v1.1.26

Changes

• feat(project): author the planning-suite mission for gh-plumbing (#262) (#383) @nolte

🚀 Features

• feat(release): implement workflow-driven version-bearing auto-bump (primary path) (#381) @nolte
• feat(release): harden reusable-release-publish against silent publish pitfalls (#380) @nolte

🐛 Bug Fixes

• fix(release): degrade gracefully when primary-path align push is rejected (#382) @nolte

🧰 Maintenance

• feat(labels): add frontend, backend, test, security labels (#385) @nolte
• fix(release): degrade gracefully when primary-path align push is rejected (#382) @nolte
• feat(release): implement workflow-driven version-bearing auto-bump (primary path) (#381) @nolte
• feat(release): harden reusable-release-publish against silent publish pitfalls (#380) @nolte
• fix(release): pin gate 4 alignment-commit check to TARGET_SHA (#379) @nolte

---

Project context

Audiences served

• Downstream repositories consuming reusable workflows → addressed by §Reusable workflow changes
• Downstream repositories extending Probot configurations → addressed by §Shared Probot configuration changes
• Repository maintainer → addressed by §Reusable workflow changes (release automation)

Reusable workflow changes

• reusable-release-publish.yml — workflow-driven, version-bearing auto-bump is now the primary alignment path (#381), with graceful degradation when the primary-path alignment push is rejected (#382).
• reusable-release-publish.yml — hardened against silent publish pitfalls so a no-op publish fails loudly instead of exiting green (#380).
• reusable-release-publish.yml — gate-4 alignment-commit check pinned to TARGET_SHA for a deterministic verification target (#379).
• Consumers pinning uses: nolte/gh-plumbing/.github/workflows/reusable-release-publish.yaml@<tag> should re-pin to v1.1.26 to pick up these changes.

Shared Probot configuration changes

• commons-settings.yml — four new labels: frontend, backend, test, security (#385). Propagates to repositories extending gh-plumbing:.github/commons-settings.yml on the next Probot Settings sync.
• commons-boring-cyborg.yml — path-based auto-labeling: src/frontend/** → frontend, src/backend/** → backend (#385). Applies to repositories extending gh-plumbing:.github/commons-boring-cyborg.yml.

Open questions

• renovate-configs/common.json is unchanged in this release; the Renovate-preset consumer audience has no release-relevant change in v1.1.26.

v1.1.25

Changes

🧰 Maintenance

• feat(release): add asset-filename input to reusable-release-publish (#378) @nolte

---

Project context

Audiences served

• Downstream repositories consuming reusable workflows → addressed by §Reusable workflow changes
• Downstream repositories extending Probot configurations → no published Probot commons-* config changed this release
• Downstream repositories consuming Renovate presets → no Renovate preset changed this release
• Repository maintainer (nolte) → addressed by the Maintenance section above

Reusable workflow changes

• reusable-release-publish.yml gains an optional asset-filename input that names the HACS zip-release asset the publish step builds and attaches (#378, .github/workflows/reusable-release-publish.yml). Backward compatible: the empty default falls back to hacs.json .filename, then to <domain>.zip. When set, it takes precedence over hacs.json .filename; a divergence between the two emits a workflow warning, since HACS reads hacs.json to pick the asset, so the two MUST agree. HACS-source consumers only — no input-contract change for non-HACS consumers of this reusable workflow.

Open questions

• Project-type autodetection matched documentation-only (signal: mkdocs.yml present, no application source), but the audience artefact (AUDIENCES.md) describes a configuration-only asset repository whose published surface is reusable workflows, Probot commons-* configs, and Renovate presets — not documentation pages. Per the spec's "audience artefact wins" rule, the audience artefact drove the section bundle (reusable-workflow surface) instead of the docs-only bundle (page moves / removals / translations). Consider formalising a reusable-workflow project type via .github/release-skill-layer.yml or a per-repo bundle in references/project-bundles.md.
• This release touched only the reusable-workflow surface (#378). The Probot-config and Renovate-preset surfaces consumed by primary audiences D2 and D3 were unchanged, so no sections were produced for them.

v1.1.24

Changes

🧰 Maintenance

• feat(hacs): add reusable-hacs-validate + zip-release asset in release-publish (#373) @nolte

---

Project context

Audiences served

• Downstream reusable-workflow consumers → addressed by §Workflow contract changes
• Downstream Probot / Renovate config consumers → addressed by §Probot / Renovate config changes
• Supply-chain / security reviewers → addressed by §Workflow contract changes

