project-init 0.5.2__tar.gz → 0.6.1__tar.gz

{project_init-0.5.2/templates/lifecycle/dot_claude → project_init-0.6.1/.claude}/hooks/dag_workflow.py

@@ -42,8 +42,6 @@ import sys
 import time
 from pathlib import Path
 
-CACHE_PATH = Path(".claude/.workflow-state.json")
-
 GRAPH: dict[str, list[str]] = {
     "issue.created": [],
     "branch.created": [],
@@ -64,8 +62,11 @@ else:
 
 
 def _run(cmd: list[str]) -> tuple[int, str]:
+    # Per-call timeout must stay well below the hook budget (settings.json
+    # "timeout": 60): a PreToolUse hook that exceeds its budget is killed and
+    # FAILS OPEN, so one hung gh call must never eat the whole allowance.
     try:
-        proc = subprocess.run(cmd, capture_output=True, text=True, timeout=15)
+        proc = subprocess.run(cmd, capture_output=True, text=True, timeout=10)  # noqa: S603 — argv list built from internal literals/validated state, never a shell string
     except (subprocess.TimeoutExpired, FileNotFoundError):
         return 1, ""
     return proc.returncode, proc.stdout
@@ -253,6 +254,17 @@ COMMAND_RULES: list[tuple[re.Pattern[str], str | None, str]] = [
         "pr.merged",
         "Use .claude/scripts/monitor_pr.sh <pr> --merge instead of `gh api .../merge` so CI and review gates are honored.",
     ),
+    (
+        # GraphQL merges bypass the REST-path rule above (2026-07 review): a
+        # `gh api graphql` mutation can merge or enable auto-merge without ever
+        # naming `/pulls/N/merge`. Block the mutation fields themselves.
+        re.compile(
+            r"\bgh\s+api\b[^&;]*\bgraphql\b[^&;]*"
+            r"(?:mergePullRequest|enablePullRequestAutoMerge)"
+        ),
+        "pr.merged",
+        "Use .claude/scripts/monitor_pr.sh <pr> --merge instead of a `gh api graphql` merge mutation so CI and review gates are honored.",
+    ),
     (
         re.compile(r"\bgh\s+pr\s+merge\b"),
         "pr.merged",
@@ -291,12 +303,69 @@ _HEREDOC_RE = re.compile(
     re.DOTALL,
 )
 
+# Git global options that sit BETWEEN `git` and the subcommand (`git -C dir
+# push`, `git -c k=v push`). Left unnormalized they defeat every `git push`
+# rule, including the direct-push-to-main block (2026-07 review). Options that
+# consume a value are listed with their value; boolean options stand alone.
+# An option value is one shell word INCLUDING quoted runs — `-c foo='a b'`
+# must normalize away too: a bare \S+ stops at the space inside the quotes
+# and the mangled residue defeats every git rule (mirrors the quoted-value
+# matcher in pre_commit_gate.sh).
+_GIT_OPT_VAL = r"(?:[^\s'\"]|'[^']*'|\"[^\"]*\")+"
+_GIT_GLOBAL_OPT = (
+    r"(?:"
+    rf"-C[ \t]+{_GIT_OPT_VAL}"  # -C <path>
+    rf"|-c[ \t]+{_GIT_OPT_VAL}"  # -c <name=value>
+    rf"|--git-dir(?:={_GIT_OPT_VAL}|[ \t]+{_GIT_OPT_VAL})"
+    rf"|--work-tree(?:={_GIT_OPT_VAL}|[ \t]+{_GIT_OPT_VAL})"
+    rf"|--namespace(?:={_GIT_OPT_VAL}|[ \t]+{_GIT_OPT_VAL})"
+    rf"|--config-env(?:={_GIT_OPT_VAL}|[ \t]+{_GIT_OPT_VAL})"
+    rf"|--exec-path(?:={_GIT_OPT_VAL})?"
+    r"|--no-pager|--paginate|-p|-P|--bare"
+    r"|--no-replace-objects|--literal-pathspecs|--no-optional-locks|--icase-pathspecs"
+    r")"
+)
+_GIT_NORMALIZE_RE = re.compile(r"\bgit((?:[ \t]+" + _GIT_GLOBAL_OPT + r")+)[ \t]+")
+
+# An interpreter receiving a heredoc executes its body, so a guarded command
+# hidden in `bash <<'EOF' … EOF` must still be scanned (2026-07 review). The
+# negative lookbehind lets `/bin/bash` match while sparing `rebash`.
+_INTERP = r"(?:bash|sh|zsh|dash|ksh|python3?|python2|eval|source)"
+_INTERP_INTRO_RE = re.compile(r"(?<![\w.-])" + _INTERP + r"\b")
+_PIPE_INTERP_RE = re.compile(r"^\s*\|\s*(?:sudo[ \t]+)?(?<![\w.-])" + _INTERP + r"\b")
+
+
+def _normalize_git_globals(cmd: str) -> str:
+    """Rewrite ``git <global-opts> <subcommand>`` to ``git <subcommand>`` for
+    matching, so interposed ``-C``/``-c``/``--git-dir`` flags can't smuggle a
+    push past the rules (2026-07 review)."""
+    return _GIT_NORMALIZE_RE.sub("git ", cmd)
+
 
 def _strip_heredocs(cmd: str) -> str:
     """Remove heredoc body text so pattern rules don't fire on body content."""
     return _HEREDOC_RE.sub("", cmd)
 
 
+def _executing_heredoc_bodies(cmd: str) -> str:
+    """Concatenate heredoc bodies that WILL run — those fed to an interpreter
+    directly (``bash <<EOF``) or via a pipe (``cat <<EOF … | bash``).
+
+    ``_strip_heredocs`` removes every body to spare prose (a commit message or
+    ``gh pr comment --body-file - <<EOF`` mentioning "git push main"), but that
+    also hid genuinely-executing bodies. Re-surfacing only the interpreter-fed
+    ones keeps prose exempt while closing the execution bypass (2026-07 review).
+    """
+    bodies = []
+    for m in _HEREDOC_RE.finditer(cmd):
+        line_start = cmd.rfind("\n", 0, m.start()) + 1
+        intro = cmd[line_start : m.start()]
+        after = cmd[m.end() : m.end() + 60]
+        if _INTERP_INTRO_RE.search(intro) or _PIPE_INTERP_RE.match(after):
+            bodies.append(m.group(0))
+    return "\n".join(bodies)
+
+
 # Free-text flag values carry arbitrary prose (commit messages, issue/PR comment
 # and release bodies, titles) that must not be scanned for command patterns — a
 # `--body` mentioning the literal "git push main" is data, not an invocation.
@@ -358,8 +427,15 @@ def guard(payload: dict) -> dict | None:
 
     # Strip heredoc bodies and free-text flag values so pattern rules don't fire
     # on prose content (e.g. `gh issue create --body "$(cat <<'EOF'\n...git
-    # push...\nEOF\n)"`, or `gh pr comment --body "...git push main..."`).
-    cmd_scan = _strip_text_flag_values(_strip_heredocs(cmd))
+    # push...\nEOF\n)"`, or `gh pr comment --body "...git push main..."`), then
+    # normalize interposed git global options so `git -C dir push` is matched
+    # like `git push` (2026-07 review).
+    cmd_scan = _normalize_git_globals(_strip_text_flag_values(_strip_heredocs(cmd)))
+    # A heredoc fed to an interpreter DOES execute its body — scan those too, so
+    # `bash <<'EOF' … git push … EOF` is not a bypass (2026-07 review).
+    exec_bodies = _executing_heredoc_bodies(cmd)
+    if exec_bodies:
+        cmd_scan += "\n" + _normalize_git_globals(_strip_text_flag_values(exec_bodies))
 
