whuppi/ci 2.4.0

• The opt-in composite sweep now owns every action uses: ref, not just the
  composite blind spot — renamed composite-refs → action-refs. It sweeps
  every whuppi/ci ref (workflows + composites, uniform) to the latest release AND
  pins every third-party action (workflows AND composites) to the latest SHA via
  pinact. No more split between Dependabot and a sweep across workflow-vs-composite.
• This leaves Dependabot owning only pub deps. Consumers drop the whole
  github-actions ecosystem from dependabot.yml (not just whuppi/ci*), keep
  sweepActions: true + CI_ACTIONS_TOKEN, and get one PR for all action bumps.
• The label/branch changed with the rename (upgrade-action-refs /
  chore/action-refs); a consumer on 2.3.0's short-lived composite-refs shape
  just re-points its wrapper.

Commits since v2.3.0 (2)

• e8b093a release: v2.4.0
• c450cfc ci: one owner for every action ref — no workflow/composite split (#39)

whuppi/ci 2.3.0

• Reverted Renovate (added in 2.2.0). Deleted the reusable renovate.yml. The
  self-hosted Renovate machine — a dashboard issue, a per-consumer renovate.json5,
  a status-check/token-scope surface — was far more than the one gap that
  actually bit us: composite action.yml refs Dependabot can't see
  (dependabot-core#6704).
• Closed that gap in the existing radar instead. New opt-in composite-refs job
  in the reusable upgrade-check.yml: sweeps every whuppi/ci ref across .github
  (workflows AND composites) to the latest release — uniform, so the pin never
  splits — and pins third-party actions inside composites to the latest SHA via
  pinact. Dependabot keeps pub deps + third-party actions in workflow files;
  the two never overlap. A consumer opts in with sweepActions: true +
  CI_ACTIONS_TOKEN and adds whuppi/ci* to its Dependabot ignore.
• Added pinact to the pinned tool supply chain (PINACT_VERSION), owned by
  self-upgrade.yml like actionlint/zizmor.
• Renamed the org secret RENOVATE_TOKEN → CI_ACTIONS_TOKEN (same
  Workflows-scope PAT; GITHUB_TOKEN still can't write .github/workflows/).
  secrets.sh's org scope stays — it's generic.

Commits since v2.2.0 (5)

• cce8645 release: v2.3.0
• c86dbd8 ci: revert Renovate — close the composite-refs gap in the existing radar (#38)
• c832143 ci: restore Renovate configurable log level (revert temp debug) (#37)
• 72a8a34 ci: temp debug logging (diagnose repository-changed) (#36)
• 6917770 ci: Renovate — commit via platform API (fix repository-changed abort) (#35)

whuppi/ci 2.2.0

• Added a reusable renovate.yml — self-hosted Renovate that each consumer calls
  from a thin wrapper (same shape as upgrade-check.yml), running against the
  calling repo. It reads composite action.yml
  (dependabot-core#6704
  blind spot), so it keeps whuppi/ci refs uniform and bumps third-party actions
  hidden in composites. Needs a RENOVATE_TOKEN org secret (Contents + Workflows +
  Pull-requests + Issues: write) — Renovate must write .github/workflows/, which
  GITHUB_TOKEN can't.
• secrets.sh gained an org scope for org-wide secrets (set org/KEY).
• Removed the whuppi-ci-refs job from upgrade-check.yml. Renovate replaces it:
  the sweep needed a Workflows-scope token GITHUB_TOKEN couldn't provide, and
  Renovate reads composites natively. Consumers migrate to the renovate.yml
  wrapper and drop their Dependabot github-actions + pub config.

Commits since v2.1.0 (4)

• bb46a1e release: v2.2.0
• 7679737 ci: release 2.2.0 — Renovate replaces the whuppi-ci-refs sweep (#34)
• bd10d2e ci: add central Renovate runner + renovate secrets env (#33)
• a8ce7d6 chore: bump pinned versions (#31)

whuppi/ci 2.1.0

• Added a whuppi-ci-refs job to the reusable upgrade-check.yml. It sweeps
  every whuppi/ci/…@vX.Y.Z ref across a consumer's .github (workflow files
  and vendored composite action.ymls alike) to the latest release, in one
  reviewed PR. Dependabot's github-actions updater never reads uses: refs
  inside composite actions
  (dependabot-core#6704,
  open), so a grouped bump moved only the workflow refs and split the pin, which
  pin-availability then rejected. The new job owns that bump and keeps the pin
  uniform by construction. Consumers drop whuppi/ci* from their Dependabot
  github-actions group.

