Skip to content
Draft
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
26 commits
Select commit Hold shift + click to select a range
4a5d2f5
Fix all markdown linting violations (MD013, MD060, MD012, MD032, MD04…
Jun 18, 2026
2ffcd35
Shorten markdown table descriptions for line length compliance
Jun 18, 2026
7d416e9
Fix markdown lint violations in action READMEs and docs
Jun 18, 2026
6b97dff
Final lint fixes: shorten remaining action README descriptions
Jun 18, 2026
8b268e4
Fix final lint error in ensure-cargo-version README
Jun 18, 2026
be4c11d
Fix markdown linting violations in execplan.
Jun 18, 2026
0022343
Fix remaining markdown linting violations.
Jun 18, 2026
ba4fcf9
Fix markdown linting violations in 6.2.1 execplan
Jun 18, 2026
8968b66
Fix duplicate heading violations and heading level incrementing.
Jun 18, 2026
efa21cb
Finalize markdown linting for 6.2.1 quickstart guide execplan.
Jun 18, 2026
1beac5f
Fix cargo-nextest Linux checksums
lodyai[bot] Jun 17, 2026
e589554
Add RFC for ortho-config environment variable aliases.
Jun 18, 2026
c07a0c6
RFC: Refine ortho-config environment variable aliases with expert review
Jun 18, 2026
2fb9a50
Fix markdown linting violations in RFC 0001
Jun 18, 2026
0806238
Fix markdown linting violations in ortho-config RFC
Jun 18, 2026
23cf31d
Author RFC 0002: Customizable Configuration Layering and File-Layer R…
Jun 18, 2026
be53560
Remove out-of-scope RFC file
Jun 18, 2026
1c7c628
docs: Create execplan for 4.2.2 safe host-mounted workspaces
Jun 18, 2026
b581c1c
docs: Fix markdown linting violations in 4.2.2 execplan
Jun 18, 2026
b4555e9
chore: Ignore docs/architecture directory (auto-generated artifacts)
Jun 18, 2026
0e23263
Expand execplan 4.2.2 with comprehensive design and implementation gu…
Jun 18, 2026
e2e6ec2
fix: Auto-fix markdown linting violations in 4-2-2 execplan
Jun 18, 2026
c6e7216
docs: Reduce 4-2-2 linting violations from 150+ to 93
Jun 18, 2026
4dabb44
fix: Simplify threat model table to pass markdown linting
Jun 18, 2026
7b84410
docs: Add execplan for feature 3.2.5 - expose default reply templates…
Jun 18, 2026
09b3afe
fix: Auto-fix markdown linting violations in 3.2.5 execplan
Jun 18, 2026
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 6 additions & 6 deletions .github/actions/determine-release-modes/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -10,16 +10,16 @@ type and optional input overrides.

| Name | Description | Required | Default |
| ---- | ----------- | -------- | ------- |
| `dry-run` | Override dry-run mode (auto-detected from event when empty) | no | `""` |
| `publish` | Override publish flag (auto-detected from event when empty) | no | `""` |
| `dry-run` | Override dry-run (auto-detected) | no | `""` |
| `publish` | Override publish flag (auto-detected) | no | `""` |

## Outputs

| Name | Description |
| ---- | ----------- |
| `dry-run` | `"true"` or `"false"` indicating dry-run mode |
| `should-publish` | `"true"` or `"false"` indicating whether to publish to a release |
| `should-upload-workflow-artifacts` | `"true"` or `"false"` indicating whether to upload workflow artefacts |
| `dry-run` | Dry-run (`"true"` or `"false"`) |
| `should-publish` | Publish (`"true"` or `"false"`) |
| `should-upload-workflow-artifacts` | Upload (`"true"` or `"false"`) |

## Usage

Expand Down Expand Up @@ -56,7 +56,7 @@ type and optional input overrides.
The action derives modes based on the GitHub event type:

| Event | Default dry-run | Default publish | Artefacts |
|-------|-----------------|-----------------|-----------|
| --- | --- | --- | --- |
| `push` (tag) | `false` | `true` | Uploaded |
| `workflow_call` | From inputs | From inputs | If not dry-run |
| `pull_request` | `true` | `false` | None |
Expand Down
15 changes: 8 additions & 7 deletions .github/actions/ensure-cargo-version/README.md
Original file line number Diff line number Diff line change
@@ -1,22 +1,23 @@
# ensure-cargo-version

Validate that the Git tag triggering a release workflow matches the version in one or more Cargo manifests.
Validate that the Git tag triggering a release workflow matches the version in
one or more Cargo manifests.

