Record 2.0.352 in the Reusable-Workflow Rollout and Add Its Catalog Snippets

[ptr727]

Release 2.0.352 (main 0b07a59d7c65d07d8df275a96deaf2e06cbefd51) is the
first tag carrying every hub-hosted reusable workflow task, produced by
the publish-release run
after promotion #774. In that run build-release-task.yml ran with every
target disabled and its github-release job succeeded while all five build
jobs skipped, proving the github-release skip fix (#762) and the
caller-granted scopes (#772). The earlier release attempt on 82fecef
(run)
ended in startup_failure because build-nuget/github-release declared
job-level permissions; #772 fixed it.

docs/reusable-workflows.md "Rollout"

• Ticks the two stage-0 merge-bot proof items: Dependabot PR Bump astral-sh/setup-uv from 8.1.0 to 10.0.0 in the actions-deps group #771 merged to
  develop with --squash through merge-bot-task.yml
  (run),
  and Dependabot PR Bump astral-sh/setup-uv from 8.1.0 to 10.0.0 in the actions-deps group #770 merged to main with --merge
  (run).
• Ticks "Promoted and released" in stages 2, 3, 4, and 5 with 2.0.352 on
  0b07a59d and Promote develop to main With the Release Task Scope Fix #774, and stage 4 also notes the first attempt's
  startup_failure and its Move the Release Task's Job Scopes to the Caller #772 fix.
• Leaves every adoption and pilot checkbox untouched.
• Does not tick either stage's "Catalog snippets ... pinned to that
  release" item, since neither stage's full set of snippets is complete this
  time: stage 2's release-with-smoke shape still calls its own repo's
  build-release-task.yml by ./ path rather than the hub's, and stage 5's
  deploy-site.yml, publish-docker-readme-task.yml, and
  check-upstream-version-task.yml each stay open for reasons the doc
  itself already states (no manifest-wide snippet by design, or a job
  embedded in a larger stub rather than a standalone caller). Both items
  gain an inline note identifying which of their snippets this PR adds.

New catalog snippets

Three of the five/six candidate files, each pinned
0b07a59d7c65d07d8df275a96deaf2e06cbefd51 # 2.0.352 and byte-identical to
its doc stub block apart from the pin (and, where the doc's own comment
wrapping does not survive an actual YAML file's comment-wrap rule, a
reworded comment kept in sync on both sides):

• catalog/snippets/workflows/test-pull-request.yml (the no-build gate
  shape from "Adopting the Gates")
• catalog/snippets/workflows/publish-release.yml (the release-repo shape
  from "Adopting the Release Chain")
• catalog/snippets/workflows/run-periodic-codegen-pull-request.yml (the
  codegen stub, which the doc already says keeps today's per-repo shape)

Skipped, with the doc updated to say why:

• test-pull-request-smoke.yml - the doc's smoke stub still calls the
  caller's own ./.github/workflows/build-release-task.yml by local path,
  never the hub's build-release-task.yml directly, so it does not meet
  the "calls the hub task" condition.
• deploy-site.yml - the doc's own "Deploy-site" paragraph states it
  "has no manifest-wide catalog snippet either," the same reason
  get-version-task.yml/publish-plan-task.yml have none: each site's own
  shape varies too much around the shared deploy job.
• check-upstream-version.yml - the doc gives only the check-upstream-version:
  job body, not a complete top-level trigger/concurrency shape, and unlike
  the codegen stub there is no doc statement that a uniform shape exists to
  copy.

catalog/snippets/workflows/README.md gained rows for the three new
snippets and an updated intro paragraph explaining the partial rollout.

TODO.md

Added one Settled line under "Host the type-specific tasks" naming
2.0.352 as the release that makes stages 2-5 adoptable and the run that
proved the release chain, and noting #769 as the one open follow-up from
the promotion review.

reports/workflow-reuse.md

Regenerated with python3 spec/workflow_reuse.py --report against the live
fleet at hub 63d244b (this branch's base). The numbers move against the
last committed report only because the live fleet moved since then, not
because of anything in this PR.

