Pin release action SHA, target_commitish, agent conventions - #61
Merged
Conversation
Three independent hardenings ported from the homeassistant-purpleair sibling repo: 1. Pin softprops/action-gh-release to commit SHA (v2.6.2) so a tag swap upstream cannot change the executed code. Add target_commitish: github.sha so release tags created on develop attach to the develop commit that built the artifact instead of being silently retargeted to main by GitHub's REST API default. 2. Document the merge-bot token strategy: GITHUB_TOKEN-authored pushes are blocked by GitHub's recursion guard from triggering further workflows. The codegen-app path uses the App identity to side-step this; dependabot and PAT-codegen targets (which feed main where releases are dispatched manually) are unaffected. Comment-only. 3. Extend AGENTS.md and copilot-instructions.md with: PR title and commit message conventions, documentation style rules, workflow YAML conventions (action SHA pinning, naming, concurrency, set -euo pipefail, if scalar form, boolean input mirroring, target_commitish), and the develop=squash / main=merge branching model.
Contributor
There was a problem hiding this comment.
Pull request overview
Hardens the release workflow so created tags/releases reliably point at the exact commit that built the artifacts (especially for develop prereleases), and documents PR/workflow conventions for future contributions.
Changes:
- Pin
softprops/action-gh-releaseto a commit SHA and settarget_commitish: ${{ github.sha }}in the reusable release workflow. - Add documentation to the merge-bot workflow explaining the
GITHUB_TOKENrecursion-guard tradeoff (no behavior change). - Add/expand PR title, markdown, workflow YAML, and branching-model conventions in
AGENTS.mdand.github/copilot-instructions.md.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 5 comments.
| File | Description |
|---|---|
| AGENTS.md | Adds PR title/commit message, markdown, workflow YAML, and branching model conventions. |
| .github/workflows/merge-bot-pull-request.yml | Adds an explanatory comment describing token behavior and recursion-guard implications. |
| .github/workflows/build-release-task.yml | Pins the release action to a SHA and explicitly sets target_commitish to the triggering commit SHA. |
| .github/copilot-instructions.md | Adds PR title/commit message convention section for agents. |
- Use US English `summarizing` instead of `summarising` in the new PR-title rule (AGENTS.md, copilot-instructions.md). The rule text itself mandates US spelling, so the example was self-contradictory. - Fix the merge-bot token-strategy comment: all three merge jobs target `main` per their `if:` conditions, not `develop`. The original draft incorrectly described App-codegen as merging to `develop`. - Soften the workflow-conventions intro to clarify the rules are a target state migrated opportunistically, not a backlog of tickets to apply across every existing workflow at once. - Rename three steps in `github-release` from `... job` to `... step` so the step-naming convention is actually true on the file the same PR touches.
5 tasks
ptr727
added a commit
that referenced
this pull request
May 4, 2026
## Summary
Three independent hardenings ported from the `homeassistant-purpleair`
sibling repo, plus convention docs for future PRs:
- **Tag pinning on releases** — `softprops/action-gh-release` is pinned
to commit SHA `3bb12739` (v2.6.2) with a trailing version comment, and
`target_commitish: ${{ github.sha }}` is set explicitly. Without it,
GitHub's REST API silently retargets the new tag to the repository
default branch (`main`) — so prerelease tags created on `develop` pushes
were attaching to `main`'s tip instead of the develop commit that built
the artifact, leaving "Browse files" and `git checkout <tag>` pointing
at unrelated code.
- **Merge-bot token comment** — documents the `GITHUB_TOKEN` vs
App-token recursion-guard tradeoff. No behavior change. The codegen-app
job already side-steps the recursion guard via the App identity;
dependabot and PAT-codegen targets feed `main` where releases are
dispatched manually, so the missing trigger is fine there.
- **Conventions documented** — `AGENTS.md` and
`.github/copilot-instructions.md` now codify PR title rules (≤72 chars,
imperative, no `Co-Authored-By` unless asked, no release-bump magnitude
in title), markdown style (reference-style links, alphabetized),
workflow YAML conventions (action SHA pinning + version comment, naming,
concurrency, `set -euo pipefail`, `if: >-` over `if: |`, boolean input
mirroring), and the develop=squash / main=merge branching model.
