Re-sync verbatim-carry artifacts from template by ptr727 · Pull Request #448 · ptr727/NxWitness

ptr727 · 2026-06-24T05:27:42Z

Converge this repo onto ptr727/ProjectTemplate: the carried artifacts (CODESTYLE.md, AGENTS.md, .github/copilot-instructions.md, .vscode, .gitattributes, and the orchestration-layer workflows) are taken by full-file replacement, and this repo's task list is folded in. Where this repo's multi-image Docker product genuinely cannot use the template shape, the deviation is documented below rather than left as silent drift.

What this does

Re-pins every orchestration-layer action to the template's exact SHAs (actions/checkout, dorny/paths-filter, softprops/action-gh-release, RubbaBoy/BYOB, peter-evans/dockerhub-description); dotnet/nbgv@master stays floating to match the template. Repo-owned build-layer leaves keep their own docker/* pins (see adaptations).
Converges the github-release job in publish-release.yml to the template's generic release semantics: tag on the built commit, auto source zip + README + LICENSE, pinned target_commitish, skip-existing guard, and the main-only Verify public release version backstop.
Carries publish-docker-readme-task.yml and build-datebadge-task.yml verbatim from the template.
Carries CODESTYLE.md whole - General section plus the per-language .NET and Python sections, with the droppable per-language model intact.
Sets line endings via .gitattributes: Dockerfiles, *.sh, the Docker/s6-overlay/** tree, and .husky/pre-commit are pinned LF; carried workflow YAML stays CRLF to match the template's checked-in form.

Validation: actionlint clean, markdownlint 0 errors.

Documented adaptations (for review)

These are the only intentional deviations from the template; everything else is verbatim carry (modulo the line-ending pins above). Sourced from AGENTS.md -> Template adaptations.

Base + per-branch Docker build structure. publish-release.yml keeps a build-base job plus separate build-main / build-develop legs (calling repo-owned build-base-images-task.yml and build-docker-task.yml) instead of the template's single per-branch matrix, because the shared nx-base / nx-base-lsio images are built once from main and reused by both legs (build_base: false) - a fan-out the template matrix can't express.
Docker-only GitHub release (no release-asset-* files). This repo ships Docker Hub images as its release artifacts, not binary/package assets, so there is no release-asset-* download step and fail_on_unmatched_files is omitted (no files to guard); all other release semantics follow the template.
Docker Hub readme repositories derived from Matrix.json. publish-docker-readme-task.yml is carried verbatim; because the image set is repo-specific the caller passes manifest: ./Make/Matrix.json + a manifest-jq program (lowercased ptr727/<image> plus the shared base repos) so the task's own get-repos job resolves the list.
Husky.Net pre-commit hooks. This repo installs Husky.Net Git hooks (pre-commit formatting/codegen), inverting the template's no-hooks default; the hooks run the same checks CI enforces, surfaced earlier.
.vscode Benchmark -> Husky.Net Run task. The carried .vscode/tasks.json swaps the template's Benchmark task for a Husky.Net Run task, matching this repo's hook tooling.
Build-layer action pins stay repo-owned. Orchestration-layer workflows pin shared actions to the template's SHAs; the repo-owned build-layer leaves (build-docker-task.yml, build-base-images-task.yml, test-release-task.yml) own their docker/* and other action versions and track them via Dependabot.

Held for maintainer end-gate review (no auto-merge).

Full-replace the carried governance/orchestration artifacts from ptr727/ProjectTemplate, adapting only documented placeholders and removing prior downstream comment accretion. AGENTS.md - Pull Request Title and Commit Message Conventions: restore the template's verbatim example set (was localized to Nx product names). - Git and Commit Rules, PR Review Etiquette: already verbatim. CODESTYLE.md - General: restore verbatim (re-add the ruff/pyright/uv casing example and the pyproject.toml analyzer-scope example that had been trimmed). - .NET: documented adaptations only (CreateMatrix/CreateMatrixTests project list, Husky.Net clean-compile/tooling, InternalsVisibleTo, Husky.Net Run task label). Workflows - get-version-task.yml, run-periodic-codegen-pull-request.yml: full verbatim replace (pin actions to SHAs, drop the github.ref checkout fallback, fix the codegen concurrency group to be workflow-only, and stagger periodic codegen to 04:00 UTC after the weekly publish). - merge-bot-pull-request.yml: full replace - switch to pull_request_target, add the merge-upstream-version job, restore terse comments; keep the Dependabot-advanced fetch-metadata pin (v3.1.0). - run-codegen-pull-request-task.yml: re-sync the orchestration shell (terse comments, action pins) keeping the CreateMatrix codegen command, the dotnet husky install step, and no NINJA_API_KEY.

Copilot

Pull request overview

This PR re-syncs NxWitness’s verbatim-carry governance/style docs and GitHub Actions orchestration workflows from ptr727/ProjectTemplate via full replacements, keeping only documented NxWitness-specific adaptations and removing accumulated downstream edits.

Changes:

Restore carried sections in AGENTS.md and CODESTYLE.md to match the template (with documented .NET-specific adaptations kept).
Re-sync CodeGen and versioning workflows (cron/concurrency behavior, action SHA pins, and comments), preserving NxWitness-specific CodeGen command/tooling steps.
Re-sync merge-bot workflow to the template model (including pull_request_target and an added upstream-version auto-merge job).

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
CODESTYLE.md	Re-sync General section content and suppression-scope example text to template wording.
AGENTS.md	Restore template’s verbatim PR title/commit example set in the carried section.
.github/workflows/run-periodic-codegen-pull-request.yml	Adjust schedule time and concurrency grouping to avoid races on fixed codegen branches.
.github/workflows/run-codegen-pull-request-task.yml	Re-sync orchestration/pins and tighten comments while preserving NxWitness CodeGen steps.
.github/workflows/merge-bot-pull-request.yml	Switch to `pull_request_target`, add upstream-version auto-merge job, and re-sync template behavior/comments.
.github/workflows/get-version-task.yml	Pin checkout/setup-dotnet by SHA, accept optional ref input, and restore template notes around NBGV usage.

Copilot

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.

Re-pull the upstream fix (ptr727/ProjectTemplate#206): pull_request_target makes github.ref the base branch, so the group serialized all bot PRs against a base. Key on github.event.pull_request.number for per-PR scoping.

Copilot

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.

…mantics

Re-carry genericized CODESTYLE.md (drop Python section, .NET-only); re-carry enriched publish-docker-readme-task.yml (get-repos job + manifest/manifest-jq/transform-artifact inputs); rewire publish-release.yml docker-readme to pass manifest + manifest-jq instead of a bespoke get-repos job. Pin .husky/pre-commit to LF. Update AGENTS.md adaptations. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Re-carry the whole genericized CODESTYLE.md (the Python section was dropped under the old droppable-section model; carry-whole keeps it inert). Normalize build-datebadge-task.yml back to CRLF per the YAML policy (EOL-only).

Copilot

Pull request overview

Copilot reviewed 11 out of 23 changed files in this pull request and generated 5 comments.

Copilot

Pull request overview

Copilot reviewed 11 out of 23 changed files in this pull request and generated no new comments.

Copilot

Pull request overview

Copilot reviewed 11 out of 23 changed files in this pull request and generated 6 comments.

Re-carry the now-portable CODESTYLE.md and the contract-fixed publish-docker-readme-task.yml (manifest-gated checkout) from the template. Add missing --yes to NxBase autoremove so cleanup runs non-interactively. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

The Copilot-flagged fix only touched NxBase; the identical non-interactive 'apt-get autoremove --purge' (no --yes) was in 11 sibling Dockerfiles and would prompt/fail when there is anything to remove. Apply --yes consistently. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Nothing in this repo produces upstream-version-main/develop branches (no check-upstream-version-task.yml); upstream NX tracking goes through codegen, which merge-codegen handles. Remove the orphan merge-upstream-version job and document the omission, matching the subset-adaptation pattern (a repo prunes bot jobs for mechanisms it doesn't use). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Copilot

Pull request overview

Copilot reviewed 23 out of 23 changed files in this pull request and generated 8 comments.

Per the upstream decision (issue #208): the SHA-pin rule applies to build-layer leaves too. Dependabot bumps SHA pins (updates SHA + version comment), so this keeps one supply-chain rule with no loss of automation. Pin checkout v7.0.0, setup-dotnet v5.3.0, docker setup-qemu v4.1.0 / setup-buildx v4.1.0 / login v4.2.0 / build-push v7.2.0. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Copilot

Pull request overview

Copilot reviewed 26 out of 26 changed files in this pull request and generated no new comments.

Per the upstream decision (issue #208): use registry-tag layer caches (docker.io/ptr727/<repo>:buildcache-<branch>) instead of type=gha to avoid the 10 GB Actions cache on this multi-image repo. cache-from pulls the develop+main buildcache tags (and the base image's own tag); cache-to pushes the current branch's buildcache when publishing; all best-effort (ignore-error=true). Update the AGENTS build-layer note (SHA-pinned actions + registry cache). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Product is not unique per image repo (NxGo and NxGo-LSIO both Product=nxgo but publish to ptr727/nxgo vs ptr727/nxgo-lsio), so the prior buildcache-<branch> tag collided across matrix rows (last-writer-wins). Derive cache_repo from the image's own first tag in the tagsargs step and key the registry cache on it. (issue #209) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Leftover wording from before the type=gha -> type=registry migration; the branch input now selects the registry buildcache tag, not a GHA cache scope. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Copilot

Pull request overview

Copilot reviewed 26 out of 26 changed files in this pull request and generated 2 comments.

Copilot

Pull request overview

Copilot reviewed 26 out of 26 changed files in this pull request and generated no new comments.

- .gitattributes: header now distinguishes editorconfig editor guidance from git's own LF enforcement - CODESTYLE.md: .NET/Python intros made conditional ("any ... project(s)") - AGENTS.md: publishing step now covers an opted-in publish-on-merge trigger - build-datebadge-task.yml: BYOB pinned to v1.3.0 SHA 24f4642 (was floating # v1)

Copilot

Pull request overview

Copilot reviewed 26 out of 26 changed files in this pull request and generated 4 comments.

Surfaced by Copilot during the NxWitness re-sync ([#448](ptr727/NxWitness#448)) — a real regression from the `pull_request_target` switch (#201). Under `pull_request_target`, `github.ref` resolves to the **base branch**, so the merge-bot concurrency group `…-${{ github.ref }}` serialized *every* bot PR against a base into one queue — delaying auto-merge/disable when multiple Dependabot/codegen PRs are open. Keying on `github.event.pull_request.number` restores per-PR scoping (a PR's events still process in arrival order; different PRs run concurrently). 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Promote `develop` to `main` for the 2.14 release. ## Included - **Fix LSIO PUID/PGID permission race (#450)** — the `init-nx-permissions` chown sweep now depends on the base `init-adduser` oneshot, so it runs after the PUID/PGID remap instead of racing it (which could leave `/config` and `/media` owned by the wrong user and break media writes). Also extracts the installer download and LSIO `abc` rename into shell scripts, hardens the rename against upstream `init-adduser` changes, and makes codegen emit LF Dockerfiles. - **Bump version to 2.14 and document the fix (#451)** — `version.json` floor 2.13 -> 2.14, HISTORY.md and README release notes. - **Re-sync verbatim-carry artifacts from template (#448)** — already on develop. Validated on a live Synology server (the #449 reporter's scenario) via the `:develop` tag; the publish run on develop was green across the full matrix. Closes #449. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

Copilot AI review requested due to automatic review settings June 24, 2026 05:27

Copilot started reviewing on behalf of ptr727 June 24, 2026 05:28 View session

Copilot AI reviewed Jun 24, 2026

View reviewed changes

Comment thread .github/workflows/merge-bot-pull-request.yml

ptr727 requested a review from Copilot June 24, 2026 05:30

Copilot started reviewing on behalf of ptr727 June 24, 2026 05:30 View session

Copilot AI reviewed Jun 24, 2026

View reviewed changes

ptr727 mentioned this pull request Jun 24, 2026

Key merge-bot concurrency on PR number, not github.ref ptr727/ProjectTemplate#206

Merged

Key merge-bot concurrency on PR number, not github.ref

cd546a9

Re-pull the upstream fix (ptr727/ProjectTemplate#206): pull_request_target makes github.ref the base branch, so the group serialized all bot PRs against a base. Key on github.event.pull_request.number for per-PR scoping.

ptr727 requested a review from Copilot June 24, 2026 05:35

Copilot started reviewing on behalf of ptr727 June 24, 2026 05:35 View session

Copilot AI reviewed Jun 24, 2026

View reviewed changes

ptr727 and others added 3 commits June 24, 2026 08:49

Pin s6-overlay and Dockerfiles to LF in .gitattributes

352eb0e

Re-pin orchestration actions to template SHAs and converge release se…

02687b6

…mantics

Copilot AI review requested due to automatic review settings June 24, 2026 16:18

Copilot started reviewing on behalf of ptr727 June 24, 2026 16:19 View session

Carry full CODESTYLE verbatim; restore CRLF on build-datebadge

d1043c8

Re-carry the whole genericized CODESTYLE.md (the Python section was dropped under the old droppable-section model; carry-whole keeps it inert). Normalize build-datebadge-task.yml back to CRLF per the YAML policy (EOL-only).

Copilot AI reviewed Jun 24, 2026

View reviewed changes

Comment thread .github/workflows/publish-docker-readme-task.yml

Comment thread .github/workflows/get-version-task.yml

Comment thread CODESTYLE.md Outdated

Comment thread CODESTYLE.md Outdated

Comment thread CODESTYLE.md Outdated

ptr727 requested a review from Copilot June 24, 2026 17:33

Copilot started reviewing on behalf of ptr727 June 24, 2026 17:34 View session

Copilot AI reviewed Jun 24, 2026

View reviewed changes

Re-carry self-contained CODESTYLE and contract-fixed docker-readme task

f984a25

ptr727 requested a review from Copilot June 24, 2026 18:42

Copilot started reviewing on behalf of ptr727 June 24, 2026 18:43 View session

Copilot stopped reviewing on behalf of ptr727 due to an error June 24, 2026 19:03
Copilot had to stop work due to a timeout.

Copilot AI reviewed Jun 24, 2026

View reviewed changes

Comment thread .github/workflows/publish-docker-readme-task.yml

Comment thread .github/workflows/get-version-task.yml

Comment thread CODESTYLE.md Outdated

Comment thread CODESTYLE.md Outdated

Comment thread Docker/NxBase.Dockerfile Outdated

Comment thread Docker/NxWitness.Dockerfile

ptr727 and others added 2 commits June 24, 2026 17:34

Copilot AI review requested due to automatic review settings June 25, 2026 01:39

Copilot started reviewing on behalf of ptr727 June 25, 2026 01:39 View session

ptr727 and others added 2 commits June 24, 2026 18:41

Add missing final newline to the two NxBase Dockerfiles

cdda57b

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Copilot stopped reviewing on behalf of ptr727 due to an error June 25, 2026 02:00
Copilot had to stop work due to a timeout.

Copilot AI reviewed Jun 25, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings June 25, 2026 02:20

Copilot started reviewing on behalf of ptr727 June 25, 2026 02:20 View session

Copilot AI reviewed Jun 25, 2026

View reviewed changes

ptr727 and others added 2 commits June 24, 2026 19:23

Copilot AI review requested due to automatic review settings June 25, 2026 02:40

Copilot started reviewing on behalf of ptr727 June 25, 2026 02:41 View session

Update stale GHA cache-scope comments to registry buildcache

5228a12

Leftover wording from before the type=gha -> type=registry migration; the branch input now selects the registry buildcache tag, not a GHA cache scope. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Copilot stopped reviewing on behalf of ptr727 due to an error June 25, 2026 03:01
Copilot had to stop work due to a timeout.

Copilot AI reviewed Jun 25, 2026

View reviewed changes

Comment thread .github/workflows/publish-docker-readme-task.yml

Comment thread .github/workflows/get-version-task.yml

ptr727 requested a review from Copilot June 25, 2026 03:06

Copilot started reviewing on behalf of ptr727 June 25, 2026 03:06 View session

Copilot AI reviewed Jun 25, 2026

View reviewed changes

ptr727 requested a review from Copilot June 25, 2026 03:35

Copilot started reviewing on behalf of ptr727 June 25, 2026 03:35 View session

Copilot stopped reviewing on behalf of ptr727 due to an error June 25, 2026 03:56
Copilot had to stop work due to a timeout.

Copilot AI reviewed Jun 25, 2026

View reviewed changes

Comment thread .github/workflows/get-version-task.yml

Comment thread .github/workflows/publish-release.yml

Comment thread .github/workflows/publish-docker-readme-task.yml

Comment thread .github/workflows/build-docker-task.yml

ptr727 merged commit 50e638a into develop Jun 25, 2026
10 of 11 checks passed

ptr727 deleted the chore/sync-template branch June 25, 2026 16:47

ptr727 mentioned this pull request Jun 25, 2026

Release 2.14: fix LSIO PUID/PGID permission race #452

Merged

Conversation

ptr727 commented Jun 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this does

Documented adaptations (for review)

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

ptr727 commented Jun 24, 2026 •

edited

Loading