From 1bae13dfaba0438a6a89d9cde668de8ceac6a342 Mon Sep 17 00:00:00 2001 From: Don Petry <36422719+don-petry@users.noreply.github.com> Date: Mon, 19 Oct 2026 15:34:27 +0000 Subject: [PATCH 1/3] chore: sync 3 org-standard workflow stub(s) from combsmith/.github --- .github/workflows/dev-lead.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/dev-lead.yml b/.github/workflows/dev-lead.yml index af5ef105c..ca7b12bfd 100644 --- a/.github/workflows/dev-lead.yml +++ b/.github/workflows/dev-lead.yml @@ -69,9 +69,9 @@ jobs: # Promotion is done by moving the channel tags centrally; this # caller is never edited on release. agent_ref threads the same channel into # dev-lead's own scripts/prompts checkout. See https://github.com/combsmith/.github/blob/main/standards/ci-standards.md#dev-lead-agent. - uses: combsmith/.github-private/.github/workflows/dev-lead-reusable.yml@dev-lead/v139-ring0 # NOSONAR(githubactions:S7637) first-party channel ref + uses: combsmith/.github-private/.github/workflows/dev-lead-reusable.yml@dev-lead/v139-next # NOSONAR(githubactions:S7637) first-party channel ref with: - agent_ref: dev-lead/v139-ring0 + agent_ref: dev-lead/v139-next secrets: inherit # NOSONAR(githubactions:S7635) first-party trusted reusable permissions: contents: write From 757ad6a600063045584ad502df7340809c34e490 Mon Sep 17 00:00:00 2001 From: Don Petry <36422719+don-petry@users.noreply.github.com> Date: Mon, 19 Oct 2026 15:34:28 +0000 Subject: [PATCH 2/3] chore: sync 3 org-standard workflow stub(s) from combsmith/.github --- .github/workflows/agent-shield.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/agent-shield.yml b/.github/workflows/agent-shield.yml index 96a35946f..c17a8cda5 100644 --- a/.github/workflows/agent-shield.yml +++ b/.github/workflows/agent-shield.yml @@ -31,4 +31,4 @@ permissions: jobs: agent-shield: - uses: combsmith/.github/.github/workflows/agent-shield-reusable.yml@agent-shield/v2-stable # NOSONAR(githubactions:S7637) first-party channel ref + uses: combsmith/.github/.github/workflows/agent-shield-reusable.yml@agent-shield/v2-next # NOSONAR(githubactions:S7637) first-party channel ref From f1f14cef23f7f51f1f8b35ebfa62e2f08a154420 Mon Sep 17 00:00:00 2001 From: Don Petry <36422719+don-petry@users.noreply.github.com> Date: Mon, 19 Oct 2026 15:34:30 +0000 Subject: [PATCH 3/3] chore: sync 3 org-standard workflow stub(s) from combsmith/.github --- .github/workflows/add-to-project.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/add-to-project.yml b/.github/workflows/add-to-project.yml index e913e82d6..35217d03e 100644 --- a/.github/workflows/add-to-project.yml +++ b/.github/workflows/add-to-project.yml @@ -47,11 +47,11 @@ jobs: add-to-project: permissions: contents: read - uses: combsmith/.github/.github/workflows/add-to-project-reusable.yml@add-to-project/v1-stable # NOSONAR(githubactions:S7637) first-party channel ref + uses: combsmith/.github/.github/workflows/add-to-project-reusable.yml@add-to-project/v1-next # NOSONAR(githubactions:S7637) first-party channel ref with: project_id: PVT_kwDOD2inqs4BZq3- project_url: https://github.com/orgs/combsmith/projects/1 - agent_ref: add-to-project/v1-stable + agent_ref: add-to-project/v1-next # Pass only the secrets the reusable declares (least privilege; avoids # `secrets: inherit` handing the reusable every org secret). secrets: