Name the Executable Asset for Its Project and Record the PhotoCleaner Pilot by ptr727 · Pull Request #778 · ptr727/ProjectTemplate

ptr727 · 2026-08-16T22:57:35Z

What

.github/actions/build-executable-default/action.yml: the release archive is named for the project file's stem (./PhotoCleaner/PhotoCleaner.csproj gives PhotoCleaner.7z) unless the new asset-name input names it, and build-release-task.yml exposes that as executable_asset_name. PhotoCleaner's first publish through the task (run 31977092102, release 1.1.11) attached Console.7z where its own leaf had attached PhotoCleaner.7z, the one regression the pilot found. PlexCleaner names its archive the same way, so the derived default is right for both known callers.
catalog/snippets/workflows/publish-release.yml and the doc's byte-identical stub: permissions: {} at workflow level, contents: read on the validate job, the publish job's grants unchanged. These are the four suppressed findings raised on Record 2.0.352 in the Reusable-Workflow Rollout and Add Its Catalog Snippets #775 after its clean round.
docs/reusable-workflows.md Rollout: PhotoCleaner ticked as the stage 2 pilot (Adopt the Hub-Hosted Validate and Release Chain Tasks PhotoCleaner#55, Update codegen files #56, the validate default-hook path observed) and the stage 4 pilot (smoke run 31974932749 and publish run 31977092102, release 1.1.11), a proof item for the asset-name fix on the next PhotoCleaner release.
reports/workflow-reuse.md regenerated: PhotoCleaner 8 workflow files to 3, all three callers, fleet callers 1 to 3.

Verification

actionlint, prose gate, repo gate, audit self-test, unit tests, markdownlint. The asset-name change is proven by the next PhotoCleaner release, recorded as a proof item.

Refs ptr727/PhotoCleaner#55, ptr727/PhotoCleaner#56.

… Pilot PhotoCleaner's first release through build-release-task.yml (1.1.11) proved the release chain and exposed one regression: the hub executable default named the archive Console.7z where the repo's own leaf named it PhotoCleaner.7z. The default now derives the name from the project file and an executable_asset_name input overrides it. The publish-release snippet and its doc example set permissions: {} at workflow level with per-job grants, which the #775 review asked for after its report. The tracker ticks PhotoCleaner as the stage 2 and 4 pilot with its runs.

Copilot

Pull request overview

This PR updates the hub’s reusable release tooling to (a) name executable release assets after the project being published (or an explicit override) and (b) record/reflect the PhotoCleaner pilot adoption, while also incorporating least-privilege workflow permissions guidance into the publish-release snippet and documentation.

Changes:

Add an executable_asset_name input to build-release-task.yml and forward it to the build-executable implementation so the produced .7z is named after the project file stem by default.
Add permissions: {} at the workflow level and contents: read for the validate job in the publish-release catalog snippet and its byte-identical doc stub.
Update rollout documentation (PhotoCleaner pilot + proof links) and regenerate the workflow reuse report.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
`reports/workflow-reuse.md`	Regenerates fleet reuse metrics to reflect the latest downstream adoption state (notably PhotoCleaner).
`docs/reusable-workflows.md`	Records PhotoCleaner as stage pilots and adds least-privilege permissions guidance plus proof run links.
`catalog/snippets/workflows/publish-release.yml`	Applies least-privilege token defaults (`permissions: {}`) and grants `contents: read` only where needed.
`.github/workflows/build-release-task.yml`	Exposes `executable_asset_name` and forwards it into executable build steps.
`.github/actions/build-executable-default/action.yml`	Implements derived executable archive naming (project stem) and wires the artifact upload to the computed path.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Copilot

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Copilot

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

Suppressed comments (1)

.github/actions/build-executable-default/action.yml:91

asset-name is documented as the archive name without the .7z extension, but the current implementation accepts values like PhotoCleaner.7z (passes the regex) and would produce PhotoCleaner.7z.7z. Consider stripping an accidental .7z suffix (or rejecting it explicitly) before validating/using the name so callers can’t accidentally double-append the extension.

        set -Eeuo pipefail
        name="${ASSET_NAME:-$(basename "$PROJECT_FILE" .csproj)}"
        if [[ ! "$name" =~ ^[A-Za-z0-9._-]+$ ]]; then
          echo "::error::asset-name must be a bare file name of letters, digits, dot, underscore or hyphen"
          exit 1

ptr727 · 2026-08-16T23:10:38Z

Answering the suppressed finding, "Suppressed comments (1)", from the round on 6643e34: .github/actions/build-executable-default/action.yml:91, "the current implementation accepts values like PhotoCleaner.7z and would produce PhotoCleaner.7z.7z". Fixed in c016356: an accidental .7z suffix is stripped before validation, so the archive is named once.

