 (see "Claude OAuth Token Rotation" below) — because these interactive sessions run on the `fable` model; a token without the marker is treated as `fable`-usable, and the marker is ignored once its stored reset epoch has passed. Second, among the surviving candidates it selects the single token whose 7-day window reset epoch is nearest in the future (soonest reset), so weekly quota that would otherwise reset unused is consumed first; a candidate with no active 7-day window is treated as having the farthest reset (now + 7 days) and therefore sorts last. Each token entry may carry an optional `selectionWeight` (a positive number, default `1`); when the eligible candidates carry differing weights the selection among them becomes weighted-random by that weight, so a token with a smaller weight is chosen proportionally less often, while a token that is the only eligible candidate is always chosen regardless of its weight. When every eligible candidate shares the same weight (the default), the deterministic soonest-reset selection above is used unchanged. The selected token string is written to stdout (pipeable) and the per-candidate decision trace is written to stderr. When no token passes the filter, nothing is written to stdout and the command exits non-zero with an explanatory message on stderr. The token-list path comes from `--tokenListJsonPath` or the `CLAUDE_CODE_OAUTH_TOKEN_LIST_JSON_PATH` environment variable; the cache directory comes from `--cacheDir` or the `TDPM_RATELIMIT_CACHE_DIR` environment variable, defaulting to `${XDG_CACHE_HOME:-~/.cache}/tdpm/ratelimit`.
 
