Name the Executable Asset for Its Project and Record the PhotoCleaner Pilot

[ptr727]

What

• .github/actions/build-executable-default/action.yml: the release archive is named for the project file's stem (./PhotoCleaner/PhotoCleaner.csproj gives PhotoCleaner.7z) unless the new asset-name input names it, and build-release-task.yml exposes that as executable_asset_name. PhotoCleaner's first publish through the task (run 31977092102, release 1.1.11) attached Console.7z where its own leaf had attached PhotoCleaner.7z, the one regression the pilot found. PlexCleaner names its archive the same way, so the derived default is right for both known callers.
• catalog/snippets/workflows/publish-release.yml and the doc's byte-identical stub: permissions: {} at workflow level, contents: read on the validate job, the publish job's grants unchanged. These are the four suppressed findings raised on Record 2.0.352 in the Reusable-Workflow Rollout and Add Its Catalog Snippets #775 after its clean round.
• docs/reusable-workflows.md Rollout: PhotoCleaner ticked as the stage 2 pilot (Adopt the Hub-Hosted Validate and Release Chain Tasks PhotoCleaner#55, Update codegen files #56, the validate default-hook path observed) and the stage 4 pilot (smoke run 31974932749 and publish run 31977092102, release 1.1.11), a proof item for the asset-name fix on the next PhotoCleaner release.
• reports/workflow-reuse.md regenerated: PhotoCleaner 8 workflow files to 3, all three callers, fleet callers 1 to 3.

Verification

actionlint, prose gate, repo gate, audit self-test, unit tests, markdownlint. The asset-name change is proven by the next PhotoCleaner release, recorded as a proof item.

Refs ptr727/PhotoCleaner#55, ptr727/PhotoCleaner#56.

[Copilot]

Pull request overview

This PR updates the hub’s reusable release tooling to (a) name executable release assets after the project being published (or an explicit override) and (b) record/reflect the PhotoCleaner pilot adoption, while also incorporating least-privilege workflow permissions guidance into the publish-release snippet and documentation.

Changes:

• Add an executable_asset_name input to build-release-task.yml and forward it to the build-executable implementation so the produced .7z is named after the project file stem by default.
• Add permissions: {} at the workflow level and contents: read for the validate job in the publish-release catalog snippet and its byte-identical doc stub.
• Update rollout documentation (PhotoCleaner pilot + proof links) and regenerate the workflow reuse report.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
reports/workflow-reuse.md	Regenerates fleet reuse metrics to reflect the latest downstream adoption state (notably PhotoCleaner).
docs/reusable-workflows.md	Records PhotoCleaner as stage pilots and adds least-privilege permissions guidance plus proof run links.
catalog/snippets/workflows/publish-release.yml	Applies least-privilege token defaults (permissions: {}) and grants contents: read only where needed.
.github/workflows/build-release-task.yml	Exposes executable_asset_name and forwards it into executable build steps.
.github/actions/build-executable-default/action.yml	Implements derived executable archive naming (project stem) and wires the artifact upload to the computed path.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

Suppressed comments (1)

.github/actions/build-executable-default/action.yml:91

• asset-name is documented as the archive name without the .7z extension, but the current implementation accepts values like PhotoCleaner.7z (passes the regex) and would produce PhotoCleaner.7z.7z. Consider stripping an accidental .7z suffix (or rejecting it explicitly) before validating/using the name so callers can’t accidentally double-append the extension.

        set -Eeuo pipefail
        name="${ASSET_NAME:-$(basename "$PROJECT_FILE" .csproj)}"
        if [[ ! "$name" =~ ^[A-Za-z0-9._-]+$ ]]; then
          echo "::error::asset-name must be a bare file name of letters, digits, dot, underscore or hyphen"
          exit 1

[ptr727]

Answering the suppressed finding, "Suppressed comments (1)", from the round on 6643e34: .github/actions/build-executable-default/action.yml:91, "the current implementation accepts values like PhotoCleaner.7z and would produce PhotoCleaner.7z.7z". Fixed in c016356: an accidental .7z suffix is stripped before validation, so the archive is named once.

For the record on the thread the reviewer resolved itself: the ::error:: line no longer echoes the rejected value, fixed in 6643e34.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

Suppressed comments (1)

.github/actions/build-executable-default/action.yml:33

• The asset-name input description says the name is “without its .7z extension”, but the example ends with Widget.7z, which reads like the input value rather than the produced archive. This is a bit self-contradictory and may confuse callers about whether to include .7z.

  asset-name:
    description: Name of the release archive without its .7z extension. Empty derives it from the project file's stem, so ./Widget/Widget.csproj gives Widget.7z.
    required: false
    default: ''

[ptr727]

Answering the suppressed finding, "Suppressed comments (1)", from the round on c38e2a7: .github/actions/build-executable-default/action.yml:33, "the example ends with Widget.7z, which reads like the input value rather than the produced archive". Fixed in 63b2d17: the description says the input Widget produces Widget.7z, and the empty case derives Widget from the project file and produces the same.

For the record on the thread the reviewer resolved itself in round 4 (asset-name forwarded to a caller's hook): fixed in c38e2a7, the input reaches only the hub default step.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

Suppressed comments (2)

.github/actions/build-executable-default/action.yml:33

• The asset-name input description implies the derived default always produces a valid asset name, but the implementation enforces a strict [A-Za-z0-9._-]+ character set and will fail if the project file stem contains spaces or other characters. Clarify the allowed characters (and that the derived name is validated) so callers understand when they must set asset-name explicitly.

  asset-name:
    description: Name of the release archive without its .7z extension, so Widget produces Widget.7z. Empty derives it from the project file's stem, so ./Widget/Widget.csproj also produces Widget.7z.
    required: false
    default: ''

.github/actions/build-executable-default/action.yml:88

• basename treats leading - values as options unless you pass --. Since project-file is caller-controlled, use basename -- ... to avoid option-style surprises and ensure the derived asset name is computed from the literal path.

        set -Eeuo pipefail
        name="${ASSET_NAME:-$(basename "$PROJECT_FILE" .csproj)}"
        name="${name%.7z}"

[ptr727]

Answering the two suppressed findings, "Suppressed comments (2)", from the round on 63b2d17.

• .github/actions/build-executable-default/action.yml:33, "the description implies the derived default always produces a valid asset name, but the implementation enforces a strict character set". Fixed in c7c82d5: the description states the allowed characters and that a given or derived name outside them fails the step.
• .github/actions/build-executable-default/action.yml:88, "basename treats leading - values as options unless you pass --". Fixed in c7c82d5: basename -- "$PROJECT_FILE" .csproj.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.