## Inputs

| Name | Required | Default | Description |
| ---- | -------- | ------- | ----------- |
| `manifests` | No | `Cargo.toml` | Newline or whitespace separated list of Cargo manifest paths to check. Paths are resolved relative to the GitHub workspace. |
| `tag-prefix` | No | `v` | Prefix stripped from the Git reference name before comparing against manifest versions. Use an empty string to disable prefix removal. |
| `check-tag` | No | `true` | Disable tag comparison by supplying a falsey value (case-insensitive `false`, `0`, `no`, `off`, or an empty string). Truthy values (`true`, `1`, `yes`, `on`) enable comparison while still attempting to read the tag for output purposes. |
| `manifests` | No | `Cargo.toml` | Manifest paths (newline separated) |
| `tag-prefix` | No | `v` | Git tag prefix to strip |
| `check-tag` | No | `true` | Enable tag comparison |

## Outputs

| Name | Description |
| ---- | ----------- |
| `version` | Version extracted from the tag reference after removing the configured prefix. |
| `crate-version` | Version read from the first manifest path provided (after resolution) after resolving workspace inheritance. |
| `crate-name` | Package name read from the first manifest path provided (after resolution). |
| `version` | Version from tag (prefix removed) |
| `crate-version` | Version from first manifest |
| `crate-name` | Package name from first manifest path |

## Usage

Expand Down
8 changes: 4 additions & 4 deletions .github/actions/export-cargo-metadata/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -15,10 +15,10 @@ manifest and export as GitHub Actions outputs and environment variables.

| Name | Description |
| ---- | ----------- |
| `name` | Package name from `[package].name` |
| `version` | Package version from `[package].version` (resolves workspace inheritance) |
| `bin-name` | Binary name from first `[[bin]].name` or `[package].name` |
| `description` | Package description from `[package].description` |
| `name` | Package name |
| `version` | Package version |
| `bin-name` | Binary name |
| `description` | Package description |

## Usage

Expand Down
42 changes: 21 additions & 21 deletions .github/actions/linux-packages/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -11,27 +11,27 @@ nFPM.

| Name | Type | Default | Description | Required |
| ---- | ---- | ------- | ----------- | -------- |
| project-dir | string | `.` | Directory containing the compiled binary, man pages and optional license file. | no |
| package-name | string | _empty_ | Package identifier written to the nFPM manifest. Defaults to `bin-name` when omitted. | no |
| bin-name | string | — | Name of the release binary to package. | yes |
| target | string | `x86_64-unknown-linux-gnu` | Rust target triple used for the build. | no |
| version | string | — | Version number recorded in the package metadata (for example `1.2.3`). | yes |
| formats | string | `deb` | Comma-, space-, or newline-separated list of package formats (for example `deb,rpm` or a multi-line value). | no |
| release | string | _empty_ | Package release or revision override. Uses the packaging helper default when omitted. | no |
| arch | string | _empty_ | Override the nFPM/GOARCH architecture. Auto-detected from `target` when not set. | no |
| maintainer | string | _empty_ | Maintainer entry for the generated package metadata. | no |
| homepage | string | _empty_ | Homepage URL recorded in package metadata. | no |
| license | string | _empty_ | Software license declared in the package metadata. | no |
| section | string | _empty_ | Package section/category used by Debian-based distributions. | no |
| description | string | _empty_ | Long description stored in the package metadata. | no |
| man-paths | string | _empty_ | Comma-, space-, or newline-separated list of man page paths relative to `project-dir`. | no |
| man-section | string | _empty_ | Default man section applied when a path lacks a suffix (for example `1`). | no |
| man-stage | string | _empty_ | Directory used to stage gzipped man pages before invoking nFPM. | no |
| binary-dir | string | _empty_ | Cargo `target` directory containing build artefacts. | no |
| outdir | string | _empty_ | Directory where packages will be written. | no |
| config-path | string | _empty_ | Location to write the generated `nfpm.yaml` configuration. | no |
| deb-depends | string | _empty_ | Comma-, space-, or newline-separated Debian runtime dependencies (each entry becomes a separate dependency in the generated manifest). | no |
| rpm-depends | string | _empty_ | Comma-, space-, or newline-separated RPM runtime dependencies. Falls back to Debian deps when omitted. | no |
| project-dir | string | `.` | Binary, man, license dir | no |
| package-name | string | _empty_ | Package ID (defaults to bin) | no |
| bin-name | string | — | Binary name | yes |
| target | string | `x86_64-unknown-linux-gnu` | Rust target triple | no |
| version | string | — | Package version | yes |
| formats | string | `deb` | Formats (e.g. `deb,rpm`) | no |
| release | string | _empty_ | Release/revision override | no |
| arch | string | _empty_ | Architecture (auto-detected) | no |
| maintainer | string | _empty_ | Package maintainer | no |
| homepage | string | _empty_ | Homepage URL | no |
| license | string | _empty_ | Software license | no |
| section | string | _empty_ | Package section | no |
| description | string | _empty_ | Package description | no |
| man-paths | string | _empty_ | Man page paths | no |
| man-section | string | _empty_ | Default man section | no |
| man-stage | string | _empty_ | Man staging directory | no |
| binary-dir | string | _empty_ | Cargo target directory | no |
| outdir | string | _empty_ | Output directory | no |
| config-path | string | _empty_ | nfpm config path | no |
| deb-depends | string | _empty_ | Debian dependencies | no |
| rpm-depends | string | _empty_ | RPM dependencies | no |

Before invoking sibling actions the composite mirrors the repository snapshot
that GitHub already downloaded for the action into a local `_self/` directory.
Expand Down
26 changes: 13 additions & 13 deletions .github/actions/macos-package/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -12,24 +12,24 @@ executing any packaging commands.

| Name | Description | Required | Default |
| ---- | ----------- | -------- | ------- |
| `name` | Display name of the packaged CLI (also used for output filenames). | yes | – |
| `identifier` | Reverse-DNS package identifier (for example `com.example.tool`). | yes | – |
| `install-prefix` | Installation prefix within the target filesystem. | no | `/usr/local` |
| `binary` | Path to the compiled binary to install. | yes | – |
| `manpage` | Optional path to a man page (`.1`, `.1.gz`, etc.) to embed. | no | empty |
| `license-file` | Path to the license text copied into the package and optional UI. | no | `LICENSE` |
| `include-license-panel` | Show the license text inside the installer UI (requires `license-file`). | no | `false` |
| `version` | Override the package version. Defaults to the Git tag (`v*`) or falls back to the commit SHA. | no | derived |
| `developer-id-installer` | Developer ID Installer identity used with `productsign` for notarized packages. | no | empty |
| `name` | Display name | yes | – |
| `identifier` | Reverse-DNS identifier | yes | – |
| `install-prefix` | Install prefix | no | `/usr/local` |
| `binary` | Binary path | yes | – |
| `manpage` | Man page path | no | empty |
| `license-file` | License file path | no | `LICENSE` |
| `include-license-panel` | Show license in UI | no | `false` |
| `version` | Version override | no | derived |
| `developer-id-installer` | Developer ID identity | no | empty |

## Outputs

| Name | Description |
| ---- | ----------- |
| `version` | Resolved version used for the package metadata. |
| `version-build-metadata` | Short commit SHA recorded when falling back to a default version. |
| `pkg-path` | Path to the generated installer archive (`dist/<name>-<version>.pkg`). |
| `signed-pkg-path` | Path to the signed installer archive when signing succeeds; empty otherwise. |
| `version` | Resolved package version |
| `version-build-metadata` | Commit SHA (fallback) |
| `pkg-path` | Installer package path |
| `signed-pkg-path` | Signed package path |

## Usage

Expand Down
8 changes: 4 additions & 4 deletions .github/actions/ratchet-coverage/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -5,10 +5,10 @@ coverage percentage falls below a stored baseline.

