Declare workflow YAML as LF and validate line endings in CI

.editorconfig

@@ -37,6 +37,11 @@ indent_size = 2
 [*.{yml,yaml}]
 indent_size = 2
 
+# Workflow YAML is LF: Dependabot and Actions rewrite it with LF, so declaring LF keeps it consistent instead of
+# mixed. git still leaves endings alone (`* -text`); this and CI (editorconfig-checker) enforce it. Other YAML is CRLF.
+[.github/workflows/*.{yml,yaml}]
+end_of_line = lf
+
 # Linux scripts
 [*.sh]
 end_of_line = lf

.editorconfig-checker.json

@@ -0,0 +1,10 @@
+{
+  "Disable": {
+    "Charset": true,
+    "Indentation": true,
+    "IndentSize": true,
+    "TrimTrailingWhitespace": true,
+    "InsertFinalNewline": true,
+    "MaxLineLength": true
+  }
+}

.github/workflows/merge-bot-pull-request.yml

@@ -1,184 +1,184 @@
-name: Merge bot pull request action
-
-# Enable auto-merge once per PR on opened/reopened; disable it when a maintainer pushes to a bot branch. Merge
-# method by base branch (develop = squash, main = merge). App token so the merge fires downstream workflows
-# (GITHUB_TOKEN pushes don't) and so the disable job has write access on read-only Dependabot PRs.
-
-# `pull_request_target` (not `pull_request`): these jobs hold the App private key, so the workflow definition and
-# its action SHAs must resolve from the trusted base branch, not the PR head. Safe because no job checks out PR
-# code - each only runs `gh pr merge` against the PR by URL.
-on:
-  pull_request_target:
-    types: [opened, reopened, synchronize]
-
-# Per-PR group: under `pull_request_target` `github.ref` is the base branch, which would serialize every bot PR
-# against that base; key on the PR number so each PR's events queue independently. `cancel-in-progress: false` so a
-# follow-up synchronize doesn't cancel an in-flight `opened` run before it enables auto-merge.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
-  cancel-in-progress: false
-
-jobs:
-
-  merge-dependabot:
-    name: Merge dependabot pull request job
-    runs-on: ubuntu-latest
-    # Dependabot PRs from this repo (not forks). Only on opened/reopened so the disable job stays sticky.
-    if: >-
-      (github.event.action == 'opened' || github.event.action == 'reopened') &&
-      github.event.pull_request.user.login == 'dependabot[bot]' &&
-      github.event.pull_request.head.repo.full_name == github.repository
-    permissions:
-      contents: write
-      pull-requests: write
-
-    steps:
-
-      - name: Generate GitHub App token step
-        id: app-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-        with:
-          client-id: ${{ secrets.CODEGEN_APP_CLIENT_ID }}
-          private-key: ${{ secrets.CODEGEN_APP_PRIVATE_KEY }}
-
-      - name: Get dependabot metadata step
-        id: metadata
-        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
-        with:
-          github-token: "${{ secrets.GITHUB_TOKEN }}"
-
-      # Skip semver-major NuGet bumps so they land via human review; other ecosystems' majors auto-merge.
-      - name: Merge pull request step
-        if: >-
-          (steps.metadata.outputs.package-ecosystem != 'nuget') ||
-          (steps.metadata.outputs.update-type != 'version-update:semver-major')
-        run: |
-          set -euo pipefail
-          case "${{ github.event.pull_request.base.ref }}" in
-            develop) method=--squash ;;
-            main) method=--merge ;;
-            *)
-              echo "::error::Unsupported base branch: ${{ github.event.pull_request.base.ref }}"
-              exit 1
-              ;;
-          esac
-          gh pr merge --auto "$method" "$PR_URL"
-        env:
-          PR_URL: ${{ github.event.pull_request.html_url }}
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-
-  merge-codegen:
-    name: Merge codegen pull request job
-    runs-on: ubuntu-latest
-    # Codegen PRs from this repo. Head/base pairing is enforced strictly (codegen-main->main, codegen-develop->
-    # develop). Only on opened/reopened so the disable job stays sticky.
-    if: >-
-      (github.event.action == 'opened' || github.event.action == 'reopened') &&
-      github.event.pull_request.user.login == 'ptr727-codegen[bot]' &&
-      github.event.pull_request.head.repo.full_name == github.repository &&
-      (
-        (github.event.pull_request.head.ref == 'codegen-main' && github.event.pull_request.base.ref == 'main') ||
-        (github.event.pull_request.head.ref == 'codegen-develop' && github.event.pull_request.base.ref == 'develop')
-      )
-    permissions:
-      contents: write
-      pull-requests: write
-
-    steps:
-
-      - name: Generate GitHub App token step
-        id: app-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-        with:
-          client-id: ${{ secrets.CODEGEN_APP_CLIENT_ID }}
-          private-key: ${{ secrets.CODEGEN_APP_PRIVATE_KEY }}
-
-      - name: Merge pull request step
-        run: |
-          set -euo pipefail
-          case "${{ github.event.pull_request.base.ref }}" in
-            develop) method=--squash ;;
-            main) method=--merge ;;
-            *)
-              echo "::error::Unsupported base branch: ${{ github.event.pull_request.base.ref }}"
-              exit 1
