hyperi-ci 2.7.2__tar.gz → 2.8.0__tar.gz

{hyperi_ci-2.7.2 → hyperi_ci-2.8.0}/.github/actions/predict-version/action.yml

@@ -29,6 +29,10 @@ inputs:
     description: "Version resolution for from-head: auto (semantic-release picks) | patch | minor (forced)"
     required: false
     default: "auto"
+  branch-build:
+    description: "'true' to run build + container on pull_request events (branch-mode: PRs validate the full pipeline; whether the container also pushes a dev image is the separate publish.container.dev_push opt-in in .hyperi-ci.yaml)"
+    required: false
+    default: ""
 
 outputs:
   will-publish:
@@ -63,7 +67,22 @@ runs:
           exit 0
         fi
 
-        # push event — match Publish: true trailer (case-insensitive on key)
+        # Publish only ever happens from main (branch-mode decision 1:
+        # branches validate, main is the sole publish path). Stated HERE,
+        # at the gate SSOT, rather than relying on downstream job `if:`
+        # conditions to catch a trailer on a branch. A trailer on a
+        # non-main ref is ignored LOUDLY, never silently.
+        if [[ "${{ github.ref }}" != "refs/heads/main" ]]; then
+          echo "will-publish=false" >> "$GITHUB_OUTPUT"
+          msg=$(git log -1 --format=%B HEAD)
+          if printf '%s' "$msg" | grep -qiE '^[[:space:]]*Publish:[[:space:]]*true[[:space:]]*$'; then
+            echo "::warning::'Publish: true' trailer on non-main ref '${{ github.ref }}' — ignored. Publishing only happens from main; merge first."
+          fi
+          echo "Non-main ref — validate-only run (no tag, no publish)"
+          exit 0
+        fi
+
+        # push to main — match Publish: true trailer (case-insensitive on key)
         msg=$(git log -1 --format=%B HEAD)
         if printf '%s' "$msg" | grep -qiE '^[[:space:]]*Publish:[[:space:]]*true[[:space:]]*$'; then
           echo "will-publish=true" >> "$GITHUB_OUTPUT"
@@ -215,9 +234,18 @@ runs:
         set -euo pipefail
         will_publish='${{ steps.gate.outputs.will-publish }}'
         event_name='${{ github.event_name }}'
+        branch_build='${{ inputs.branch-build }}'
 
+        # run-build: publish runs always; an opted-in pull_request also
+        # builds (branch-mode decision 2 — PRs validate the FULL pipeline
+        # incl. container; whether that container is pushed as a dev
+        # image is the container stage's own dev_push decision). Raw
+        # branch pushes never build — the gate doctrine (non-shipping
+        # commits compile nothing) is unchanged.
         if [[ "$will_publish" == "true" ]]; then
           run_build=true
+        elif [[ "$event_name" == "pull_request" && "$branch_build" == "true" ]]; then
+          run_build=true
         else
           run_build=false
         fi
@@ -230,4 +258,4 @@ runs:
 
         echo "run-build=$run_build" >> "$GITHUB_OUTPUT"
         echo "run-checks=$run_checks" >> "$GITHUB_OUTPUT"
-        echo "::notice::run-checks=$run_checks run-build=$run_build (will-publish=$will_publish event=$event_name)"
+        echo "::notice::run-checks=$run_checks run-build=$run_build (will-publish=$will_publish event=$event_name branch-build=$branch_build)"

{hyperi_ci-2.7.2 → hyperi_ci-2.8.0}/.github/actions/setup-runtime/action.yml

@@ -40,7 +40,7 @@ runs:
   steps:
     - name: Install uv
       if: ${{ !contains(runner.name, 'arc-runner') }}
-      uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+      uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
       with:
         enable-cache: ${{ inputs.enable-uv-cache }}
 

