build(deps): bump markdownlint-cli2 default to 0.23.3 by kyle-sexton · Pull Request #663 · melodic-software/ci-workflows

kyle-sexton · 2026-10-04T01:12:29Z

Bumps the markdown action's markdownlint-cli2 default from 0.23.2 to 0.23.3, the last open item on #628.

melodic-software/standards package.json now pins 0.23.3. The action's pin rule is to absorb the standards pin and never go past it, so this matches it. .markdownlint-cli2.jsonc already points its $schema at v0.23.3.

typos, check-jsonschema and editorconfig-checker landed earlier, in #631 and #632.

Testing: node --test .github/scripts/*.test.cjs .github/actions/claude-lane-outcome/*.test.cjs passes 209 of 209.

Closes #628

Refs #628 Match the markdownlint-cli2 pin now at 0.23.3 in melodic-software/standards. The action pin-rule absorbs bumps to that pin and never past it. Co-authored-by: Kyle Sexton <kyle-sexton@users.noreply.github.com>

chatgpt-codex-connector · 2026-10-04T01:12:37Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-04T01:13:43.967471Z	`ef6062d`	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

claude · 2026-10-04T01:12:42Z

Claude finished @kyle-sexton's task in 30s —— View job

Security Review — No Issues Found ✅

Gather context (PR diff, changed files)
Apply skip-gate check
Review changed file(s) for security-relevant surface
Post final findings

Scope reviewed: .github/actions/markdown/action.yml (1 line changed) — bumps the markdownlint-cli2 default pin from 0.23.2 to 0.23.3.

Skip gate: This change has no security-relevant surface. It's a version-string literal in a composite action's default: input, matching the pin absorbed from melodic-software/standards. It does not touch triggers, permissions, secrets, injectable run: expressions, or any authorization/trust boundary. No instruction-surface deletion/narrowing either — the authority comment above the line (Authority: melodic-software/standards' markdownlint-cli2 pin...) is preserved verbatim.

No findings. Nothing further to review here — this is the GitHub Actions/dependency-pin hardening lane (zizmor's territory) and it only applies to loosened or unpinned pins, not a bump within the existing absorb-but-never-exceed policy.

claude · 2026-10-04T01:12:45Z

Claude finished @kyle-sexton's task in 36s —— View job

Code review

Gather context (diff, action.yml, .markdownlint-cli2.jsonc)
Apply skip gate
Post findings

Skip gate: trivial change, no meaningful review surface.

This is a single-line default-version bump in .github/actions/markdown/action.yml (0.23.2 → 0.23.3), consistent with the stated pin rule (absorb the standards pin, never go past it). Verified:

.markdownlint-cli2.jsonc's $schema already points at v0.23.3, matching the new default.
No other references to 0.23.2 remain in the repo.

No correctness, architecture, or maintainability issues found. The PR body's described test run (node --test ...) is author-claimed and not independently re-run here, since it's unrelated to this one-line change.

github-actions · 2026-10-04T01:13:36Z

claude-security-review has reviewed this pull request through ef6062d; a later push is reviewed from there.

github-actions · 2026-10-04T01:13:43Z

claude-review has reviewed this pull request through ef6062d; a later push is reviewed from there.

github-actions · 2026-10-04T01:13:57Z

PR body contract — issue linkage

This PR body does not yet satisfy the issue-linkage contract:

Missing a "## Summary" section. Describe what this PR changes and why, in a sentence or two.
Missing a "## Fix" section. State the concrete change and how it addresses the problem.
Missing a "## Verification" section. Record concrete evidence the change works (commands, gates, output).
Missing a "## Related" section. List related PRs, ADRs, or decision-log entries this PR does not close.

Edit the body and this comment updates itself on the next run.