-The `selectLiveSessionOauthToken` sub-command picks a token for a new live interactive Claude Code session a human is about to start, so that concurrent interactive sessions spread across distinct tokens instead of stacking onto the same one. It loads the token list and reads the same per-token rate-limit cache as `selectOauthToken`, and it is read-only in exactly the same way: it never starts the proxy, never mutates any cache file, and never writes the token anywhere. It applies a base rate-limit eligibility filter (5-hour window at least 25% free AND 7-day window at least 3% free, with a missing cache file or an expired window treated as fully free, and any token carrying a non-expired reactive `seven_day_fable` rejection marker excluded), and additionally excludes any token whose 5-hour window is less than `minFiveHourFreeRatio` (default 60%) free or whose 7-day window is less than `minSevenDayFreeRatio` (default 14%) free; these stricter thresholds prevent the `cl` script from starting a new interactive session on a token that is nearly exhausted. It additionally measures current live occupancy per token by scanning running Claude Code processes on the local Linux host: for each process under `/proc` it reads the NUL-separated `/proc/<pid>/environ` and, when the process is a Claude Code process, takes its `CLAUDE_CODE_OAUTH_TOKEN` and `CLAUDE_CODE_SESSION_ID`. A token's occupancy is the number of distinct `CLAUDE_CODE_SESSION_ID` values bound to it, so child processes that inherit one session id count once. Processes without `CLAUDE_CODE_OAUTH_TOKEN` (for example API-key sessions) are ignored, and a process whose environ cannot be read is skipped. Among the eligible tokens the selection is deterministic and reset-first. Each eligible token is given a concurrent session limit of `maxConcurrentSessionCount` (default `10`), scaled by its optional `selectionWeight` (a positive number, default `1`). That limit is held at its full value while the free share of the token's 5-hour window is at or above `fullSpeedFiveHourFreeRatio` (default `0.5`), and is tapered linearly in proportion to the free share below that point, never dropping under `1`. The 5-hour window is the only window that lowers the limit: it is the one that runs out within a single working stretch, and a session that hits it mid-flight has to be restarted, which costs more than it saves. The 7-day window never lowers the limit, so a weekly allowance that is about to expire is drained at full speed rather than discarded unused; the 7-day window is instead what orders the candidates. The token whose 7-day window resets soonest among those still under their limit is selected, so allowance that is about to expire is consumed before the reset discards it; ties are broken by the fewer live sessions. All four tuning numbers (`maxConcurrentSessionCount`, `fullSpeedFiveHourFreeRatio`, `minFiveHourFreeRatio`, `minSevenDayFreeRatio`) are read from the fleet-wide config file named by `--fleetConfigFilePath` or the `TDPM_FLEET_CONFIG` environment variable, under a `liveSessionOauthTokenSelection` mapping; a key the file omits keeps its built-in value, while an unreadable file or an out-of-range value is reported as an error rather than silently ignored. A token at its limit is skipped in favour of the next soonest-resetting token that still has room, and when every eligible token is at its limit the soonest-resetting one is returned rather than none. A token that is the only eligible candidate is always chosen regardless of its weight or occupancy. The selected token string is written to stdout (pipeable) and the per-candidate decision trace is written to stderr; when no token passes the filter, nothing is written to stdout and the command exits non-zero with an explanatory message on stderr. The token-list path and cache directory are resolved exactly as for `selectOauthToken`. Because occupancy is read from `/proc/<pid>/environ`, this sub-command is Linux-specific.
+The `selectLiveSessionOauthToken` sub-command picks a token for a new live interactive Claude Code session a human is about to start, so that concurrent interactive sessions spread across distinct tokens instead of stacking onto the same one. It loads the token list and reads the same per-token rate-limit cache as `selectOauthToken`, and it is read-only in exactly the same way: it never starts the proxy, never mutates any cache file, and never writes the token anywhere. It applies a base rate-limit eligibility filter (5-hour window at least 25% free AND 7-day window at least 1% free, with a missing cache file or an expired window treated as fully free, and any token carrying a non-expired reactive `seven_day_fable` rejection marker excluded), and additionally excludes any token whose 5-hour window is less than `minFiveHourFreeRatio` (default 60%) free or whose 7-day window is less than `minSevenDayFreeRatio` (default 14%) free; these stricter thresholds prevent the `cl` script from starting a new interactive session on a token that is nearly exhausted. It additionally measures current live occupancy per token by scanning running Claude Code processes on the local Linux host: for each process under `/proc` it reads the NUL-separated `/proc/<pid>/environ` and, when the process is a Claude Code process, takes its `CLAUDE_CODE_OAUTH_TOKEN` and `CLAUDE_CODE_SESSION_ID`. A token's occupancy is the number of distinct `CLAUDE_CODE_SESSION_ID` values bound to it, so child processes that inherit one session id count once. Processes without `CLAUDE_CODE_OAUTH_TOKEN` (for example API-key sessions) are ignored, and a process whose environ cannot be read is skipped. Among the eligible tokens the selection is deterministic and reset-first. Each eligible token is given a concurrent session limit of `maxConcurrentSessionCount` (default `10`), scaled by its optional `selectionWeight` (a positive number, default `1`). That limit is held at its full value while the free share of the token's 5-hour window is at or above `fullSpeedFiveHourFreeRatio` (default `0.5`), and is tapered linearly in proportion to the free share below that point, never dropping under `1`. The 5-hour window is the only window that lowers the limit: it is the one that runs out within a single working stretch, and a session that hits it mid-flight has to be restarted, which costs more than it saves. The 7-day window never lowers the limit, so a weekly allowance that is about to expire is drained at full speed rather than discarded unused; the 7-day window is instead what orders the candidates. The token whose 7-day window resets soonest among those still under their limit is selected, so allowance that is about to expire is consumed before the reset discards it; ties are broken by the fewer live sessions. All four tuning numbers (`maxConcurrentSessionCount`, `fullSpeedFiveHourFreeRatio`, `minFiveHourFreeRatio`, `minSevenDayFreeRatio`) are read from the fleet-wide config file named by `--fleetConfigFilePath` or the `TDPM_FLEET_CONFIG` environment variable, under a `liveSessionOauthTokenSelection` mapping; a key the file omits keeps its built-in value, while an unreadable file or an out-of-range value is reported as an error rather than silently ignored. A token at its limit is skipped in favour of the next soonest-resetting token that still has room, and when every eligible token is at its limit the soonest-resetting one is returned rather than none. A token that is the only eligible candidate is always chosen regardless of its weight or occupancy. The selected token string is written to stdout (pipeable) and the per-candidate decision trace is written to stderr; when no token passes the filter, nothing is written to stdout and the command exits non-zero with an explanatory message on stderr. The token-list path and cache directory are resolved exactly as for `selectOauthToken`. Because occupancy is read from `/proc/<pid>/environ`, this sub-command is Linux-specific.
 
