v7.15.0

Changes

• @r7 consumers need no adjustment. No input, output, secret or default was added, renamed or removed anywhere
  in this release. Repositories that already request pages in documentation_steps start publishing documentation
  again on their next release without any change on their side.

• IntermediateCleanUp.yml is deprecated and will be removed in r8. It is superseded by
  CleanupArtifacts.yml, which CompletePipeline.yml already instantiates for both of its cleanup jobs. The template
  now emits a deprecation warning as its first step, mirroring ArtifactCleanUp.yml, and states the migration:

  # before
  sqlite_coverage_artifacts_prefix: ${{ fromJson(needs.Params.outputs.artifact_names).codecoverage_sqlite }}-
  xml_unittest_artifacts_prefix:    ${{ fromJson(needs.Params.outputs.artifact_names).unittesting_xml }}-
  
  # after
  json: ${{ needs.Params.outputs.artifact_names }}
  artifact-json-ids: >-
    codecoverage_sqlite:-*
    unittesting_xml:-*

  This deprecation is why the release is v7.15.0 and not a patch: semver requires a minor increment when public API
  functionality is marked deprecated.

• CheckCodeQuality.yml's artifact input is now unused. It is kept declared, because removing an input from a
  stable release branch breaks every consumer that passes it — CompletePipeline does. See the note at the bottom.

• All if expressions in CompletePipeline.yml that combine a status check function with further terms are written
  as folded block scalars, one term per line.

Bug Fixes

• CompletePipeline.yml: documentation was never published to GitHub Pages when application testing is disabled.
  PDFDocumentation and PublishToGitHubPages were the last two jobs whose if carried no status check function:

  if: contains(inputs.documentation_steps, 'pages')

  Without one, GitHub keeps the implicit success(), and that is evaluated over the entire dependency closure, not
  just over needs. With the default apptest: 'false', AppTestingParams and AppTesting are skipped, and that
  state reaches both jobs through PublishTestResults → Documentation. Those two survive on !cancelled(), but
  surviving does not stop the propagation, so both documentation jobs were skipped although their condition was true
  and all of their direct dependencies had succeeded.

  Present since v7.12.0, which reactivated application testing (1a11cbb) and added AppTesting to
  PublishTestResults.needs. v7.14.0 (#236) converted the jobs that were failing loudly to !cancelled() but did not
  reach these two, because they fail silently — a skipped job is not a red pipeline.

  Both now read:

  if: >-
    ${{ !failure() && !cancelled()
     && contains(inputs.documentation_steps, 'pages')
    }}

  !failure() rather than always(): a skipped dependency must no longer suppress the job, a failed one still
  must — that was the pre-v7.12.0 behavior.

  Verified against the pyVHDLModel v0.38.0 release, modelling the job graph of
  run 30691716593 against the observed results:

  job	status function	direct needs all successful	skipped ancestors	result
  VersionCheck	no	yes	–	success
  Install	no	yes	–	success
  PDFDocumentation	no	yes	AppTestingParams, AppTesting	skipped
  PublishToGitHubPages	no	yes	AppTestingParams, AppTesting	skipped
  Documentation, IntermediateCleanUp, ArtifactCleanUp, TriggerTaggedRelease	yes	–	AppTestingParams, AppTesting	success

  Every job without a status check function and with a skipped ancestor was skipped; every job without one and with a
  clean ancestor set ran. No counterexample.

  Impact: no repository using CompletePipeline.yml has published documentation since v7.12.0 (2026-07-13). Affected
  releases are pyVHDLModel v0.38.0 and sphinx-reports v0.11.2; both can be republished by dispatching Pipeline on
  their tags once r7 carries this release.

• PrepareJob.yml: submodules were never detected. The check tested for a file named .gitsubmodules; Git's file
  is .gitmodules. has_submodules was therefore always 'false', and git_submodule_count, git_submodule_names
  and git_submodule_paths kept their initial empty values — for every repository, since the workflow was introduced.

  Verified against a scratch repository with two submodules: has_submodules=true, count=2, names=libA:libB,
  paths=deps/libA:deps/libB, and has_submodules=false once .gitmodules is removed.

  Nothing consumes these four outputs today, which is why nobody hit it.

• CleanupArtifacts.yml: an unknown artifact ID raised NameError. Both compute steps called printf(...) in
  their case _: fallback, but the step runs shell: python, where printf is not a function. Since a shell: python
  step aborts on an exception, an artifact-json-ids entry that is not a key of the JSON dictionary meant no
  artifact of that set was deleted and the cleanup job failed — not "one entry skipped".

  Reproduced against both revisions:

  BEFORE -> exit code 1   NameError: name 'printf' is not defined. Did you mean: 'print'?
  AFTER  -> Name 'unknown_key' not found in JSON dictionary.
            Artifact to delete:
              pyX-UnitTestReportSummary-XML-*
              pyX-Packages
  

• CheckCodeQuality.yml: the security scan could be skipped silently. The Bandit step was guarded by
  if: inputs.artifact != '', although the step writes its report to a fixed path (report/bandit/report.xml) and
  never used that parameter. An empty artifact name skipped the scan while the job installed bandit, ran to the end
  and reported success — a green security check that scanned nothing. The guard is removed.

