chore: sync standards components by melodic-standards-sync[bot] · Pull Request #15429 · melodic-software/claude-code-plugins

melodic-standards-sync · 2026-11-11T20:16:52Z

Summary

Automated exact-file synchronization from melodic-software/standards@1af4bb247c890ec874d0c5986eb7c280441b4502 (requested ref main).

No linked issue — recurring automated distribution, not tied to a tracked change.

Fix

Managed component mappings applied to melodic-software/claude-code-plugins:

actionlint: .github/actionlint.yaml → .github/actionlint.yaml (mode 100644)
dependabot-policy: components/dependabot-policy/policy.json → .github/standards/dependabot-policy/policy.json (mode 100644)
editorconfig-checker: .editorconfig-checker.json → .editorconfig-checker.json (mode 100644)
engineering-standards: components/engineering-standards/standards-index.md → docs/standards/README.md (mode 100644)
engineering-standards: standards/engineering/bulk-mutation.md → docs/standards/bulk-mutation.md (mode 100644)
engineering-standards: standards/engineering/concise-prose.md → docs/standards/concise-prose.md (mode 100644)
engineering-standards: standards/engineering/design-for-change.md → docs/standards/design-for-change.md (mode 100644)
engineering-standards: standards/engineering/deterministic-work-execution.md → docs/standards/deterministic-work-execution.md (mode 100644)
engineering-standards: standards/engineering/documentation-and-citations.md → docs/standards/documentation-and-citations.md (mode 100644)
engineering-standards: standards/engineering/reference-dont-duplicate.md → docs/standards/reference-dont-duplicate.md (mode 100644)
engineering-standards: standards/engineering/simpler-code.md → docs/standards/simpler-code.md (mode 100644)
engineering-standards: standards/engineering/source-authority-tiers.md → docs/standards/source-authority-tiers.md (mode 100644)
engineering-standards: standards/process/issue-tracker.md → docs/standards/issue-tracker.md (mode 100644)
github-actions-conventions: components/github-actions-conventions/vocabulary.json → .github/standards/github-actions-conventions/vocabulary.json (mode 100644)
github-actions-conventions: components/github-actions-conventions/vocabulary.schema.json → .github/standards/github-actions-conventions/vocabulary.schema.json (mode 100644)
gitleaks: .gitleaks.toml → .gitleaks.toml (mode 100644)
issue-body-contract-plugins: components/issue-body-contract/contract.json → docs/contracts/issue-body/contract.json (mode 100644)
lychee: lychee.toml → lychee.toml (mode 100644)
lychee-online-claude-code-plugins: components/lychee-online/targets/claude-code-plugins.yml → .github/workflows/maintenance-check-links-online-claude-code-plugins.yml (mode 100644)
managed-files-guard-caller: components/managed-files-guard/managed-files-guard.yml → .github/workflows/pr-check-managed-files-hosted.yml (mode 100644)
markdownlint: .markdownlint-cli2.jsonc → .markdownlint-cli2.jsonc (mode 100644)
node-runtime: .node-version → .node-version (mode 100644)
path-detection-guardrails: components/path-detection/machine-path-patterns.sh → plugins/guardrails/lib/path-detection/machine-path-patterns.sh (mode 100644)
pr-body-contract-rule: .claude/rules/pr-body-contract.md → .claude/rules/pr-body-contract.md (mode 100644)
pyright: components/pyright/pyrightconfig.json → .github/standards/pyright/pyrightconfig.json (mode 100644)
repository-text: .editorconfig → .editorconfig (mode 100644)
repository-text: .gitattributes → .gitattributes (mode 100644)
review-instructions: REVIEW.md → REVIEW.md (mode 100644)
runner-policy: components/runner-policy/package-lock.json → .github/standards/runner-policy/package-lock.json (mode 100644)
runner-policy: components/runner-policy/package.json → .github/standards/runner-policy/package.json (mode 100644)
runner-policy: components/runner-policy/policy.json → .github/standards/runner-policy/policy.json (mode 100644)
runner-policy: components/runner-policy/policy.schema.json → .github/standards/runner-policy/policy.schema.json (mode 100644)
runner-policy: components/runner-policy/repository-policy.schema.json → .github/standards/runner-policy/repository-policy.schema.json (mode 100644)
runner-policy: components/runner-policy/runner-policy.mjs → .github/standards/runner-policy/runner-policy.mjs (mode 100755)
shellcheck: .shellcheckrc → .shellcheckrc (mode 100644)
trusted-actors: components/trusted-actors/trusted-actors.json → .github/standards/trusted-actors/trusted-actors.json (mode 100644)
trusted-actors: components/trusted-actors/trusted-actors.schema.json → .github/standards/trusted-actors/trusted-actors.schema.json (mode 100644)
typos: _typos.toml → _typos.toml (mode 100644)
zizmor: .github/zizmor.yml → .github/zizmor.yml (mode 100644)

Verification

Review and merge this PR normally. Do not hand-edit these managed files downstream; change their standards source instead.