 The `startDaemon` command supports a `preparationWorker` mapping in the fleet-wide config file named by `--fleetConfigFilePath` or the `TDPM_FLEET_CONFIG` environment variable. This section controls per-token concurrency for the preparation worker pool. Supported keys:
 

package/bin/domain/usecases/OauthTokenSelectUseCase.js

@@ -10,7 +10,7 @@ exports.selectionWeightOf = selectionWeightOf;
 const SECONDS_PER_DAY = 86400;
 const SEVEN_DAYS_IN_SECONDS = 7 * SECONDS_PER_DAY;
 exports.FIVE_HOUR_MIN_FREE_RATIO = 0.25;
-exports.SEVEN_DAY_MIN_FREE_RATIO = 0.03;
+exports.SEVEN_DAY_MIN_FREE_RATIO = 0.01;
 exports.DEFAULT_OAUTH_TOKEN_SELECTION_THRESHOLDS = {
     fiveHourMinFreeRatio: exports.FIVE_HOUR_MIN_FREE_RATIO,
     sevenDayMinFreeRatio: exports.SEVEN_DAY_MIN_FREE_RATIO,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "github-issue-tower-defence-management",
-  "version": "2.19.0",
+  "version": "2.19.2",
   "description": "",
   "main": "bin/index.js",
   "scripts": {
@@ -26,6 +26,10 @@
     "github-issue-tower-defence-management": "bin/adapter/entry-points/cli/index.js"
   },
   "types": "types/index.d.ts",
+  "files": [
+    "bin",
+    "types"
+  ],
   "repository": {
     "type": "git",
     "url": "git+https://github.com/HiromiShikata/npm-cli-github-issue-tower-defence-management.git"

package/types/domain/usecases/OauthTokenSelectUseCase.d.ts

@@ -34,7 +34,7 @@ export type OauthTokenSelectionThresholds = {
     sevenDayMinFreeRatio: number;
 };
 export declare const FIVE_HOUR_MIN_FREE_RATIO = 0.25;
-export declare const SEVEN_DAY_MIN_FREE_RATIO = 0.03;
+export declare const SEVEN_DAY_MIN_FREE_RATIO = 0.01;
 export declare const DEFAULT_OAUTH_TOKEN_SELECTION_THRESHOLDS: OauthTokenSelectionThresholds;
 export declare const CL_SCRIPT_OAUTH_TOKEN_SELECTION_THRESHOLDS: OauthTokenSelectionThresholds;
 export declare const SEVEN_DAY_WINDOW_HOURS = 168;

package/.env.example

@@ -1,7 +0,0 @@
-DOTENV_CONFIG_QUIET=true
-GH_TOKEN=
-GOOGLE_SERVICE_ACCOUNT_KEY=
-SLACK_USER_TOKEN=
-GH_USER_NAME=
-GH_USER_PASSWORD=
-GH_AUTHENTICATOR_KEY=

package/.gitattributes

@@ -1,2 +0,0 @@
-bin/** linguist-generated=true
-types/** linguist-generated=true

package/.github/CODEOWNERS

@@ -1,6 +0,0 @@
-# DO NOT EDIT DIRECTLY.
-# This file is auto-synchronized from HiromiShikata/repositories-management.
-# Direct edits in downstream repositories will be overwritten by the next sync.
-# Update the source file in HiromiShikata/repositories-management instead.
-
-* @HiromiShikata @renovate

package/.github/copilot-instructions.md

@@ -1,6 +0,0 @@
-<!--
-DO NOT EDIT DIRECTLY.
-This file is auto-synchronized from HiromiShikata/repositories-management.
-Direct edits in downstream repositories will be overwritten by the next sync.
-Update the source file in HiromiShikata/repositories-management instead.
--->