Documentation

Everything in this section is documentation only; no job template behaviour depends on it.

• The complete documentation rework (#245). Every workflow_call input, output and secret of every job template
  now has a detail section and a summary-table row, cross-checked against the YAML by script. Highlights:

  • Three templates documented for the first time: ApplicationTesting (was a .. todo:: stub titled "idea"),
    CheckCodeQuality and CleanupArtifacts (no page at all) — which is why CompletePipeline had been linking to
    the deprecated cleanup template for the job it actually instantiates.
  • VerifyDocs was a stub too; it is documented and marked on hold, since it is instantiated nowhere.
  • CleanupArtifacts' artifact-json-ids syntax is written down for the first time.
  • 14 documented default values corrected against the workflow files, e.g. reports/unit → report/unit.
  • Every Behavior list names the input parameter that configures, enables or disables each step.
  • One convention for tool links (:term: in prose, :term:X (:pypi:PyPI package ) in dependency lists), one
    convention for boolean parameters (Possible Values lists the values, Description explains them — applied to all
    29 of them).
  • Dependency.rst separates what a job template installs from what the caller supplies through requirements,
    apt, brew and pacboy.
  • Glossary gained pyTooling/MiKTeX, wheel, upload-artifact, download-artifact, pylint and radon.
  • Index directives completed: 13 pages were missing entries for tools they mention.

• New Conditional Jobs section on the Development page (doc/Deveopment.rst, previously a single .. todo::).
  It documents the status check functions and the implicit success(), the propagation of skipped jobs along the
  transitive dependency closure with the defect above as the worked example, which function to pick for which kind of
  job, and how to verify that a switch skips only what it should. The GitHub specifics live there instead of in
  comments inside the workflow files.

• TagReleaseCommit documents why a dispatched tag pipeline is titled with the workflow name, and proposes
  run-name: ${{ github.ref_type == 'tag' && github.ref_name || '' }} in the calling workflow as the fix. Untested
  end to end — see the note below.

• The documentation builds with zero page-level Sphinx warnings.

Unit Tests

• _Checking_NamespacePackage_Pipeline.yml now requests 'html latex pdf'. It is the pipeline with application
  testing disabled, so it combines a skipped upstream job with a job conditioned on documentation_steps:
  PDFDocumentation must run, and would have been skipped before this change. pages is deliberately not added —
  PublishToGitHubPages deploys, and the verification pipeline would overwrite this repository's own GitHub Pages
  site. Testing that half needs a dry-run mode on the job template; recorded as a finding rather than approximated.

  Verified on run 30764122048: AppTestingParams and
  AppTesting skipped, PDFDocumentation executed, run conclusion success.

• _Checking_CleanupArtifacts.yml passes an unknown_key entry, so the case _: branch is exercised by the
  verification pipeline rather than only by a typo in production.

• _Checking_SimplePackage_Pipeline.yml is green again. It had failed on every push for at least six runs, always
  in CodeQuality / 🩺 Linting, on two findings in the dummy package (Missing function or method docstring,
  Consider using 'sys.exit' instead). pylint exits non-zero for any message and the step has no
  continue-on-error, so a real regression could not be told apart from the standing failure. Both fixtures now rate
  10.00/10.

• All seven _Checking_* workflows carry run-name, so a dispatched tag run is titled with the tag. This repository
  does not exercise that path — its own tags arrive as push events — so the line is correct but unproven here.

• The PrepareJob submodule logic and the CleanupArtifacts fallback branch were executed offline against both
  revisions before pushing; output quoted above. All changed shell scripts pass bash -n, all changed workflows parse
  as YAML.

---

Related Issues and Pull-Requests

• Contains #245 (documentation rework, finding A4) and #246 (three workflow fixes, findings A11, A12, A13), both
  already merged into dev.
• Follow-up to #236 (v7.14.0), Fix jobs being skipped when application testing is disabled, which fixed the same
  defect class for six other jobs but missed the two that skip silently.
• Regression introduced by 1a11cbb, Reactivated Application Testing, released with v7.12.0.
• Reported from the VHDL/pyVHDLModel v0.38.0 release run,
  where the release completed but PublishToGitHubPages was skipped on both main and the v0.38.0 tag.

Important

r7 must be updated after merging, or no consumer publishes documentation.

Note

CheckCodeQuality.yml's artifact input is now referenced nowhere. It is declared required: true, so it cannot be
dropped without breaking consumers that pass it on @r7. Two options for r8: remove it, or give it a purpose by
uploading the bandit XML report under that name.

Note

Open findings not addressed here: A7 (PDFDocumentation fails on 763 unresolved LaTeX references), A3
(PublishTestResults exercises the released package, not the branch), A10 (PublishToGitHubPages cannot be verified
without deploying), A16 (mingw_requirements bypasses the ./ path resolution), A17 and A18 (both scheduled for
r8).

---

Published from Verification of Pipeline Templates (Namespace Package) workflow triggered by Paebbels on 2026-08-03 23:37:35 UTC.

This automatic release was created by pyTooling/Actions::Release.yml