     for pattern, target, message in COMMAND_RULES:
         if not pattern.search(cmd_scan):
@@ -463,7 +539,7 @@ def cmd_push(branch: str | None, max_retries: int, *, force: bool = False) -> in
         push_cmd = ["git", "push", "-u", "origin", branch]
         if force:
             push_cmd.append("--force-with-lease")
-        proc = subprocess.run(push_cmd)
+        proc = subprocess.run(push_cmd)  # noqa: S603 — fixed git argv + validated branch name, never a shell string
         if proc.returncode == 0:
             sys.stdout.write(f"push: pushed {branch} ({expected_sha})\n")
             return 0
@@ -559,7 +635,7 @@ def cmd_finish(pr_number: int | None, review_cycle: int | None) -> int:
     monitor_args = ["bash", str(script), str(pr_number), "--merge"]
     if review_cycle is not None:
         monitor_args += ["--review-cycle", str(review_cycle)]
-    return subprocess.run(monitor_args).returncode
+    return subprocess.run(monitor_args).returncode  # noqa: S603 — fixed bash argv + resolved script path, never a shell string
 
 
 _VALID_TYPES = {"feat", "fix", "chore", "docs", "test"}
@@ -620,10 +696,18 @@ def cmd_create_pr_nojira(
     if rc != 0:
         return rc
 
-    code, url = _gh(["pr", "view", "--json", "url", "-q", ".url"])
-    if code == 0 and url.strip():
-        sys.stdout.write(f"Draft PR already exists: {url.strip()}\n")
-        return 0
+    # `gh pr view` with no selector also resolves the most recent CLOSED/MERGED
+    # PR for the branch — reusing a branch name after a merge must open a new
+    # PR, not report the merged one as "already exists" (matches check_pr_opened).
+    code, out = _gh(["pr", "view", "--json", "url,state"])
+    if code == 0:
+        try:
+            data = json.loads(out or "{}")
+        except json.JSONDecodeError:
+            data = {}
+        if data.get("state") == "OPEN" and data.get("url"):
+            sys.stdout.write(f"Draft PR already exists: {data['url']}\n")
+            return 0
 
     # Conventional Commits, no scope = no linked issue (ADR-006)
     pr_title = f"{type_}: {title}"

{project_init-0.5.2 → project_init-0.6.1}/.claude/scripts/monitor_pr.sh

@@ -4,9 +4,13 @@
 # Requires: gh, python3 (stdlib only — no jq dependency).
 #
 # Usage:
-#   .claude/scripts/monitor_pr.sh <pr-number> [--merge] [--review-cycle N] [--no-review]
+#   .claude/scripts/monitor_pr.sh <pr-number> [--merge] [--review-cycle N] [--no-review] [--admin]
 #
 # --merge: squash-merge and delete branch automatically when all checks pass.
+# --admin: allow an admin override when the PR is BLOCKED by branch protection
+#   AFTER the review gate passed (e.g. an unresolved conversation). Without it,
+#   a post-review BLOCKED state fails with guidance instead of silently
+#   overriding the protection setup_github.sh provisioned (2026-07 review).
 # --review-cycle N: current review fix cycle count (0-based, default 0).
 #   When N >= MAX_REVIEW_CYCLES and review/decision is still failing or pending,
 #   force-merges with --admin.
@@ -29,33 +33,49 @@
 set -euo pipefail
 
 PR_NUMBER="${1:-}"
-MODE="${2:-}"
+MODE=""
 REVIEW_CYCLE=0
 MAX_REVIEW_CYCLES=2
 NO_REVIEW=0
+ALLOW_ADMIN=0
 
 if [ -z "$PR_NUMBER" ]; then
-  echo "Usage: monitor_pr.sh <pr-number> [--merge] [--review-cycle N] [--no-review]" >&2
+  echo "Usage: monitor_pr.sh <pr-number> [--merge] [--review-cycle N] [--no-review] [--admin]" >&2
   exit 1
 fi
 
