Oliver Kieselbach b89008e745 ci(agent): customer release notes come in through the release_notes dispatch input, never from CI (D-187) ...

build-agent.yml gains an optional release_notes input; the release body opens with
"What's new" from that input, or a generic fallback linking to the docs changelog
plus a marker the operator tooling uses to anchor the next notes, so releases
dispatched by hand leave no gap. --generate-notes dropped (pull requests only);
a compare link to the previous tag replaces it. Plan-first rule: plans live in
internal/work/plans from the first draft. Gitlinks: internal, .claude/commands.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

2026-09-04 15:47:10 +02:00

..

bootstrap-script-gates.yml

ci(scripts): publish customer scripts on push, decoupled from the agent release

2026-08-19 15:09:33 +02:00

build-agent.yml

ci(agent): customer release notes come in through the release_notes dispatch input, never from CI (D-187)

2026-09-04 15:47:10 +02:00

build-msi.yml

ci(msi): build from project dir - wix resolves File/@Source against cwd

2026-08-18 03:11:12 +02:00

ci.yml

ci: skip CI and CodeQL on gitlink bumps and prose-only commits

2026-09-04 05:00:25 +02:00

codeql.yml

ci: skip CI and CodeQL on gitlink bumps and prose-only commits

2026-09-04 05:00:25 +02:00

combine-rules.yml

fix(ci): no third-party action holds release/deploy credentials by mutable tag — build-agent creates releases with first-party gh release create (job holds contents/id-token/attestations:write), combine-rules pushes generated outputs with plain git (contents:write on main), deploy-web builds the static export in CI (setup-node 22, npm ci, next build — same path ci.yml tests) and uploads it with the exactly pinned SWA CLI 2.0.10 instead of Azure/static-web-apps-deploy (Oryx in-container build, deploy token as action input), attests portal-<sha>.tar.gz and drops the unusable per-PR preview environments; azure/login and Azure/functions-action are SHA-pinned with version comments for Dependabot

2026-08-30 18:21:19 +02:00

deploy-backend.yml

fix(ci): no third-party action holds release/deploy credentials by mutable tag — build-agent creates releases with first-party gh release create (job holds contents/id-token/attestations:write), combine-rules pushes generated outputs with plain git (contents:write on main), deploy-web builds the static export in CI (setup-node 22, npm ci, next build — same path ci.yml tests) and uploads it with the exactly pinned SWA CLI 2.0.10 instead of Azure/static-web-apps-deploy (Oryx in-container build, deploy token as action input), attests portal-<sha>.tar.gz and drops the unusable per-PR preview environments; azure/login and Azure/functions-action are SHA-pinned with version comments for Dependabot

2026-08-30 18:21:19 +02:00

deploy-mcp.yml

fix(ci): no third-party action holds release/deploy credentials by mutable tag — build-agent creates releases with first-party gh release create (job holds contents/id-token/attestations:write), combine-rules pushes generated outputs with plain git (contents:write on main), deploy-web builds the static export in CI (setup-node 22, npm ci, next build — same path ci.yml tests) and uploads it with the exactly pinned SWA CLI 2.0.10 instead of Azure/static-web-apps-deploy (Oryx in-container build, deploy token as action input), attests portal-<sha>.tar.gz and drops the unusable per-PR preview environments; azure/login and Azure/functions-action are SHA-pinned with version comments for Dependabot

2026-08-30 18:21:19 +02:00

deploy-web.yml

fix(ci): no third-party action holds release/deploy credentials by mutable tag — build-agent creates releases with first-party gh release create (job holds contents/id-token/attestations:write), combine-rules pushes generated outputs with plain git (contents:write on main), deploy-web builds the static export in CI (setup-node 22, npm ci, next build — same path ci.yml tests) and uploads it with the exactly pinned SWA CLI 2.0.10 instead of Azure/static-web-apps-deploy (Oryx in-container build, deploy token as action input), attests portal-<sha>.tar.gz and drops the unusable per-PR preview environments; azure/login and Azure/functions-action are SHA-pinned with version comments for Dependabot

2026-08-30 18:21:19 +02:00

indexnow-notify.yml

added valid return codes

2026-03-20 08:21:04 +01:00

oidc-login-test.yml

fix(ci): no third-party action holds release/deploy credentials by mutable tag — build-agent creates releases with first-party gh release create (job holds contents/id-token/attestations:write), combine-rules pushes generated outputs with plain git (contents:write on main), deploy-web builds the static export in CI (setup-node 22, npm ci, next build — same path ci.yml tests) and uploads it with the exactly pinned SWA CLI 2.0.10 instead of Azure/static-web-apps-deploy (Oryx in-container build, deploy token as action input), attests portal-<sha>.tar.gz and drops the unusable per-PR preview environments; azure/login and Azure/functions-action are SHA-pinned with version comments for Dependabot

2026-08-30 18:21:19 +02:00

pester.yml

ci(scripts): publish customer scripts on push, decoupled from the agent release

2026-08-19 15:09:33 +02:00

publish-scripts.yml

ci(scripts): publish customer scripts on push, decoupled from the agent release

2026-08-19 15:09:33 +02:00