package/.github/dependabot.yml

@@ -1,19 +0,0 @@
-# DO NOT EDIT DIRECTLY.
-# This file is auto-synchronized from HiromiShikata/repositories-management.
-# Direct edits in downstream repositories will be overwritten by the next sync.
-# Update the source file in HiromiShikata/repositories-management instead.
-
-version: 2
-updates:
-  - package-ecosystem: npm
-    directory: /
-    schedule:
-      interval: weekly
-      day: saturday
-    open-pull-requests-limit: 0
-  - package-ecosystem: github-actions
-    directory: /
-    schedule:
-      interval: weekly
-      day: saturday
-    open-pull-requests-limit: 0

package/.github/instructions/code-review.instructions.md

@@ -1,50 +0,0 @@
----
-applyTo: '**'
----
-
-<!--
-DO NOT EDIT DIRECTLY.
-This file is auto-synchronized from HiromiShikata/repositories-management.
-Direct edits in downstream repositories will be overwritten by the next sync.
-Update the source file in HiromiShikata/repositories-management instead.
--->
-
-# Code Review Instructions
-
-## Scope Integrity
-
-Flag pull requests that contain changes unrelated to the stated PR title or description.
-Each PR must address a single topic or feature.
-If unrelated modifications are detected, request that they be split into separate issues first.
-
-## Lint and Static Analysis Bypass Detection
-
-Flag any code that disables, ignores, or bypasses linting rules.
-Report usage of eslint-disable, @ts-ignore, @ts-expect-error, noqa, or similar suppression comments.
-Flag modifications to linter configuration files that weaken existing rules.
-
-## Error Handling Violations
-
-Flag code that catches exceptions but does nothing with them (empty catch blocks).
-Flag API endpoints that return HTTP 200 status codes when errors have occurred.
-Flag code that converts errors into success responses or hides error states.
-Flag use of console.log for error handling instead of proper error propagation.
-Flag code that swallows errors by returning default values without logging or reporting.
-
-## Test Coverage Requirements
-
-Flag new features or bug fixes that lack corresponding unit tests.
-Flag modifications to existing code where related tests have not been updated.
-Flag deletion or disabling of existing tests without justification.
-Flag test files that use skip, only, or other mechanisms to bypass test execution.
-Flag mock implementations that always return success without testing failure scenarios.
-Report when test coverage for modified files appears insufficient.
-Report when test assertion for modified files appears insufficient.
-
-## Code Quality Red Flags
-
-Flag hardcoded credentials, API keys, or secrets.
-Flag commented-out code blocks.
-Flag TODO or FIXME comments without associated issue references.
-Flag any use of type assertions (as any, as unknown) that bypass type safety.
-Flag functions with excessive cyclomatic complexity.

