chore(dc-init): update workflows,actions

Author: xaoscience

.github/actions/identity/action.yml

@@ -1,3 +1,6 @@
+# Template created by https://github.com/XAOSTECH/dev-control
+# See templates folder documentation for details.
+
 name: Bot Setup
 description: >
   Register the machine user GPG key to their GitHub profile, import and configure it

.github/workflows/anglicise.yml

@@ -1,3 +1,6 @@
+# Template created by https://github.com/XAOSTECH/dev-control
+# See templates folder documentation for details.
+
 name: British English Spelling Check
 
 on:
@@ -16,13 +19,13 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
       - name: Generate App Token
         id: app_token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@v2
         with:
           app-id: ${{ secrets['XB_AI'] }}
           private-key: ${{ secrets['XB_PK'] }}
@@ -305,12 +308,29 @@ jobs:
             ! -path "./.git/*" \
             ! -path "./node_modules/*" \
             ! -path "./vendor/*" \
-            ! -path "./.github/workflows/*" \
+            ! -path "./.github/workflows/anglicise.yml" \
             ! -path "./workflows-templates/anglicise.yml" \
             ! -path "./licence-templates/*" \
-            ! -path "./LICENSE" \
+            ! -path "./LICENCE" \
             2>/dev/null | sort)
 
+          is_workflow_file() {
+            local file="$1"
+            [[ "$file" =~ ^\./\.github/workflows/.*\.ya?ml$ || "$file" =~ ^\./workflows-templates/.*\.ya?ml$ ]]
+          }
+
+          is_workflow_text_context() {
+            local line="$1"
+            [[ "$line" =~ ^[[:space:]]*# ]] ||
+            [[ "$line" =~ ^[[:space:]-]*name:[[:space:]] ]] ||
+            [[ "$line" =~ ^[[:space:]-]*(description|title|body):[[:space:]] ]]
+          }
+
+          is_excluded_text_line() {
+            local line="$1"
+            echo "$line" | grep -qE '(https?://|file://|github/|[?&](color|center|gray|licence)=[a-zA-Z0-9]+|"Authorization": "Bearer|types:[[:space:]]*\[[^]]+\]|--[a-z-]+ (center|color|gray)|\$\{?(color|center|gray);\}|\b(color|center|gray|licence)[_A-Z]*=|gum |\\$|shields\.io|stop-color|[a-z-]color[a-z-]*:|color[a-z-]*:[[:space:]]*#|align-items:)'
+          }
+
           echo "## British English Spelling Check" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
           echo "🔍 Checking $(echo "$FILES" | wc -l) files for American spellings..." | tee -a $GITHUB_STEP_SUMMARY
@@ -335,16 +355,23 @@ jobs:
               # - Gum/TUI library options
               # - Variable references ($color, ${color})
               # - Assignment patterns (color=, COLOR=) including query params
-              MATCHES=$(grep -inw "$american" "$file" 2>/dev/null | \
-                grep -vE '(https?://|file://|github/|[?&](color|center|gray|licence)=[a-zA-Z0-9]+|"Authorization": "Bearer|types:[[:space:]]*\[[^]]+\]|--[a-z-]+ (center|color|gray)|\$\{?(color|center|gray);}|\b(color|center|gray|licence)[_A-Z]*=|gum |\\$|shields\.io)' || true)
+              MATCHES=$(grep -inw "$american" "$file" 2>/dev/null || true)
               