Security review: PR #15429 (chore: sync standards components)

No security issues found.

I read every hunk of the diff. It has 6 files: 4 first paths plus 2 byte-identical copies, as listed in identical.txt.

.github/workflows/pr-check-managed-files-hosted.yml (trusted path): the only change adds six paths to the on.pull_request.paths filter: four issue-form templates, .github/standards/issue-body-contract/contract.json, and the two new plugin reference/issue-body-contract.json copies. This makes the managed-files guard run on more pull requests, so it narrows nothing. Nothing else in the workflow changes: the trigger is still pull_request and not pull_request_target (L36), permissions stay contents: read / pull-requests: read (L95-L97), and the action is still SHA-pinned (L119). No trust control is widened.
docs/standards/issue-tracker.md (trusted path, docs/standards/**): the change adds an exception so the agent-ready work-item form need not set a native Issue Type at filing; triage sets it. I read this under the instruction-surface lens. The removed requirement is a taxonomy rule, not a guardrail in any protected class. Without it, an issue is left untyped until triage, with no route to a credential, token, code execution or billing. The form still applies the needs-triage floor label (contract labels). This diff does not add the form template itself. I did not consult the register file, because the change is not a guardrail removal.
plugins/bugs/reference/issue-body-contract.json, with identical copy plugins/work-items/reference/issue-body-contract.json: these are new, inert JSON data files. A repository-wide grep finds no code, hook, skill or manifest that reads issue-body-contract apart from the workflow path filter, the changelogs and the standards doc. Neither plugin's .claude-plugin/plugin.json is touched, so no manifest field changed. The copy's path is a plain reference/ data path, not a hook, workflow, settings or manifest path, so its content does nothing different there.
.changes/bugs/chore-standards-sync-224a1754.md, with identical copy .changes/work-items/…: changelog fragments only.

The PR description is a plain list of the sync's mappings. It contains no text telling the lane to pass the PR, skip a check or drop a finding.

critical-findings: 0

github-actions · 2026-11-11T22:01:37Z

claude-review reviewed 80d79d14f4f017a95241a544ae33f03c47510a59: read 6 of 6 changed file(s); 0 finding(s), 0 as inline comments.

CI code review: PR #15429 (chore: sync standards components)

Complete review: I read all 6 changed files. Two pairs are byte-identical, so I read the first file of each pair, and the job counts the copies:

.changes/bugs/chore-standards-sync-224a1754.md is the same as .changes/work-items/chore-standards-sync-a313f74d.md.
plugins/bugs/reference/issue-body-contract.json is the same as plugins/work-items/reference/issue-body-contract.json.

Each copy's path is a plugin's changelog fragment or reference file. Neither is a hook, workflow, settings or manifest path, so the content does nothing different at the copied path.

No findings.

What changed:

.github/workflows/pr-check-managed-files-hosted.yml: adds 7 paths to the pull_request.paths filter.
- These are the 4 issue-form templates, .github/standards/issue-body-contract/contract.json and the two plugin reference/issue-body-contract.json copies.
- The templates and .github/standards/issue-body-contract/ don't exist in this repository. The file's header comment says the list is the union of managed paths across every sync target, so paths missing here are expected and do no harm.
- The list stays sorted. Nothing in the job changed.
docs/standards/issue-tracker.md (trusted path docs/standards/**, whole change read): records one exception to the type rule. The agent-ready work-item form sets no Issue Type, and triage sets it later.
- The exception appears in all three places that state the rule ("Issue forms set no title prefix", "Filing an issue" and "The type axis"), and the three agree with each other.
- It also agrees with the synced contract's "agent-ready": { "nativeType": null }.
plugins/{bugs,work-items}/reference/issue-body-contract.json: a new managed copy of the standards contract.
- The JSON is well formed.
- floorLabels matches every typed form's labels, and decomposed-item has no form and no labels, which matches its description ("born triaged; no public form").
- The fragment says nothing in either plugin reads the file yet, so no runtime behavior changes.
Changelog fragments: a bump: patch fragment for each affected plugin (bugs, work-items), in the same format as the existing fragments in .changes/work-items/.
- A patch bump fits a reference file that nothing consumes.
- No plugin.json or marketplace.json changed, so there are no manifest lines to report.

Closing issue: none. The PR body says this is a recurring automated sync with no linked issue.

Embedded text: the PR body's "Do not hand-edit these managed files downstream" is guidance about how the files are maintained. It asks nothing of this lane.

Spend: none of note. The managed-files guard now also runs on pull requests that touch the 7 added paths, a small number of GitHub-hosted runner minutes.

melodic-automation-lanes · 2026-11-11T22:15:27Z

The pr-unblock lane stopped fix-ci on this pull request: the lane could fix a failing check only by weakening a test, which is refused, so it runs one fresh fixer round on this head that must keep the test's assertions. The lane sets no label: the run ends in a failing pr-unblock/fix-ci status on the head the lane gated.

Reason: ci-fix-weaken-retry
Head: 80d79d14f4f017a95241a544ae33f03c47510a59
Run: https://github.com/melodic-software/claude-code-plugins/actions/runs/43108671886

When a retry on this head can change the outcome, the lane runs one on its own, up to its per-head cap, and edits this comment if it stops again; a run that does not stop clears the status. When no retry can (a review thread the lane does not take or settle, or a failing check after the retries are spent), a person resolves the threads or gets the checks green, then dispatches the workflow below: that run finds the cause gone and clears the status. On a pull request the lanes App opened, the dispatchers start that run once per stop; on any other, a person does. A new commit to the branch starts clean.

To run it again on this head now, dispatch the pr-unblock workflow:

gh workflow run pr-unblock.yml -R melodic-software/claude-code-plugins -f pr-number=15429 -f activity=fix-ci

#988) No related issue: follow-up to #986 (owner-approved issue-body contract design) ## Summary #986 synced the issue-body contract into two plugin directories of `claude-code-plugins`. Its sync PR, melodic-software/claude-code-plugins#15429, cannot pass: `scripts/check-cross-plugin-source-drift.sh` refuses a file byte-identical across two plugins unless the same change registers it, and a registry entry cannot land first because the check also refuses an entry with fewer than two copies (STALE BASELINE). A sync PR cannot carry that registration. ## Fix - `sync-manifest.yml`: `issue-body-contract-bugs` and `issue-body-contract-work-items` become one component, `issue-body-contract-plugins`, delivering `contract.json` to `docs/contracts/issue-body/contract.json` in `claude-code-plugins`. That repository's `sync-shared-copies.sh` fans the canonical into each plugin's `reference/`, registered in the same change, as it already does for `docs/contracts/standards/README.md`. - The hosted managed-files guard lists the new destination instead of the two plugin paths. - The component README names the new path. ## Verification - `bash distribution/sync-manifest.sh validate`: valid, 52 components, 15 targets. - `components/managed-files-guard/managed-files-guard.test.sh`: passes. - In a `claude-code-plugins` checkout, a registry entry for `reference/issue-body-contract.json` without the copies fails `check-cross-plugin-source-drift.sh --check` with STALE BASELINE (exit 1), which rules out registering first. ## Related - #986 - melodic-software/claude-code-plugins#15429 (the sync PR this push refreshes) 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01VQb9Q2ceZLXhTR4d1vkTCe Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

…b4502)

melodic-standards-sync Bot added the standards-sync Standards-config sync PRs from the standards-sync workflow. label Nov 11, 2026

melodic-standards-sync Bot enabled auto-merge November 11, 2026 20:16

kyle-sexton mentioned this pull request Nov 11, 2026

fix(issue-body-contract): deliver the plugin contract to one root path melodic-software/standards#988

Merged

kyle-sexton mentioned this pull request Nov 11, 2026

fix(pr-unblock): keep fix-ci off standards-sync and release PRs #15447

Merged

chore: sync standards components (1af4bb247c890ec874d0c5986eb7c280441…

9d8cbb1

…b4502)

melodic-standards-sync Bot force-pushed the chore/standards-sync branch from 80d79d1 to 9d8cbb1 Compare November 11, 2026 22:28

melodic-standards-sync Bot disabled auto-merge November 11, 2026 22:28

melodic-standards-sync Bot enabled auto-merge November 11, 2026 22:28

melodic-standards-sync Bot added this pull request to the merge queue Nov 11, 2026

Merged via the queue into main with commit 269a74f Nov 11, 2026
66 checks passed

melodic-standards-sync Bot deleted the chore/standards-sync branch November 11, 2026 22:45

kyle-sexton mentioned this pull request Nov 11, 2026

feat(work-items): read issue-body skeletons from the org issue-body contract #15453

Merged

Navigation Menu

Repository navigation

chore: sync standards components - #15429

chore: sync standards components#15429
melodic-standards-sync[bot] merged 1 commit into
mainfrom
chore/standards-sync

melodic-standards-sync Bot commented Nov 11, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Nov 11, 2026

Uh oh!

github-actions Bot commented Nov 11, 2026

Uh oh!

melodic-automation-lanes Bot commented Nov 11, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

melodic-standards-sync Bot commented Nov 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Fix

Verification

Related

Uh oh!

github-actions Bot commented Nov 11, 2026

Security review: PR #15429 (chore: sync standards components)

Uh oh!

github-actions Bot commented Nov 11, 2026

CI code review: PR #15429 (chore: sync standards components)

Uh oh!

melodic-automation-lanes Bot commented Nov 11, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

melodic-standards-sync Bot commented Nov 11, 2026 •

edited

Loading