package/.github/workflows/api-created_issue_pr.yml

@@ -1,97 +0,0 @@
-# DO NOT EDIT DIRECTLY.
-# This file is auto-synchronized from HiromiShikata/repositories-management.
-# Direct edits in downstream repositories will be overwritten by the next sync.
-# Update the source file in HiromiShikata/repositories-management instead.
-
-name: Add to Project
-
-on:
-  workflow_dispatch:
-    inputs:
-      issue_or_pr_url:
-        description: 'Issue or PR URL (https://github.com/<owner>/<repo>/issues/<number> or .../pull/<number>)'
-        required: true
-        default: ''
-
-env:
-  PROJECT_V2_ID: PVT_kwHOAGJHa84AFWnr
-
-jobs:
-  add-to-project:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: step-security/harden-runner@v2
-        with:
-          egress-policy: audit
-      - name: Generate hs-bot-gh-ap installation token
-        id: app-token
-        uses: actions/create-github-app-token@v3
-        with:
-          client-id: ${{ secrets.HS_BOT_GH_AP_CLIENT_ID }}
-          private-key: ${{ secrets.HS_BOT_GH_AP_PRIVATE_KEY }}
-          owner: HiromiShikata
-      - name: Add to Project
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-        run: |
-          ISSUE_OR_PR_URL="${{ github.event.inputs.issue_or_pr_url }}"
-          ISSUE_OR_PR_URL="${ISSUE_OR_PR_URL%%\?*}"
-          ISSUE_OR_PR_URL="${ISSUE_OR_PR_URL%/}"
-
-          if ! echo "$ISSUE_OR_PR_URL" | grep -qE '^https://github\.com/[^/]+/[^/]+/(issues|pull)/[0-9]+$'; then
-            echo "Invalid URL format. Expected: https://github.com/<owner>/<repo>/issues/<number> or .../pull/<number>"
-            echo "Got: $ISSUE_OR_PR_URL"
-            exit 1
-          fi
-
-          REPO_PATH=$(echo "$ISSUE_OR_PR_URL" | awk -F'/' '{print $4"/"$5}')
-          NUMBER=$(echo "$ISSUE_OR_PR_URL" | grep -oE '[0-9]+$')
-
-          if echo "$ISSUE_OR_PR_URL" | grep -q "/pull/"; then
-            RESOURCE_TYPE="pulls"
-          else
-            RESOURCE_TYPE="issues"
-          fi
-
-          REST_RESPONSE=$(curl -s -w "\n%{http_code}" -H "Authorization: token $GH_TOKEN" \
-            "https://api.github.com/repos/$REPO_PATH/$RESOURCE_TYPE/$NUMBER")
-          HTTP_STATUS=$(echo "$REST_RESPONSE" | tail -n1)
-          REST_BODY=$(echo "$REST_RESPONSE" | sed '$d')
-
-          if [ "$HTTP_STATUS" != "200" ]; then
-            echo "REST API returned HTTP $HTTP_STATUS"
-            echo "$REST_BODY"
-            exit 1
-          fi
-
-          NODE_ID=$(echo "$REST_BODY" | jq -r '.node_id')
-
-          if [ -z "$NODE_ID" ] || [ "$NODE_ID" = "null" ]; then
-            echo "Failed to get node ID. REST response:"
-            echo "$REST_BODY"
-            exit 1
-          fi
-
-          echo "Node ID: $NODE_ID"
-
-          GRAPHQL_PAYLOAD=$(jq -n \
-            --arg nodeId "$NODE_ID" \
-            --arg projectId "$PROJECT_V2_ID" \
-            '{"query": "mutation($contentId: ID!, $projectId: ID!) { addProjectV2ItemById(input: { contentId: $contentId, projectId: $projectId }) { item { id } } }", "variables": {"contentId": $nodeId, "projectId": $projectId}}')
-
-          RESPONSE=$(curl -s -X POST \
-            -H "Authorization: bearer $GH_TOKEN" \
-            -H "Content-Type: application/json" \
-            https://api.github.com/graphql \
-            -d "$GRAPHQL_PAYLOAD")
-          echo "$RESPONSE"
-
-          if ! echo "$RESPONSE" | jq '.' > /dev/null 2>&1; then
-            echo "Non-JSON response received"
-            exit 1
-          fi
-
-          if echo "$RESPONSE" | jq -e '.errors' > /dev/null; then
-            echo "GraphQL error occurred"
-            exit 1
-          fi

package/.github/workflows/ci-failure-issue-creator.yml

@@ -1,48 +0,0 @@
-# DO NOT EDIT DIRECTLY.
-# This file is auto-synchronized from HiromiShikata/repositories-management.
-# Direct edits in downstream repositories will be overwritten by the next sync.
-# Update the source file in HiromiShikata/repositories-management instead.
-
-name: CI Failure Issue Creator
-
-on:
-  check_suite:
-    types:
-      - completed
-
-jobs:
-  create-or-comment-issue:
-    if: github.event.check_suite.conclusion == 'failure' && github.event.check_suite.head_branch == github.event.repository.default_branch
-    runs-on: ubuntu-latest
-    permissions:
-      issues: write
-    steps:
-      - uses: step-security/harden-runner@v2
-        with:
-          egress-policy: audit
-      - name: Create or comment on CI failure issue
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          ISSUE_TITLE="[CI] Default branch CI failure"
-          REPO="${{ github.repository }}"
-          COMMIT_CHECKS_URL="${{ github.server_url }}/${{ github.repository }}/commit/${{ github.event.check_suite.head_sha }}/checks"
-
-          EXISTING_ISSUE_NUMBER=$(gh issue list \
-            --repo "$REPO" \
-            --state open \
-            --search "$ISSUE_TITLE in:title" \
-            --json number,title \
-            --jq ".[] | select(.title == \"$ISSUE_TITLE\") | .number" \
-            | head -n1)
-
-          if [ -n "$EXISTING_ISSUE_NUMBER" ]; then
-            gh issue comment "$EXISTING_ISSUE_NUMBER" \
-              --repo "$REPO" \
-              --body "CI failed on the default branch. [View failed checks]($COMMIT_CHECKS_URL)"
-          else
-            gh issue create \
-              --repo "$REPO" \
-              --title "$ISSUE_TITLE" \
-              --body "CI failed on the default branch. [View failed checks]($COMMIT_CHECKS_URL)"
-          fi