{hyperi_ci-2.7.2 → hyperi_ci-2.8.0}/.github/workflows/_release-tail.yml

@@ -85,9 +85,10 @@ env:
 jobs:
   container:
     name: Container
-    # Branch / PR pushes never reach this workflow (caller gates on
-    # quality+test+build pre-needs). Pushes to main and
-    # workflow_dispatch always reach here:
+    # Raw branch pushes never reach this workflow (caller gates on
+    # quality+test+build pre-needs). Pushes to main, workflow_dispatch,
+    # and branch-mode pull_request runs (caller's branch-build opt-in)
+    # reach here:
     #
     # - Validate-only (push to main, will-publish == 'false'):
     #   docker build runs to catch Dockerfile breakages, but no push
@@ -95,20 +96,25 @@ jobs:
     #   BEFORE we ever try to publish from it.
     # - Publish (will-publish == 'true'): docker build + push to all
     #   configured registries.
+    # - pull_request (branch-mode): docker build; pushed as a DEV image
+    #   (branch-<slug> + sha tags, GHCR only) iff the project sets
+    #   publish.container.dev_push — else validate-only. Fork PRs are
+    #   excluded outright (first clause; no secrets, no pushes).
     #
-    # The push-vs-validate decision lives in container/stage.py keyed
-    # off HYPERCI_PUBLISH_MODE — set when will-publish is true.
+    # The publish/dev/validate decision lives in hyperi_ci.publish_mode
+    # (the SSOT), keyed off HYPERCI_PUBLISH_MODE + the event context.
     if: |
       github.event.pull_request.head.repo.fork != true && (
         (github.event_name == 'push' && github.ref == 'refs/heads/main') ||
-        github.event_name == 'workflow_dispatch'
+        github.event_name == 'workflow_dispatch' ||
+        github.event_name == 'pull_request'
       )
     runs-on: ubuntu-latest
     permissions:
       contents: read
       packages: write
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{ inputs.tag || github.ref }}
 
@@ -121,7 +127,7 @@ jobs:
       - name: Install uv
         # Needed to run the resolve step below. Cheap, no Docker Hub —
         # so a library never pays the Buildx/Docker-Hub cost (issue #33).
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           enable-cache: false
 
@@ -142,7 +148,7 @@ jobs:
         # anonymous rate limits when the Dockerfile pulls a Hub base
         # image. Conditional on the org var being set; no-op otherwise.
         if: steps.resolve.outputs.build == 'true' && vars.DOCKERHUB_USERNAME != ''
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -151,7 +157,7 @@ jobs:
         # GITHUB_TOKEN via job-level packages:write permission — can create
         # new repo-owned packages on first push.
         if: steps.resolve.outputs.build == 'true'
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -159,7 +165,7 @@ jobs:
 
       - name: Set up Docker Buildx
         if: steps.resolve.outputs.build == 'true'
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Download build artifacts
         # The build-dist-* artifact carries both dist/ (binaries) and
@@ -213,7 +219,7 @@ jobs:
       pull-requests: write
       packages: write
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           # On push OR a from-head dispatch (issue #35), check out main HEAD
           # so the tag is created there. On a tag dispatch (retroactive
@@ -280,13 +286,13 @@ jobs:
 
       - name: Docker Hub login
         if: vars.DOCKERHUB_USERNAME != ''
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: GHCR login
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -303,12 +309,12 @@ jobs:
 
       - name: Install Rust toolchain
         if: inputs.language == 'rust'
-        uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # master
+        uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # master
         with:
           toolchain: ${{ inputs.rust-toolchain }}
 
       - name: Install uv
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           enable-cache: false
 

{hyperi_ci-2.7.2 → hyperi_ci-2.8.0}/.github/workflows/ci.yml

@@ -47,18 +47,30 @@ concurrency:
   group: ${{ github.workflow }}-${{ inputs.tag || github.ref }}
   cancel-in-progress: true
 
+# Least-privilege GITHUB_TOKEN default for every job (CodeQL
+# actions/missing-workflow-permissions). Two jobs elevate: release-tail
+# (passes write down to _release-tail.yml -- semantic-release commit/tag +
+# GHCR) and plan (semantic-release push-access verify on a publish predict).
+# commit-check / quality / test / build are read-only.
+permissions:
+  contents: read
+
 jobs:
   plan:
     name: Plan
     if: github.event.pull_request.head.repo.fork != true
     runs-on: ubuntu-latest
+    # predict-version runs semantic-release, whose git plugin verifies push
+    # access (a `git push --dry-run`) on a publish predict -- needs write.
+    permissions:
+      contents: write
     outputs:
       run-checks: ${{ steps.predict.outputs.run-checks }}
       run-build: ${{ steps.predict.outputs.run-build }}
       will-publish: ${{ steps.predict.outputs.will-publish }}
       next-version: ${{ steps.predict.outputs.version }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{ inputs.tag || github.ref }}
           fetch-depth: 0  # full history -- semantic-release dry-run reads it
@@ -69,6 +81,7 @@ jobs:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           from-head: ${{ inputs.from-head }}
           bump: ${{ inputs.bump }}
+          branch-build: ${{ vars.HYPERCI_BRANCH_BUILD }}
 
   commit-check:
     name: Commit messages
@@ -83,11 +96,11 @@ jobs:
       github.event_name == 'pull_request'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
       - name: Install uv
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           enable-cache: true
       - name: Set up Python
@@ -101,7 +114,7 @@ jobs:
     name: Quality
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{ inputs.tag || github.ref }}
           # Full history + tags: the interface gate diffs against the last
@@ -109,7 +122,7 @@ jobs:
           fetch-depth: 0
 
