From baaa579bc7dbb542579f1d11a8d8cc04562de67a Mon Sep 17 00:00:00 2001 From: Jon Gallant <2163001+jongio@users.noreply.github.com> Date: Fri, 13 Nov 2026 10:24:23 -0800 Subject: [PATCH 1/2] chore(repo-maintain): align repo governance, workflows, and runtime parity Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/dependabot.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 04f4c02..ff35cb6 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -5,8 +5,15 @@ updates: schedule: interval: weekly open-pull-requests-limit: 5 + cooldown: + default-days: 7 + ignore: + - dependency-name: "@types/node" + update-types: ["version-update:semver-major"] - package-ecosystem: github-actions directory: / schedule: interval: weekly open-pull-requests-limit: 5 + cooldown: + default-days: 7 From 0465ebfdec8b28bb331e5f271ca7138ce689d5fd Mon Sep 17 00:00:00 2001 From: Jon Gallant <2163001+jongio@users.noreply.github.com> Date: Fri, 13 Nov 2026 10:24:24 -0800 Subject: [PATCH 2/2] docs(repo-maintain): sync documentation, skills, and eval suites Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- CONTRIBUTING.md | 3 +-- README.md | 2 +- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 576c12a..ccaae2c 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -67,8 +67,7 @@ The build also generates `dist/THIRD-PARTY-NOTICES.txt` and `dist/bundled-dependencies.json` from inputs with positive byte contributions to esbuild's executable output, excluding completely tree-shaken modules, alongside the existing inline notices in `dist/index.cjs.LEGAL.txt`. Commit all generated -outputs; `pnpm check:dist` verifies them together. Full license sections in -package READMEs are retained when standalone files are absent. The version-bound +outputs; `pnpm check:dist` verifies them together. The version-bound supplement for `@nodable/entities` comes from the license at its npm-published `gitHead`; keep that provenance with any update. Attribution-only `NOTICE` and `COPYRIGHT` files are retained separately; they diff --git a/README.md b/README.md index 0cf5a18..7507fa6 100644 --- a/README.md +++ b/README.md @@ -279,7 +279,7 @@ explicit lint rejects execution overrides. | `eval-paths` | Newline-separated literal paths for all/run. Spaces are preserved. No shell expansion. | | `tags` | Newline-separated native filters for all/run, e.g. `cost=free` or `flaky!=yes`. | | `github-token` | Defaults to `${{ github.token }}`. Used for model auth and PR reporting in all; artifact discovery and commenting in report; not forwarded in explicit lint/run. Discovery requires `actions: read`. | -| `copilot-token` | Optional explicit model token. Overrides automatic model auth in all; required for workflow-token auth in explicit run. | +| `copilot-token` | Optional explicit model token. Overrides automatic model auth in all; supports workflow-token auth in explicit run. | | `credential-env` | Advanced evaluator credential variable names, one per line, for BYOK/custom providers. Supplying these disables automatic model-token injection in all. Never put values here. Cannot list `COPILOT_GITHUB_TOKEN` with `copilot-token`. | | `report-token` | Optional bot/App comment token override for all/report. Discovery uses `github-token`, falling back to this token if absent. Human/PAT reporters are refused. Not valid on explicit lint/run. | | `report-id` | Shared lint/run/report identity, default `evals`; letters/digits/underscore/hyphen. Maximum 64 characters (59-character prefix for all). Advanced `evals-run` / `evals-lint` share the `evals` comment. |