-if [ -n "$MODE" ] && [ "$MODE" != "--merge" ]; then
-  echo "Unknown option: $MODE" >&2
-  exit 2
-fi
-
-# Parse remaining flags (order-independent after position 2).
-# Shift past <pr-number> and optional --merge; remaining args are flags.
+# Parse flags (order-independent). --merge is just another flag: the usage
+# line presents every flag as independent, so `monitor_pr.sh 12 --no-review`
+# must not be rejected for lacking --merge in position 2.
 shift 1  # drop PR_NUMBER
-[ "$MODE" = "--merge" ] && shift 1  # drop --merge if present
 while [ $# -gt 0 ]; do
   case "$1" in
-    --review-cycle)   REVIEW_CYCLE="${2:-0}"; shift 2 ;;
+    --merge)          MODE="--merge"; shift ;;
+    --review-cycle)
+      # Validate before `shift 2`: with no value, the shift fails under set -e
+      # and aborts with no message (Copilot review).
+      if [ $# -lt 2 ]; then
+        echo "--review-cycle requires a numeric value" >&2
+        exit 2
+      fi
+      REVIEW_CYCLE="$2"; shift 2 ;;
     --review-cycle=*) REVIEW_CYCLE="${1#*=}"; shift ;;
     --no-review)      NO_REVIEW=1; shift ;;
+    --admin)          ALLOW_ADMIN=1; shift ;;
     *) echo "Unknown option: $1" >&2; exit 2 ;;
   esac
 done
+case "$REVIEW_CYCLE" in
+  '' | *[!0-9]*) echo "--review-cycle must be a non-negative integer (got '$REVIEW_CYCLE')" >&2; exit 2 ;;
+esac
+
+# --admin, --no-review and --review-cycle only take effect while merging. Warn
+# loudly if they were passed without --merge so the flag isn't silently a no-op.
+if [ "$MODE" != "--merge" ]; then
+  if [ "$ALLOW_ADMIN" -eq 1 ] || [ "$NO_REVIEW" -eq 1 ] || [ "$REVIEW_CYCLE" -ne 0 ]; then
+    echo "WARNING: --admin/--no-review/--review-cycle only apply with --merge; ignoring (monitor-only run)." >&2
+  fi
+fi
 
 _count_pending() {
   echo "$1" | python3 -c "
@@ -212,6 +232,7 @@ while { [ "$REVIEW_DECISION" = "REVIEW_REQUIRED" ] || [ "$REVIEW_DECISION" = "UN
   # Bot reviewers like Codex post comments without changing reviewDecision.
   if [ "$REVIEW_DECISION" = "REVIEW_REQUIRED" ] && _has_review_activity; then
     echo "  Review comments detected — proceeding without waiting for formal approval."
+    REVIEW_ACTIVITY=1
     break
   fi
   CHECKS=$(gh pr checks "$PR_NUMBER" --json name,state,bucket 2>/dev/null) || CHECKS="[]"
@@ -241,8 +262,15 @@ if [ "$REVIEW_DECISION" = "CHANGES_REQUESTED" ]; then
 fi
 
 if [ "$REVIEW_DECISION" = "REVIEW_REQUIRED" ]; then
-  echo "PR #$PR_NUMBER: review/decision still pending after ${REVIEW_TIMEOUT}s — no reviewer has acted."
-  echo "  Full PR: $(gh pr view "$PR_NUMBER" --json url -q '.url' 2>/dev/null || true)"
+  if [ "${REVIEW_ACTIVITY:-0}" -eq 1 ]; then
+    # The wait loop broke early because reviews were posted (e.g. a bot's
+    # COMMENTED review) — surface them instead of claiming nobody acted.
+    echo "PR #$PR_NUMBER: review comments posted, but no formal approval yet:"
+    _print_review_comments
+  else
+    echo "PR #$PR_NUMBER: review/decision still pending after ${REVIEW_TIMEOUT}s — no reviewer has acted."
+    echo "  Full PR: $(gh pr view "$PR_NUMBER" --json url -q '.url' 2>/dev/null || true)"
+  fi
 
   if [ "$MODE" = "--merge" ]; then
     if [ "$REVIEW_CYCLE" -ge "$MAX_REVIEW_CYCLES" ]; then
@@ -272,8 +300,21 @@ if [ "$MODE" = "--merge" ]; then
       exit 1
     fi
   elif [ "$MERGE_STATE" = "BLOCKED" ]; then
-    echo "PR is blocked by review protection — merging with admin override."
-    _admin_merge
+    # The review gate already passed to reach here, so BLOCKED means a DIFFERENT
+    # branch-protection rule is unmet — most often an unresolved review thread.
+    # Auto-admin-merging past it on cycle 0 silently defeats the protection this
+    # very tool set up, so it requires an explicit --admin opt-in (2026-07
+    # review; backported from the template copy).
+    if [ "$ALLOW_ADMIN" -eq 1 ]; then
+      echo "PR is blocked by branch protection — merging with admin override (--admin)."
+      _admin_merge
+    else
+      echo "ERROR: PR #$PR_NUMBER is BLOCKED by branch protection after the review gate" >&2
+      echo "  passed — typically an unresolved review conversation, or a required" >&2
+      echo "  check that has not reported. Resolve the blocker, or re-run with --admin" >&2
+      echo "  to override." >&2
+      exit 1
+    fi
   else
     if ! _run_gh pr merge "$PR_NUMBER" --squash --delete-branch; then
       if ! _run_gh pr merge "$PR_NUMBER" --squash --delete-branch --auto; then

{project_init-0.5.2 → project_init-0.6.1}/.claude/scripts/push_wiki.sh

@@ -41,8 +41,13 @@ git clone "https://github.com/${REPO_SLUG}.wiki.git" "$WIKI_DIR"
 cp "$SOURCE_FILE" "$WIKI_DIR/Home.md"
 
 cd "$WIKI_DIR"
-for page in "${PRUNE_PAGES[@]}"; do
-  [[ -f "$page" ]] && git rm -q "$page" && echo "Pruned $page"
+# ${arr[@]+...} guard: expanding an empty array under `set -u` is a fatal
+# "unbound variable" on bash 3.2-4.3 (stock macOS), aborting before the commit.
+for page in ${PRUNE_PAGES[@]+"${PRUNE_PAGES[@]}"}; do
+  if [[ -f "$page" ]]; then
+    git rm -q "$page"
+    echo "Pruned $page"
+  fi
 done
 git add Home.md
 if git diff --cached --quiet; then

{project_init-0.5.2 → project_init-0.6.1}/.claude/settings.json

@@ -8,7 +8,7 @@
           {
             "type": "command",
             "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/github_command_guard.sh",
-            "timeout": 10
+            "timeout": 60
           }
         ]
       }

project_init-0.6.1/.githooks/pre-push

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+# pre-push gate for the project-init repo itself (dogfood).
+#
+# Runs the SAME `just ci` (lint + tests) that CI runs, before the push leaves
+# the machine — so nothing red reaches a PR and the push→CI-fail→fix→re-push
+# loop is caught locally. This is the local↔CI parity gate whose absence let a
+# fresh-scaffold lint failure ship (the scaffolder's CI caught it only after a
+# push, and even then incompletely).
+#
+# Enabled automatically by `just setup` (git config core.hooksPath .githooks).
+# Bypass in an emergency with: git push --no-verify
+set -euo pipefail
+
+if command -v just >/dev/null 2>&1; then
+  # `just ci` tests the working tree, but the push ships the committed tree.
+  # Skip (fail-open) on a dirty worktree rather than test a tree that isn't what
+  # gets pushed — a WIP fix could mask a failure, or unrelated WIP fail a clean
+  # push. CI stays the backstop.
+  if [ -n "$(git status --porcelain 2>/dev/null)" ]; then
+    echo "pre-push: working tree is dirty — skipping the 'just ci' gate" >&2
+    echo "  (it would test the worktree, not the commit being pushed)." >&2
+    echo "  Commit or stash your changes to run the gate before pushing." >&2
+  else
+    echo "pre-push: running 'just ci' (lint + tests)…"
+    if ! just ci; then
+      echo ""
+      echo "❌ pre-push: 'just ci' failed — fix the errors above before pushing."
+      echo "   (bypass in an emergency with: git push --no-verify)"
+      exit 1
+    fi
+  fi
+else
+  echo "pre-push: 'just' not found — skipping local CI gate (CI still runs)." >&2
+fi