package/.github/workflows/close-manual-prs.yml

@@ -1,80 +0,0 @@
-# DO NOT EDIT DIRECTLY.
-# This file is auto-synchronized from HiromiShikata/repositories-management.
-# Direct edits in downstream repositories will be overwritten by the next sync.
-# Update the source file in HiromiShikata/repositories-management instead.
-
-name: Close Manual PRs
-
-on:
-  pull_request:
-    types:
-      - opened
-      - reopened
-  schedule:
-    - cron: '0 15 * * *'
-  workflow_dispatch:
-
-jobs:
-  close-manual-pr:
-    runs-on: ubuntu-latest
-    if: github.event_name != 'pull_request' || github.event.pull_request.user.type != 'Bot'
-    steps:
-      - uses: step-security/harden-runner@v2
-        with:
-          egress-policy: audit
-      - name: Generate hs-bot-gh-ap installation token
-        id: app-token
-        uses: actions/create-github-app-token@v3
-        with:
-          client-id: ${{ secrets.HS_BOT_GH_AP_CLIENT_ID }}
-          private-key: ${{ secrets.HS_BOT_GH_AP_PRIVATE_KEY }}
-      - name: Close manually created pull requests
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-          REPO: ${{ github.repository }}
-          EVENT_NAME: ${{ github.event_name }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-          PR_ACTOR_LOGIN: ${{ github.event.pull_request.user.login }}
-          PR_ACTOR_TYPE: ${{ github.event.pull_request.user.type }}
-        run: |
-          ALLOWED_LOGINS="hs-bot-gh-app[bot] dependabot[bot] renovate[bot] github-actions[bot]"
-
-          is_manual_pr() {
-            local login="$1" type="$2"
-            [ "$type" = "Bot" ] && return 1
-            for allowed in $ALLOWED_LOGINS; do
-              [ "$login" = "$allowed" ] && return 1
-            done
-            return 0
-          }
-
-          close_with_comment() {
-            local pr_num="$1"
-            gh pr comment "$pr_num" --repo "$REPO" \
-              --body $'From: :robot: close-manual-prs\n\nThis repository is managed through an automated task-based workflow. Pull requests must originate from task issues and are created automatically by the CI system when a branch is pushed. Manually created pull requests are outside the scope of this workflow and will be closed automatically.\n\nIf you need to make changes, please create or use an existing task issue and push your branch — the CI system will create the pull request automatically.\n\nThank you for your understanding.'
-            gh pr close "$pr_num" --repo "$REPO"
-          }
-
-          if [ "$EVENT_NAME" = "pull_request" ]; then
-            echo "Checking PR $PR_NUMBER by $PR_ACTOR_LOGIN (type: $PR_ACTOR_TYPE)."
-            if is_manual_pr "$PR_ACTOR_LOGIN" "$PR_ACTOR_TYPE"; then
-              echo "Closing PR $PR_NUMBER as manually created."
-              close_with_comment "$PR_NUMBER"
-            else
-              echo "PR $PR_NUMBER is from an allowed actor, skipping."
-            fi
-          else
-            echo "Running sweep for manually created open PRs in $REPO."
-            gh api "repos/$REPO/pulls" --paginate \
-              --jq '.[] | [(.number | tostring), .user.login, .user.type] | @tsv' \
-              > /tmp/open_prs.tsv
-            while IFS=$'\t' read -r pr_num login type; do
-              echo "Checking PR $pr_num by $login (type: $type)."
-              if is_manual_pr "$login" "$type"; then
-                echo "Closing PR $pr_num as manually created."
-                close_with_comment "$pr_num"
-              else
-                echo "PR $pr_num is from an allowed actor, skipping."
-              fi
-            done < /tmp/open_prs.tsv
-          fi