-              ;;
-          esac
-          gh pr merge --auto "$method" "$PR_URL"
-        env:
-          PR_URL: ${{ github.event.pull_request.html_url }}
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-
-  merge-upstream-version:
-    name: Merge upstream version pull request job
-    runs-on: ubuntu-latest
-    # Upstream-version bump PRs from the App. Head/base pairing is enforced (upstream-version-main->main,
-    # upstream-version-develop->develop). Only on opened/reopened so the disable job stays sticky.
-    if: >-
-      (github.event.action == 'opened' || github.event.action == 'reopened') &&
-      github.event.pull_request.user.login == 'ptr727-codegen[bot]' &&
-      github.event.pull_request.head.repo.full_name == github.repository &&
-      (
-        (github.event.pull_request.head.ref == 'upstream-version-main' && github.event.pull_request.base.ref == 'main') ||
-        (github.event.pull_request.head.ref == 'upstream-version-develop' && github.event.pull_request.base.ref == 'develop')
-      )
-    permissions:
-      contents: write
-      pull-requests: write
-
-    steps:
-
-      - name: Generate GitHub App token step
-        id: app-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-        with:
-          client-id: ${{ secrets.CODEGEN_APP_CLIENT_ID }}
-          private-key: ${{ secrets.CODEGEN_APP_PRIVATE_KEY }}
-
-      - name: Merge pull request step
-        run: |
-          set -euo pipefail
-          case "${{ github.event.pull_request.base.ref }}" in
-            develop) method=--squash ;;
-            main) method=--merge ;;
-            *)
-              echo "::error::Unsupported base branch: ${{ github.event.pull_request.base.ref }}"
-              exit 1
-              ;;
-          esac
-          gh pr merge --auto "$method" "$PR_URL"
-        env:
-          PR_URL: ${{ github.event.pull_request.html_url }}
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-
-  disable-auto-merge-on-maintainer-push:
-    name: Disable auto-merge on maintainer push job
-    runs-on: ubuntu-latest
-    # Fires when a maintainer pushes to a bot's branch (synchronize, actor != bot). Disables auto-merge so the
-    # maintainer's commits don't merge with the bot's; they re-enable it manually. The disable call is idempotent.
-    if: >-
-      github.event.action == 'synchronize' &&
-      github.event.pull_request.head.repo.full_name == github.repository &&
-      (
-        github.event.pull_request.user.login == 'dependabot[bot]' ||
-        github.event.pull_request.user.login == 'ptr727-codegen[bot]'
-      ) &&
-      github.actor != github.event.pull_request.user.login
-    permissions:
-      pull-requests: write
-
-    steps:
-
-      - name: Generate GitHub App token step
-        # App token because a Dependabot PR's GITHUB_TOKEN is read-only regardless of who triggered the event.
-        id: app-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-        with:
-          client-id: ${{ secrets.CODEGEN_APP_CLIENT_ID }}
-          private-key: ${{ secrets.CODEGEN_APP_PRIVATE_KEY }}
-
-      - name: Disable auto-merge step
-        run: gh pr merge --disable-auto "$PR_URL"
-        env:
-          PR_URL: ${{ github.event.pull_request.html_url }}
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+name: Merge bot pull request action
+
+# Enable auto-merge once per PR on opened/reopened; disable it when a maintainer pushes to a bot branch. Merge
+# method by base branch (develop = squash, main = merge). App token so the merge fires downstream workflows
+# (GITHUB_TOKEN pushes don't) and so the disable job has write access on read-only Dependabot PRs.
+
+# `pull_request_target` (not `pull_request`): these jobs hold the App private key, so the workflow definition and
+# its action SHAs must resolve from the trusted base branch, not the PR head. Safe because no job checks out PR
+# code - each only runs `gh pr merge` against the PR by URL.
+on:
+  pull_request_target:
+    types: [opened, reopened, synchronize]
+
+# Per-PR group: under `pull_request_target` `github.ref` is the base branch, which would serialize every bot PR
+# against that base; key on the PR number so each PR's events queue independently. `cancel-in-progress: false` so a
+# follow-up synchronize doesn't cancel an in-flight `opened` run before it enables auto-merge.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: false
+
+jobs:
+
+  merge-dependabot:
+    name: Merge dependabot pull request job
+    runs-on: ubuntu-latest
+    # Dependabot PRs from this repo (not forks). Only on opened/reopened so the disable job stays sticky.
+    if: >-
+      (github.event.action == 'opened' || github.event.action == 'reopened') &&
+      github.event.pull_request.user.login == 'dependabot[bot]' &&
+      github.event.pull_request.head.repo.full_name == github.repository
+    permissions:
+      contents: write
+      pull-requests: write
+
+    steps:
+
+      - name: Generate GitHub App token step
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ secrets.CODEGEN_APP_CLIENT_ID }}
+          private-key: ${{ secrets.CODEGEN_APP_PRIVATE_KEY }}
+
+      - name: Get dependabot metadata step
+        id: metadata
