From 665a2c30fd33280074b7261e1571e84577dae356 Mon Sep 17 00:00:00 2001
From: Nick Nicholas <opoudjis@gmail.com>
Date: Tue, 11 Aug 2026 21:17:30 +1000
Subject: [PATCH] cimas: sync 2026-08-10 wave (3-week drift catch-up +
 standoc-models P3)

Fortnightly cimas sync wave 2026-08-10. 97 of 137 mapped repos have
accumulated drift over 3 weeks since last wave (2026-07-22). Key changes:
standoc-models P3 monorepo entry (metanorma-core#16 / ci#390),
mn-samples-plateau docker.yml unmap (ci#388), ci#375/#376 supersedes
(ci#383/#384/#385), gh-actions/model/Makefile verify-images defensive
check (ci#302/#303).

request-checks: true
---
 .github/workflows/release.yml | 37 ++++++++++++++++++++++++++++++++++-
 .rubocop.yml                  |  9 +++++++++
 2 files changed, 45 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7779003..c6f56c8 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,5 +1,30 @@
 # Auto-generated by Cimas: Do not edit it manually!
 # See https://github.com/metanorma/cimas
+# Variant of `release.yml` for gems whose maintainers write GitHub Release
+# notes by hand at release time and want to opt out of the auto-generated
+# notes floor introduced in metanorma/ci#354.
+#
+# The only difference from the parent `release.yml` template is the
+# `release_notes: manual` input passed to the reusable `rubygems-release.yml`
+# — that flag makes the reusable's Ensure-GitHub-Release step skip itself
+# entirely, leaving Release creation + notes authoring to the maintainer.
+#
+# Used by opoudjis-maintained gems (all `metanorma-*` except
+# `metanorma-plugin-*` and `metanorma-utils`, plus `isodoc`, `isodoc-i18n`,
+# `basicdoc-models`). See the `release_wo_bundle_install_manual_notes.yml`
+# sibling variant for gems that also opt out of the shared workflow's
+# implicit bundle install (metanorma-utils today). Gems mapping
+# `release_github_packages.yml` are exempt-by-construction — that
+# template calls `ghpkg-release.yml`, not `rubygems-release.yml`, so
+# metanorma/ci#354's auto-notes floor doesn't reach them.
+#
+# To switch from opt-out back to the auto-notes floor: change the
+# cimas.yml mapping for this gem from `master/release_manual_notes.yml`
+# back to `master/release.yml`. No content edit needed.
+#
+# See metanorma/ci#354 for the rationale and metanorma/ci#PR-number for
+# the introduction of this variant.
+
 name: release
 
 on:
@@ -14,12 +39,22 @@ on:
   repository_dispatch:
     types: [ do-release ]
 
+# Least-privilege ceiling for the called rubygems-release.yml: its release job
+# needs contents:write (git tag push) and id-token:write (OIDC Trusted Publishing).
+permissions:
+  contents: write
+  id-token: write
+
 jobs:
   release:
     uses: metanorma/ci/.github/workflows/rubygems-release.yml@main
     with:
       next_version: ${{ github.event.inputs.next_version }}
+      # Opt out of the auto-generated GitHub Release notes floor added in
+      # metanorma/ci#354. Notes are written by hand at release time; the
+      # workflow skips the ensure-release step entirely and the maintainer
+      # creates the Release with their own notes.
+      release_notes: manual
     secrets:
       rubygems-api-key: ${{ secrets.METANORMA_CI_RUBYGEMS_API_KEY }}
       pat_token: ${{ secrets.METANORMA_CI_PAT_TOKEN }}
-
diff --git a/.rubocop.yml b/.rubocop.yml
index ac258f6..372b21e 100644
--- a/.rubocop.yml
+++ b/.rubocop.yml
@@ -2,6 +2,15 @@
 # See https://github.com/metanorma/cimas
 inherit_from:
   - https://raw.githubusercontent.com/riboseinc/oss-guides/main/ci/rubocop.yml
+  # .rubocop_todo.yml MUST be the last entry. inherit_from is last-wins:
+  # if listed before oss-guides, the shared config's stricter Metrics/
+  # (MethodLength, BlockLength, etc.) rules override the todo's per-file
+  # grandfathering, and the todo becomes inert on those cops. Empirically
+  # verified on suma 2026-07-06: with todo listed first, 34 Metrics/* offenses
+  # remained; moved last, cleared. Every gem in the metanorma-org fleet
+  # already ships a `.rubocop_todo.yml` on its live tree (audited 2026-07-06,
+  # 54/54 have it), so this reference is safe to emit unconditionally.
+  - .rubocop_todo.yml
 
 # Rubocop plugins enabled centrally so every metanorma-org gem picks them up
 # on cimas sync — best practice belongs at the shared-template layer, not