package/.github/workflows/codeql.yml

@@ -1,107 +0,0 @@
-# For most projects, this workflow file will not need changing; you simply need
-# to commit it to your repository.
-#
-# You may wish to alter this file to override the set of languages analyzed,
-# or to provide custom queries or build logic.
-#
-# ******** NOTE ********
-# We have attempted to detect the languages in your repository. Please check
-# the `language` matrix defined below to confirm you have the correct set of
-# supported CodeQL languages.
-#
-name: 'CodeQL Advanced'
-
-on:
-  push:
-    branches: ['main']
-  pull_request:
-    branches: ['main']
-  schedule:
-    - cron: '42 8 * * 6'
-
-jobs:
-  analyze:
-    name: Analyze (${{ matrix.language }})
-    concurrency:
-      group: codeql-${{ github.event_name }}-${{ github.head_ref || github.ref_name }}-${{ matrix.language }}
-      cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
-    # Runner size impacts CodeQL analysis time. To learn more, please see:
-    #   - https://gh.io/recommended-hardware-resources-for-running-codeql
-    #   - https://gh.io/supported-runners-and-hardware-resources
-    #   - https://gh.io/using-larger-runners (GitHub.com only)
-    # Consider using larger runners or machines with greater resources for possible analysis time improvements.
-    runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
-    permissions:
-      # required for all workflows
-      security-events: write
-
-      # required to fetch internal or private CodeQL packs
-      packages: read
-
-      # only required for workflows in private repositories
-      actions: read
-      contents: read
-
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - language: actions
-            build-mode: none
-          - language: javascript-typescript
-            build-mode: none
-        # CodeQL supports the following values keywords for 'language': 'actions', 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'rust', 'swift'
-        # Use `c-cpp` to analyze code written in C, C++ or both
-        # Use 'java-kotlin' to analyze code written in Java, Kotlin or both
-        # Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both
-        # To learn more about changing the languages that are analyzed or customizing the build mode for your analysis,
-        # see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning.
-        # If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how
-        # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
-    steps:
-      - uses: step-security/harden-runner@v2
-        with:
-          egress-policy: audit
-      - name: Checkout repository
-        uses: actions/checkout@v7
-
-      # Add any setup steps before running the `github/codeql-action/init` action.
-      # This includes steps like installing compilers or runtimes (`actions/setup-node`
-      # or others). This is typically only required for manual builds.
-      # - name: Setup runtime (example)
-      #   uses: actions/setup-example@v1
-
-      # Initializes the CodeQL tools for scanning.
-      - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4.37.8
-        with:
-          languages: ${{ matrix.language }}
-          build-mode: ${{ matrix.build-mode }}
-          # If you wish to specify custom queries, you can do so here or in a config file.
-          # By default, queries listed here will override any specified in a config file.
-          # Prefix the list here with "+" to use these queries and those in the config file.
-
-          # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
-          # queries: security-extended,security-and-quality
-
-      # If the analyze step fails for one of the languages you are analyzing with
-      # "We were unable to automatically build your code", modify the matrix above
-      # to set the build mode to "manual" for that language. Then modify this step
-      # to build your code.
-      # ℹ️ Command-line programs to run using the OS shell.
-      # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
-      - name: Run manual build steps
-        if: matrix.build-mode == 'manual'
-        shell: bash
-        run: |
-          echo 'If you are using a "manual" build mode for one or more of the' \
-            'languages you are analyzing, replace this with the commands to build' \
-            'your code, for example:'
-          echo '  make bootstrap'
-          echo '  make release'
-          exit 1
-
-      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4.37.8
-        with:
-          category: '/language:${{matrix.language}}'