Workflow contract changes

• New reusable workflow reusable-hacs-validate.yaml — validates a HACS-distributed Home Assistant custom integration via hacs/action and Home Assistant Core's hassfest. Inputs (all optional, with defaults): category (integration), ignore (""), run_hassfest (true), hacs_action_ref (main). Consume via uses: nolte/gh-plumbing/.github/workflows/reusable-hacs-validate.yaml@<tag>. Documented in docs/{en,de}/workflows/hacs.md. (PR #373; .github/workflows/reusable-hacs-validate.yaml)
• reusable-release-publish.yml attaches a HACS <domain>.zip asset to the draft before the draft→published flip, gated on the hacs version-bearing-file source. No-op for every non-HACS consumer; existing callers see no behaviour change. (PR #373; .github/workflows/reusable-release-publish.yml)

Compatibility breaks

• None. Both changes are additive: the new workflow's inputs all carry defaults, and the release-publish asset step is gated and a no-op for non-HACS consumers.

Probot / Renovate config changes

• None in this release.

v1.1.23

Changes

• docs: render icons, surface language switcher, document coverage workflows (#366) @nolte
• fix(docs): bump pymdown-extensions to 10.21.3 for Pygments 2.20 compat (#365) @nolte

🧰 Maintenance

• feat(mkdocs): add pre-build-command hook to deploy + strict-build reusables (#372) @nolte
• chore(ci): give every workflow a speaking display name (#371) @nolte
• chore(settings): require docs / MkDocs Build check on develop (#369) @nolte
• chore(ci): wire mkdocs --strict build into static CI (#368) @nolte
• chore(ci): add reusable mkdocs --strict build workflow (#367) @nolte

v1.1.22

Changes

🧰 Maintenance

• feat(workflows): add reusable Node.js coverage workflow with job summary (#364) @nolte
• feat(workflows): add reusable Python coverage workflow with job summary (#363) @nolte

---

Project context

Audiences served

• Downstream repositories consuming reusable workflows (primary) → §Reusable workflows added, §Input contracts
• Security-conscious downstream users & supply-chain reviewers (secondary) → §Security notes

Probot-config and Renovate-preset consumers are unaffected by this release — no commons-*.yml or renovate-configs/ change landed.

Reusable workflows added

• reusable-python-coverage.yaml — runs pytest with pytest-cov and renders the coverage report into the GitHub Actions job summary, with an optional fail-under gate (#363, 4fbfe9a).
• reusable-nodejs-coverage.yaml — runs Node.js tests (Vitest or Jest) and renders the Istanbul json-summary coverage report into the job summary, with an optional fail-under gate (#364, f7c2a87).

Input contracts (for consumers pinning @v1.1.22)

• reusable-python-coverage.yaml: python-version (3.x), working-directory (.), install-command (pip install -e .[test]), coverage-source (.), pytest-args (""), fail-under (0). No secrets required.
• reusable-nodejs-coverage.yaml: node-version (lts/*), working-directory (.), install-command (npm ci), test-command (npm test), coverage-summary-path (coverage/coverage-summary.json), fail-under (0). No secrets required.

Breaking changes

• None. Both workflows are additive; no existing reusable-workflow contract changed.

Security notes

• Both jobs declare least-privilege permissions: contents: read and require no secrets.
• Actions are version-pinned (actions/checkout@v6.0.0, actions/setup-python@v6, actions/setup-node@v6).
• Inputs are consumed only inside the calling (trusted) workflow; the Node renderer passes inputs via env: rather than inline interpolation.

v1.1.21

Changes

🧰 Maintenance

• chore(docs): proofread README and docs prose for grammar and style (#362) @nolte

---

Project context

Project type: documentation-only repository. gh-plumbing publishes reusable workflows and Probot/Renovate configs; the MkDocs site documents that surface. This release touches documentation only — no published workflow, Probot, or Renovate contract changed.

Audiences served

• Downstream reusable-workflow consumers → §Published-surface contract
• Downstream Probot-config consumers → §Published-surface contract
• Downstream Renovate-preset consumers → §Published-surface contract
• Maintainer & contributors → §Documentation changes

Published-surface contract

• No changes to .github/workflows/reusable-*, .github/commons-*.yml, or renovate-configs/ since v1.1.20. This tag is a safe pinning target: identical input/secret contracts, so consumers on @v1.1.20 can move to @v1.1.21 with no behavioural change.