       - name: Install uv
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           enable-cache: true
 
@@ -137,12 +150,12 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest]
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{ inputs.tag || github.ref }}
 
       - name: Install uv
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           enable-cache: true
 
@@ -161,7 +174,7 @@ jobs:
     if: needs.plan.outputs.run-build == 'true'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{ inputs.tag || github.ref }}
 
@@ -189,7 +202,7 @@ jobs:
           fi
 
       - name: Install uv
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           enable-cache: true
 
@@ -218,6 +231,14 @@ jobs:
   release-tail:
     name: Release tail
     needs: [plan, build]
+    # Elevated + passed to _release-tail.yml: its tag-and-publish job commits +
+    # tags (contents), pushes GHCR (packages) and runs the semantic-release GH
+    # plugin (issues + pull-requests). Capped by the caller's grant.
+    permissions:
+      contents: write
+      packages: write
+      issues: write
+      pull-requests: write
     # Local ref (dogfood): a change to the shared release tail is exercised
     # on hyperi-ci's own CI before any consumer pins it. The tail's own
     # tag-and-publish job is gated on will-publish == 'true', so a non-publish

{hyperi_ci-2.7.2 → hyperi_ci-2.8.0}/.github/workflows/go-ci.yml

@@ -59,6 +59,10 @@ on:
         type: string
         default: ""
         description: "Space-separated submodule paths to init after checkout (e.g. 'schemas'). Empty (default) inits nothing. The submodule must be reachable by the job token -- public, or a token with cross-repo read access."
+      branch-build:
+        type: string
+        default: ""
+        description: "'true' to run build + container on pull_request events (branch-mode). Also settable repo-wide via the HYPERCI_BRANCH_BUILD variable. Dev-image push is the separate publish.container.dev_push opt-in."
     secrets:
       JFROG_TOKEN:
         required: false
@@ -106,6 +110,18 @@ concurrency:
 env:
   HYPERCI_PUBLISH_TARGET: ${{ inputs.publish-target }}
   HYPERCI_INSTALL: uvx --no-cache --refresh hyperi-ci
+  # Rare edge-case escape hatch: set the HYPERCI_QUALITY_SKIP repo/org
+  # variable (e.g. "semgrep") to force-skip a quality tool whose false
+  # positive is halting CI, until the real fix lands. Empty when unset.
+  HYPERCI_QUALITY_SKIP: ${{ vars.HYPERCI_QUALITY_SKIP }}
+
+# Least-privilege GITHUB_TOKEN default for every job (CodeQL
+# actions/missing-workflow-permissions). Two jobs elevate: release-tail
+# (passes write down to _release-tail.yml -- semantic-release commit/tag +
+# GHCR) and plan (semantic-release push-access verify on a publish predict).
+# commit-check / quality / test / build are read-only.
+permissions:
+  contents: read
 
 jobs:
   # ---------------------------------------------------------------------------
@@ -116,6 +132,10 @@ jobs:
     name: Plan
     if: github.event.pull_request.head.repo.fork != true
     runs-on: ubuntu-latest
+    # predict-version runs semantic-release, whose git plugin verifies push
+    # access (a `git push --dry-run`) on a publish predict -- needs write.
+    permissions:
+      contents: write
     outputs:
       run-checks: ${{ steps.predict.outputs.run-checks }}
       run-build: ${{ steps.predict.outputs.run-build }}
@@ -126,7 +146,7 @@ jobs:
       - name: Beta notice
         run: echo "::warning title=Go CI is beta::The Go reusable workflow is less battle-tested than Rust/Python/TS — verify results carefully."
 