## Test plan
- [ ] CI green on the PR (test-pull-request workflow)
- [ ] After merge to develop, observe the next prerelease tag on the
Releases page — the tag's "Browse files" link should resolve to the same
commit SHA that ran `publish-release.yml`, not `main`'s tip
- [ ] Markdown renders correctly on the PR page (no MD025/MD031/MD032
warnings in editor preview)
- [ ] Subsequent PRs in this refactor series follow the new
title/body/workflow conventions
ptr727
added a commit
that referenced
this pull request
May 11, 2026
…me (#66) Release merge: brings five squashed PRs from develop into main. ## Squashed PRs included - **#61 — Pin release action SHA, target_commitish, agent conventions.** `softprops/action-gh-release` pinned to a commit SHA with `target_commitish: ${{ github.sha }}` so the release tag lands on the artifact's commit, not the default branch. Updated `AGENTS.md` workflow YAML conventions. - **#62 — Rename Library project to NuGetLibrary.** Project + folder renamed; `.slnx`, `.csproj`, build workflow, and references updated. Disambiguates from the new Python sibling. - **#63 — Add devcontainer + per-OS host and SSH signing docs.** New `docs/host-setup.md`, `docs/ssh-signing.md`, `docs/devcontainer.md`. Devcontainer bind-mounts SSH public key, allowed_signers, and `gh` config so commits sign correctly inside the container. - **#64 — Add PyPiLibrary Python sibling project.** New `PyPiLibrary/` template under `src/`-layout: pyproject.toml + uv.lock + ruff/pyright/pytest config + sample module + tests + `build-pypilibrary-task.yml` workflow + `publish-pypi` job in `publish-release.yml`. - **#65 — Split Devcontainer and Workspace per Language and Drop Husky.** `.devcontainer/dotnet/` + `DotNet.code-workspace` and `.devcontainer/python/` + `Python.code-workspace`. Husky.Net removed (CI is the lint backstop). Optional opt-in hooks documented in README. All Husky references removed from workflows, AGENTS, CODESTYLE, and tasks. ## Notes - Merge method: **merge-commit** (per [AGENTS.md branching model](https://github.com/ptr727/ProjectTemplate/blob/develop/AGENTS.md#branching-model)). Squash and rebase are blocked by the main ruleset. - Main currently has 6 codegen-update commits that develop doesn't have (#58, #59, #60 etc.). The merge-commit re-anchors develop on top of those; the next develop cycle will start by merging main back into develop to absorb them. ## Test plan - [ ] CI passes on the merge commit (test-release-task workflow, all build matrix legs). - [ ] Confirm release tag lands on the merge commit (target_commitish from #61). - [ ] Spot-check the new `.devcontainer/dotnet/` and `.devcontainer/python/` open and build cleanly. - [ ] Spot-check `cd PyPiLibrary && uv sync && uv run pytest` passes. - [ ] Confirm `.git/hooks/pre-commit` is absent in a fresh clone (Husky removed).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Three independent hardenings ported from the
homeassistant-purpleairsibling repo, plus convention docs for future PRs:softprops/action-gh-releaseis pinned to commit SHA3bb12739(v2.6.2) with a trailing version comment, andtarget_commitish: ${{ github.sha }}is set explicitly. Without it, GitHub's REST API silently retargets the new tag to the repository default branch (main) — so prerelease tags created ondeveloppushes were attaching tomain's tip instead of the develop commit that built the artifact, leaving "Browse files" andgit checkout <tag>pointing at unrelated code.GITHUB_TOKENvs App-token recursion-guard tradeoff. No behavior change. The codegen-app job already side-steps the recursion guard via the App identity; dependabot and PAT-codegen targets feedmainwhere releases are dispatched manually, so the missing trigger is fine there.AGENTS.mdand.github/copilot-instructions.mdnow codify PR title rules (≤72 chars, imperative, noCo-Authored-Byunless asked, no release-bump magnitude in title), markdown style (reference-style links, alphabetized), workflow YAML conventions (action SHA pinning + version comment, naming, concurrency,set -euo pipefail,if: >-overif: |, boolean input mirroring), and the develop=squash / main=merge branching model.Test plan
publish-release.yml, notmain's tip