               if [[ -n "$MATCHES" ]]; then
-                FILES_TO_FIX["$file"]=1
                 while IFS= read -r match; do
                   [[ -z "$match" ]] && continue
                   LINE_NUM=$(echo "$match" | cut -d: -f1)
-                  LINE_CONTENT=$(echo "$match" | cut -d: -f2- | sed 's/^[[:space:]]*//' | head -c 100)
-                  
+                  LINE_CONTENT=$(echo "$match" | cut -d: -f2-)
+
+                  if is_workflow_file "$file" && ! is_workflow_text_context "$LINE_CONTENT"; then
+                    continue
+                  fi
+
+                  if is_excluded_text_line "$LINE_CONTENT"; then
+                    continue
+                  fi
+
+                  FILES_TO_FIX["$file"]=1
                   echo "  ❌ $file:$LINE_NUM - '$american' → '$british'"
                   ISSUE_OUTPUT+="| \`$file:$LINE_NUM\` | $american | $british | $pattern |"$'\n'
                   ISSUES_FOUND=$((ISSUES_FOUND + 1))
@@ -390,11 +417,28 @@ jobs:
             ! -path "./.git/*" \
             ! -path "./node_modules/*" \
             ! -path "./vendor/*" \
-            ! -path "./.github/workflows/*" \
+            ! -path "./.github/workflows/anglicise.yml" \
             ! -path "./workflows-templates/anglicise.yml" \
             ! -path "./licence-templates/*" \
-            ! -path "./LICENSE" \
+            ! -path "./LICENCE" \
             2>/dev/null)
+
+          is_workflow_file() {
+            local file="$1"
+            [[ "$file" =~ ^\./\.github/workflows/.*\.ya?ml$ || "$file" =~ ^\./workflows-templates/.*\.ya?ml$ ]]
+          }
+
+          is_workflow_text_context() {
+            local line="$1"
+            [[ "$line" =~ ^[[:space:]]*# ]] ||
+            [[ "$line" =~ ^[[:space:]-]*name:[[:space:]] ]] ||
+            [[ "$line" =~ ^[[:space:]-]*(description|title|body):[[:space:]] ]]
+          }
+
+          is_excluded_text_line() {
+            local line="$1"
+            echo "$line" | grep -qE "(https?://|github/|[?&](color|center|gray|licence)=|=[\"'](center|color|licence)|types:[[:space:]]*\[[^]]+\]|--[a-z-]+ (center|color|gray)|--color|--center|\$\{?(color|center|gray|licence)|\b(COLOR|CENTER|GRAY|LICENCE)[_A-Z]*=|gum |\\$|shields\.io|stop-color|[a-z-]color[a-z-]*:|color[a-z-]*:[[:space:]]*#|align-items:)"
+          }
           
           FIXED_COUNT=0
           
@@ -419,7 +463,9 @@ jobs:
               # - Escaped line continuations (trailing backslash)
               # NOTE: filename exclusion is handled in the perl regex via (?!\.)
               # so that 'colors' in a comment is fixed even if 'colours.sh' appears on the same line
-              if echo "$line" | grep -qE "(https?://|github/|[?&](color|center|gray|licence)=|=[\"'](center|color|licence)|types:[[:space:]]*\[[^]]+\]|--[a-z-]+ (center|color|gray)|--color|--center|\$\{?(color|center|gray|licence)|\b(COLOR|CENTER|GRAY|LICENCE)[_A-Z]*=|gum |\\$|shields\.io)"; then
+              if is_workflow_file "$file" && ! is_workflow_text_context "$line"; then
+                echo "$line"
+              elif is_excluded_text_line "$line"; then
                 echo "$line"
               else
                 # Apply case-preserving replacement using perl
@@ -455,7 +501,21 @@ jobs:
               
               # Check if file contains the word (case-insensitive, whole word)
               # Exclude lines where the match is inside a code/CLI pattern (filename exclusion handled by perl (?!\.))
-              if grep -inw "$american" "$file" 2>/dev/null | grep -qvE "(https?://|file://|github/|[?&](color|center|gray|licence)=[a-zA-Z0-9]+|\"Authorization\": \"Bearer|types:[[:space:]]*\[[^]]+\]|=[\"'](center|color|licence)|--[a-z-]+ (center|color|gray)|--color|--center|\$\{?(color|center|gray|licence)|\b(COLOR|CENTER|GRAY|LICENCE)[_A-Z]*|gum |\\$|shields\.io)"; then
+              SHOULD_FIX=false
+              while IFS= read -r match; do
+                [[ -z "$match" ]] && continue
+                MATCH_LINE=$(echo "$match" | cut -d: -f2-)
+                if is_workflow_file "$file" && ! is_workflow_text_context "$MATCH_LINE"; then
+                  continue
+                fi
+                if is_excluded_text_line "$MATCH_LINE"; then
+                  continue
+                fi
+                SHOULD_FIX=true
+                break
+              done < <(grep -inw "$american" "$file" 2>/dev/null || true)
+
+              if [[ "$SHOULD_FIX" == true ]]; then
                 case_preserve_replace "$file" "$american" "$british"
                 echo "  ✓ Fixed in: $file"
                 FIXED_COUNT=$((FIXED_COUNT + 1))
@@ -465,6 +525,23 @@ jobs:
           
           echo "✅ Applied fixes to $FIXED_COUNT file(s)"
 
+      - name: Validate workflow identifiers remain canonical
+        if: steps.check.outputs.needs_fix == 'true'
+        run: |
+          set -euo pipefail
+          BAD=0
+          for file in .github/workflows/*.yml workflows-templates/*.yml; do
+            [[ -f "$file" ]] || continue
+            if grep -nE '^[[:space:]]*analyse:[[:space:]]*$|needs:[[:space:]]*\[[^]]*\banalyse\b[^]]*\]|uses:[[:space:]]+[^[:space:]]+/analyse@' "$file"; then
+              BAD=1
+            fi
+          done
+          if [[ "$BAD" -ne 0 ]]; then
+            echo "❌ Found UK spelling in workflow functional identifiers; aborting."
+            exit 1
+          fi
+          echo "✅ Workflow functional identifiers remain canonical."
+
       - name: Setup bot identity (if fixes needed)
         id: import_gpg
         if: steps.check.outputs.needs_fix == 'true'

