From 4d0a5eda8dc263b7703af10032baee00e25156f7 Mon Sep 17 00:00:00 2001 From: Nick Nicholas Date: Tue, 11 Aug 2026 21:22:09 +1000 Subject: [PATCH] cimas: sync 2026-08-10 wave (3-week drift catch-up + standoc-models P3) Fortnightly cimas sync wave 2026-08-10. 97 of 137 mapped repos have accumulated drift over 3 weeks since last wave (2026-07-22). Key changes: standoc-models P3 monorepo entry (metanorma-core#16 / ci#390), mn-samples-plateau docker.yml unmap (ci#388), ci#375/#376 supersedes (ci#383/#384/#385), gh-actions/model/Makefile verify-images defensive check (ci#302/#303). request-checks: true --- .github/workflows/release.yml | 34 +++++++++++++++++++++++++++++++++- .rubocop.yml | 9 +++++++++ 2 files changed, 42 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 7e13f3c..7b306e9 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,5 +1,27 @@ # Auto-generated by Cimas: Do not edit it manually! # See https://github.com/metanorma/cimas +# Variant of `release_wo_bundle_install.yml` for gems whose maintainers +# write GitHub Release notes by hand at release time and want to opt out +# of the auto-generated notes floor introduced in metanorma/ci#354. +# +# The only difference from the parent `release_wo_bundle_install.yml` +# template is the `release_notes: manual` input passed to the reusable +# `rubygems-release.yml` — that flag makes the reusable's +# Ensure-GitHub-Release step skip itself entirely, leaving Release +# creation + notes authoring to the maintainer. +# +# Used by opoudjis-maintained gems that also opt out of the shared +# workflow's implicit `bundle install` (currently `metanorma-utils`). +# See `release_manual_notes.yml` sibling variant for gems that keep the +# shared bundle-install path. +# +# To switch from opt-out back to the auto-notes floor: change the +# cimas.yml mapping for this gem from +# `master/release_wo_bundle_install_manual_notes.yml` back to +# `master/release_wo_bundle_install.yml`. No content edit needed. +# +# See metanorma/ci#354 for the rationale. + name: release on: @@ -14,6 +36,12 @@ on: repository_dispatch: types: [ do-release ] +# Least-privilege ceiling for the called rubygems-release.yml: its release job +# needs contents:write (git tag push) and id-token:write (OIDC Trusted Publishing). +permissions: + contents: write + id-token: write + jobs: release: uses: metanorma/ci/.github/workflows/rubygems-release.yml@main @@ -22,7 +50,11 @@ jobs: release_command: rake release bundler_cache: false post_install: gem install bundler rake rspec + # Opt out of the auto-generated GitHub Release notes floor added in + # metanorma/ci#354. Notes are written by hand at release time; the + # workflow skips the ensure-release step entirely and the maintainer + # creates the Release with their own notes. + release_notes: manual secrets: rubygems-api-key: ${{ secrets.METANORMA_CI_RUBYGEMS_API_KEY }} pat_token: ${{ secrets.METANORMA_CI_PAT_TOKEN }} - diff --git a/.rubocop.yml b/.rubocop.yml index ac258f6..372b21e 100644 --- a/.rubocop.yml +++ b/.rubocop.yml @@ -2,6 +2,15 @@ # See https://github.com/metanorma/cimas inherit_from: - https://raw.githubusercontent.com/riboseinc/oss-guides/main/ci/rubocop.yml + # .rubocop_todo.yml MUST be the last entry. inherit_from is last-wins: + # if listed before oss-guides, the shared config's stricter Metrics/ + # (MethodLength, BlockLength, etc.) rules override the todo's per-file + # grandfathering, and the todo becomes inert on those cops. Empirically + # verified on suma 2026-07-06: with todo listed first, 34 Metrics/* offenses + # remained; moved last, cleared. Every gem in the metanorma-org fleet + # already ships a `.rubocop_todo.yml` on its live tree (audited 2026-07-06, + # 54/54 have it), so this reference is safe to emit unconditionally. + - .rubocop_todo.yml # Rubocop plugins enabled centrally so every metanorma-org gem picks them up # on cimas sync — best practice belongs at the shared-template layer, not