## Inputs

| Name | Description | Required | Default |
| ------------- | ------------------------------------------------------------------ | -------- | -------------------- |
| baseline-file | File used to persist the baseline coverage percentage between runs | no | `.coverage-baseline` |
| args | Additional arguments passed to `cargo llvm-cov` | no | `''` |
| Name | Description | Required | Default |
| --- | --- | --- | --- |
| baseline-file | Baseline coverage file | no | `.coverage-baseline` |
| args | Additional cargo llvm-cov args | no | `''` |

## Outputs

Expand Down
27 changes: 15 additions & 12 deletions .github/actions/release-to-pypi-uv/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -7,16 +7,16 @@ Build and publish Python distributions via

| Name | Description | Required | Default |
| --- | --- | --- | --- |
| tag | Tag to release (e.g. `v1.2.3`). Required when the workflow is not running on a tag ref. | no | _(empty)_ |
| require-confirmation | Require a manual confirmation string before publishing. | no | `false` |
| confirm | Confirmation string. Must equal `release <tag>` when `require-confirmation` is true. | no | _(empty)_ |
| environment-name | GitHub environment to reference in the release summary. | no | `pypi` |
| uv-index | Optional uv index name to publish to (e.g. `testpypi`). Must exist in `tool.uv.index`. | no | _(empty)_ |
| toml-glob | Glob used to discover `pyproject.toml` files for version validation. | no | `**/pyproject.toml` |
| skip-directories | Comma- or newline-separated directory names to skip during discovery. | no | _(empty)_ |
| fail-on-dynamic-version | Fail when a project declares a dynamic PEP 621 version instead of a literal string. | no | `false` |
| fail-on-empty | Fail when no `pyproject.toml` files match the discovery glob. | no | `false` |
| python-version | Python version to install and use for all uv commands. | no | `3.13` |
| tag | Tag to release (e.g. `v1.2.3`) | no | _(empty)_ |
| require-confirmation | Require manual confirmation | no | `false` |
| confirm | Confirmation string | no | _(empty)_ |
| environment-name | GitHub environment name | no | `pypi` |
| uv-index | uv index name (e.g. `testpypi`) | no | _(empty)_ |
| toml-glob | Glob for `pyproject.toml` discovery | no | `**/pyproject.toml` |
| skip-directories | Directories to skip | no | _(empty)_ |
| fail-on-dynamic-version | Fail on dynamic PEP 621 version | no | `false` |
| fail-on-empty | Fail on empty discovery | no | `false` |
| python-version | Python version | no | `3.13` |

The composite action installs the interpreter requested through `python-version`
before invoking any uv commands, ensuring builds run against the expected
Expand All @@ -36,8 +36,11 @@ uses additional transient paths that should be excluded.
| tag | Resolved release tag. |
| version | Resolved release version (tag without the leading `v`). |

> **Required permissions**: set the job to `permissions: contents: read` and `permissions: id-token: write` so uv Trusted Publishing can exchange an OpenID Connect (OIDC) token with PyPI.
> The composite action forwards the workflow's `GITHUB_TOKEN` to its scripts as `GH_TOKEN`, so you do not need to add an extra `env` block.
> **Required permissions**: set the job to `permissions: contents: read` and
> `permissions: id-token: write` so uv Trusted Publishing can exchange an
> OpenID Connect (OIDC) token with PyPI.
> The composite action forwards the workflow's `GITHUB_TOKEN` to its scripts
> as `GH_TOKEN`, so you do not need to add an extra `env` block.