…669) No related issue: Phase 4 of the GitHub Actions conventions program (tracking: melodic-software/standards#672) ## Summary Renames this repository's workflows and actions to the org naming convention (`<stage>-<function>[-<modifier>]`, `name:` = file stem), as recorded in standards `components/github-actions-conventions/rename-map.json`. It also folds the three `-self` dogfood callers into thin jobs in `pr-require-checks.yml` (formerly `ci.yml`). This is the content of the v0.34.0 restructure release; consumers keep working on their SHA pins until they repin. ## Fix - `d1b5dc0`: `git mv` of 45 files to their mapped paths, `job_renames` applied (including `needs:` and `needs.<id>.result`), and reusables reference their own actions with `$/.github/actions/<x>` instead of a pinned full path. - `a724617`: deletes `claude-review-self.yml`, `claude-security-review-self.yml` and `issue-triage-label-self.yml`; adds jobs `pr-review`, `pr-review-security` and `intake-label-needs-triage`, each pinned to the v0.33.0 SHA of its old path with the same permissions and the one secret the `-self` file passed. It adds the `ready_for_review` and `issues: [opened, reopened]` triggers and the event guards, keeps the three folded jobs out of `ci-status`, and deletes `composites-head`, because `$/` from a `./` call already runs HEAD's composites. - `6c7ba42`: the two standards-synced composites (`comment-hygiene` and `machine-specific-paths`) are reached through `$/`. Their directories keep their old names until the standards sync destinations move. - `b2f99f9`: the folded review jobs run only on opened, synchronize, reopened and ready_for_review, which is what the `-self` files ran on. - `ci-status` keeps its job id and stays the only required check. ## Verification - Fresh-context verifier: 8 of 9 criteria pass. The ninth fails on one pre-existing naming-lint warning (job id `plan` in `maintenance-sync-standards.yml`). It is non-blocking, and the job id is unchanged from main. - `actionlint`: only the `$/ ... ref is missing` errors, which standards#675 waives through the synced config. - `node --test .github/scripts/*.test.cjs`: 192/192 pass. - naming-lint enforcing: only the two sync-managed directories remain, and they move with the standards sync-destination change. - The github-iac governance-verify draft (github-iac#598) passes against this branch. ## Related - Prerequisites, all merged: standards#675 (actionlint `$/`), #676 (lockstep drift), #677 (repin path mapping), #678 (runner-policy `$/`), and the Dependabot ignores in six repos. - Lands in lockstep with github-iac#598, followed by a self-repin PR and the v0.34.0 release. - Open PRs #663, #664 and #665 touch renamed paths and need a rebase after this merges. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

kyle-sexton · 2026-10-07T05:14:22Z

Closing: stale agent PR built on pre-rename paths (v0.34.0 renamed the workflows); superseded by the conventions migration.

build(deps): bump markdownlint-cli2 default to 0.23.3

ef6062d

Refs #628 Match the markdownlint-cli2 pin now at 0.23.3 in melodic-software/standards. The action pin-rule absorbs bumps to that pin and never past it. Co-authored-by: Kyle Sexton <kyle-sexton@users.noreply.github.com>

github-actions Bot added the needs-issue-linkage label Oct 4, 2026

kyle-sexton mentioned this pull request Oct 4, 2026

refactor: rename workflows and actions to the org naming convention #669

Merged

kyle-sexton closed this Oct 7, 2026

kyle-sexton deleted the cursor/markdownlint-cli2-0-23-3-dd48 branch October 7, 2026 05:14

Navigation Menu

Repository navigation

build(deps): bump markdownlint-cli2 default to 0.23.3 - #663

build(deps): bump markdownlint-cli2 default to 0.23.3#663
kyle-sexton wants to merge 1 commit into
mainfrom
cursor/markdownlint-cli2-0-23-3-dd48

kyle-sexton commented Oct 4, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 4, 2026 •

edited

Loading

Uh oh!

claude Bot commented Oct 4, 2026 •

edited

Loading

Uh oh!

claude Bot commented Oct 4, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 4, 2026

Uh oh!

github-actions Bot commented Oct 4, 2026

Uh oh!

github-actions Bot commented Oct 4, 2026

Uh oh!

kyle-sexton commented Oct 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

kyle-sexton commented Oct 4, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

claude Bot commented Oct 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Security Review — No Issues Found ✅

Uh oh!

claude Bot commented Oct 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code review

Uh oh!

github-actions Bot commented Oct 4, 2026

Uh oh!

github-actions Bot commented Oct 4, 2026

Uh oh!

github-actions Bot commented Oct 4, 2026

Uh oh!

kyle-sexton commented Oct 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

chatgpt-codex-connector Bot commented Oct 4, 2026 •

edited

Loading

claude Bot commented Oct 4, 2026 •

edited

Loading

claude Bot commented Oct 4, 2026 •

edited

Loading