.github/workflows/automerge.yml

@@ -1,3 +1,6 @@
+# Template created by https://github.com/XAOSTECH/dev-control
+# See templates folder documentation for details.
+
 name: Automerge
 
 # PRIVILEGED workflow - runs with write permissions after validation
@@ -210,135 +213,65 @@ jobs:
     steps:
       - name: Generate App Token
         id: app_token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@v2
         with:
           app-id: ${{ secrets.XB_AI }}
           private-key: ${{ secrets.XB_PK }}
 
-      - name: Checkout base branch
-        uses: actions/checkout@v4
-        with:
-          # Shallow clone - automerge only needs base ref, not PR history
-          # Reduces attack surface by not fetching untrusted PR commits
-          fetch-depth: 1
-          token: ${{ steps.app_token.outputs.token }}
-
-      - name: Setup bot identity
-        id: identity
-        uses: ./.github/actions/identity
-        with:
-          gpg-private-key: ${{ secrets.XB_GK }}
-          gpg-passphrase: ${{ secrets.XB_GP }}
-          user-token: ${{ secrets.XB_UT }}
-          bot-name: ${{ vars.BOT_NAME || 'xaos-bot' }}
-
-      - name: Merge PR from workflow_run (validated via artifact)
-        if: |
-          steps.identity.outputs.gpg-outcome == 'success' && 
-          needs.verify.outputs.should_merge == 'true'
-        env:
-          PR_NUMBER: ${{ needs.verify.outputs.pr_number }}
-          HEAD_SHA: ${{ needs.verify.outputs.head_sha }}
-          BASE_REF: ${{ needs.verify.outputs.base_ref }}
-          HEAD_LABEL: ${{ needs.verify.outputs.head_label }}
-          PR_TITLE: ${{ needs.verify.outputs.pr_title }}
-          GH_TOKEN: ${{ steps.app_token.outputs.token }}
-        run: |
-          set -euo pipefail
-          echo "🔀 Merging PR #${PR_NUMBER} with signed commit"
-          
-          git fetch origin "$BASE_REF"
-          git checkout -B "$BASE_REF" "origin/$BASE_REF"
-          # codeql[actions/untrusted-checkout/high]: False positive - PR pre-verified by guard job.
-          # Guard validates author (xaos-bot or approved contributor), labels (automerge), and approval.
-          # This fetch/merge only executes AFTER successful verification. No untrusted code execution.
-          git fetch origin "pull/${PR_NUMBER}/head":"refs/remotes/pr/${PR_NUMBER}"
-
-          # Create GitHub-style merge message
-          MERGE_MSG="Merge pull request #${PR_NUMBER} from ${HEAD_LABEL}\n\n${PR_TITLE}"
-
-          if ! git merge --no-ff -m "$MERGE_MSG" "refs/remotes/pr/${PR_NUMBER}"; then
-            echo "❌ Merge conflict for PR #${PR_NUMBER}. Aborting."
-            git merge --abort || true
-            exit 1
-          fi
-
-          git push origin "$BASE_REF"
-          echo "✅ Merged PR #${PR_NUMBER} successfully"
-
-      - name: Merge PRs from manual/anglicise (legacy guard path)
-        if: |
-          steps.identity.outputs.gpg-outcome == 'success' && 
-          needs.guard.outputs.should_merge == 'true'
-        env:
-          PR_NUMBERS: ${{ needs.guard.outputs.pr_numbers }}
-          GH_TOKEN: ${{ steps.app_token.outputs.token }}
-        run: |
-          set -euo pipefail
-          pr_numbers=$(echo "$PR_NUMBERS" | tr -d '[]' | tr ',' ' ')
-          for pr_number in $pr_numbers; do
-            echo "🔀 Merging PR #${pr_number} with signed commit"
-            pr_json=$(gh api "repos/${GITHUB_REPOSITORY}/pulls/${pr_number}")
-            base_ref=$(echo "$pr_json" | jq -r '.base.ref')
-            head_sha=$(echo "$pr_json" | jq -r '.head.sha')
-            pr_title=$(echo "$pr_json" | jq -r '.title')
-            pr_branch=$(echo "$pr_json" | jq -r '.head.label')
-
-            git fetch origin "$base_ref"
-            git checkout -B "$base_ref" "origin/$base_ref"
-            # codeql[actions/untrusted-checkout/high]: False positive - PR pre-verified by guard job.
-            # Guard validates author (xaos-bot or approved contributor), required labels (automerge),
-            # and approval status. This fetch/merge only executes AFTER successful validation.
-            # No untrusted code runs - we merge verified commits with GPG signature for traceability.
-            git fetch origin "pull/${pr_number}/head":"refs/remotes/pr/${pr_number}"
-
-            # Create GitHub-style merge message
-            MERGE_MSG="Merge pull request #${pr_number} from ${pr_branch}\n\n${pr_title}"