## Usage

Expand Down
19 changes: 13 additions & 6 deletions .github/actions/rust-build-release/CHANGELOG.md
Original file line number Diff line number Diff line change
Expand Up @@ -11,17 +11,24 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
### Added

- Cross-compile and stage `x86_64-unknown-illumos` artefacts from Linux runners.
- Provide shared packaging fixtures and helpers that build the sample project once and produce `.deb` and `.rpm` artefacts for the integration tests.
- Support staging and packaging for `unknown-linux-musl` targets alongside GNU triples for x86_64, aarch64, i686, arm*, and riscv64 builds.
- Require containerized `cross` builds for FreeBSD targets on non-FreeBSD hosts to enable `x86_64-unknown-freebsd` cross-compilation.
- Automatically export `CROSS_CONTAINER_ENGINE` for the detected container runtime when running FreeBSD builds with `cross`.
- Provide shared packaging fixtures and helpers that build the sample project
once and produce `.deb` and `.rpm` artefacts for the integration tests.
- Support staging and packaging for `unknown-linux-musl` targets alongside GNU
triples for x86_64, aarch64, i686, arm*, and riscv64 builds.
- Require containerized `cross` builds for FreeBSD targets on non-FreeBSD hosts
to enable `x86_64-unknown-freebsd` cross-compilation.
- Automatically export `CROSS_CONTAINER_ENGINE` for the detected container
runtime when running FreeBSD builds with `cross`.
- Add a `manifest-path` input for selecting an alternate Cargo manifest.
- Add a `toolchain` input for explicitly overriding the resolved build toolchain.

### Fixed

- Pin `setup-rust` to the commit behind `setup-rust-v1`, so toolchain inputs and OS guards apply when invoked from external repositories.
- Resolve toolchains from the target repository before falling back to the action's bundled default: explicit input first, then `rust-toolchain.toml` or `rust-toolchain`, then manifest `rust-version`.
- Pin `setup-rust` to the commit behind `setup-rust-v1`, so toolchain inputs
and OS guards apply when invoked from external repositories.
- Resolve toolchains from the target repository before falling back to the
action's bundled default: explicit input first, then `rust-toolchain.toml`
or `rust-toolchain`, then manifest `rust-version`.

## [0.1.0] - 2025-09-10

Expand Down
12 changes: 6 additions & 6 deletions .github/actions/upload-codescene-coverage/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,12 +4,12 @@ Upload coverage reports to CodeScene and cache the CLI for faster runs.

## Inputs

| Name | Description | Required | Default |
| ------------------ | ------------------------------------------------------------ | -------- | ----------- |
| path | Coverage file path; blank or `__auto__` infers automatically | no | `__auto__` |
| format | Coverage format (`cobertura` or `lcov`) | no | `cobertura` |
| access-token | CodeScene project access token | yes | |
| installer-checksum | SHA-256 checksum of the installer script | no | |
|Name|Description|Required|Default|
|---|---|---|---|
|path|Coverage file path; blank or `__auto__` infers automatically|no|`__auto__`|
|format|Coverage format (`cobertura` or `lcov`)|no|`cobertura`|
|access-token|CodeScene project access token|yes||
|installer-checksum|SHA-256 checksum of the installer script|no||

If `path` is empty or `__auto__`, the action looks for `lcov.info` when
`format` is `lcov`, or `coverage.xml` when `format` is `cobertura`. The
Expand Down
5 changes: 3 additions & 2 deletions .github/actions/upload-release-assets/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ release state.
| `release-tag` | Git tag identifying the release to publish to | yes | - |
| `bin-name` | Binary name used to derive artefact names | yes | - |
| `dist-dir` | Directory containing staged artefacts | no | `dist` |
| `dry-run` | When true, only validate artefacts and print the upload plan | no | `"false"` |
| `dry-run` | Validate artefacts without uploading | no | `"false"` |
| `clobber` | Overwrite existing assets with the same name | no | `"true"` |

## Outputs
Expand Down Expand Up @@ -90,7 +90,8 @@ Files in nested directories are namespaced with their path prefix, replacing

1. **Discovery**: Recursively scan `dist-dir` for matching artefacts
2. **Validation**: Verify files are non-empty and have unique asset names
3. **Upload**: Use `gh release upload` to publish artefacts (or print plan in dry-run mode)
3. **Upload**: Use `gh release upload` to publish artefacts (or print plan in
dry-run mode)

### Error Handling

Expand Down
Loading
Loading