Documentation changes

• Proofread the README and the bilingual MkDocs docs — fixed grammar, capitalisation, German address-form consistency, and abbreviation expansions (ff1ffca, #362). Touches README.md and docs/{de,en}/** only.

v1.1.20

Changes

• feat(renovate): track nolte/vale-style releases via .vale.ini customManager (#361) @nolte
• feat(portfolio): add portfolio manifest (reusable CI/CD plumbing capabilities) (#360) @nolte

v1.1.19

Changes

• docs(portfolio-app): document Issues:write permission for auto-close (#359) @nolte
• docs(portfolio-app): document App registration form fields in detail (#354) @nolte
• fix(taskfile): repoint includes from deleted branch to develop (#353) @nolte
• docs(portfolio-app): make user-account mode visible in MkDocs site (#352) @nolte
• feat(terraform): add user-account mode to portfolio-app module (#351) @nolte
• docs(de): mirror #346 edits into docs/de/ tree (#348) @nolte
• docs: overhaul docs/ + README, close catalog drift and 12 Vale alerts (#346) @nolte
• feat(docs): publish documentation in EN and DE via mkdocs-static-i18n (#347) @nolte
• fix(docs): align mkdocs casing with upstream vocab tightening (#344) @nolte
• docs(probot): clarify _extends pinning contract and per-surface strategy (#343) @nolte

🧰 Maintenance

• feat(workflows): wire release-drafter and mkdocs through the App-token pattern (#357) (#358) @nolte
• fix(workflows): wire refresh-master through the App-token pattern (#356) @nolte
• feat(commons): declare portfolio App as branch-protection bypass actor (Phase 2 of #330) (#355) @nolte
• feat(terraform): add portfolio-app provisioning module (stacked on #349) (#350) @nolte
• feat(workflows): mint portfolio App token in emitting wrappers (Phase 1 of #330) (#349) @nolte

---

Project context

Audiences served

• Downstream repos consuming reusable workflows (D1) → §Reusable workflows
• Downstream repos extending Probot configurations (D2) → §Probot commons configurations
• Repository maintainer (C1) → §Maintainer infrastructure, §Documentation site
• Open-source readers (I2) → §Documentation site
• Security-conscious downstream reviewers (I1) → §Reusable workflows

Reusable workflows

Portfolio-App token plumbing landed in two phases (tracked by #330):

• reusable-release-cd-refresh-master.yml, reusable-release-publish.yml, reusable-automerge.yaml — emitting wrappers now mint a portfolio-App token so cascaded push / release events run under an App identity (Phase 1: #349, 67cbd5a)
• reusable-release-cd-refresh-master.yml — refresh-master path wired through the App-token pattern (#356, 04b9e77)
• reusable-release-drafter.yml, reusable-mkdocs.yaml — release-drafter and mkdocs paths wired through the App-token pattern (Phase 2: #358, 2d0c883)

Downstream uses: callers do not need to change; the App identity replaces the implicit GITHUB_TOKEN inside the reusable workflows themselves.

Probot commons configurations

commons-settings.yml:

• nolte-portfolio-app is now declared as the branch-protection push-restriction actor on both master and develop (#355, 2279d2b). Consumers on personal accounts (non-organisation) inherit silently — the Settings App skips restrictions.apps for those repositories.

Renovate presets

No changes to renovate-configs/ in this release.

Maintainer infrastructure (new)

Net-new module that operators need before adopting the App-token pattern downstream:

• terraform/portfolio-app/ — Terraform module that provisions the portfolio GitHub App, with both organisation and personal-account owner modes (#350, e17369b; #351, 0dc4f35)

Documentation site

• EN/DE bilingual publication via mkdocs-static-i18n, including the new docs/de/ mirror (#347, ba1747e; #348, 5e2c78a)
• Top-level docs and README overhaul; closes 12 Vale alerts and resolves catalog drift (#346, 70205a6)
• New portfolio App setup pages — organisation and personal-account modes, App registration form fields, the Issues: write permission needed for auto-close (#352, a227612; #354, 599b6f4; #359, 5ebca9f)
• Probot _extends pinning contract and per-surface strategy documented (#343, a50c14d)
• MkDocs casing aligned with upstream Vale vocabulary tightening (#344, f07dfd3)

v1.1.18

Changes

🧰 Maintenance

• fix(settings): make develop branch protection portfolio-neutral (#341) @nolte
• fix(docker-publish): make latest-tag logic deterministic (#342) @nolte

v1.1.17

Changes

🧰 Maintenance

• feat(docker): add reusable Docker build/publish and lint/dry-build workflows (#339) @nolte