chore: update repo-platform template to build@a703906f0b72

[Vivswan]

Automated template update from Vivswan/repo-platform (build branch).

• Previous: fc67557
• New: build@a703906f0b72

Review any merge conflicts and confirm repository-local sections were preserved before merging.

Note

This branch is regenerated on every sync run; manual commits
pushed to it are overwritten. Make fixes in a separate branch or
after merging.

Split-class files were rebuilt structurally over this update: the managed
half comes from a clean render at the new template ref, the
repository-local half byte-for-byte from the previous commit, and
copier's merged result for these files was discarded. Local edits inside
a managed half do NOT survive this rebuild (managed halves are
template-owned); such edits are reset and flagged below. Each bullet
names its file's actual disposition (not every file has previous content
to carry); verify each file's diff before merging:

• .gitignore: repository-local region restored from the repository's copy
• AGENTS.md: repository tail re-appended below the fresh managed content
• CONTRIBUTING.md: repository tail re-appended below the fresh managed content
• SECURITY.md: repository copy kept whole (its managed content matches the render)

One-run starter pin rollout: repo-platform's composite actions now ship on the green-gated build delivery branch instead of floating on main or the retired actions branch, but starter workflows are rendered once and repo-owned, so template sync cannot re-render their pins. This sync checked each starter for the retired fuzz-issue pins; a rewrote line below is a byte-surgical port (only the exact pin token changed, every other byte is untouched), a left alone line is a hand-set pin this rollout never touches:

• .github/workflows/nightly-fuzz.yml: rewrote 2 occurrence(s) of Vivswan/repo-platform/actions/fuzz-issue@main to Vivswan/repo-platform/actions/fuzz-issue@build
• .github/workflows/nightly.yml: rewrote 2 occurrence(s) of Vivswan/repo-platform/actions/fuzz-issue@main to Vivswan/repo-platform/actions/fuzz-issue@build

[Copilot]

🟡 Changes recommended

The required check migration cannot satisfy branch protection during rollout, and an existing CI topology test now fails.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Updates the repo-platform template, centralizing CI and moving shared actions to the green-gated build branch.

Changes:

• Replaces local gate jobs with reusable fleet CI and an external all-green verdict.
• Updates workflow action pins and Bun to 1.4.0.
• Refreshes template metadata while preserving local sections.

File summaries

File	Description
CONTRIBUTING.md	Updates CI guidance.
AGENTS.md	Documents the new fleet CI model.
.gitignore	Refreshes managed-region metadata.
.github/workflows/release.yml	Moves release-health to @build.
.github/workflows/nightly.yml	Moves fuzz-issue actions to @build.
.github/workflows/nightly-fuzz.yml	Moves fuzz-issue actions to @build.
.github/workflows/ci.yml	Delegates gating jobs to fleet CI.
.github/workflows/all-green.yml	Adds the external verdict workflow.
.github/repo-platform-manifest.json	Updates ownership grammar, hashes, and provenance.
.copier-answers.yml	Advances the template revision.
.bun-version	Upgrades Bun to 1.4.0.

Review details

• Files reviewed: 10/11 changed files
• Comments generated: 3
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Vivswan]

Triage of the Copilot review

All three findings verified as correct. Disposition below; threads replied and resolved.

Required check, on this head:

$ gh pr checks 61 | grep -c all-green
0
$ gh api repos/.../rulesets/19194858 --jq '...required_status_checks[].context'
all-green

Repo-owned test, in the failing checks / check job:

40 |     expect(jobs, "ci.yml has no all-green job").toContain("all-green");
error: ci.yml has no all-green job

Finding	Verdict	Owner
No producer for the required all-green check during rollout	Correct, blocks merge	repo-platform (rollout mechanic)
test/docs/ci-workflow.test.ts asserts the retired topology	Correct, blocks CI	this repository
AGENTS.md local section describes the removed release job	Correct, stale docs	this repository

Two of the three are repo-owned (neither path appears in .github/repo-platform-manifest.json), so they need a follow-up branch here; template sync will not heal them. The first is inherent to the first verdict sync in any fleet repo and clears once all-green.yml is on main.

Diff safety was checked separately and is clean: no repo-owned file deleted or overwritten, the manifest gains exactly one entry (.github/workflows/all-green.yml), the .gitignore and AGENTS.md/CONTRIBUTING.md local halves are byte-preserved, the starter pin rewrites in nightly.yml/nightly-fuzz.yml changed only the ref token, and no action source under src/ or lib/ is touched.

[Vivswan]

Pushed d5fdbf9, which unblocks checks / check.

The failing test is retired, not fixed. test/docs/ci-workflow.test.ts asserted the old CI topology - that ci.yml carries an in-run all-green job whose needs: lists every other job. This sync moves the verdict out of the run into the external all-green.yml, so that assertion could only fail. The file held nothing but that contract, so it is deleted whole rather than patched.

Nothing is left unguarded. The fleet machinery already covers what the test protected: ci.yml and all-green.yml are manifest-tracked as managed with content hashes, validate-template catches drift on them, and repo-platform's require-job anchor stops a consumer disarming the gate. The deleted test only ever read top-level ci.yml jobs anyway - it never looked inside the repo-owned checks.yml, so it would not have noticed a gating job removed there either.

Also corrected four repo-owned comments that described the same retired shape:

• AGENTS.md and CONTRIBUTING.md - the release job is now info-release with needs: [checks, ci], kept out of the verdict by its info- prefix rather than by being absent from a needs list. The old prose said "Do not add it to the needs list", which no longer means anything.
• .github/workflows/checks.yml - what a failing boundary-check parks (info-release, through the checks call), and why the skip lives on the steps: a skipped job now stands down instead of failing, so the job stays unconditional to give the verdict a real result.
• .github/settings.yml - all-green is a check run the verdict workflow creates, not a CI job with a needs: list.

Verified locally on the new head: bun run check exits 0, bun test is 1661 pass / 1 skip / 0 fail, yamllint -s over every tracked YAML is clean. The settings.yml change is comment-only - parsing HEAD and the new version yields identical data.

[Copilot]

🔵 Needs a closer look

The first-run gate migration requires an intentional administrator bypass and final human validation.

Review details

• Files reviewed: 13/14 changed files
• Comments generated: 0 new
• Review effort level: Balanced

[Copilot]

🟡 Changes recommended

Repository checks still assert the removed in-run gate, and several preserved documentation sections describe the obsolete topology.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Suppressed comments (1)

.github/workflows/ci.yml:91

• This topology migration also leaves repository-owned guidance encoding the removed in-run gate: .github/settings.yml:81-83 says all-green is in ci.yml with a needs list, and .github/workflows/checks.yml:63-70 says release needs that job and skipped checks fail it. Those comments now contradict this info-release/external-verdict design and should be updated with the migration.

  info-release:
    needs: [checks, ci]

• Files reviewed: 10/11 changed files
• Comments generated: 2
• Review effort level: Balanced

[Copilot]

🟢 Approval recommended

The updated workflow topology is internally consistent, repository-local sections remain preserved, and all observed checks pass.

Review details

• Files reviewed: 13/14 changed files
• Comments generated: 0 new
• Review effort level: Balanced