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{ inputs.tag || github.ref }}
           fetch-depth: 0
@@ -138,17 +158,20 @@ jobs:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           from-head: ${{ inputs.from-head }}
           bump: ${{ inputs.bump }}
+          branch-build: ${{ inputs.branch-build || vars.HYPERCI_BRANCH_BUILD }}
 
       - name: Generate build matrix
         # Go cross-compiles natively (GOOS/GOARCH) — same multi-arch
-        # matrix shape as Rust on publish; single-arch on validate.
+        # matrix shape as Rust on publish; single-arch on validate AND
+        # branch-mode PR builds (arch breadth keys off will-publish,
+        # NOT run-build).
         id: matrix
         shell: bash
         run: |
           set -euo pipefail
           AMD64_RUNNER="${{ startsWith(github.head_ref || github.ref_name, 'renovate/') && (vars.GH_RUNNER_RENOVATE || 'ubuntu-latest') || (inputs.runner-mode || vars.GH_RUNNER_MODE) == 'free' && 'ubuntu-latest' || inputs.runner-build || vars.GH_RUNNER_GOLANG || vars.GH_RUNNER_DEFAULT || 'ubuntu-latest' }}"
           ARM64_RUNNER="${{ vars.GH_RUNNER_ARM64 || 'ubuntu-24.04-arm' }}"
-          if [[ "${{ steps.predict.outputs.run-build }}" == "true" ]]; then
+          if [[ "${{ steps.predict.outputs.will-publish }}" == "true" ]]; then
             matrix='{"include":[{"goos":"linux","goarch":"amd64","runner":"'"$AMD64_RUNNER"'","os_arch":"linux-amd64"},{"goos":"linux","goarch":"arm64","runner":"'"$ARM64_RUNNER"'","os_arch":"linux-arm64"}]}'
           else
             matrix='{"include":[{"goos":"linux","goarch":"amd64","runner":"'"$AMD64_RUNNER"'","os_arch":"linux-amd64"}]}'
@@ -169,11 +192,11 @@ jobs:
       github.event_name == 'pull_request'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
       - name: Install uv
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           enable-cache: false
       - name: Validate commit messages
@@ -187,18 +210,18 @@ jobs:
     steps:
       - name: Docker Hub login
         if: ${{ vars.DOCKERHUB_USERNAME != '' }}
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{ inputs.tag || github.ref }}
 
       - name: Set up Go
         if: ${{ !contains(runner.name, 'arc-runner') }}
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version-file: ${{ inputs.go-version-file }}
 
@@ -212,7 +235,7 @@ jobs:
 
       - name: Install uv
         if: ${{ !contains(runner.name, 'arc-runner') }}
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           enable-cache: false
 
@@ -248,24 +271,24 @@ jobs:
     steps:
       - name: Docker Hub login
         if: ${{ vars.DOCKERHUB_USERNAME != '' }}
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{ inputs.tag || github.ref }}
 
       - name: Set up Go
         if: ${{ !contains(runner.name, 'arc-runner') }}
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version-file: ${{ inputs.go-version-file }}
 
       - name: Install uv
         if: ${{ !contains(runner.name, 'arc-runner') }}
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           enable-cache: false
 
@@ -303,7 +326,7 @@ jobs:
     strategy:
       matrix: ${{ fromJson(needs.plan.outputs.build-matrix) }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{ inputs.tag || github.ref }}
 
@@ -329,13 +352,13 @@ jobs:
 
       - name: Set up Go
         if: ${{ !contains(runner.name, 'arc-runner') }}
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version-file: ${{ inputs.go-version-file }}
 
       - name: Install uv
         if: ${{ !contains(runner.name, 'arc-runner') }}
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           enable-cache: false
 
@@ -370,6 +393,14 @@ jobs:
   release-tail:
     name: Release tail
     needs: [plan, build]
+    # Elevated + passed to _release-tail.yml: its tag-and-publish job commits +
+    # tags (contents), pushes GHCR (packages) and runs the semantic-release GH
+    # plugin (issues + pull-requests). Capped by the caller's grant.
+    permissions:
+      contents: write
+      packages: write
+      issues: write
+      pull-requests: write
     uses: hyperi-io/hyperi-ci/.github/workflows/_release-tail.yml@main
     with:
       language: golang