package/.github/workflows/commit-lint.yml

@@ -1,85 +0,0 @@
-# DO NOT EDIT DIRECTLY.
-# This file is auto-synchronized from HiromiShikata/repositories-management.
-# Direct edits in downstream repositories will be overwritten by the next sync.
-# Update the source file in HiromiShikata/repositories-management instead.
-
-name: Lint Commit Messages
-on:
-  pull_request:
-    types:
-      - opened
-      - edited
-      - reopened
-      - synchronize
-
-concurrency:
-  group: commitlint-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  commit-lint:
-    runs-on: ubuntu-latest
-    permissions:
-      issues: read
-      pull-requests: write
-      contents: read
-    steps:
-      - uses: step-security/harden-runner@v2
-        with:
-          egress-policy: audit
-      - name: Checkout code
-        uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-
-      - name: Use Node.js
-        uses: actions/setup-node@v7
-
-      - name: Check for DONTMERGE
-        run: |
-          result=$(find . \
-            -type f \
-            ! -path './.github/workflows/commit-lint.yml' \
-            ! -name '*.snap' \
-            -exec grep -Hn 'DONTMERGE' {} \;)
-          if [[ ! -z "$result" ]]; then
-            echo "$result"
-            exit 1
-          fi
-      - uses: nearform-actions/github-action-check-linked-issues@v1
-        id: check-linked-issues
-        if: false
-        with:
-          exclude-branches: 'release/**, dependabot/**, project-common/**'
-          loose-matching: true
-      - name: Check PR title follows conventional commit format
-        uses: amannn/action-semantic-pull-request@v6
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          types: |
-            build
-            chore
-            ci
-            docs
-            feat
-            fix
-            perf
-            refactor
-            revert
-            style
-            test
-            autogen
-            prep
-            adapt
-      - name: Install commitlint
-        run: |
-          mkdir -p /tmp/commitlint-run
-          cd /tmp/commitlint-run
-          npm init -y
-          npm install --no-audit --no-fund --save-dev @commitlint/cli @commitlint/config-conventional
-      - name: Lint commits
-        env:
-          NODE_PATH: /tmp/commitlint-run/node_modules
-        run: |
-          /tmp/commitlint-run/node_modules/.bin/commitlint --from=origin/${{ github.event.repository.default_branch }} --to=HEAD --config $GITHUB_WORKSPACE/.github/workflows/configs/commitlint.config.cjs

package/.github/workflows/configs/commitlint.config.cjs

@@ -1,32 +0,0 @@
-// DO NOT EDIT DIRECTLY.
-// This file is auto-synchronized from HiromiShikata/repositories-management.
-// Direct edits in downstream repositories will be overwritten by the next sync.
-// Update the source file in HiromiShikata/repositories-management instead.
-
-module.exports = {
-  extends: ['@commitlint/config-conventional'],
-  rules: {
-    'type-enum': [
-      2,
-      'always',
-      [
-        'build',
-        'chore',
-        'ci',
-        'docs',
-        'feat',
-        'fix',
-        'perf',
-        'refactor',
-        'revert',
-        'style',
-        'test',
-        'autogen',
-        'prep',
-        'adapt',
-      ],
-    ],
-    'header-max-length': [0],
-    'body-max-line-length': [0],
-  },
-};

package/.github/workflows/configs/commitlint.config.js

@@ -1,32 +0,0 @@
-// DO NOT EDIT DIRECTLY.
-// This file is auto-synchronized from HiromiShikata/repositories-management.
-// Direct edits in downstream repositories will be overwritten by the next sync.
-// Update the source file in HiromiShikata/repositories-management instead.
-
-module.exports = {
-  extends: ['@commitlint/config-conventional'],
-  rules: {
-    'type-enum': [
-      2,
-      'always',
-      [
-        'build',
-        'chore',
-        'ci',
-        'docs',
-        'feat',
-        'fix',
-        'perf',
-        'refactor',
-        'revert',
-        'style',
-        'test',
-        'autogen',
-        'prep',
-        'adapt',
-      ],
-    ],
-    'header-max-length': [0],
-    'body-max-line-length': [0],
-  },
-};