-
-            if ! git merge --no-ff -m "$MERGE_MSG" "refs/remotes/pr/${pr_number}"; then
-              echo "❌ Merge conflict for PR #${pr_number}. Aborting."
-              git merge --abort || true
-              exit 1
-            fi
-
-            if ! git log -1 --pretty=%B | grep -q "${head_sha}"; then
-              echo "ℹ️ Merge commit created; pushing to ${base_ref}"
-            fi
-
-            git push origin "$base_ref"
-          done
-
-      - name: Merge via API (fallback - no GPG signature)
-        if: |
-          steps.identity.outputs.gpg-outcome != 'success' && 
-          (needs.verify.outputs.should_merge == 'true' || needs.guard.outputs.should_merge == 'true')
+      - name: Merge PR from workflow_run via API (safe privileged path)
+        if: needs.verify.outputs.should_merge == 'true'
         uses: actions/github-script@v7
         env:
           PR_NUMBER_SINGLE: ${{ needs.verify.outputs.pr_number }}
-          PR_NUMBERS_MULTI: ${{ needs.guard.outputs.pr_numbers }}
+          EXPECTED_HEAD_SHA: ${{ needs.verify.outputs.head_sha }}
         with:
           github-token: ${{ steps.app_token.outputs.token }}
           script: |
             const { owner, repo } = context.repo;
-            let prNumbers = [];
-            
-            // Handle single PR from workflow_run
-            if (process.env.PR_NUMBER_SINGLE) {
-              prNumbers.push(parseInt(process.env.PR_NUMBER_SINGLE, 10));
+            const prNumber = parseInt(process.env.PR_NUMBER_SINGLE || '', 10);
+            const expectedHead = process.env.EXPECTED_HEAD_SHA;
+            if (!Number.isInteger(prNumber)) {
+              core.setFailed('Invalid PR number from validation artifact');
+              return;
             }
-            
-            // Handle multiple PRs from manual/anglicise
-            if (process.env.PR_NUMBERS_MULTI) {
-              const multi = JSON.parse(process.env.PR_NUMBERS_MULTI || '[]');
-              prNumbers.push(...multi);
+            const pr = await github.rest.pulls.get({ owner, repo, pull_number: prNumber });
+            if (expectedHead && pr.data.head.sha !== expectedHead) {
+              core.setFailed(`Head SHA changed for PR #${prNumber}; expected ${expectedHead}, got ${pr.data.head.sha}`);
+              return;
             }
-            
-            for (const prNumber of prNumbers) {
-              try {
-                await github.rest.pulls.merge({ owner, repo, pull_number: prNumber });
-                core.info(`✅ Merged PR #${prNumber} via API fallback`);
-              } catch (error) {
-                core.setFailed(`❌ Failed to merge PR #${prNumber}: ${error.message}`);
-              }
+            await github.rest.pulls.merge({
+              owner,
+              repo,
+              pull_number: prNumber,
+              sha: pr.data.head.sha,
+              merge_method: 'merge',
+              commit_title: `Merge pull request #${prNumber} from ${pr.data.head.label}`,
+              commit_message: pr.data.title,
+            });
+            core.info(`✅ Merged PR #${prNumber} via workflow_run artifact validation`);
+      - name: Merge PRs from manual/anglicise via API (safe path)
+        if: needs.guard.outputs.should_merge == 'true'
+        uses: actions/github-script@v7
+        env:
+          PR_NUMBERS_MULTI: ${{ needs.guard.outputs.pr_numbers }}
+        with:
+          github-token: ${{ steps.app_token.outputs.token }}
+          script: |
+            const { owner, repo } = context.repo;
+            const prNumbers = JSON.parse(process.env.PR_NUMBERS_MULTI || '[]');
+            for (const raw of prNumbers) {
+              const prNumber = parseInt(String(raw), 10);
+              if (!Number.isInteger(prNumber)) continue;
+              const pr = await github.rest.pulls.get({ owner, repo, pull_number: prNumber });
+              await github.rest.pulls.merge({
+                owner,
+                repo,
+                pull_number: prNumber,
+                sha: pr.data.head.sha,
+                merge_method: 'merge',
+                commit_title: `Merge pull request #${prNumber} from ${pr.data.head.label}`,
+                commit_message: pr.data.title,
+              });
+              core.info(`✅ Merged PR #${prNumber} via guarded manual path`);
             }