{hyperi_ci-2.7.2 → hyperi_ci-2.8.0}/.github/workflows/python-ci.yml

@@ -56,6 +56,10 @@ on:
         type: string
         default: ""
         description: "Space-separated submodule paths to init after checkout (e.g. 'schemas'). Empty (default) inits nothing. The submodule must be reachable by the job token -- public, or a token with cross-repo read access."
+      branch-build:
+        type: string
+        default: ""
+        description: "'true' to run build + container on pull_request events (branch-mode). Also settable repo-wide via the HYPERCI_BRANCH_BUILD variable. Dev-image push is the separate publish.container.dev_push opt-in."
     secrets:
       JFROG_TOKEN:
         required: false
@@ -110,6 +114,18 @@ concurrency:
 env:
   HYPERCI_PUBLISH_TARGET: ${{ inputs.publish-target }}
   HYPERCI_INSTALL: uvx --no-cache --refresh hyperi-ci
+  # Rare edge-case escape hatch: set the HYPERCI_QUALITY_SKIP repo/org
+  # variable (e.g. "semgrep") to force-skip a quality tool whose false
+  # positive is halting CI, until the real fix lands. Empty when unset.
+  HYPERCI_QUALITY_SKIP: ${{ vars.HYPERCI_QUALITY_SKIP }}
+
+# Least-privilege GITHUB_TOKEN default for every job (CodeQL
+# actions/missing-workflow-permissions). Two jobs elevate: release-tail
+# (passes write down to _release-tail.yml -- semantic-release commit/tag +
+# GHCR) and plan (semantic-release push-access verify on a publish predict).
+# commit-check / quality / test / build are read-only.
+permissions:
+  contents: read
 
 jobs:
   # ---------------------------------------------------------------------------
@@ -121,13 +137,17 @@ jobs:
     name: Plan
     if: github.event.pull_request.head.repo.fork != true
     runs-on: ubuntu-latest
+    # predict-version runs semantic-release, whose git plugin verifies push
+    # access (a `git push --dry-run`) on a publish predict -- needs write.
+    permissions:
+      contents: write
     outputs:
       run-checks: ${{ steps.predict.outputs.run-checks }}
       run-build: ${{ steps.predict.outputs.run-build }}
       will-publish: ${{ steps.predict.outputs.will-publish }}
       next-version: ${{ steps.predict.outputs.version }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{ inputs.tag || github.ref }}
           fetch-depth: 0  # full history — semantic-release dry-run reads it
@@ -139,6 +159,7 @@ jobs:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           from-head: ${{ inputs.from-head }}
           bump: ${{ inputs.bump }}
+          branch-build: ${{ inputs.branch-build || vars.HYPERCI_BRANCH_BUILD }}
 
   commit-check:
     name: Commit messages
@@ -154,11 +175,11 @@ jobs:
       github.event_name == 'pull_request'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
       - name: Install uv
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           enable-cache: false
       - name: Validate commit messages
@@ -172,18 +193,18 @@ jobs:
     steps:
       - name: Docker Hub login
         if: ${{ vars.DOCKERHUB_USERNAME != '' }}
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{ inputs.tag || github.ref }}
 
       - name: Install uv
         if: ${{ !contains(runner.name, 'arc-runner') }}
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           enable-cache: true
 
@@ -242,18 +263,18 @@ jobs:
     steps:
       - name: Docker Hub login
         if: ${{ vars.DOCKERHUB_USERNAME != '' }}
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{ inputs.tag || github.ref }}
 
       - name: Install uv
         if: ${{ !contains(runner.name, 'arc-runner') }}
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           enable-cache: true
 
@@ -292,7 +313,7 @@ jobs:
     if: needs.plan.outputs.run-build == 'true'
     runs-on: ${{ startsWith(github.head_ref || github.ref_name, 'renovate/') && (vars.GH_RUNNER_RENOVATE || 'ubuntu-latest') || (inputs.runner-mode || vars.GH_RUNNER_MODE) == 'free' && 'ubuntu-latest' || inputs.runner-build || vars.GH_RUNNER_PYTHON || vars.GH_RUNNER_DEFAULT || 'ubuntu-latest' }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{ inputs.tag || github.ref }}
 
@@ -330,7 +351,7 @@ jobs:
 
       - name: Install uv
         if: ${{ !contains(runner.name, 'arc-runner') }}
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           enable-cache: true
 
@@ -367,6 +388,14 @@ jobs:
   release-tail:
     name: Release tail
     needs: [plan, build]
+    # Elevated + passed to _release-tail.yml: its tag-and-publish job commits +
+    # tags (contents), pushes GHCR (packages) and runs the semantic-release GH
+    # plugin (issues + pull-requests). Capped by the caller's grant.
+    permissions:
+      contents: write
+      packages: write
+      issues: write
+      pull-requests: write
     uses: hyperi-io/hyperi-ci/.github/workflows/_release-tail.yml@main
     with:
       language: python