+        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
+        with:
+          github-token: "${{ secrets.GITHUB_TOKEN }}"
+
+      # Skip semver-major NuGet bumps so they land via human review; other ecosystems' majors auto-merge.
+      - name: Merge pull request step
+        if: >-
+          (steps.metadata.outputs.package-ecosystem != 'nuget') ||
+          (steps.metadata.outputs.update-type != 'version-update:semver-major')
+        run: |
+          set -euo pipefail
+          case "${{ github.event.pull_request.base.ref }}" in
+            develop) method=--squash ;;
+            main) method=--merge ;;
+            *)
+              echo "::error::Unsupported base branch: ${{ github.event.pull_request.base.ref }}"
+              exit 1
+              ;;
+          esac
+          gh pr merge --auto "$method" "$PR_URL"
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+
+  merge-codegen:
+    name: Merge codegen pull request job
+    runs-on: ubuntu-latest
+    # Codegen PRs from this repo. Head/base pairing is enforced strictly (codegen-main->main, codegen-develop->
+    # develop). Only on opened/reopened so the disable job stays sticky.
+    if: >-
+      (github.event.action == 'opened' || github.event.action == 'reopened') &&
+      github.event.pull_request.user.login == 'ptr727-codegen[bot]' &&
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      (
+        (github.event.pull_request.head.ref == 'codegen-main' && github.event.pull_request.base.ref == 'main') ||
+        (github.event.pull_request.head.ref == 'codegen-develop' && github.event.pull_request.base.ref == 'develop')
+      )
+    permissions:
+      contents: write
+      pull-requests: write
+
+    steps:
+
+      - name: Generate GitHub App token step
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ secrets.CODEGEN_APP_CLIENT_ID }}
+          private-key: ${{ secrets.CODEGEN_APP_PRIVATE_KEY }}
+
+      - name: Merge pull request step
+        run: |
+          set -euo pipefail
+          case "${{ github.event.pull_request.base.ref }}" in
+            develop) method=--squash ;;
+            main) method=--merge ;;
+            *)
+              echo "::error::Unsupported base branch: ${{ github.event.pull_request.base.ref }}"
+              exit 1
+              ;;
+          esac
+          gh pr merge --auto "$method" "$PR_URL"
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+
+  merge-upstream-version:
+    name: Merge upstream version pull request job
+    runs-on: ubuntu-latest
+    # Upstream-version bump PRs from the App. Head/base pairing is enforced (upstream-version-main->main,
+    # upstream-version-develop->develop). Only on opened/reopened so the disable job stays sticky.
+    if: >-
+      (github.event.action == 'opened' || github.event.action == 'reopened') &&
+      github.event.pull_request.user.login == 'ptr727-codegen[bot]' &&
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      (
+        (github.event.pull_request.head.ref == 'upstream-version-main' && github.event.pull_request.base.ref == 'main') ||
+        (github.event.pull_request.head.ref == 'upstream-version-develop' && github.event.pull_request.base.ref == 'develop')
+      )
+    permissions:
+      contents: write
+      pull-requests: write
+
+    steps:
+
+      - name: Generate GitHub App token step
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ secrets.CODEGEN_APP_CLIENT_ID }}
+          private-key: ${{ secrets.CODEGEN_APP_PRIVATE_KEY }}
+
+      - name: Merge pull request step
+        run: |
+          set -euo pipefail
+          case "${{ github.event.pull_request.base.ref }}" in
+            develop) method=--squash ;;
+            main) method=--merge ;;
+            *)
+              echo "::error::Unsupported base branch: ${{ github.event.pull_request.base.ref }}"
+              exit 1
+              ;;
+          esac
+          gh pr merge --auto "$method" "$PR_URL"
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+
+  disable-auto-merge-on-maintainer-push:
+    name: Disable auto-merge on maintainer push job
+    runs-on: ubuntu-latest
+    # Fires when a maintainer pushes to a bot's branch (synchronize, actor != bot). Disables auto-merge so the
+    # maintainer's commits don't merge with the bot's; they re-enable it manually. The disable call is idempotent.
+    if: >-
+      github.event.action == 'synchronize' &&
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      (
+        github.event.pull_request.user.login == 'dependabot[bot]' ||
+        github.event.pull_request.user.login == 'ptr727-codegen[bot]'
+      ) &&
+      github.actor != github.event.pull_request.user.login
+    permissions:
+      pull-requests: write
+
+    steps:
+
+      - name: Generate GitHub App token step
+        # App token because a Dependabot PR's GITHUB_TOKEN is read-only regardless of who triggered the event.
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ secrets.CODEGEN_APP_CLIENT_ID }}
+          private-key: ${{ secrets.CODEGEN_APP_PRIVATE_KEY }}
+
+      - name: Disable auto-merge step
+        run: gh pr merge --disable-auto "$PR_URL"
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}