Gates run locally

spec/validate.py, python3 -m unittest discover -s scripts/tests (686
tests), spec/audit.py --selftest, spec/workflow_reuse.py --selftest,
scripts/repo_gate.py (sha-pin resolved against GitHub), scripts/build_dist.py --check,
scripts/prose_lint.py (all nine checks), ruff check/ruff format --check,
mypy, and the Docker actionlint, markdownlint-cli2, and
editorconfig-checker linters (only .ruff_cache noise there).

[Copilot]

Pull request overview

Records hub release 2.0.352 as the first tag carrying the full set of hub-hosted reusable workflow tasks, and advances the reusable-workflows rollout by adding the first set of catalog-ready caller snippets pinned to that release.

Changes:

• Update the rollout tracker and supporting docs to mark promotion/release proofs for stages 0–5 and note which catalog snippets are now available vs. intentionally still pending.
• Add three new workflow caller snippets to catalog/snippets/workflows/, each pinned to 0b07a59d… # 2.0.352, and update the snippets catalog README accordingly.
• Regenerate the fleet workflow reuse report and record the release milestone in TODO.md.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
TODO.md	Adds a settled milestone entry for release 2.0.352, including links to the proving run and the remaining follow-up issue.
reports/workflow-reuse.md	Regenerates the workflow-reuse report against the current live fleet state at the referenced hub commit.
docs/reusable-workflows.md	Updates the rollout checklist and adoption docs to record proof items and annotate which catalog snippets are now present vs. still pending.
catalog/snippets/workflows/test-pull-request.yml	Adds the “no-build gate” caller snippet pinned to the 2.0.352 release commit.
catalog/snippets/workflows/publish-release.yml	Adds the release-repo caller stub snippet pinned to the 2.0.352 release commit.
catalog/snippets/workflows/run-periodic-codegen-pull-request.yml	Adds the periodic codegen caller snippet pinned to the 2.0.352 release commit.
catalog/snippets/workflows/README.md	Adds rows for the new snippets and updates the intro text to reflect the partial-but-advancing rollout.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.

Suppressed comments (4)

catalog/snippets/workflows/publish-release.yml:33

• The validate job calls validate-task.yml, whose jobs request contents: read. Without an explicit caller permissions: grant, this relies on the repository default token permissions and can be broader than necessary (or could fail if a repo later tightens defaults). Grant only contents: read on this job explicitly.

  validate:
    name: Validate job
    needs: [plan]
    if: ${{ needs.plan.outputs.publish == 'true' }}
    uses: ptr727/ProjectTemplate/.github/workflows/validate-task.yml@0b07a59d7c65d07d8df275a96deaf2e06cbefd51 # 2.0.352

docs/reusable-workflows.md:460

• The example validate job doesn’t declare permissions: even though validate-task.yml requests contents: read. Add an explicit permissions: { contents: read } grant here so the example remains least-privilege and doesn’t depend on repository default token permissions.

  validate:
    name: Validate job
    needs: [plan]
    if: ${{ needs.plan.outputs.publish == 'true' }}
    uses: ptr727/ProjectTemplate/.github/workflows/validate-task.yml@0b07a59d7c65d07d8df275a96deaf2e06cbefd51 # 2.0.352

catalog/snippets/workflows/publish-release.yml:17

• This catalog snippet leaves workflow token permissions implicit, which can grant broader-than-needed scopes depending on the repository default. To make the snippet least-privilege by construction (matching the other caller stubs here), add permissions: {} at workflow scope and rely on per-job permissions: blocks.

This issue also appears on line 29 of the same file.

concurrency:
  group: ${{ github.workflow }}
  cancel-in-progress: false

jobs:

docs/reusable-workflows.md:444

• In the release-chain stub example, workflow token permissions are implicit. That can grant broader scopes than intended depending on the repo default, which conflicts with the surrounding guidance about granting only what’s needed. Add permissions: {} to make the example least-privilege by default and rely on per-job permissions: blocks.

This issue also appears on line 456 of the same file.

concurrency:
  group: ${{ github.workflow }}
  cancel-in-progress: false

jobs: