v1.8.0
Give shell-ci a test lane, close a main-guard bypass, and stop python-ci from tracking latest.
shell-ci (#87)
- New
test-commandinput runs the repository's own shell test suite after the lint job;apt-packagesinstalls whatever that suite needs. - The lane is skipped entirely when
test-commandis empty, so existing callers are unaffected.
main-guard (#87)
- Require the pull request head to live in this repository, not just to be named
develop. The branch name alone is forgeable — a fork can name any branchdevelopand satisfy the old check.
python-ci (#87)
ruff-versionandpytest-versionnow default to pins (0.12.0/8.4.0) instead of the empty "use latest" value. An unpinned tool changes lint and test behaviour for every Python consumer the day a new release ships, with no per-repo buffer.- Only enable pip caching when a dependency file actually exists —
cache: pipfailed outright on repos without one.
Concurrency (#87)
bun-ci,go-audit,go-ci,go-fuzz,python-ci,rust-audit,rust-ci,rust-fuzz,rust-supply-chainandshell-cinow key their concurrency group onworking-directory. Two directories in the same repo no longer cancel each other's runs.
Repo-local (no consumer impact)
- Run the DCO gate on this repository's own pull requests (#78).
- Retire the
profile-versionsbot (#84); refresh and restructure the org profile (#83, #85, #88); trim the README (#77).
Upgrade note:
python-ciconsumers that relied on the previous "empty = latest" default now get the pins above. Passruff-version/pytest-versionexplicitly to override, and bump the pins through a new.githubrelease so the change is reviewable per repo.