For the record on the thread the reviewer resolved itself: the ::error:: line no longer echoes the rejected value, fixed in 6643e34.

Copilot

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Copilot

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

Suppressed comments (1)

.github/actions/build-executable-default/action.yml:33

The asset-name input description says the name is “without its .7z extension”, but the example ends with Widget.7z, which reads like the input value rather than the produced archive. This is a bit self-contradictory and may confuse callers about whether to include .7z.

  asset-name:
    description: Name of the release archive without its .7z extension. Empty derives it from the project file's stem, so ./Widget/Widget.csproj gives Widget.7z.
    required: false
    default: ''

ptr727 · 2026-08-16T23:18:40Z

Answering the suppressed finding, "Suppressed comments (1)", from the round on c38e2a7: .github/actions/build-executable-default/action.yml:33, "the example ends with Widget.7z, which reads like the input value rather than the produced archive". Fixed in 63b2d17: the description says the input Widget produces Widget.7z, and the empty case derives Widget from the project file and produces the same.

For the record on the thread the reviewer resolved itself in round 4 (asset-name forwarded to a caller's hook): fixed in c38e2a7, the input reaches only the hub default step.

Copilot

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

Suppressed comments (2)

.github/actions/build-executable-default/action.yml:33

The asset-name input description implies the derived default always produces a valid asset name, but the implementation enforces a strict [A-Za-z0-9._-]+ character set and will fail if the project file stem contains spaces or other characters. Clarify the allowed characters (and that the derived name is validated) so callers understand when they must set asset-name explicitly.

  asset-name:
    description: Name of the release archive without its .7z extension, so Widget produces Widget.7z. Empty derives it from the project file's stem, so ./Widget/Widget.csproj also produces Widget.7z.
    required: false
    default: ''

.github/actions/build-executable-default/action.yml:88

basename treats leading - values as options unless you pass --. Since project-file is caller-controlled, use basename -- ... to avoid option-style surprises and ensure the derived asset name is computed from the literal path.

        set -Eeuo pipefail
        name="${ASSET_NAME:-$(basename "$PROJECT_FILE" .csproj)}"
        name="${name%.7z}"

ptr727 · 2026-08-16T23:24:40Z

Answering the two suppressed findings, "Suppressed comments (2)", from the round on 63b2d17.

.github/actions/build-executable-default/action.yml:33, "the description implies the derived default always produces a valid asset name, but the implementation enforces a strict character set". Fixed in c7c82d5: the description states the allowed characters and that a given or derived name outside them fails the step.
.github/actions/build-executable-default/action.yml:88, "basename treats leading - values as options unless you pass --". Fixed in c7c82d5: basename -- "$PROJECT_FILE" .csproj.

Copilot

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

… Fix (#786) Promote `develop` to `main`, carrying: - #783 Drop IGNORE_GITHUB_REF From the Hosted Get-Version Task (the hosted task follows WORKFLOW.md D3.1 like the inline get-version job already does) - #778 Name the Executable Asset for Its Project and Record the PhotoCleaner Pilot (the executable default names its archive for the project file, the publish-release snippet and doc stub carry explicit permissions, PhotoCleaner ticked as the stage 2 and 4 pilot) - #775 Record 2.0.352 in the Reusable-Workflow Rollout and Add Its Catalog Snippets - #773 Expand references/ in large skill files for progressive disclosure - #776 Make the linux host-setup scripts refuse more than one action - #782 Add PowerShell as an Optional Tool From the Microsoft Feed The release that follows is the pin PhotoCleaner's Dependabot bumps to, and PhotoCleaner's next release through it is the proof that the executable asset is named `PhotoCleaner.7z` again. Closes #769.

Copilot AI lite review requested due to automatic review settings August 16, 2026 22:57

Copilot started reviewing on behalf of ptr727 August 16, 2026 22:58 View session