Adopt the Hub-Hosted Validate and Release Chain Tasks

[ptr727]

Adopts the hub's reusable validate gate and release chain from
ptr727/ProjectTemplate, pinned to release 2.0.352 at
0b07a59d7c65d07d8df275a96deaf2e06cbefd51, per
docs/reusable-workflows.md "Adopting the Gates" and "Adopting the
Release Chain". This is the stage 2 and stage 4 pilot for PhotoCleaner,
following the stage 1 merge-bot pilot in #53/#54.

Deleted (hub-owned now)

• .github/workflows/validate-task.yml
• .github/workflows/build-release-task.yml
• .github/workflows/build-executable-task.yml
• .github/workflows/build-docker-task.yml
• .github/workflows/get-version-task.yml

Input mapping (no repo-specific hook)

PhotoCleaner's build matches the hub defaults exactly through inputs
alone, so it carries no .github/actions/build-executable or
.github/actions/docker-prepare hook:

• executable_project: ./PhotoCleaner/PhotoCleaner.csproj (hub default
  is ./Console/Console.csproj).
• docker_image: ptr727/photocleaner, vanilla single-target, no
  docker_matrix. The hub default's tag scheme (latest/develop plus
  the SemVer2 tag) and cache repo match today's copy exactly.
• enable_nuget: false, enable_pypi: false (this repo carries
  neither leaf, and the hub's default inputs are both true).
• The Docker build-args the hub task composes automatically
  (LABEL_VERSION, BUILD_CONFIGURATION, BUILD_VERSION,
  BUILD_FILE_VERSION, BUILD_ASSEMBLY_VERSION,
  BUILD_INFORMATION_VERSION, BUILD_PACKAGE_VERSION) match today's
  copy byte for byte, so no docker-prepare hook is needed for them
  either.
• CODECOV_TOKEN is mapped to validate-task.yml in both workflows,
  and DOCKER_HUB_USERNAME/DOCKER_HUB_ACCESS_TOKEN are mapped to
  build-release-task.yml, all under the names spec/secrets.json
  already declares.

Known regression during migration

The hub's build-release-task.yml/build-docker-task.yml core carries
no Docker Hub description push (that becomes
publish-docker-readme-task.yml in stage 5, per
docs/reusable-workflows.md "The Docker Family"). Adopting the release
chain now, ahead of stage 5, means the Docker Hub overview stops
refreshing on a main publish until PhotoCleaner adopts that task.
This is the documented cost of the staged rollout, not an oversight.

Trigger changes

• test-pull-request.yml moves from a push-to-every-branch trigger
  to the hub's release-with-smoke shape: pull_request to
  [main, develop] plus workflow_dispatch, with a changes
  paths-filter (!.github/workflows/**) gating the smoke build. This
  also newly runs CI on a fork's pull request, which the old push
  trigger structurally could not.
• publish-release.yml keeps its exact trigger (workflow_dispatch
  plus the weekly main-only schedule) and gains a plan job
  (publish-plan-task.yml) whose publish decision is equivalent to
  today's inline github.ref_name == 'main' || 'develop' guard.

Prose

OPERATIONS.md's .github/workflows/ bullet is updated to describe
the hub-hosted validate-task.yml/build-release-task.yml in place of
the deleted local copies. README.md, HISTORY.md, and
.github/copilot-instructions.md carry no mention of the deleted
files (checked, no edits needed). WORKFLOW.md, GOVERNANCE.md,
CODESTYLE.md, and AGENTS.md are carried hub content and are not
edited here, though WORKFLOW.md's D1.1/D1.4 notes ("this repo runs
no paths filter") are now stale given the new changes job; that
staleness is flagged here rather than fixed, since those four files
are out of scope for this PR.

Review fix

Round 1 flagged that the changes job's checkout had no fetch-depth,
which could starve dorny/paths-filter's local diff of a common
ancestor on a workflow_dispatch run (no PR to read the changed-files
list from). Fixed in 75b8ce4 with fetch-depth: 0. A separate,
recurring finding that a negation-only filter (!.github/workflows/**)
never matches was declined with evidence: this step uses the action's
default predicate-quantifier: some, under which a negation-only
filter does match, and the PR's own first-push run proves it (see CI
evidence below).

CI evidence

Run https://github.com/ptr727/PhotoCleaner/actions/runs/31974932749
(head d611355, before the fetch-depth fix) and its 75b8ce4 rerun
both went green end to end through the hub tasks:

• Detect changed targets job (new changes filter job): release
  correctly matched OPERATIONS.md and excluded the four deleted plus
  two modified .github/workflows/** files.
• Validate sources job (hub validate-task.yml): Lint sources job,
  Unit test job, and Validate repository job all passed. The
  validate job's hub default hook ran (PhotoCleaner carries no
  .github/actions/validate), proving the hook-fallback default path
  live for the first time downstream.
• Smoke build job (hub build-release-task.yml, smoke: true): the
  inlined Get version information job and Validate release version job ran, then Build executable job and Resolve Docker build matrix job / Build Docker image job for
  docker.io/ptr727/photocleaner:develop, both through the hub's
  build-executable-default and docker-prepare-default composite
  actions (no repo hooks). Build NuGet library job, Build PyPI library job, and Build Docker base image job correctly skipped
  (enable_nuget/enable_pypi false, docker_build_base unset).
  Publish GitHub release job correctly skipped (smoke).
• Check pull request workflow status job (the ruleset-bound
  aggregator, verbatim): passed.

A real publish through build-release-task.yml/publish-plan-task.yml
is the maintainer's dispatch or the next weekly schedule after this
merges and promotes, not provable here.

Audit

python3 spec/audit.py PhotoCleaner --branch feature/hub-tasks from
the hub checkout, at head 75b8ce4:

• The interface findings on test-pull-request.yml and
  publish-release.yml clear: neither file is reported.
• One manifest gap remains: DRIFT interface: .github/workflows/build-release-task.yml absent on feature/hub-tasks, cannot verify its contract. The hub's manifest for PhotoCleaner still
  expects a build-release-task.yml caller-graded file to exist; this
  design instead folds its caller jobs (smoke-build, publish)
  directly into test-pull-request.yml and publish-release.yml,
  matching docs/reusable-workflows.md "Adopting the Release Chain"
  ("a caller stub in its own publish-release.yml... nothing here
  lands as a catalog snippet"). Closing this gap is a hub-side
  spec/files.json change, out of scope for this PR since the hub is
  read-only here.
• Every other finding (AGENTS.md, GOVERNANCE.md, CODESTYLE.md,
  WORKFLOW.md, .github/copilot-instructions.md, .editorconfig,
  .gitattributes, cspell.json, version.json,
  repo-config/README.md, AUDIT.md, spec/secrets.json,
  codecov.yml) is pre-existing hub-canonical drift unrelated to this
  PR (the hub has moved on since PhotoCleaner's last resync); none of
  those files are touched here.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 43.37%. Comparing base (a3158ce) to head (75b8ce4).

Additional details and impacted files

@@           Coverage Diff            @@
##           develop      #55   +/-   ##
========================================
  Coverage    43.37%   43.37%           
========================================
  Files           28       28           
  Lines         3896     3896           
  Branches       306      306           
========================================
  Hits          1690     1690           
  Misses        2154     2154           
  Partials        52       52           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

Adopts the reusable validation gate and release chain workflows from ptr727/ProjectTemplate (pinned to 2.0.352 / 0b07a59…), replacing the repository’s locally-copied workflow task files. This keeps PhotoCleaner’s CI/release behavior aligned with the hub while reducing duplicated workflow logic.

Changes:

• Replace local reusable workflow tasks with hub-hosted validate-task.yml, build-release-task.yml, and publish-plan-task.yml callers.
• Update PR CI to the “release-with-smoke” shape (PR-triggered + changes filter + workflow status aggregator).
• Update operations documentation to reflect hub-hosted workflow ownership.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
OPERATIONS.md	Updates the repo layout description to reflect hub-hosted validate/release tasks.
.github/workflows/test-pull-request.yml	Switches PR CI to hub validate-task and hub build-release-task (smoke) with a changes filter and required-status aggregator.
.github/workflows/publish-release.yml	Switches publish flow to hub publish-plan-task, hub validate-task, and hub build-release-task.
.github/workflows/validate-task.yml	Deleted (now hub-owned).
.github/workflows/build-release-task.yml	Deleted (now hub-owned).
.github/workflows/build-executable-task.yml	Deleted (now hub-owned).
.github/workflows/build-docker-task.yml	Deleted (now hub-owned).
.github/workflows/get-version-task.yml	Deleted (now hub-owned).

Suppressed comments (1)

.github/workflows/test-pull-request.yml:37

• The paths-filter definition uses only a negated pattern (!.github/workflows/**). In dorny/paths-filter, a filter with only negated patterns never matches anything, so steps.filter.outputs.release will always be false and the smoke-build job will never run (even when non-workflow files change). Add an include pattern (e.g. **) and then exclude workflow paths.

          filters: |
            release:
              - '!.github/workflows/**'

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[ptr727]

Replying to the round-1 Copilot review on d611355.

"The changes job is triggered on workflow_dispatch as well as pull_request..." (.github/workflows/test-pull-request.yml:30, thread PRRT_kwDOQpdRl86Zp3NM, already auto-resolved as outdated by the fix push): Accepted. Fixed in 75b8ce4: the changes job's checkout step now sets fetch-depth: 0, so a workflow_dispatch run (no PR to query) has full history for dorny/paths-filter's local diff against the default branch.

Suppressed finding, .github/workflows/test-pull-request.yml:37, "a filter consisting of negated patterns only never matches anything": Disproven. The claim depends on predicate-quantifier: 'some-with-excludes'; this step uses the action's default, predicate-quantifier: some (visible in the run's own step log), under which a negation-only filter matches every file the pattern does not exclude. The live run on this PR's first push, https://github.com/ptr727/PhotoCleaner/actions/runs/31974932749/job/95232853358, shows exactly that: Filter release = true, Matching files: OPERATIONS.md [modified], correctly excluding the four deleted and two modified .github/workflows/** files from the match. smoke-build ran on that same run. No change made.

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.