{project_init-0.5.2 → project_init-0.6.1}/.github/workflows/ci.yml

@@ -14,35 +14,59 @@ jobs:
     name: Lint and test
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v8.1.0
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b  # v8.1.0
         with:
           version: "0.11.7"
           enable-cache: true
           cache-dependency-glob: "uv.lock"
           python-version: "3.12"
 
+      # shellcheck ships preinstalled on ubuntu-24.04; shfmt does not. The
+      # scaffolded-output lint guard (test_shell_lint_gate.py) skips when its
+      # tool is absent, so without this step the shfmt guard would silently
+      # no-op in CI — a green check that tested nothing. Pinned + checksum-
+      # verified, mirroring the install the scaffolded ci.yml.tmpl ships.
+      - name: Install shfmt
+        run: |
+          mkdir -p "$HOME/.local/bin"
+          tmp="$(mktemp -d)"
+          curl -sSfL https://github.com/mvdan/sh/releases/download/v3.8.0/shfmt_v3.8.0_linux_amd64 -o "$tmp/shfmt_v3.8.0_linux_amd64"
+          curl -sSfL https://github.com/mvdan/sh/releases/download/v3.8.0/sha256sums.txt -o "$tmp/sha256sums.txt"
+          ( cd "$tmp" && grep 'shfmt_v3.8.0_linux_amd64$' sha256sums.txt | sha256sum -c - )
+          chmod +x "$tmp/shfmt_v3.8.0_linux_amd64"
+          mv "$tmp/shfmt_v3.8.0_linux_amd64" "$HOME/.local/bin/shfmt"
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+
       - name: Sync dev dependencies
-        run: uv sync --extra dev --locked
+        run: uv sync --group dev --locked
 
       - name: Lint (ruff)
         run: uv run ruff check .
 
       - name: Tests (pytest) — parallel mode
-        # Falls back to single-threaded if xdist not available
-        run: uv run pytest -n auto --tb=short -q 2>/dev/null || uv run pytest --tb=short -q
+        # Use xdist when importable, else single-threaded — decided by an
+        # explicit capability check, not `|| retry`, so a genuinely failing
+        # suite is not run twice with its first-pass stderr hidden (2026-07
+        # review).
+        run: |
+          if uv run python -c "import xdist" 2>/dev/null; then
+            uv run pytest -n auto --tb=short -q
+          else
+            uv run pytest --tb=short -q
+          fi
 
   wheel-smoke:
     name: Wheel smoke test
     runs-on: ubuntu-24.04
     needs: lint-and-test
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v8.1.0
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b  # v8.1.0
         with:
           version: "0.11.7"
           enable-cache: true
@@ -89,12 +113,12 @@ jobs:
     name: Secret scan (gitleaks)
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
         with:
           # Full history so leaked commits are caught, not just the latest diff
           fetch-depth: 0
 
-      - uses: gitleaks/gitleaks-action@v3
+      - uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e  # v3
         env:
           GITHUB_TOKEN: ${{ github.token }}
 
@@ -104,10 +128,10 @@ jobs:
     name: ShellCheck (scaffolded scripts)
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v8.1.0
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b  # v8.1.0
         with:
           version: "0.11.7"
           enable-cache: true
@@ -146,8 +170,8 @@ jobs:
     outputs:
       shell: ${{ steps.filter.outputs.shell }}
     steps:
-      - uses: actions/checkout@v6
-      - uses: dorny/paths-filter@v3
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
+      - uses: dorny/paths-filter@d1c1ffe0248fe513906c8e24db8ea791d46f8590  # v3
         id: filter
         with:
           filters: |
@@ -170,10 +194,10 @@ jobs:
     if: needs.changes.outputs.shell == 'true'
     runs-on: macos-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v8.1.0
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b  # v8.1.0
         with:
           version: "0.11.7"
           python-version: "3.12"
@@ -228,10 +252,10 @@ jobs:
       run:
         shell: bash  # GitHub's "bash" on Windows is Git Bash — the supported path
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v8.1.0
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b  # v8.1.0
         with:
           version: "0.11.7"
           python-version: "3.12"