Commits since v2.0.5 (5)

• 3844c43 release: v2.1.0
• a1254e3 feat: sweep whuppi/ci refs to latest via upgrade-check (#32)
• 730ecef chore: bump pinned versions (#29)
• a9a52cd build(deps): bump the actions group across 3 directories with 4 updates (#30)
• 2e1c48c chore: bump pinned versions (#28)

whuppi/ci 2.0.5

• Bumped the Chrome-for-testing pin to 150.0.7871.115 (with chromedriver),
  sha256s recomputed from the upstream release assets and re-verified by
  fetch_verified. The CDN prunes old versions, so consumers on the stale
  pin would start 404ing on web-test downloads.

Commits since v2.0.4 (3)

• a992849 release: v2.0.5
• 4eabae1 chore: cut 2.0.5 — Chrome-for-testing pin refresh (#27)
• 0c5d653 chore: bump pinned versions (#26)

whuppi/ci 2.0.4

• Fixed --stamp-changelog crashing on a package's first-ever release.
  get_published_versions piped pub.dev's response straight into jq; for a
  never-published package pub.dev returns 404 with an XML body, jq exits 5,
  and pipefail killed the publish job (device_io's first publish). A 404 now
  means "zero published versions" — the legitimate first-release state —
  while any other non-200 still fails loudly, since treating pub.dev
  downtime as "nothing published" would misfile real published versions
  under the unpublished collapsible.

Commits since v2.0.3 (2)

• af86170 release: v2.0.4
• fb97482 fix: stamp-changelog no longer crashes on a first-ever publish (#25)

whuppi/ci 2.0.3

• The 2.0.2 mention escape didn't actually work: GitHub decodes HTML
  entities before scanning release notes for mentions, so @immutable
  still credited the immutable org as a release contributor. Commit-list
  @word tokens are now wrapped in code spans instead — GitHub never
  mention-parses code — which also reads better, since these tokens are
  code annotations in the first place.

Commits since v2.0.2 (2)

• 9a8e3ec release: v2.0.3
• 247a90d fix: wrap commit-list @word in code spans — entity escape doesn't stop mentions (#24)

whuppi/ci 2.0.2

• Release notes no longer mention-bomb strangers. The auto-generated commits
  collapsible embedded commit subjects verbatim, so a subject containing a
  bare @word (@immutable, @override, ...) became a GitHub mention and
  credited that account as a release contributor — device_io's first release
  listed the immutable org. Commit-list @s are now escaped as @,
  which renders the same and mentions nobody.

Commits since v2.0.1 (2)

• 43c88ca release: v2.0.2
• 2348720 fix: escape @ in release-notes commit lists to prevent mentions (#23)

whuppi/ci 2.0.1

• Fixed the release-tool action swallowing every output release.sh writes.
  The v2.0.0 move from a workspace checkout to a composite action lost the
  output plumbing: composite actions only expose inner-step outputs through an
  explicit outputs: mapping, and the action had none. The gate would decide
  should_run=true, the caller's steps.<id>.outputs.should_run read back
  empty, and every downstream job (discover, git-install-note, publish)
  skipped — a release run that goes green while releasing nothing. The action
  now maps should_run, version, tag, and has_release outward.

Commits since v2.0.0 (2)

• 6871640 release: v2.0.1
• 918dd09 fix: forward release.sh outputs through the release-tool action (#22)

whuppi/ci 2.0.0

Two gate changes. MAJOR: a consumer must update its Makefile to adopt.

• Added tool/verify_web_gate.sh, the shared dual-compiler web gate. It compiles
  a consumer's example under both flutter build web (dart2js) and --wasm
  (dart2wasm). The two compilers have different type models, so js-interop code
  dart2js accepts (a non-exhaustive JSAny switch, an unsound interop cast)
  dart2wasm can reject, and nothing else in the toolchain compiles wasm (the
  analyzer and dart2js use the JS model; pana's wasm tag is an import heuristic).
  A JS-only build is a false green. Registered in stamped-files.txt.
• The stamped gates no longer default their SDK/config env vars. A
  ${VAR:-fvm dart} fallback silently diverges a laptop from CI, so
  analyze_core, platforms_gate, and verify_web_gate now require
  DART / FLUTTER / EXPECTED_PLATFORMS and fail loud if unset. The one
  default lives in the consumer's Makefile, which passes them explicitly.

Adopting: re-stamp all gates, pass EXPECTED_PLATFORMS from make platforms,
and wire make verify-web to the new gate.

Commits since v1.0.8 (3)

• 8b11c52 release: v2.0.0
• 3815270 docs: 2.0.0 changelog — gates require inputs + web gate (#21)
• 712cb91 feat: shared dual-compiler web gate (dart2js + dart2wasm) (#20)