{project_init-0.5.2 → project_init-0.6.1}/.github/workflows/docs.yml

@@ -35,10 +35,10 @@ jobs:
     name: Build site
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v8.1.0
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b  # v8.1.0
         with:
           version: "0.11.7"
           enable-cache: true
@@ -54,7 +54,7 @@ jobs:
         run: uv run mkdocs build --strict
 
       - name: Upload Pages artifact
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa  # v3
         with:
           path: site
 
@@ -72,4 +72,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e  # v4

{project_init-0.5.2 → project_init-0.6.1}/.github/workflows/release.yml

@@ -5,11 +5,21 @@
 # Cutting a release:
 #   1. Bump version in pyproject.toml AND src/project_init/__init__.py
 #   2. git tag vX.Y.Z && push the tag
+#      — or, where a tag can't be pushed directly, run the "Tag Release"
+#        workflow (tag-release.yml): it verifies + creates the tag and then
+#        dispatches THIS workflow on the new tag ref.
 name: Release
 
 on:
   push:
     tags: ["v*"]
+  # Dispatchable on an EXISTING v* tag ref (tag-release.yml does this after
+  # creating the tag — a GITHUB_TOKEN tag push never triggers the tag-push
+  # path above, by GitHub's recursive-workflow rule). Every step below reads
+  # the tag from the run ref, so a dispatch on a non-tag ref fails the
+  # version guard cleanly. Keeping the run ON the tag ref also satisfies the
+  # pypi environment's v*-tags-only deployment rule (ADR-011).
+  workflow_dispatch: {}
 
 permissions:
   contents: write
@@ -18,13 +28,13 @@ jobs:
   release:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
         with:
           # Full history — git-cliff needs prior tags to scope --latest.
           fetch-depth: 0
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v8.1.0
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b  # v8.1.0
         with:
           version: "0.11.7"
 
@@ -40,7 +50,7 @@ jobs:
         run: uv build
 
       - name: Generate changelog (latest tag)
-        uses: orhun/git-cliff-action@v4
+        uses: orhun/git-cliff-action@f50e11560dce63f7c33227798f90b924471a88b5  # v4
         with:
           config: cliff.toml
           args: --latest
@@ -48,7 +58,7 @@ jobs:
           OUTPUT: RELEASE_NOTES.md
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b  # v3
         with:
           # Only the build artifacts — an unscoped glob also picks up the
           # tracked dist/.gitignore and uploads it as a stray
@@ -72,10 +82,10 @@ jobs:
       contents: read
       id-token: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v8.1.0
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b  # v8.1.0
         with:
           version: "0.11.7"
 
@@ -83,4 +93,4 @@ jobs:
         run: uv build
 
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b  # release/v1

{project_init-0.5.2/templates/lifecycle/dot_github → project_init-0.6.1/.github}/workflows/review-status.yml

@@ -31,6 +31,10 @@ jobs:
           PR_NUMBER: ${{ github.event.pull_request.number }}
           SHA: ${{ github.event.pull_request.head.sha }}
           REPO: ${{ github.repository }}
+          # Route the event value through env, not inline ${{ }} in the script —
+          # keeps the whole workflow to one untrusted-input discipline (2026-07
+          # review). GitHub-generated URL, so risk is low; consistency matters.
+          REVIEW_URL: ${{ github.event.review.html_url }}
         run: |
           DECISION=$(gh pr view "$PR_NUMBER" --repo "$REPO" --json reviewDecision -q '.reviewDecision // ""')
           case "$DECISION" in
@@ -45,4 +49,4 @@ jobs:
             --field state="$STATE" \
             --field description="$DESCRIPTION" \
             --field context="review/decision" \
-            --field target_url="${{ github.event.review.html_url }}"
+            --field target_url="$REVIEW_URL"